| name | using-medusa-cloud |
| description | Manages Medusa Cloud resources through the Cloud CLI (mcloud). Use when deploying, debugging deployments, managing environments, environment variables, or any Medusa Cloud operation. CRITICAL for mcloud commands, deployment failures, build logs, Cloud setup, and CI/CD workflows. |
Managing Medusa Cloud Resources
Operational guide for AI agents managing Medusa Cloud infrastructure through the mcloud CLI. Covers setup, deployments, debugging, environments, and variables.
Constraints
- Always pass
--json when parsing CLI output. Plaintext output is for humans and may change without warning.
- Confirm context before mutating. Run
mcloud whoami --json before any state change.
- Read before you write. Run a
get or list before any delete, redeploy, or trigger-build.
- Use
--yes for destructive operations. delete commands (including variables delete) require --yes in non-interactive mode.
- Variable changes need a deploy to apply.
variables set/delete don't rebuild or redeploy: redeploy for runtime changes, trigger-build for build changes.
- Production environments cannot be deleted.
mcloud environments delete errors on production by design.
- Never pass
--reveal unless the user explicitly asks. Secret values appear in terminal scrollback and logs.
--json and --follow are incompatible. Use bounded time windows (--from/--to) with --json for programmatic log ingestion.
CRITICAL: Load Reference Files When Needed
Load these references based on what you're doing:
- Setting up the CLI? → MUST load
setup.md first
- Debugging a failed deployment? → MUST load
debugging-deployments.md first
- Managing environments or variables? → MUST load
environments-and-variables.md first
Minimum requirement: Load at least one reference file before executing multi-step workflows.
Quick Reference
Authentication Check
Always verify auth and scope before mutating state:
mcloud whoami --json | jq -e '.auth.kind != "none" and .organization.id != null'
Exit code 0 = authenticated and scoped. Non-zero = stop and ask the user.
Set Context Once
mcloud use \
--organization org_123 \
--project proj_123 \
--environment production
CRITICAL: mcloud use without flags is interactive and fails in CI/Docker/piped input. Always pass flags.
Deployment Status Routing
Route on backend_status (or storefront_status):
| Status | Meaning | Logs to check |
|---|
build-failed | Build step failed | mcloud deployments build-logs <id> |
deployment-failed | Runtime crashed after build | mcloud logs --deployment <id> |
timed-out | Exceeded time budget | Both: build-logs first, then runtime logs |
Redeployment Decision
| Command | When to use |
|---|
mcloud environments redeploy <env> | Fix is environment-side (variable change, infra) — reruns existing build |
mcloud environments trigger-build <env> | Fix is in source code on the tracked branch — starts new build |
Common Pitfalls
- TTY-only commands.
mcloud login, mcloud use (without flags), and delete without --yes require a TTY. They fail in CI, Docker, or piped input.
MCLOUD_TOKEN precedence. When set, file-based credentials are ignored and mcloud login is rejected. Unset it to switch accounts.- Personal vs org access keys. Personal keys require
--organization; org keys are pre-scoped.
organizations list requires personal auth. Org access keys return 401 on this command.- Build IDs vs deployment IDs.
depl_* = deployment ID; anything else = build ID (resolved to latest deployment). mcloud logs --deployment accepts both; other commands take build IDs only.
mcloud local build has no --json. It streams plaintext and reports success via its exit code (0 = success). Requires Docker and must run inside the project's Git repo. Use it to reproduce build-failed failures locally — see debugging-deployments.md.
Reference Files
setup.md - CLI installation, authentication, context setup
debugging-deployments.md - Build/deployment failure recipes and log analysis
environments-and-variables.md - Environment lifecycle and variable management
