| name | tencentcloud-cli |
| description | Guide agents to use Tencent Cloud TCCLI correctly and safely. Use when a user asks to run or explain Tencent Cloud CLI, TCCLI, tccli, 腾讯云 CLI, Tencent Cloud resource inspection, profile/credential setup, CVM/VPC/CLB/CDB/PostgreSQL/Redis/VDB/TKE/COS/CAM or other Tencent Cloud operations from a terminal, including read-only queries, API command discovery, JSON/filter output, SSO or CVM role authentication, troubleshooting, or preparing mutating commands. |
Tencent Cloud CLI
Use Tencent Cloud CLI through the tccli binary.
Workflow
- Resolve the binary with
command -v tccli; if absent, tell the user Tencent Cloud CLI is not installed and stop before inventing commands.
- Inspect local context before operating:
tccli --version
tccli configure get region
tccli configure get output
- Confirm the active
--profile, --region, output format, service version, and endpoint before any resource query that depends on them.
- Bound the query scope before running cloud APIs. Do not scan every service or every region by default. Use the user's requested product/region first; otherwise use the configured region and the narrow product set needed for the task.
- Use
tccli help, tccli <service> help, and tccli <service> <action> help to discover exact service names, API action names, required parameters, and options.
- Prefer JSON output for follow-up processing. Use
--filter only after confirming the response shape, and use jq locally when filtering is clearer or safer.
- For unfamiliar operations, use Tencent Cloud API Explorer or local CLI help to map the API action to
tccli <service> <Action>.
- Summarize results with profile, region, service version, endpoint, and request ID when available so the user can see what scope was queried.
Scope Control
For inventory or "what resources exist" tasks, first try Tencent Cloud Config ListDiscoveredResources; if the config recorder is disabled or empty, fall back to an allowlist of common resource products instead of enumerating all products.
Default inventory allowlist: cvm, cbs, vpc, clb, cdb, postgres, redis, mongodb, vdb, ckafka, trabbit, tke, lighthouse, and cos.
Use a two-pass region strategy:
- Fast path: query the configured region and any user-mentioned regions. For this workspace's current Tencent Cloud account, previously observed active regions are
ap-guangzhou and ap-shanghai; ap-beijing has only default network resources.
- Exhaustive path: only scan all available regions when the user explicitly asks for full-account/global inventory, or when fast-path results are insufficient for the requested report.
Stop querying a product in a region after UnsupportedRegion; record it once and continue with other requested products or regions. Do not retry unsupported product/region combinations.
Command Reference
Read references/cli-usage.md when you need exact command patterns for configuration, region selection, inventory allowlists, SSO, CVM role auth, output filtering, COS, JSON input, waiter usage, debugging, or troubleshooting.
Safety
Treat create, update, delete, start, stop, restart, reboot, resize, attach, detach, bind, unbind, authorize, revoke, grant, upload, download-to-sensitive-path, overwrite, and any operation with write/delete side effects as mutating.
Before running a mutating command, get explicit confirmation in the current conversation. Present the exact command, active profile, --region, service version, endpoint, target resource identifiers, and expected effect.
Never print or persist SecretId, SecretKey, STS tokens, SSO tokens, passwords, private keys, cookies, or decrypted configuration. Avoid tccli configure list unless you can redact the output before sharing it, because installed versions may print secrets in full. If authentication is missing, guide the user to configure credentials locally; do not ask them to paste secrets into chat.
