Cloud accounts

https://docs.evohub.io/mcp

claude mcp add --transport http evohub-docs https://docs.evohub.io/mcp

{
  "mcpServers": {
    "evohub-docs": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://docs.evohub.io/mcp"
      ]
    }
  }
}

{
  "mcpServers": {
    "evohub-docs": {
      "url": "https://docs.evohub.io/mcp"
    }
  }
}

{
  "servers": {
    "evohub-docs": {
      "type": "http",
      "url": "https://docs.evohub.io/mcp"
    }
  }
}

A cloud account is read by EvoHub itself, with no agent to install. You grant read-only access in your cloud, EvoHub reads the account every 15 minutes, and what it finds appears in Catalog beside what your agents report: networks, machines, load balancers, databases and more, and who answers for them.

Cloud accounts belong to the organization, beside its agents, so they are managed under Organization → Cloud accounts.

#Connect an account

An organization can connect up to 20 accounts.

#AWS

EvoHub assumes a read-only IAM role that you create in the account from a CloudFormation template.

1. Download the template. It creates a role (named EvoHubCatalogReadOnly by default; the name must start with EvoHub) that trusts EvoHub only with this connection's external ID, and allows only the listing calls Catalog makes: no data, no secrets, no changes.
2. Create the role in the account, then read its ARN from the stack's RoleArn output.
3. Give its ARN and select Save and check.

Catalog reads, among others, EC2 instances, VPCs and subnets, security groups, load balancers and target groups, RDS instances and clusters, EKS clusters, Lambda functions and S3 buckets. A Lambda function's environment variables are kept by name only, never their values, and an instance's user data is never read. A service the role does not allow is shown on the connection as not readable; it is not a failure.

#Azure

EvoHub reads with the built-in Reader role, through its own application.

1. Run one command in Azure Cloud Shell for each subscription. The console shows it. It gives EvoHub's application read access and marks the subscription for this connection with the evohub-connection tag.
2. Give the directory (tenant) ID it printed and select Save and check.

EvoHub reads only the subscriptions marked for this connection.

#GCP

EvoHub reads with Cloud Asset Viewer and Browser, as its own service account.

1. Run one command in Cloud Shell for each project. The console shows it. It gives EvoHub read access and marks the project for this connection with the evohub-connection label.
2. Select Save and check.

EvoHub reads only the projects marked for this connection, and lists the projects it read on the connection.

#portvMind

portvMind has no read-only role, so EvoHub reads with an application credential you create.

1. Run the command the console shows in a terminal, with your portvMind user name and project ID. It creates an application credential for EvoHub. The credential is restricted, so it cannot create other credentials.
2. Give the credential it printed: its Credential id and Credential secret, and select Save and check.

EvoHub only lists with the credential. The secret is kept encrypted and is never shown again; to replace it, type a new one.

#What you see

What an account reports appears in Catalog like anything an agent reports: under Inventory → Resources, matched to services, in drift, and counted in the Overview.

On Catalog → Map, Cloud accounts lays each account out region by region: each network with its internet gateway, peerings and subnets (public or private, and the NAT gateway a private one leaves through), what runs in each subnet, what spans the network, and what sits outside any network. Links show traffic, egress, internet access and which security groups let which in. A machine whose security groups open an admin port, such as SSH, RDP or a database, to the whole internet is flagged, and counted under Exposed on the Overview.

When a machine is also seen by an agent, for example a VM running the agent or a Kubernetes node, the two are shown as the same machine.

#Pause, change or disconnect

• Pause stops reading the account; Resume reads it again at once and then every 15 minutes. A changed role is also read at once. Neither reads again within two minutes of the last read.
• You can rename a connection, change its role, directory or regions, or give a new portvMind credential.
• Disconnect stops reading the account. What it reported stays in Catalog. Remove the role, application or credential in your cloud as well.

An account that has not been read for 45 minutes has its resources marked stale.

#Permissions

By default every role can see cloud accounts, and Owners and Admins can connect them. The external ID that the AWS role trusts is shown only to people who can connect accounts. See Catalog permissions.

#Billing

The environment an account reports into is billed as a watched environment, like one an agent reports from, at 11 EvoHub tokens a day. Cloud accounts themselves are free. See Catalog overview.

#Related

• Catalog overview
• EvoHub Agent
• Cloud accounts API