Cloudinary MCP connector for AI agents

Cloudinary MCP tools for AI agents

CALL ANY TOOL

12 tools covering asset, create.

cloudinarymcp_list_tags

List tags

Retrieves a list of tags currently applied to assets in your Cloudinary account Retrieves a comprehensive list of all tags that exist in your product environment for assets of the specified type. [Cloudinary Admin API documentation](https://cloudinary.com/documentation/admin_api)

Parameters

Name

Type

Required

Description

resource_type

string

Required

The type of resource (image, video, or raw).

max_results

integer

Optional

Maximum number of results to return (1-500).

next_cursor

string

Optional

Cursor for pagination.

prefix

string

Optional

Limit the returned tags to those that start with the specified prefix.

cloudinarymcp_search_assets

Search assets

cloudinarymcp_list_files

List files

cloudinarymcp_search_folders

Search folders

cloudinarymcp_list_images

List images

cloudinarymcp_get_tx_reference

Get tx reference

cloudinarymcp_list_videos

List videos

cloudinarymcp_get_asset_details

Get asset details

cloudinarymcp_create_folder

Create folder

cloudinarymcp_get_usage_details

Get usage details

cloudinarymcp_create_asset_relations

Create asset relations

cloudinarymcp_get_generation_task

Get generation task

cloudinarymcp_move_folder

Move folder

cloudinarymcp_sign_upload

Sign upload

Use this tool when the user wants to upload a file to Cloudinary directly from their own machine or environment. It signs Upload API parameters so the caller can POST files straight to the Cloudinary Upload API : no API secret required on the client side. NOT suitable for large files (>100 MB) or bulk uploads : direct the user to the Cloudinary CLI (`cld uploader upload`) or an SDK instead, which handle chunking, retries, and progress reporting. Returns one credential object per input entry: upload_params : serialized params to echo verbatim as form fields (includes timestamp) api_key : Cloudinary API key signature : HMAC signature over upload_params; invalidated if any field is changed host : Upload API hostname (may differ from api.cloudinary.com for regional/enterprise accounts) cloud_name : Cloudinary cloud name Send only signable params in the input (public_id, folder, tags, context, metadata, eager, transformation, …). Do not include file, resource_type, api_key, or signature : these are not part of the signed parameter set and will be ignored if passed. To upload after signing, POST multipart/form-data to: https:///v1_1///upload Include your file plus api_key, signature, and EVERY key from upload_params as its own form field. Any added, dropped, renamed, or re-serialized field invalidates the signature. resource_type (image/video/raw/auto) is part of the URL, not upload_params. Example (all upload_params keys must appear : shown here with public_id and timestamp only for brevity; include every key your upload_params actually contains): curl https:///v1_1//image/upload \ -F 'file=@"/path/to/photo.jpg"' \ -F 'api_key=' -F 'signature=' \ -F 'timestamp=' \ -F 'public_id=' # one -F per upload_params key IMPORTANT : the file= argument MUST use two quoting layers: single-quotes around the entire -F value (shell), double-quotes around the path (curl): -F 'file=@""'. Paths with spaces or special characters are common and will be word-split by the shell if unquoted, silently truncating the filename at the first space.

Parameters

Name

Type

Required

Description

uploads

array

Required

One or more sets of Cloudinary Upload API parameters to sign. Returns one signed credential object per entry, in the same order. Only genuine Upload API params are signed; file, resource_type, api_key, and signature are excluded.

cloudinarymcp_asset_rename

Asset rename

cloudinarymcp_asset_update

Asset update

cloudinarymcp_upload_asset

Upload asset

cloudinarymcp_generate_image

Generate image

cloudinarymcp_transform_asset

Transform asset

cloudinarymcp_generate_archive

Generate archive

cloudinarymcp_manage_asset_tags

Manage asset tags

cloudinarymcp_visual_search_assets

Visual search assets

cloudinarymcp_manage_asset_context

Manage asset context

cloudinarymcp_download_asset_backup

Download asset backup

cloudinarymcp_manage_asset_metadata

Manage asset metadata

cloudinarymcp_generate_image_from_images

Generate image from images

cloudinarymcp_delete_asset

Delete asset

cloudinarymcp_delete_folder

Delete folder

cloudinarymcp_delete_derived_assets

Delete derived assets

cloudinarymcp_delete_asset_relations

Delete asset relations

Build your Agent

Same auth pattern across every framework.

from langchain_mcp_adapters.client import MultiServerMCPClient
from scalekit import ScalekitClient

client = ScalekitClient(env_url=ENV_URL, client_id=CLIENT_ID, client_secret=SECRET)
token = client.agent.get_token(user_id="user_id", connector="cloudinarymcp")

mcp = MultiServerMCPClient({
    "cloudinarymcp": {
        "url": "https://mcp.scalekit.com/cloudinarymcp",
        "headers": {"Authorization": "Bearer " + token}
    }
})
tools = await mcp.get_tools()

import OpenAI from "openai";
const token = await client.agent.getToken({ userId: "user_id", connector: "cloudinarymcp" });
// Connect to MCP at https://mcp.scalekit.com/cloudinarymcp

import Anthropic from "@anthropic-ai/sdk";
const token = await client.agent.getToken({ userId: "user_id", connector: "cloudinarymcp" });
// Connect to MCP at https://mcp.scalekit.com/cloudinarymcp

from google.adk.agents import LlmAgent
token = client.agent.get_token(user_id="user_id", connector="cloudinarymcp")
# Connect to MCP at https://mcp.scalekit.com/cloudinarymcp

Try these prompts

Paste any prompt into your agent to get started.

Finds images in your asset library based on visual similarity or content?

SEE HOW AUTH WORKS

User authorises once. Every agent call after uses their token with scope enforcement.

Authorize

Your user connects

Cloudinary MCP

once. We tie it to their identity and the meetings they approved — no shared bot account, no org-wide access

Who:

user ‘A’

when:

Once per user

access:

Limited to user

Store

Their

Cloudinary MCP

token lives in a vault scoped to them. User A's meetings are never reachable by an agent acting for user B, even on the same connection

vault:

encrypted

scope:

per-user

tokens:

auto-refreshed

Resolve

When your agent calls a

Cloudinary MCP

tool, we fetch the right token server-side. It never touches your agent, never appears in the LLM context, never shows up in your logs

speed:

~40ms

check:

before every call

seen by:

nobody

Audit

Every

Cloudinary MCP

tool call is logged — who triggered it, which meeting was fetched, what came back. 90 days of history, tied to the user who authorized it

history:

90 days

export:

SIEM-ready

logged:

every call

Test other agents

See the same per-user auth pattern across other connectors.

GTM and RevOps Teams

Competitive intelligence briefing agent

Scans Gong calls for competitor mentions, matches each one to its Notion battlecard, and DMs every affected rep a single Slack digest per cycle. Every call runs as the PMM who owns the briefing, never a shared bot.

GTM and RevOps Teams

Outbound prospecting agent

Searches Apollo for prospects matching your ICP, scores and ranks them, drafts personalized outreach in Gmail, and logs every send to Google Sheets. Mail goes out as the rep, not from a shared inbox.

GTM and RevOps Teams

CRM AI agent

Reads the Granola transcript after every call, extracts next steps and updates the HubSpot record, drafts the follow-up in Gmail, and confirms in Slack, all on the rep's own delegated OAuth.

Support and Ops Teams

Meeting prep

Pulls agenda, participant context, and open action items before every meeting.

Why Scalekit

Secure your agent's access. Connectors ship in minutes

01.

Shared tokens break per-user analytics

A shared token looks fine in a demo. In production every call looks like a service account. Scalekit resolves the real user credential.

“Our agents act across Salesforce, Gong, Google Drive, and more, on behalf of every customer. Scalekit behind the scenes meant we can keep adding tools without ever rebuilding how credentials or tool calling work.”

Venu Madhav Kattagoni

Head of Engineering / Von

FAQs

Frequently Asked Questions

Does the agent access Cloudinary as the user or as a shared key?
As the user. Each workspace member authorizes once and Scalekit resolves their credential at request time. Audit logs attribute every action to that user, not a shared service account.

Where is the Cloudinary OAuth token stored?
In Scalekit's managed AES-256 token vault, namespaced per tenant. Refresh is automatic. Revocation is a single dashboard action. Tokens never appear in prompts, logs, or LLM context.

Can I limit what the agent is allowed to do in Cloudinary?
Yes. Pass a tool name filter to listScopedTools so the media agent only sees the subset you authorize. Pre-API-call scope checks block out-of-policy actions before the request reaches Cloudinary.

What happens when a user revokes Cloudinary access?
The connection is invalidated on the next tool call. Subsequent requests for that user fail closed with a clear error. Other users in the tenant remain unaffected. The event is logged for audit.

Which media assets can the agent transform or delete?
Only assets the authorizing user can manage in Cloudinary. Uploads, renames, and deletions follow the user's product environment permissions, and destructive tools can be filtered out entirely.

On this page

Tool and actions Framework Compatibility Starter Prompt Auth Lifecycle Try Other Agents Why Scalekit