LABSCO SUMMARY
MCP access here is production access, and the plugin says so.
The org grant is the boundary that matters: it is chosen at sign-in, enforced on the server rather than in the client, and changing it means signing in again. On top of that, deleting resources, shrinking or deleting volumes, replacing workloads and applying to production all require explicit confirmation, and secret values never leave the platform. Codex users have one extra step — plugin hooks are off by default there, and the guardrail rule needs them on.
What it is
Control Plane's official plugin. It pairs the hosted Control Plane MCP server with domain skills and two guided agents, so an assistant can operate workloads with verified cpln commands instead of improvising them.
What you get
- Live tools against the hosted Control Plane server, scoped to the organizations you grant
- Domain skills across CLI usage, access control, autoscaling, networking, observability, migration, templates, stateful storage and security
- Two guided agents: workload troubleshooting, and migration from Kubernetes, Compose or Helm
- An always-on guardrail rule applied in every session
- In Claude Code, two of the workflows also have slash commands —
/cpln:troubleshootand/cpln:migrate-k8s; other clients ask for them by name - Secrets surface as metadata only — values are never returned through the tools
Requirements
For a supported client, install the plugin: /plugin marketplace add https://github.com/controlplane-com/ai-plugin.git then /plugin install cpln@controlplane in Claude Code, codex plugin marketplace add for Codex, or agy plugin install for Antigravity CLI. Any other client points at the hosted server: https://mcp.cpln.io/mcp. Authentication is OAuth 2.1 with PKCE — you pick which organizations it may operate on, and the grant is enforced server-side on every call. CPLN_TOKEN, CPLN_ORG, CPLN_GVC and CPLN_PROFILE are only needed for the cpln CLI workflows some skills generate.
Setup effort
Add the hosted endpoint, then sign in — paste it into your client, then approve the OAuth sign-in
USE CASES
01
Working out why a workload keeps restarting
Hand the troubleshooting agent a workload and an environment and let it walk the evidence.
02
Moving off Kubernetes
Convert a kustomization or Helm chart to Control Plane and apply it to staging after you confirm.
03
Putting a domain in front of a service
Ask for the hostname and auto-TLS rather than assembling the CLI invocation yourself.
04
Granting cloud access without keys
Give a workload credential-free read access to a bucket instead of minting IAM keys.
BEFORE YOU INSTALL
What to know first
Requires
A Control Plane account, signed in over OAuth when the client first connects
INSTALLATION
Connect your client
Server setup
ENDPOINT URL
https://mcp.cpln.io/mcp?toolsets=fullAdd this hosted endpoint to your MCP client, then sign in.
MCP Clients
Claude Code
CLAUDE CODE · IN CLIENT
/plugin marketplace add https://github.com/controlplane-com/ai-plugin.git
/plugin install cpln@controlplane
/reload-pluginsSign in: run /mcp, select cpln and sign in, or run claude mcp login cpln.
Codex
Add the marketplace:
CODEX · TERMINAL
codex plugin marketplace add https://github.com/controlplane-com/ai-plugin.gitStart Codex, open /plugins, and install cpln.
Guardrail injection needs plugin hooks, which Codex turns off by default. Add the block below to ~/.codex/config.toml and restart Codex.
CODEX · TOML
[features]
plugins = true
plugin_hooks = trueThen sign in with codex mcp login cpln and choose which Control Plane organizations it may operate on.
Antigravity CLI
ANTIGRAVITY CLI · TERMINAL
agy plugin install https://github.com/controlplane-com/ai-plugin/plugins/cplnAny MCP client
ANY MCP CLIENT · JSON
{
"mcpServers": {
"cpln": {
"type": "http",
"url": "https://mcp.cpln.io/mcp?toolsets=full"
}
}
}