> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Pulumi

> Connect Pulumi to CloudThinker for stack inventory, resource search, policy review, and approval-gated deployments

Connect your Pulumi account to let [Alex](/guide/agents/alex) (Cloud Engineer) inspect stacks, search the resources Pulumi manages, review policy violations, and look up Registry schemas through Pulumi's hosted MCP server. Pulumi uses **OAuth**, so you never paste a Pulumi access token into CloudThinker.

## Prerequisites

* A **Pulumi Cloud account** that belongs to the organization you want CloudThinker to inspect.
* Permission to authorize CloudThinker through Pulumi's OAuth flow.

<Info>
  The tools read the organization your Pulumi account defaults to. Authorize with the account that belongs to the organization holding the stacks you care about, or the agent reports an empty inventory.
</Info>

## Setup

<Steps>
  <Step title="Open CloudThinker">
    Go to **Connections → Pulumi** in your workspace.
  </Step>

  <Step title="Start the OAuth flow">
    Click **Connect** to open Pulumi's authorization page.
  </Step>

  <Step title="Authorize CloudThinker">
    Sign in to the Pulumi account that can see the stacks you want, then approve access.
  </Step>

  <Step title="Return to CloudThinker">
    CloudThinker stores the OAuth tokens and the connection shows a **Connected** status.
  </Step>
</Steps>

## Connection details

Pulumi uses OAuth, so there are no fields to fill in. CloudThinker stores the tokens automatically once the authorization completes.

| Field            | Description                                                            |
| ---------------- | ---------------------------------------------------------------------- |
| **OAuth tokens** | Issued by Pulumi and stored automatically; no manual entry required    |
| **MCP endpoint** | Pulumi's hosted server at `mcp.ai.pulumi.com`; fixed, not configurable |

## Required permissions

CloudThinker inherits the Pulumi access granted during OAuth.

* **Read operations** cover stacks, managed resources, policy violations, organization members, Neo task history, and Registry schemas.
* **Deployments and Pulumi Neo** need matching Pulumi access **and** explicit [approval](/guide/approval) in CloudThinker, because both change cloud resources.

<Tip>
  Authorize with an account that reads the organization rather than one that administers it. Read access covers every capability below except the two that already ask you first.
</Tip>

## Agent capabilities

Once connected, Alex can:

| Capability               | Description                                                          |
| ------------------------ | -------------------------------------------------------------------- |
| **Stack inventory**      | List stacks in the organization with their project and last update   |
| **Resource search**      | Find Pulumi-managed resources by name, type, project, or stack       |
| **Policy review**        | List policy violations and group them by enforcement level           |
| **Registry lookup**      | Read provider resource and function schemas from the Pulumi Registry |
| **Organization members** | List the members and admins of the organization                      |
| **Neo tasks**            | Read Pulumi Neo task history; driving Neo requires approval          |
| **AWS deployment**       | Deploy to AWS only after you approve the call                        |

### Verify the connection

```text theme={null}
@alex #report list my Pulumi stacks and the organization they belong to
```

### Example prompts

```text theme={null}
@alex #report which Pulumi stacks have mandatory policy violations
@alex #report find every S3 bucket Pulumi manages and name the stack that owns it
@alex #recommend read the aws:s3/bucket schema and list the settings we leave unset
```

## Approval-gated tools

Four Pulumi tools change real state, so CloudThinker asks before each call: **deploy to AWS**, and the three tools that drive Pulumi Neo (bridge, continue a task, reset a conversation). The agent names the stack and the effect, then waits for your answer.

Everything else on this connection reads. Reading a stack never triggers a prompt, so an inventory or policy question completes in one turn.

<Warning>
  Approve a deployment only when you recognize the stack in the prompt. A Pulumi deployment provisions real cloud resources and bills your cloud account.
</Warning>

## Troubleshooting

<Accordion title="The OAuth flow does not complete">
  Your browser may be signed in to a different Pulumi account. Sign in to the intended account at app.pulumi.com, then retry **Connect** in CloudThinker.
</Accordion>

<Accordion title="The agent reports no stacks">
  Pulumi answers for the organization your account defaults to. Confirm that account is a member of the organization holding the stacks, then reconnect with the right account.
</Accordion>

<Accordion title="The agent says it lacks access to an organization">
  The token reaches only the organizations your Pulumi user belongs to. Add the user to the organization in Pulumi, or reconnect with an account that already belongs to it.
</Accordion>

<Accordion title="A deployment prompt keeps asking for confirmation">
  That is the approval gate, and it is per call. Answer the prompt in the conversation. See [Approval](/guide/approval) for how CloudThinker handles gated tools.
</Accordion>

<Accordion title="A new Pulumi tool is missing">
  CloudThinker exposes a reviewed list of Pulumi tools. A tool Pulumi releases later stays hidden until CloudThinker reviews it and decides whether it needs approval.
</Accordion>

## Security

* **Least privilege** — grant only the permissions the agents need for your use case; start read-only and widen later.
* **Read-only by default** — use read-only credentials unless you want agents to make changes through this connection.
* **Rotate credentials** — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
* **Revoke on offboarding** — remove the credential at the provider when you delete a connection or a teammate leaves.

- **Keep the gate on** — leave deployment and Pulumi Neo approval-gated; they are the only tools here that can change your cloud.
- **Reconnect deliberately** — the connection reaches whatever the authorizing account reaches, so switch accounts by removing the connection and authorizing again.

## Related

<CardGroup cols={2}>
  <Card title="Alex Agent" icon="cloud" href="/guide/agents/alex">
    Cloud infrastructure and cost analysis
  </Card>

  <Card title="Approval" icon="shield-check" href="/guide/approval">
    How CloudThinker gates tools that change state
  </Card>
</CardGroup>