All examples on this page are executable as soon as a token and a project ID are available. They use the same endpoints, headers and response formats as the quick start in the documentation.
The six tools of ENTRONYX CLOUD can do the same thing. The choice therefore does not depend on the feature set, but solely on the task. This table names exactly one tool for each task.
No row in this table is a one-way street. What was started with the command line can later be imported as a Terraform resource; what an agent suggests is read as a plan and applied by a person.
Command line, Terraform provider, MCP server and the customer panel speak the same HTTP interface. If you know it, you know the limits of all four tools — and you know what your own script can do as well. It is described using OpenAPI 3.1: a machine-readable file that can be used to generate a client for any language.
A token carries a scope per resource group — compute:rw, billing:ro and so on. If the scope is missing, the interface responds with 403, not 404: the resource exists, the token is just not allowed to see it.
The project is in its own header, not in the path. This means the same request remains unchanged between test and production; only the identifier is swapped.
Authorization: Bearer · X-Entronyx-Project
The window slides, it does not jump at the full minute. Every response carries the remaining quota; if you read it, you never have to hit the limit.
On a 429, the wait time is in Retry-After. An immediate retry extends the block instead of bypassing it.
3,000 requests per minute, per project and token
The version is in the path and only changes for breaking changes. A deprecated version continues to run for twelve months and reports itself during this time via the Deprecation header.
Lists are paginated using a cursor. It is opaque and returned unchanged — unlike a page number, it does not skip an entry if a resource is created or disappears during pagination.
v2 in the path · cursor instead of offset
What the block does: it puts the token and project into the environment, fetches the first page of instances in Frankfurt, reads the headers and requests the second page using the cursor from the first response.
# Put token and project into the environment once — never into a repository.
$ export ENTRONYX_TOKEN="ex_live_9f3c1a7d2b48e05c"
$ export ENTRONYX_PROJECT="prj_4c81f0"
# First page: up to 20 instances in Frankfurt. Include headers.
$ curl -sS https://api.entronyx.cloud/v2/compute/instances \
-H "Authorization: Bearer $ENTRONYX_TOKEN" \
-H "X-Entronyx-Project: $ENTRONYX_PROJECT" \
-D /tmp/kopf.txt \
-G --data-urlencode "region=fra1" --data-urlencode "limit=20"
{
"data": [
{
"id": "srv_8d41ac",
"name": "web-01",
"flavor": "nx-4-8",
"region": "fra1",
"image": "debian-13",
"state": "running",
"created_at": "2026-08-14T09:12:44Z",
"network": { "ipv4": "185.42.19.7", "ipv6": "2a0e:8f02:41::7" }
}
],
"page": { "next_cursor": "eyJhIjoic3J2Xzhk", "has_more": true }
}
# What is in the headers: remaining quota and request ID.
$ grep -iE "x-ratelimit|x-request-id" /tmp/kopf.txt
x-ratelimit-limit: 3000
x-ratelimit-remaining: 2987
x-ratelimit-reset: 1787043180
x-request-id: req_2f8c14ab9e
# Second page: return the cursor of the first unchanged.
$ curl -sS https://api.entronyx.cloud/v2/compute/instances \
-H "Authorization: Bearer $ENTRONYX_TOKEN" \
-H "X-Entronyx-Project: $ENTRONYX_PROJECT" \
-G --data-urlencode "region=fra1" --data-urlencode "limit=20" \
--data-urlencode "cursor=eyJhIjoic3J2Xzhk"
data with the instances of this page and page with the cursor for the next. The remaining quota is not in the body, but in the headers — in the example 2,987 of 3,000. The request to create an instance is in the quick start of the documentation. There it carries an idempotency key: if the request is repeated after a connection drop, the key prevents a second instance.What the block does: it requests an instance with a flavor that does not exist in the Berlin region and reads the response. A flavor is a fixed combination of cores and memory.
# A flavor that does not exist in this region: 422, not repeatable.
$ curl -sS -o /tmp/leib.json -w "%{http_code}\n" \
-X POST https://api.entronyx.cloud/v2/compute/instances \
-H "Authorization: Bearer $ENTRONYX_TOKEN" \
-H "X-Entronyx-Project: $ENTRONYX_PROJECT" \
-H "Content-Type: application/json" \
-d '{ "name": "web-02", "flavor": "nx-96-768", "region": "ber1", "image": "debian-13" }'
422
$ jq . /tmp/leib.json
{
"error": {
"code": "flavor_not_available_in_region",
"message": "Flavor nx-96-768 is not offered in region ber1.",
"field": "flavor",
"request_id": "req_71b0d4c6aa"
}
}
Four headers that a client should evaluate. If you only read the first three, you will never get close to the limit; if you only read the fourth, you will wait correctly after exceeding it.
| Header | Meaning |
|---|---|
X-RateLimit-Limit | Window quota, here always 3,000 |
X-RateLimit-Remaining | Remaining requests in the current window |
X-RateLimit-Reset | Unix time when the window restarts |
Retry-After | Seconds until the next allowed attempt, for 429 and 503 |
An excerpt, not a directory: nine requests that together cover the usual path from an empty environment to a running system. The complete list with all fields is available as an OpenAPI description.
| Method | Path | Purpose | Success |
|---|---|---|---|
| GET | /v2/compute/instances | List instances of a project, filtered by region | 200 |
| POST | /v2/compute/instances | Create instance, repeatable with idempotency key | 201 |
| GET | /v2/compute/instances/{id} | Read an instance with state, network and volumes | 200 |
| DELETE | /v2/compute/instances/{id} | Destroy instance, volumes remain | 204 |
| GET | /v2/storage/volumes | Block volumes with class, size and connection | 200 |
| POST | /v2/network/private-networks | Create private Layer 2 network across multiple locations | 201 |
| GET | /v2/k8s/clusters/{id}/kubeconfig | Obtain access file for a cluster | 200 |
| POST | /v2/webhooks | Register event target, signature via HMAC | 201 |
| GET | /v2/billing/usage | Consumption per resource and label in the period | 200 |
All paths are under the base path https://api.entronyx.cloud. Write requests accept the Idempotency-Key header; it is valid for 24 hours.
entronyx is statically linked — all dependencies are packed into a single file — and runs on Linux, macOS and Windows without an interpreter in the background. Every output is available as a readable table and as JSON for further processing. The same query is therefore suitable for a quick glance and for a cron job.
What this block does: it installs the tool on macOS or Debian, stores a token and sets the active project.
# macOS
$ brew install entronyx/tap/entronyx
# Debian and Ubuntu
$ curl -fsSL https://pkg.entronyx.cloud/gpg | sudo tee /etc/apt/keyrings/entronyx.asc >/dev/null
$ echo "deb [signed-by=/etc/apt/keyrings/entronyx.asc] https://pkg.entronyx.cloud/apt stable main" \
| sudo tee /etc/apt/sources.list.d/entronyx.list
$ sudo apt update && sudo apt install entronyx
# Log in and set the active project. The token is in a file,
# not in the argument — arguments end up in the process list and history.
$ entronyx auth login --token-file ~/.config/entronyx/token
$ entronyx config set-project prj_4c81f0
# Check which account and which project is being worked against.
$ entronyx auth whoami
Account ENTRONYX Deutschland GmbH (acc_5b12)
Project prj_4c81f0 (production)
Scopes compute:rw storage:rw network:ro billing:ro
Expiry 12 November 2026, 24 days remaining
The structure is consistently entronyx <scope> <verb>. If you know the scope, you can find the verb via --help; if you know the verb, you can find the flags in the same place. No abbreviations, no special cases.
| Command | Purpose | Note |
|---|---|---|
entronyx auth login | Store and verify token | --token-file, never as an argument |
entronyx config set-project | Set active project | applies to all subsequent calls |
entronyx compute list | List instances | --region, --label, --state |
entronyx compute create | Create instance | --wait blocks until “running” |
entronyx compute ssh | Open connection to an instance | resolves names against the API |
entronyx storage volume create | Create and attach block volume | --class block-nvme |
entronyx network private-network list | vRack networks and their locations | --output json for scripts |
entronyx k8s kubeconfig | Get access file of a cluster | --merge schreibt in ~/.kube/config |
entronyx k8s nodepool scale | Scale node group up or down | --wait waits for “ready” |
entronyx billing usage | Retrieve consumption in the period | --from, --to, --group-by label |
Every command supports --output table, --output json and --output jsonl (one JSON object per line) as well as --query for an expression on the JSON response. The default is table when the output goes to a terminal, and json when it is piped.
A tool is suitable for automation if it promises two things: a stable output format and a meaningful exit code. Both apply here across minor versions — new fields are added, existing ones do not disappear.
What this block does: it fetches three instances as JSON, creates a fourth and waits for its target state, writes the monthly consumption line by line to a file and scales up a node group.
# Every output is available as a table for humans and as JSON for scripts.
$ entronyx compute list --region fra1 --output json | jq -r '.data[] | [.name, .network.ipv4] | @tsv'
web-01 185.42.19.7
web-02 185.42.19.8
db-01 185.42.19.21
# --query filters in the tool so no second process is needed.
$ entronyx compute create --name web-03 --flavor nx-4-8 --region fra1 \
--image debian-13 --ssh-key key_7a21bc --wait \
--output json --query ".network.ipv4"
185.42.19.9
# JSONL for line-by-line processing of large lists. Paging via the
# The tool handles the cursor itself.
$ entronyx billing usage --from 2026-08-01 --to 2026-08-31 \
--group-by label --output jsonl > verbrauch.jsonl
# Evaluate exit code instead of searching output.
$ entronyx k8s nodepool scale --cluster k8s-prod --pool general --count 6 --wait
$ echo $?
0
| Code | Meaning |
|---|---|
| 0 | Success |
| 2 | Usage error, such as unknown flag |
| 3 | API error, error object is on stderr |
| 4 | Timeout, mostly with --wait |
A terminal in the browser, authenticated against the same account as the panel. No token is copied into the session, no installation is necessary, and the environment is located in the same region as the resources being worked on.
What the block does: It queries the origin of the session, measures the space in both areas, fetches a directory from Git and starts a Terraform run — all without a single local installation.
# The environment opens in the browser at shell.entronyx.cloud and is already
# logged in — no token is copied into the session.
entronyx@shell:~$ entronyx auth whoami
Account ENTRONYX Deutschland GmbH (acc_5b12)
Project prj_4c81f0 (production)
Origin Cloud Shell, session sh_9d2c41, valid until 21:40
# /home survives the session, everything else does not.
entronyx@shell:~$ df -h /home /tmp
Filesystem Size Used Avail Mounted on
/dev/hdd1 5.0G 1.2G 3.8G /home
tmpfs 2.0G 24M 2.0G /tmp
# An example that runs without any local installation:
entronyx@shell:~$ git clone https://github.com/beispiel/infra.git && cd infra
entronyx@shell:~/infra$ terraform init && terraform plan
# Disconnected after 30 minutes without input. Running processes belong
# therefore in tmux — it survives the disconnection within the session duration.
entronyx@shell:~$ tmux new -s migration
The environment is a workspace, not a compute node. If you need more than what is listed here, use an instance — it costs less than the workaround via an environment that is not built for it.
The set covers the usual working day: describing infrastructure, operating clusters, filtering outputs, mirroring data, querying databases. The versions are updated with each image; the image itself is renewed monthly.
| Tool | Version | What for |
|---|---|---|
entronyx | always up to date | Command line, already authenticated against the account |
terraform / opentofu | 1.14 / 1.11 | Describe and apply infrastructure |
kubectl / helm | 1.34 / 3.19 | Operate clusters, roll out packages |
Python | 3.14 | with boto3, requests and the Python package entronyx |
Node.js | 24 LTS | with @entronyx/sdk, npm and pnpm |
Go | 1.26 | Compile small tools in place |
jq / yq | 1.8 / 4.48 | Process JSON and YAML outputs |
rclone / restic | 1.72 / 0.19 | Mirror Object Storage, check backups |
psql / redis-cli | 18 / 8.2 | Query managed databases directly |
git / gh | 2.53 / 2.84 | Fetch sources, write back changes |
Additional packages can be installed in the persistent area under /home — for example via pipx, npm --prefix or go install. System-wide installations do not survive the session because the root file system comes fresh from the image at every start.
The provider — Terraform's provider module for ENTRONYX CLOUD — covers compute, storage, network, Kubernetes and databases. What can be clicked in the panel can also be described as a resource. This is the same condition that applies to the HTTP interface.
What the block does: It describes a complete setup — private network across two locations, subnet in fra1, an instance attached to it, an NVMe volume with 512 GB and its attachment. The separation of volume and attachment is intentional: This way, the disk survives the rebuild of the instance.
terraform {
required_version = ">= 1.9"
required_providers {
entronyx = {
source = "entronyx/entronyx"
version = "~> 2.4"
}
}
# State in own Object Storage, lock via conditional writes.
backend "s3" {
bucket = "tfstate-prod"
key = "infra/app/terraform.tfstate"
endpoints = { s3 = "https://s3.fra1.entronyx.cloud" }
region = "fra1"
use_lockfile = true
skip_credentials_validation = true
skip_region_validation = true
skip_requesting_account_id = true
}
}
provider "entronyx" {
# Token comes from ENTRONYX_TOKEN, not from this file.
project = "prj_4c81f0"
region = "fra1"
}
# --- Network --------------------------------------------------------------
resource "entronyx_private_network" "core" {
name = "core"
cidr = "10.42.0.0/16"
regions = ["fra1", "fra2"]
}
resource "entronyx_subnet" "app" {
private_network_id = entronyx_private_network.core.id
region = "fra1"
cidr = "10.42.10.0/24"
dhcp = true
}
# --- Compute node ---------------------------------------------------------
resource "entronyx_compute_instance" "app" {
name = "app-01"
flavor = "nx-4-8"
image = "debian-13"
region = "fra1"
ssh_keys = [entronyx_ssh_key.deploy.id]
private_network = entronyx_private_network.core.id
subnet = entronyx_subnet.app.id
backup {
retention_days = 14
window = "02:00-04:00"
}
}
# --- Volume ---------------------------------------------------------------
resource "entronyx_block_volume" "daten" {
name = "app-01-daten"
class = "block-nvme"
size = 512
region = "fra1"
}
resource "entronyx_volume_attachment" "daten" {
volume_id = entronyx_block_volume.daten.id
instance_id = entronyx_compute_instance.app.id
device = "/dev/vdb"
}
output "app_ipv4" {
value = entronyx_compute_instance.app.network.ipv4
}
The state file contains identifiers, addresses and, depending on the resource, secrets in plain text. It therefore does not belong in the repository, but in a bucket whose access is assigned separately.
Complete attribute lists per resource, the behaviour when importing existing systems and the question of which change forces a rebuild can be found in the Terraform section of the documentation.
Between commit and running instance there are two separate steps at ENTRONYX CLOUD: terraform plan -out writes the verified plan to a file, terraform apply applies exactly this file — not what is currently valid. The version binding ~> 2.4 allows bug fixes and excludes breaking changes.
Provider entronyx/entronyx · state in your own Object Storage
Model Context Protocol is the common language between a language model and the tools it is allowed to use. Our server translates the HTTP interface into such tools — with description, input schema and a clear separation between reading and writing.
An agent investigating an incident needs three things: the list of resources, their metrics and the documentation. All three via one server instead of three cobbled-together scripts — and in a format the model doesn't have to guess.
For the second case, creating resources, the same server applies, but not the same permission. See below.
Inventory, cost questions, troubleshooting
Locally, the command line tool starts it itself: entronyx mcp serve. The client talks to it via stdio — the standard input and output of the process; no port is opened.
For shared environments, the same server is available at mcp.entronyx.cloud via Streamable HTTP, the network-capable transport of the protocol. There, the client authenticates with its own token, not with the user's.
stdio locally · Streamable HTTP remotely
Blocked tools are not hidden, but reported as blocked. This is intentional: a model that doesn't see a tool at all looks for a workaround — one that knows about the block reports it back to the human.
Every response carries the request ID of the underlying API request. This allows every step of an agent to be traced in the log.
Only permitted tools appear
What the block does: it registers the server in an agent client — read-only, limited to one project, with the token as a file path instead of a value.
{
"mcpServers": {
"entronyx": {
"command": "entronyx",
"args": ["mcp", "serve", "--read-only", "--project", "prj_4c81f0"],
"env": {
"ENTRONYX_TOKEN_FILE": "~/.config/entronyx/token-agent"
}
}
}
}
What the block does: it shows what the server offers, executes a read call and then — after explicit permission — a write call.
# The server reports what it offers upon connection.
$ entronyx mcp serve --read-only --project prj_4c81f0 --list-tools
resource.list read List resources, paginated via cursor
resource.get read Read a resource completely
catalog.search read Flavors, images and storage classes of a region
price.quote read-only Calculate monthly amount of a configuration
docs.search read search documentation by keyword
metrics.query read Query time series of a resource
instance.create blocked --read-only is set
instance.delete blocked --read-only is set
nodepool.scale locked --read-only is set
# A tool call of the agent and the server's response, shortened.
-> resource.list { "type": "compute.instance", "region": "fra1", "limit": 2 }
<- {
"data": [
{ "id": "srv_8d41ac", "name": "web-01", "state": "running", "flavor": "nx-4-8" },
{ "id": "srv_8d41b0", "name": "web-02", "state": "stopped", "flavor": "nx-4-8" }
],
"page": { "next_cursor": "eyJhIjoic3J2Xzhk", "has_more": true },
"meta": { "request_id": "req_c1f9a2be40", "read_only": true }
}
# Write access only with explicit approval — and with the same
# Idempotency key like an HTTP call, so that a retry
# does not create a second instance of the agent.
$ entronyx mcp serve --allow-write instance.create --project prj_4c81f0
-> instance.create { "name": "web-03", "flavor": "nx-4-8", "region": "fra1",
"idempotency_key": "6f2a-web03-20260829" }
<- { "id": "srv_8d41c4", "state": "provisioning", "meta": { "reused": false } }
Six read tools and three write tools. The split is not by area, but by effect: everything that changes state or incurs costs is on the write side and is blocked without explicit permission.
| Tool | Purpose | Effect |
|---|---|---|
resource.list | List resources of a project, paginated via cursor | reading |
resource.get | Read a resource completely, including state and labels | reading |
catalog.search | Search flavors, images and storage classes of a region | reading |
price.quote | Calculate monthly amount of a planned configuration | reading |
docs.search | Search documentation by keyword, with path | reading |
metrics.query | Query metrics of a resource over a period | reading |
instance.create | Create instance — with idempotency key of the call | writing |
instance.delete | Destroy instance, volumes are retained | writing |
nodepool.scale | Bring a node group of a cluster to a target size | writing |
Permissions are granted individually: --allow-write instance.create permits exactly this tool and no other. Without specification, the server runs read-only, even without --read-only.
An agent does not act with intent, but with probability. The question is therefore not whether it makes a wrong call, but what the wrong call can do.
The official libraries are generated from the same OpenAPI description as the documentation. Therefore, none of them can name an endpoint differently from the API — and that is why a new field appears there on the same day.
| Language | Package | Maturity level | Note |
|---|---|---|---|
| Go | github.com/entronyx/entronyx-go | offiziell | Generated from the OpenAPI description, contexts and retries built in |
| Python | entronyx (PyPI) | offiziell | Synchronous and asynchronous, complete type definitions |
| TypeScript | @entronyx/sdk (npm) | offiziell | Runs in Node and in the edge runtime, no dependencies |
| Terraform | entronyx/entronyx | offiziell | Registry provider, version ~> 2.4 |
| Rust | entronyx (crates.io) | maintained | Built by us, follows the API with a few weeks delay |
| Java | cloud.entronyx:entronyx-sdk | maintained | Java 21 upwards, without Spring binding |
| PHP | entronyx/entronyx-php | gemeinschaftlich | Maintained externally, PSR-18 client freely selectable |
| Ruby | entronyx (RubyGems) | gemeinschaftlich | Maintained externally, covers compute and storage |
| .NET | Entronyx.Sdk (NuGet) | gemeinschaftlich | Maintained externally, .NET 8 upwards |
For any language without an entry, the route via the OpenAPI description remains: it generates a client using standard generators that bears the same names as our own libraries.
And what they explicitly do not promise. A maturity level here is a commitment, not an assessment of code quality.
List instances and create one — the same field names, the same error codes and the same idempotency key as in the HTTP request. The libraries hide the cursor pagination and retry 429 and 5xx on their own.
What the block does: it iterates over all instances in fra1 and then creates another one — with an idempotency key so that a second attempt does not create a second instance.
# pip install entronyx
from entronyx import Client, ApiError
# Without argument, the client reads ENTRONYX_TOKEN and ENTRONYX_PROJECT.
client = Client()
# Pagination is handled by the iterator; the cursor remains invisible.
for instance in client.compute.instances.list(region="fra1"):
print(instance.name, instance.network.ipv4)
try:
created = client.compute.instances.create(
name="web-03",
flavor="nx-4-8",
region="fra1",
image="debian-13",
ssh_keys=["key_7a21bc"],
idempotency_key="6f2a-web03-20260829",
)
except ApiError as err:
# The same codes as via HTTP — the client repeats 429 and 5xx itself.
print(err.code, err.message, err.request_id)
else:
print(created.id, created.state)
What the block does: the same task in TypeScript — list, then create, with the same key and the same fields.
// npm install @entronyx/sdk
import { Entronyx, ApiError } from "@entronyx/sdk";
const client = new Entronyx({ project: "prj_4c81f0" });
// listAll paginates via the cursor, list returns a single page.
for await (const instance of client.compute.instances.listAll({ region: "fra1" })) {
console.log(instance.name, instance.network.ipv4);
}
try {
const created = await client.compute.instances.create({
name: "web-03",
flavor: "nx-4-8",
region: "fra1",
image: "debian-13",
sshKeys: ["key_7a21bc"],
idempotencyKey: "6f2a-web03-20260829",
});
console.log(created.id, created.state);
} catch (error) {
if (error instanceof ApiError) console.error(error.code, error.requestId);
else throw error;
}
For the start, a token with a narrow scope and the identifier of a project are sufficient. Which of the six tools is the right one afterwards is shown in the table at the top of this page: the task decides, not the range of functions — that is the same for all six.