OpenAPI Türkçe gyrohosting.com ↗

MCP server: connect Claude, Cursor and VS Code to Gyro

The Gyro MCP server lets AI assistants search these docs and manage your Gyro cloud with your own API key: servers, containers, S3, DNS, billing. Money and delete actions always need your confirmation.

The Model Context Protocol (MCP) connects AI assistants to tools. The Gyro MCP server (@gyro-hosting/mcp, open source, MPL-2.0) runs on your computer, talks to the Gyro API with your own API key and can only see your account.

1. Create an API key#

Client area → account menu (top right) → API Credentials. Start with read scopes (cloud_read, services_read, billing_read); add write, order or delete scopes only if you want the assistant to change things. Add your IP address to the key's allow list. The docs tools work without any key.

2. Add the server to your assistant#

{
  "mcpServers": {
    "gyro": {
      "command": "npx",
      "args": ["-y", "@gyro-hosting/mcp"],
      "env": { "GYRO_TOKEN": "wck_..." }
    }
  }
}
claude mcp add gyro --env GYRO_TOKEN=wck_... -- npx -y @gyro-hosting/mcp
{
  "mcpServers": {
    "gyro": {
      "command": "npx",
      "args": ["-y", "@gyro-hosting/mcp"],
      "env": { "GYRO_TOKEN": "wck_..." }
    }
  }
}
{
  "inputs": [
    { "type": "promptString", "id": "gyro-token", "description": "Gyro API key", "password": true }
  ],
  "servers": {
    "gyro": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@gyro-hosting/mcp"],
      "env": { "GYRO_TOKEN": "${input:gyro-token}" }
    }
  }
}

Claude Desktop: Settings → Developer → Edit Config (claude_desktop_config.json). Cursor: ~/.cursor/mcp.json or .cursor/mcp.json in the project. VS Code: .vscode/mcp.json (the key is asked once and stored by VS Code). Needs Node.js 18.17 or newer.

Docs only (no key, nothing can change):

{
  "mcpServers": {
    "gyro-docs": { "command": "npx", "args": ["-y", "@gyro-hosting/mcp"] }
  }
}

3. Tools#

ToolWhat it doesKey
search_docs, get_endpoint, get_doc, list_products, get_limits_infoSearch these docs, read one endpoint's OpenAPI description, read a page as Markdown, list products, account limitsnot needed
whoami, list_services, get_service, list_servers, get_server, get_catalog, get_balanceRead your account, services, servers, plans/regions/images, balanceread scopes
get_container_environment, list_container_services, get_container_logsContainers (ECS): environment, services, logsread scopes
list_vpcs, get_vpc, list_server_nicsPrivate networks (VPC, Gyro Cloud Istanbul): VPCs, subnets, attached servers, gateway, server cardsread scopes
list_buckets, list_objects, list_dns_zones, list_dns_records, api_getS3 buckets and objects, DNS zones and records, any other GET endpointread scopes
server_power, scale_container_service, restart_container_service, set_dns_record, create_bucketChange something — only with confirm: truewrite scopes
create_vpc, rename_vpc, create_subnet, attach_server_nic, set_vpc_gateway, add_port_forward, server_public_ip_onPrivate network changes — only with confirm: true; the VPC gateway is billed hourly while onwrite scopes
create_server, create_container_environment, create_storageSpend money: without confirm they only return a price quote (dry run)cloud_order
delete_server, delete_dns_record, delete_container_service, delete_vpc, delete_subnet, detach_server_nic, remove_port_forward, server_public_ip_off, api_requestDestructive (marked destructiveHint) — only with confirm: truewrite / delete scopes

Safety#

Your key, your account. Every call runs with the key you configured; the API answers 404 for anything that is not yours. The key is never written to logs or returned in results; secret fields in answers are masked unless you ask for them.

Money and deletes need you. Tools that change something do nothing without confirm: true, and assistants are told to ask you first. Order tools return a price quote (dry run) first; a real order uses an Idempotency-Key, so a retry never orders twice. Destructive tools are marked with destructiveHint, so clients ask before running them.

Prompt injection. Server names, logs and ticket text can contain text written by others. Every result is wrapped as untrusted data with a notice telling the assistant never to follow instructions inside it. Keep write and delete scopes off unless you need them.

Limits. The API limits apply (60 requests per minute per key by default, daily paid-operation cap). See Account limits.

Example prompts#

“Which of my servers are stopped?” · “Show the last 50 log lines of the api service in container environment 12345.” · “How much would a standart-2-4 server in Istanbul cost per month?” · “Add an A record www → 203.0.113.10 to example.com.” · “How do I connect a GitHub repository to Gyro Pipeline?”

Remote endpoint (no install)#

Gyro also runs the same server for you at https://mcp.gyrohosting.com/mcp (Streamable HTTP, stateless). Nothing to install: send your key as Authorization: Bearer wck_…. Without the header only the docs tools work.

claude mcp add --transport http gyro https://mcp.gyrohosting.com/mcp --header "Authorization: Bearer wck_..."
{
  "mcpServers": {
    "gyro": {
      "type": "http",
      "url": "https://mcp.gyrohosting.com/mcp",
      "headers": { "Authorization": "Bearer wck_..." }
    }
  }
}
{
  "inputs": [
    { "type": "promptString", "id": "gyro-token", "description": "Gyro API key", "password": true }
  ],
  "servers": {
    "gyro": {
      "type": "http",
      "url": "https://mcp.gyrohosting.com/mcp",
      "headers": { "Authorization": "Bearer ${input:gyro-token}" }
    }
  }
}

Claude.ai and Claude Desktop (custom connector): Settings → Connectors → Add custom connector → URL https://mcp.gyrohosting.com/mcp. Without a key the connector gives the docs tools; for account tools use a client that can send the Authorization header (Claude Code, Cursor, VS Code) or the local server above.

IP-locked keys: calls to the Gyro API come from the endpoint's addresses 45.87.174.151, 45.87.174.153, 45.87.174.154; add them to the key's allow list (or use a separate key for the remote endpoint). Limits: about 120 requests per minute per key and 300 per IP address on the endpoint, 256 KB per request; the API limits above still apply. Your key is not stored or logged; each request is handled on its own.