菜单
CloudBase platform overview and routing guide. This skill should be used when users need high-level capability selection, platform concepts, console navigation, or cross-platform best practices before choosing a more specific implementation skill.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/TencentCloudBase/CloudBase-AI-Toolkit --skill cloudbase-platform命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | cloudbase-platform |
| description | CloudBase platform overview and routing guide. This skill should be used when users need high-level capability selection, platform concepts, console navigation, or cross-platform best practices before choosing a more specific implementation skill. |
| version | 2.33.0 |
| alwaysApply | false |
Sibling CloudBase skills ship beside this skill. Use local relative paths such as ../auth-tool-cloudbase/SKILL.md.
If a referenced sibling skill file is missing from this environment, ask the user to install the full CloudBase plugin (or the missing skill). Do not HTTP-fetch remote skill or protocol markdown into the agent context.
Cross-cutting protocols (required before code changes or deployments):
references/protocols/change-safety-protocol.mdreferences/protocols/deployment-gate.mdreferences/protocols/sensitive-runtime-data-protection.md../minimal-web-baas-demo/SKILL.md
envQuery → lock one DB plane → MCP schema → @cloudbase/js-sdk CRUD → preview.../web-development/SKILL.md../auth-tool-cloudbase/SKILL.md, ../auth-web-cloudbase/SKILL.md../miniprogram-development/SKILL.md../cloudbase-wechat-integration/SKILL.md (official docs: https://docs.cloudbase.net/integration/introduce/index.md)../cloud-functions/SKILL.md../http-api-cloudbase/SKILL.md../cloudbase-document-database-web-sdk/SKILL.md or ../cloudbase-document-database-in-wechat-miniprogram/SKILL.md../postgresql-development-cloudbase/SKILL.md../relational-database-mcp-cloudbase/SKILL.md or ../data-model-creation/SKILL.md../cloud-storage-web/SKILL.mdcloudbase-platform/references/protocols/change-safety-protocol.md).cloudbase-platform/references/protocols/deployment-gate.md.x-cloudbase-context, full req.headers, or process.env from Cloud Functions / CloudRun (including httpbin-style debug images) — follow references/protocols/sensitive-runtime-data-protection.md.Use this skill for CloudBase platform knowledge when you need to:
This skill provides foundational knowledge that applies to all CloudBase projects, regardless of whether they are Web, Mini Program, or backend services.
Understand platform differences
Follow best practices
@cloudbase/js-sdk direct DB access for browser CRUD; use cloud functions only for secrets, scheduled/background jobs, or elevated cross-collection logic that security rules / RLS cannot express (see ../minimal-web-baas-demo/SKILL.md for the demo default)Use correct SDKs and APIs
postgresql-development-cloudbase; do not reuse NoSQL app.database() / db.collection(...) snippets or MySQL queryMysqlDatabase / manageMysqlDatabase for PG data pathsenvQuery tool to get environment IDsrc/lib/backend.*, src/lib/auth.*, src/lib/*service.*, and bound page handlers before broad concept reading.Use the canonical CloudBase MCP setup from the main cloudbase guideline
cloudbase guideline firsttcb CLI now (../cloudbase-cli/SKILL.md, ../cloudbase/references/tooling-fallback.md). Inspect tool schemas before MCP execution. Do not hard-code Secret ID / Secret Key / Env ID in configauth, while application-side auth configuration uses queryAppAuth / manageAppAuthWhen working with domain-related tasks, use the correct tool based on the requirement:
| Requirement | Tool | Parameters | Purpose |
|---|---|---|---|
| Security Domain (安全域名) | manageEnv(action="addSecurityDomain" | "removeSecurityDomain") | domains (array of host:port strings) | CORS/request source validation for browser uploads. No certificate involved. (Deprecated alias: envDomainManagement.) |
| Reuse existing Custom Domain | queryGateway(listCustomDomains) → manageGateway(createRoute) | domain = existing custom domain; route fields | Expose a service/path on an already-bound custom domain. No certificateId. Prefer this when a custom domain already exists. |
| Bind new Custom Domain (自定义域名) | manageGateway(action="bindCustomDomain") | domain (string), certificateId (string) | First-time bind of a new public HTTPS domain. Requires certId from SSL console. |
| Delete Custom Domain | manageGateway(action="deleteCustomDomain") | domain (string) | Remove custom domain binding (only after routes on that domain are deleted). |
| Disable / enable gateway route | manageGateway(action="disableRoute" | "enableRoute") | path (required), prefer explicit domain | Toggle Routes[].Enable via ModifyHTTPServiceRoute (not ModifyGatewayRoute). |
| Disable static hosting default domain | queryGateway(listRoutes) → manageGateway(disableRoute) | domain = *.tcloudbaseapp.com (DomainType=STATIC_STORE, IsDefault=true), usually path="/" | Turns off public access on the shared hosting CDN default host. Do not use manageHosting. |
Key indicators for choosing the right tool:
listCustomDomains then createRoute(domain=...) (no certificateId)manageGateway(action="bindCustomDomain")manageEnv(action="addSecurityDomain" / "removeSecurityDomain")createRoute when possible; only bindCustomDomain for first-time domain bind*.tcloudbaseapp.com → queryGateway(listRoutes) then manageGateway(disableRoute) with that STATIC_STORE domain; never invent ModifyGatewayRouteWhen a CloudBase tool call fails and the error message contains a specific error code (pattern Category.Code, e.g. OperationDenied.FreePackageDenied, ResourceNotFound.*), always route through the official docs before acting — do not guess the meaning, do not hardcode fix recipes here:
searchKnowledgeBase(mode="docs", action="searchDocs", query="<错误码>") — official docs search covers error-code pages. Act on the documented meaning and the fix steps the doc prescribes (plan limits → upgrade guidance, misconfiguration → config fix, etc.).https://docs.cloudbase.net/error-code/basichttps://cloud.tencent.com/document/product/876/34823https://cloud.tencent.com/document/product/876/127357 rather than assuming which tier unlocks it.When a task explicitly requires recording operation steps or results to a file (e.g., RESULT.json): perform the tool calls first, then write a complete record containing every attempt (action, success/failure, message) plus a summary with total / succeeded / failed counts. Do not write the file from memory before the calls finish.
Static Hosting vs Cloud Storage:
manageStorage / queryStorage), not manageHosting(action="upload")Static Hosting Domain:
queryHosting(action="websiteConfig")<envId>-<appId>.tcloudbaseapp.com (DomainType=STATIC_STORE, often IsDefault=true in queryGateway(listRoutes))manageGateway(action="disableRoute", domain="<that-host>", path="/") (or updateRoute with enable=false). Re-enable with enableRoute. Do not look for a manageHosting disable-default-domain action; do not call non-existent ModifyGatewayRoute — the API is ModifyHTTPServiceRoute/Cloud Storage Public URL:
manageStorage(action=upload) and queryStorage(action=url) return temporaryUrl which is a temporary signed URL that expires (default 1 hour). Do NOT use this as a permanent public URL.envQuery(action=info) to get environment detailsEnvInfo.Storages[0].CdnDomain (e.g., your-env-id.tcb.qcloud.la)https://{CdnDomain}/{cloudPath}CdnDomain is env-xxx.tcb.qcloud.la and cloudPath is uploads/avatar.jpg, the public URL is https://env-xxx.tcb.qcloud.la/uploads/avatar.jpgPRIVATE which requires signed URLs)SDK Initialization:
envQuery toolenvQuery(action="list", alias=..., aliasExact=true) first and use the returned full EnvIdauth.set_env, console URLs, or generated config filesimport cloudbase from "@cloudbase/js-sdk"; const app = cloudbase.init({ env: "your-full-env-id" });import("@cloudbase/js-sdk") or async wrappers such as initCloudBase() with internal initPromiseEnvironment Management (via manageEnv):
The manageEnv tool provides full lifecycle management for CloudBase environments.
| Action | Description | Key Parameters |
|---|---|---|
listPackages | Query available plans | (none) |
create | Create new environment (needs confirm) | alias, packageId, resources, duration |
modifyPlan | Change plan (upgrade/downgrade, needs confirm) | envId, packageId |
renew | Renew environment (needs confirm) | envId, duration |
Creating an environment with specific resources:
manageEnv(action="create", alias="my-env", packageId="baas_personal",
resources=["flexdb","storage","function","postgresql"], confirm="yes")
resources (optional, create only): controls which CloudBase capabilities to enable:
flexdb — Document database (NoSQL)storage — Cloud Storagefunction — Cloud Functionspostgresql — PostgreSQL relational database (PG mode)Resources to CreateEnv.region: CreateEnv does not accept Region; environment region is determined by account/package.confirm="yes".Querying available packages before creating:
manageEnv(action="listPackages")
Changing plan (e.g. personal → standard):
manageEnv(action="modifyPlan", envId="your-env-id", packageId="baas_pf_standard", confirm="yes")
Renewing an environment:
manageEnv(action="renew", envId="your-env-id", duration=1, confirm="yes")
Important: Authentication methods for different platforms are completely different, must strictly distinguish!
auth.getVerification(), for detailed, refer to web auth related docsauth.getSession() and require data.session; do not use deprecated getLoginState() or auth.getUser() / auth.getCurrentUser() as proof of real login.queryAppAuth / manageAppAuth, not the MCP auth toolaccessKey alone does not create a gateway-authenticated anonymous session. With @cloudbase/js-sdk 3.x, call await auth.signInAnonymously() (or an equivalent authenticated session) before NoSQL app.database() CRUD, or the gateway returns 401. If the app uses AuthGuard or RLS for access control, ensure is_anonymous checks are in place when anonymous access is allowed.auth.uid(), NOT current_user. When writing RLS policies for CloudBase PostgreSQL, the user identity must use auth.uid() (returns the JWT sub / actual user ID as text, not uuid — unlike Supabase). Prefer owner columns as varchar(64) / text; if the column is uuid, cast with auth.uid()::uuid or you get operator does not exist: uuid = text. Do NOT use current_user or current_setting(...) — these PostgreSQL built-in functions return the database role name (e.g. authenticated), not the CloudBase auth user ID. CloudBase PG provides four auth helper functions: auth.uid(), auth.role(), auth.email(), auth.jwt(). Verify availability with SELECT proname FROM pg_proc WHERE pronamespace = 'auth'::regnamespace.wxContext.OPENID via wx-server-sdkpackage.json, declaring required dependenciesmanageFunctions(action="createFunction") to create functionsmanageFunctions(action="updateFunctionCode") to deploy cloud functionsfunctionRootPath refers to the parent directory of function directories, e.g., cloudfunctions directory⚠️ CRITICAL: Always configure permissions BEFORE writing database operation code!
Permission Model:
Platform Compatibility (CRITICAL):
ADMINWRITE or ADMINONLY for write operationsConfiguration Workflow:
Create collection → Configure security rules → Write code → Test
managePermissions(action="updateResourcePermission") to configure resource permissionsno-sql-web-sdk/security-rules.md for detailed resourceType="noSqlDatabase" examples only; do not treat doc._openid, auth.openid, query-subset validation, or create / update / delete JSON templates as generic rules for functions, storage, or SQL tableshttps://cloud.tencent.com/document/product/876/41802https://docs.cloudbase.net/database/security-ruleshttps://docs.cloudbase.net/cloud-function/security-ruleshttps://docs.cloudbase.net/storage/security-rulesCompatibility note:
permissionssecurity-rule, security-rules, secret-rule, secret-rules, and access-control still resolve to the permissions pluginreadSecurityRule / writeSecurityRule are removed; prefer queryPermissions / managePermissionsCommon Scenarios:
READONLY (admin manages via cloud functions)CUSTOM with auth.uid check (users manage their own)CUSTOM with ownership validationPRIVATE or ADMINONLYCross-Collection Operations:
../minimal-web-baas-demo/SKILL.mdCloudBase MCP provides role management via queryPermissions and managePermissions (CLI equivalent: tcb role). See each tool's schema for the full action list.
⚠️ CRITICAL: Role policies and resource permissions are two independent systems with NO automatic synchronization.
Query (queryPermissions): listRoles, getRole (by roleId / roleIdentity / roleName).
Manage (managePermissions): createRole, updateRole, deleteRoles, addRoleMembers, removeRoleMembers, addRolePolicies, removeRolePolicies.
managePermissions(action="createRole", roleName="Developer", roleIdentity="developer",
policies=["FunctionsAccess"], memberUids=["user-uid-1"])
⚠️ Only custom roles can be deleted. System roles are read-only.
See also: CLI equivalent commands in cloudbase-cli/references/permission.md
@cloudbase/js-sdk → database (see ../minimal-web-baas-demo/SKILL.md)Get Data Model Operation Object:
@cloudbase/wx-cloud-client-sdk, initialize const client = initHTTPOverCallFunction(wx.cloud), use client.models@cloudbase/node-sdk@3.10+, initialize const app = cloudbase.init({env}), use app.models@cloudbase/js-sdk, initialize const app = cloudbase.init({env}), after login use app.modelsData Model Query:
manageDataModel tool to:
MySQL Data Model Invocation Rules:
db.collection('model_name').get()app.models.model_name.list({ filter: { where: {} } })manageDataModel tool's docs method to get specific SDK usageAfter creating/deploying resources, provide corresponding console links. All console URLs follow the pattern: https://tcb.cloud.tencent.com/dev?envId=${envId}#/{path} — replace ${envId} with the real EnvId resolved via envQuery (resolve aliases first; see Environment and Authentication below), and resource names with actual values.
The CloudBase console is updated frequently. If a live, logged-in console shows a different hash path from this list, prefer the live console path over stale documentation and then update this skill to match.
#/overview#/cloud-template/market#/db/doc · Collections #/db/doc/collection/${collectionName} · Models #/db/doc/model/${modelName}#/db/mysql · Tables #/db/mysql/table/default/ (must be enabled in console first)#/scf · Detail #/scf/detail?id=${functionName}&NameSpace=${envId}#/platform-run#/storage#/ai#/static-hosting (alt: https://console.cloud.tencent.com/tcb/hosting)#/identity · Login management #/identity/login-manage · Token management #/identity/token-management#/lowcode/apps#/devops/log#/env/http-access (security domains, CORS, env vars, quotas)For configuration pages (like login management), guide users through the setup process rather than only dropping a link.
All packaged reference files (required for skill lint reachability):