What is CP-MCP?
CP-MCP is a hosted MCP server that connects Claude to your Cloudpath Enrollment System. You sign in with Google, save your Cloudpath admin credentials, and add one URL to Claude as a custom connector. From then on you can ask Claude about your Cloudpath deployment in plain language, and it works against the live Cloudpath REST API on your behalf.
It covers all three Cloudpath API surfaces — Core (admin), Tenant Portal, and Property Management — plus two extra utilities on the Core surface for minting word-list passphrases and generating branded portal images.
What can you ask Claude to do?
Section titled “What can you ask Claude to do?”Day-to-day Cloudpath admin work, asked the way you’d ask a colleague: inventory and audits, bulk changes, DPSK and passphrase seeding, and portal branding. Claude can reach anything the Cloudpath REST API exposes to your admin account. For example:
- “List the authentication servers configured on this Cloudpath.”
- “How many registration lists exist, and how many entries does each hold?”
- “Create ten memorable three-word passphrases and seed them into DPSK pool X.”
- “Generate a branded logo and favicon for this property portal and upload them.”
- “Show me the DPSK pools and which policies they’re attached to.”
Three surfaces from one connector
Section titled “Three surfaces from one connector”| Object | Cloudpath surface | Served under |
|---|---|---|
core | Core API (admin) | /admin/publicApi |
tenant | Tenant Portal API | /admin/rest/tenant |
property | Property Management API | /admin/rest/propertyMgmtPortals/{portalGuid} |
Each object exposes the same six primitives for discovering and calling
endpoints. core adds two more:
generate_passphrase for word-list PSKs and
generate_image for branded portal logos and
favicons. See The three API surfaces.
How does Claude reach the API?
Section titled “How does Claude reach the API?”Claude works against the live API through CP-MCP’s one MCP tool. It searches an index of the 175 Cloudpath operations, reads the schema for the endpoint it needs, and calls it. CP-MCP attaches your credentials server-side, and you never pick endpoints yourself. For the mechanics, see How code mode works.
Getting started
Section titled “Getting started”How your credentials are handled
Section titled “How your credentials are handled”Your Cloudpath password is encrypted at rest, decrypted only when minting a Cloudpath JWT, and never sent to Claude or included in any model context. See the Security model.