跳到主要内容

Manage Slick Cloud with MCP

Slick Cloud runs hosted Slick Agent instances for you. Normally you manage them from the /agents page in the Hackit Portal. This guide connects your local Slick Agent to the Portal's MCP server so you can manage those cloud instances by just asking — "list my cloud agents", "restart the stopped one", "what's it costing me" — without leaving your terminal.

It's a standard MCP server hosted by Hackit, gated by the same OAuth login you already use for the Portal. Once connected, Slick gets two tools it can call on your behalf.

What you can do with it​

Once connected, the model can call these on your Slick Cloud org:

Ask for…Under the hood
"List my cloud agents"agents (list)
"What's the status of <name>?"agents (get / status)
"Roughly what is this instance costing?"agents (cost_estimate)
"Start / stop / restart <name>"agent (start / stop / restart)
"Spin up a new instance called <name>"agent (create)
"Destroy <name>"agent (destroy)
"Update the env / image on <name>"agent (update_env / update_image)

Every call runs against your org with your Portal identity, and membership is re-checked on each call — the connection can only touch instances you already control from the web UI.

Prerequisites​

  • A Hackit Portal account with Slick Cloud access (at least one instance, or the ability to create one).

  • MCP support installed. If you used the standard install script it's already there; otherwise:

    cd ~/.slick/slick-agent
    uv pip install -e ".[mcp]"

You do not need a separate API key or client secret — the server uses OAuth with PKCE, and the login is a browser round-trip.

Step 1: add the server​

slick mcp add --url https://portal.hackit.cc/mcp --auth oauth slick-cloud

--auth oauth tells Slick this is an OAuth-protected HTTP server. On first connect Slick:

  1. Discovers the server's OAuth endpoints automatically (RFC 9728 / 8414 metadata).
  2. Registers itself as a client (RFC 7591 Dynamic Client Registration) — no secret to copy.
  3. Opens your browser to the Portal to sign in and authorize.
  4. Stores the resulting token under ~/.slick/mcp-tokens/ and reuses it (refresh is automatic).

Choosing an organization​

If your Portal account belongs to more than one organization, the browser shows an org picker during authorization — pick which org this connection should manage. The choice is made once, in the browser; there's nothing to pass on the command line. Single-org accounts skip this step and bind automatically.

If you ever need to point the connection at a different org, remove and re-add the server (slick mcp remove slick-cloud, then the add command again) and pick the other org in the browser.

Step 2: verify it connected​

slick mcp test slick-cloud

Then start (or reload) a session:

slick chat
/reload-mcp

Ask a read-only question to confirm the tools are live:

List my Slick Cloud agents and their current status.

You should get back the same instances you see on the Portal's /agents page.

Step 3: use it​

Read-only questions are always safe:

Which of my cloud agents is currently running, and roughly what is each one costing?

Lifecycle actions map to plain requests:

Restart the instance called research-bot.
Create a new Slick Cloud instance named scratch, then tell me when it's ready.

Slick reports what each tool returned — the instance list, the new status, the created instance's details — so you can confirm the action landed.

Configuration​

After slick mcp add, the server lives in ~/.slick/config.yaml:

mcp_servers:
  slick-cloud:
    url: "https://portal.hackit.cc/mcp"
    auth: oauth

No credentials go in config.yaml — the OAuth token is kept separately under ~/.slick/mcp-tokens/, the same way the Portal refresh token stays out of your config.

Limiting the tool surface​

The server exposes both read (agents) and mutating (agent) tools. If you want the connection to be read-only — list and inspect, but never start/stop/create/destroy — restrict it to the agents tool:

mcp_servers:
  slick-cloud:
    url: "https://portal.hackit.cc/mcp"
    auth: oauth
    tools:
      include: [agents]

Run /reload-mcp after changing the config. See Use MCP with Slick for the full filtering model (include/exclude, prompts, resources).

Troubleshooting​

The browser shows an org picker and I'm not sure which to choose​

You belong to multiple Portal organizations. Pick the org whose Slick Cloud instances you want to manage from this connection. If you're unsure, it's the org that owns the instances you see on the Portal /agents page. You can re-choose later by removing and re-adding the server.

"invalid_client" or "unknown client" on connect​

The stored client registration no longer matches the server (for example, you connected to a different environment previously). Clear this server's cached OAuth state and re-add it:

slick mcp remove slick-cloud
rm -f ~/.slick/mcp-tokens/slick-cloud.*
slick mcp add --url https://portal.hackit.cc/mcp --auth oauth slick-cloud

The tools aren't showing up after adding the server​

Reload MCP inside the session and re-check:

/reload-mcp
Tell me which MCP-backed tools are available right now.

If they're still missing, run slick mcp test slick-cloud to see the connection error directly.

It asks me to log in again​

OAuth tokens refresh automatically, but if the Portal invalidates your session (password change, revoke, expiry) the next call asks you to re-authorize. Re-run the slick mcp add command — the browser flow re-mints a token.

Headless / SSH / remote host​

The OAuth browser callback runs on the machine where Slick is running. On a remote host, forward the loopback port over SSH — the same pattern as any other OAuth login. See OAuth over SSH / Remote Hosts.

See also​