CloudBase skill for Claude Code: build and deploy apps on Tencent CloudBase

• Asks domestic or international before any login

  CloudBase has two separate account systems, so environments and keys do not cross over. SKILL.md says to infer the site if possible, otherwise ask once, and then save it in .cloudbase/project.json.

  Read · Step 0: confirm the site

• Three stages with a mandatory last stage

  Read the matching skill first, prepare MCP resources before writing front-end code, then run the cloudbase-code-review guide and fix errors.

  Try: “Build a to-do app on CloudBase with login and a database.”

  Runs code · Workflow: explore, implement, close out

• Global rules, constitution and a standalone fallback

  Examples: always pass an explicit EnvId, stop after 2 to 3 failed attempts on one path, do not use `any` to bypass type errors, and do not rely on deprecated login-state calls.

  Read · Activation contract and guardrails

• Sends 16 scenario types to the right nested guide

  Covers Web auth, Mini Programs, native apps, NoSQL, PostgreSQL, existing MySQL, cloud functions, CloudRun, AI agents, a minimal demo, UI, AI model calls, health inspection and spec workflow.

  Read · High-priority routing table

• Prefers the CloudBase MCP server, falls back to tcb

  If MCP tools are missing in this session, Claude configures MCP for next time and uses the tcb CLI now (tcb login, tcb env use). SKILL.md says not to recommend tcb deploy.

  Runs code · MCP and CLI prerequisite

• Deploys functions, CloudRun services and front ends

  Uses manageFunctions, manageCloudRun and manageApps(action="deployApp"). It says to confirm with you before destructive or production write operations such as delete, overwrite or plan change.

  Runs code · Deployment workflow

• Declares impact and waits for confirmation

  For changes to schemas, permissions, auth flows, API contracts or deployment config, Claude states what is affected and asks for your confirmation before editing. After 3 repeats of one symptom it must stop patching.

  Read · Change safety protocol

• Seven top-level reference files

  tooling-fallback, site-onboarding, deployment-workflow, console-links, scenarios, mcp-setup and activation-map.yaml.

  Read · On-demand references

Watch out for

• It can change and delete resources in your cloud account

  The guides cover deploying functions and apps, auth settings, databases, storage and deleting apps. deployment-workflow.md says to confirm before destructive or production writes. Use a test environment and check each confirmation. github.com

• The plugin sends a usage ping to Tencent's Beacon service

  The SessionStart hook session-start-telemetry.mjs runs plugin-telemetry.mjs, which POSTs to https://otheve.beacon.qq.com/analytics/v2_upload. It sends one toolkit_plugin_first_use event the first time and one toolkit_plugin_dau event at most once per UTC day, with a stamp kept in ~/.config/cloudbase-plugin/. Each event carries the plugin version, login_uin and envId read from ~/.config/.cloudbase/auth.json (or "unknown"), a user-agent with OS, release, CPU architecture and Node version, and a device ID that is a SHA-256 hash of your hostname, CPU models and network MAC addresses. The script header says it reads only uin and envId from the auth file and sends no prompts, paths or tool arguments. Set CLOUDBASE_PLUGIN_TELEMETRY=off (or CLOUDBASE_MCP_TELEMETRY_DISABLED=true) to stop it. github.com

• The plugin hooks read your project and log prompts locally

  SessionStart (startup, resume, clear, compact) runs four scripts: session-start-telemetry.mjs (the ping above); session-start-seen-skills.mjs (on clear or compact, deletes the plugin's seen-skills files in the temp folder); session-start-profiler.mjs (checks the project folder for files such as cloudbaserc.json, project.config.json, app.json, Dockerfile, cloudfunctions/, prisma/schema.prisma, drizzle.config.* and package.json dependencies, then appends CLOUDBASE_PLUGIN_* exports to CLAUDE_ENV_FILE); and inject-session-context.mjs (adds plugin rules, a skill catalog and the detected scenario to the session context; in an empty folder it also tells Claude not to stay in planning mode and to start with tool calls). SessionEnd runs session-end-cleanup.mjs, which deletes the temp files. UserPromptSubmit runs user-prompt-submit-skill-inject.mjs, which matches your prompt against generated/skill-manifest.json and injects up to 3 skills, and appends the first 500 characters of your prompt to a local file under ~/.claude/projects/<project path>/cloudbase-plugin/skill-injections.jsonl. PreToolUse on Edit, Write, MultiEdit, apply_patch and Bash runs pretooluse-skill-inject.mjs, which matches the file path or command against skill patterns, injects up to 3 skills and logs the path and the first 500 characters of the command to the same file. CLOUDBASE_PLUGIN_AUDIT_LOG_FILE=off disables that log. In the scripts we read, only plugin-telemetry.mjs makes a network call. github.com

• It can start a local MCP server or use API keys

  The local route runs npx @cloudbase/cloudbase-mcp@latest, which fetches the newest version each time. The remote route can use SecretId and SecretKey headers, but SKILL.md says to prefer browser OAuth in an interactive IDE and never to hard-code secrets. github.com

• Deployed code can leak credentials if it echoes headers

  The bundled protocol warns that the x-cloudbase-context header can carry temporary cloud credentials. Never deploy code that returns request headers or environment variables. github.com

• The plugin also bundles agents, commands and two MCP servers

  Beyond the hooks, the plugin repo has 2 agents (cloudbase-architect, cloudbase-deployment-expert), 4 slash commands (cloudbase-deploy, cloudbase-env, cloudbase-init, cloudbase-status) and a .mcp.json that declares a remote server (tcb-api.cloud.tencent.com) and a local one run with npx -y @cloudbase/cloudbase-mcp@latest. The agent files list no tools in their frontmatter. github.com

Security advisories