Operate

Connect an AI agent

Let Claude, Cursor or another AI agent work on your panel for you: look at your projects, read logs, deploy, take a backup. It acts as you, and it asks for your approval before it deletes, spends or gives access.

Time · 5 min You'll need · An AI agent client and a panel

Goal

You'll have an AI agent connected to your panel, signed in as you, that stops and asks you before anything that cannot be undone or that costs money.

What an agent can do

An agent can do what you can do in the panel, and no more: it uses your role and the projects you have access to. It can look at projects and instances, read logs, deploy, back up, clone a staging and change settings.

Some things stay in the panel on purpose. Passwords, keys and tokens never reach the agent and it cannot set them. Uploading a backup to restore and the interactive terminals are not available to it either.

Steps

Open the connection page. In your panel, open the user menu (your name, top right) and choose Connect an agent. It shows your panel's MCP address, with a button to copy it, and the steps for each client with that address already filled in.
Add the panel to your client. The page covers Claude Code, Claude and Claude Desktop, Cursor, VS Code and Codex. In Claude Code, for example, you run this with your panel's address:
```
claude mcp add --transport http --scope user incubacloud 'https://<your panel>/mcp'
```
Sign in through IncubaCloud. The first time, the agent opens a page where you sign in with your IncubaCloud account, as you do in the browser. If you were invited to a panel and never opened it, open it once first so your user exists.
Allow the agent. The page names the agent and the panel it wants to reach. Allow only an agent you started yourself. Choose Allow, or Cancel to refuse.

Verify it worked

Ask the agent to list your projects: it answers with yours.
It appears in Connected agents, with the panel and the day you allowed it.

What always asks for your confirmation

Some actions wait for you, whatever the agent asks. Until you approve, nothing happens:

Spending money: ordering a VPS, contracting, changing or cancelling backup storage, changing your plan, adding or removing extras. The approval shows the amount and how often it is billed, before VAT.
Giving or removing access: inviting a user, changing a role, removing or reactivating a user.
Deleting data: a project, an instance, a server or a backup destination. Restoring a backup, replacing a staging's data with a copy of production and moving an instance wait for you too.
Reaching your instances and servers: a sign-in link to an instance, a download link for a backup, a command on a production instance and every command on a server. You see the exact command.
Security: changing a security setting and trusting a server's SSH key. You see the values before and after, or the old key and the new one.

Depending on your client, you see a yes/no question inside it, or the panel opens an approval page, or the agent gives you the link to that page. The page needs your panel session and shows what will happen, with Approve and Cancel. An approval lasts ten minutes and works once, only for the agent that asked.

What an approval protects you from

It protects you from the agent's mistakes and from instructions hidden in a log or an email that the agent reads. It does not protect you from a client you should not trust, nor from an agent that drives your browser while your panel is open. Connect only clients you trust, and revoke any you stop trusting.

See and revoke your agents

Open My IncubaCloud and look for Connected agents at the foot of the page. It lists each agent with its panel, when you allowed it and when it was last used. Revoke cuts it off: its access ends within five minutes and it cannot renew it. An agent that stays unused for 30 days is cut off on its own.

Signing out

Signing out of your IncubaCloud account does not disconnect your agents: they do not depend on your browser's session. To cut one off, revoke it in Connected agents.

Self-hosted panels and API keys

Panels hosted by IncubaCloud sign agents in with your IncubaCloud account and refuse API keys. A self-hosted panel without an OAuth provider for agents works with API keys instead: create one in your preferences (Security, API Keys), treat it like a password and use the commands the connection page shows, which carry the key. To cut that agent off, delete its key.

Privacy

The agent acts with your user's role and your projects' access, never more. What it changes is in the audit log under your name, marked as done through an agent.
Secrets stay out: the passwords, keys and tokens the panel keeps are replaced in whatever the agent reads.
Connecting an agent does not make IncubaCloud send anything to an AI provider. The agent is yours: what it reads goes to the provider you chose, under your terms with them.