Getting a key
Sign in with Google and make a key on your account page. Choose what it may do (see Permissions); an AI app usually needs read and write. The key is shown once. Send it as a Bearer token:
Authorization: Bearer cpk_...MCP server
The server is at https://cloudpool.vercel.app/mcp and speaks the Model Context Protocol over Streamable HTTP. It keeps no session between calls, so any number of apps can use it at once. An app only sees the tools its key allows.
Connecting an AI app
Claude (claude.ai, and the Claude apps on your computer and phone): in Settings, Connectors, choose Add custom connector, name it CloudPool and give it this address:
https://cloudpool.vercel.app/mcpClaude opens CloudPool's sign-in: sign in with Google, choose what Claude may do, and press Allow. No key to copy. Claude's access then shows on your account page as a key named Claude (connector); delete it there to disconnect Claude. Any other app that follows the MCP authorization spec connects the same way.
Apps and scripts that take a key instead use one from your account page:
Claude Code:
$ claude mcp add --transport http cloudpool https://cloudpool.vercel.app/mcp --header "Authorization: Bearer cpk_..."Claude Desktop reaches servers that take a key through mcp-remote (it needs Node). In Settings, Developer, Edit Config, add to claude_desktop_config.json and restart Claude:
{
"mcpServers": {
"cloudpool": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://cloudpool.vercel.app/mcp", "--header", "Authorization:Bearer cpk_..."]
}
}
}Cursor (~/.cursor/mcp.json) and VS Code (.vscode/mcp.json, with "servers" in place of "mcpServers" and "type": "http"):
{
"mcpServers": {
"cloudpool": {
"url": "https://cloudpool.vercel.app/mcp",
"headers": { "Authorization": "Bearer cpk_..." }
}
}
}Tools
Paths look like /Work/Invoices/march.pdf, the same whichever account holds the file. A login with several drives names one with drive (its name or id); without it, tools use the first drive.
| Tool | What it does | Arguments | Needs |
|---|---|---|---|
list_drives | The drives of this CloudPool login, with their space and the storage accounts in each. | none | read |
list_folder | Lists a folder: its files and subfolders, merged across every account of the drive. | drive path | read |
get_info | Details of one file or folder: type, size, modified time and the accounts that hold it. | drive path | read |
read_file | Reads a file (up to 4 MB). Text comes back as text; images as images; anything else as base64. | drive path as | read |
search | Finds files and folders whose name contains the text (any case), looking through subfolders. | drive query path limit | read |
write_file | Saves a file (up to 4 MB). Missing folders are made. CloudPool picks the account with room. An existing file is kept unless overwrite is true. | drive path content encoding overwrite | write |
create_folder | Makes a folder, and any missing folders above it. | drive path | write |
move | Moves a file or folder into another folder (made if missing). | drive path to_folder | write |
rename | Renames a file or folder where it is. | drive path new_name | write |
delete | Deletes a file or folder (a folder with everything in it) from every account that holds it. Storage services may keep it in their own bin for a while. | drive path | delete |
share_link | Makes a public CloudPool link to a file or folder (anyone with the link can open it). | drive path | links |
REST API
Calls go to https://cloudpool.vercel.app/api/v1. Answers are JSON, {"ok": true, "data": ...} or {"ok": false, "code": "...", "error": "..."} with a matching HTTP status, except file contents, which come back as the file itself. A drive is named by its id, its name, or _ for the first drive.
Calls
| Call | What it does | Needs |
|---|---|---|
| GET /me | The login, email and permissions of the key. | any |
| GET /drives | Every drive with its space and accounts. ?space=false skips asking each service how full it is. | read |
| GET /drives/:drive/list?path= | A folder, merged across the drive’s accounts. | read |
| GET /drives/:drive/info?path= | One file or folder. | read |
| GET /drives/:drive/search?q=&path=&limit= | Names containing q, through subfolders. | read |
| GET /drives/:drive/content?path= | The file’s bytes (up to 4 MB). | read |
| PUT /drives/:drive/content?path=&overwrite=true | Uploads the request body (up to 4 MB) as raw bytes: send application/octet-stream or no content type (curl -T does). JSON and form bodies are refused, because they would arrive changed. Missing folders are made. | write |
| POST /drives/:drive/folders | {"path"} Makes a folder and any missing above it. | write |
| POST /drives/:drive/move | {"path", "to"} Moves into another folder. | write |
| POST /drives/:drive/rename | {"path", "name"} | write |
| DELETE /drives/:drive/files?path= | Deletes a file or a folder with everything in it. | delete |
| POST /drives/:drive/links | {"path"} A public CloudPool link. | links |
| GET /links | Your share links. | links |
| DELETE /links/:code | Deletes a share link. | links |
| GET /accounts | Connected storage accounts, their drive and space. No tokens. | accounts |
| PATCH /accounts/:id | {"drive", "inDrive", "tier", "label"} Moves an account to another drive, takes it out of or back into its drive, marks it for small or big files. | manage |
| DELETE /accounts/:id | Disconnects an account. Nothing in it is deleted. | manage |
| POST /drives | {"name"} Makes a drive. | manage |
| PATCH /drives/:drive | {"name"} Renames a drive. | manage |
| DELETE /drives/:drive | Deletes an empty drive (not the first). | manage |
| GET /vault | The whole decrypted account list, tokens and passwords included. | secrets |
Changes to drives and accounts are saved in your encrypted account list, so every computer and phone signed in to the login picks them up on its next sync.
Examples
$ export CP="Authorization: Bearer cpk_..."
$ curl -H "$CP" https://cloudpool.vercel.app/api/v1/drives
$ curl -H "$CP" "https://cloudpool.vercel.app/api/v1/drives/_/list?path=/Photos"
$ curl -H "$CP" -T report.pdf "https://cloudpool.vercel.app/api/v1/drives/_/content?path=/Work/report.pdf"
$ curl -H "$CP" -o report.pdf "https://cloudpool.vercel.app/api/v1/drives/_/content?path=/Work/report.pdf"
$ curl -H "$CP" -X POST -H "Content-Type: application/json" \
-d '{"path": "/Work/report.pdf"}' https://cloudpool.vercel.app/api/v1/drives/_/linksPermissions
| Permission | Lets the key |
|---|---|
read | List drives and folders, search, read files, see space. |
write | Upload files, make folders, move and rename. |
delete | Delete files and folders. |
links | Make, list and delete public CloudPool links. |
accounts | See which storage accounts are connected and how full they are (no passwords or tokens). |
manage | Make, rename and delete drives; move accounts between drives; disconnect accounts. |
secrets | Read the whole account list with every token and password in it. Only for your own scripts. Never give it to an AI app. |
What the server can reach
The MCP server and the API run on this website, so they work while your computers are off. Like the phone web app, the website reaches Google Drive, MEGA, TeraBox and GitHub accounts itself.
Every other service (OneDrive, Dropbox, Amazon S3, NAS boxes, disks...) needs the transfer engine inside CloudPool on a computer. So while CloudPool is open on one of your computers, calls for a drive with such accounts are passed to it: it runs them with its own engine, over every account of the drive, and sends the answer back. Answers that came that way say so, with "answeredBy": "<computer name>". A disk goes to the computer it is plugged into.
The calls travel through a queue on CloudPool's sync server, sealed with AES-256-GCM under a key that only the website and that computer hold. The computer asks the queue for work every couple of seconds, so a call takes a moment longer. Turn it off per computer in CloudPool's Settings, Your CloudPool login, Answer MCP and API calls; your account page lists the computers answering. With none answering, the website answers with the accounts it reaches and lists the rest as computerOnly.
Private folders stay closed either way: only CloudPool itself opens them.
Limits
- Reading or uploading a file through the MCP server or the API: up to 4 MB each. Use CloudPool itself for bigger files.
- Split files (over 3.5 GB, in pieces) are listed but open only in CloudPool on a computer.
- Each call has 60 seconds (45 of them for a computer to answer). A search stops after 300 folders and says so (
"complete": false). - 50 API keys per login.
How keys are kept
CloudPool keeps only a SHA-256 fingerprint of each key, so a key cannot be shown again, only replaced. To reach your storage, a call opens your account list in the website's memory, where it may stay for up to ten minutes to make the next call quicker; nothing from it is written down. Deleting a key, or your login, stops it at once. See Security for how your login itself is kept.