MCP Directory

How to add Pulumi MCP Server to Windsurf

Give agents Pulumi powers: browse the provider registry, preview and deploy stacks, and search deployed resources. Paste the config into ~/.codeium/windsurf/mcp_config.json and restart Windsurf.

Last updated June 14, 2026 · 0★ · stdio · apikey · official

Windsurf config for Pulumi MCP Server

npx @pulumi/mcp-server@latest stdio
{
  "mcpServers": {
    "pulumi-mcp-server": {
      "command": "npx",
      "args": [
        "@pulumi/mcp-server@latest",
        "stdio"
      ]
    }
  }
}

Setup steps

  1. 1Open Windsurf → Cascade → the hammer/MCP icon → Configure (or edit ~/.codeium/windsurf/mcp_config.json).
  2. 2Paste the Pulumi MCP Server config below.
  3. 3Fill in placeholder secrets, then save.
  4. 4Click Refresh in the MCP panel.
  5. 5Pulumi MCP Server's tools become available to Cascade.

Before you start

  • Pulumi CLI installed on the client machine (required for preview/up/refresh operations)
  • Node.js with npx, or Docker for the containerized mode
  • A Pulumi access token (app.pulumi.com/account/tokens) for Docker mode and the hosted endpoint; registry tools work without credentials

What Pulumi MCP Server can do in Windsurf

pulumi-registry-list-resources

Browse available cloud resources across providers.

pulumi-registry-list-functions

Explore available provider functions.

pulumi-registry-get-resource

Get code examples and documentation for a specific resource.

pulumi-registry-get-function

Get provider function examples for your Pulumi program.

pulumi-registry-get-type

Get schema definitions for complex resource properties and types.

pulumi-cli-preview

Preview infrastructure changes before deployment.

pulumi-cli-up

Deploy infrastructure changes, creating and updating resources.

pulumi-cli-stack-output

Retrieve stack outputs like URLs and resource IDs.

Security

pulumi-cli-up deploys real infrastructure with your Pulumi credentials — keep previews auto-approved at most, and gate up/refresh behind human review. Tokens: the Docker mode takes PULUMI_ACCESS_TOKEN as an env var, and the hosted endpoint authenticates with a Pulumi access token from app.pulumi.com/account/tokens.

Pulumi MCP Server + Windsurf FAQ

Where is the Windsurf config file?

Windsurf reads MCP servers from ~/.codeium/windsurf/mcp_config.json. Paste the Pulumi MCP Server config there under the "mcpServers" key and restart the client.

Is Pulumi MCP Server safe to use with Windsurf?

pulumi-cli-up deploys real infrastructure with your Pulumi credentials — keep previews auto-approved at most, and gate up/refresh behind human review. Tokens: the Docker mode takes PULUMI_ACCESS_TOKEN as an env var, and the hosted endpoint authenticates with a Pulumi access token from app.pulumi.com/account/tokens.

Is the Pulumi MCP server safe to let an agent use?

Registry and preview tools are read-only and low-risk; pulumi-cli-up and refresh change real cloud infrastructure using your Pulumi credentials, so keep them behind manual approval. The server itself is official Pulumi software distributed via npm and Docker.

Where did the GitHub repo go?

pulumi/mcp-server now returns 404 — the code moved as Pulumi consolidated repos. The npm package @pulumi/mcp-server is still actively published by Pulumi, and the docs page at pulumi.com/docs/iac/using-pulumi/mcp-server is the maintained reference.

Local stdio or hosted endpoint — which should I use?

Use local stdio (npx @pulumi/mcp-server@latest stdio) when the agent needs your local project files and CLI login for preview/up. Use the hosted https://mcp.ai.pulumi.com/mcp endpoint for registry, resource search, and Neo features from HTTP-capable clients, authenticating with a Pulumi access token.

View repo Full Pulumi MCP Server page