Alibaba Cloud STS MCP integration for AI agents.
Connect AI agents to Alibaba Cloud STS through 1 structured actions, including assume role. Review authentication, inputs, workflows, and safety guidance.
- ACTION CONTRACTS
- 1
- AUTHENTICATION
- Custom credentials
- SOURCE STATUS
- Provider-backed
CATALOG SOURCE REVIEWED AUGUST 23, 2026 / ACTION NAMES AND SCHEMAS DERIVED FROM WORKING MACHINES PROVIDER SOURCE
CAPABILITY PROFILE
What the Alibaba Cloud STS integration exposes
The Alibaba Cloud STS Agent App exposes 1 provider-backed actions for security and developer tools work. Its current contract lets an authorized agent use a connected alibaba cloud ram accesskey pair to call sts assumerole and return temporary credentials. These operations are called through Working Machines as typed capabilities rather than through browser navigation or copied UI steps.
A connection uses Custom credentials. Before execution, the agent can inspect the selected action, its required fields, declared scopes, and expected output contract. Provider credentials remain inside the Working Machines runtime; the calling agent receives the capability and its structured result, not the underlying secret.
For reliable operation, start with the narrowest action that satisfies the task, resolve stable provider identifiers before changing state, and validate the returned object or status after execution. Availability still depends on the connected Alibaba Cloud STS account, granted provider permissions, workspace policy, region, plan, and upstream API behavior.
VERIFIED ACTION SAMPLE
Real Alibaba Cloud STS capabilities.
Showing 1 of 1 actions. Risk labels are conservative signals based on operation names, not substitutes for provider documentation or runtime policy.
assume_roleREVIEWUse a connected Alibaba Cloud RAM AccessKey pair to call STS AssumeRole and return temporary credentials.
INPUTS: roleArn / roleSessionName / durationSeconds / policy
INPUT CONTRACTS
Know what the action needs before it runs.
assume_role
roleArnOPTIONAL- The Alibaba Cloud RAM role ARN to assume. Required when the connection has no saved Role ARN; otherwise the saved Role ARN is used when this field is omitted.
roleSessionNameOPTIONAL- The STS role session name.
durationSecondsOPTIONAL- The temporary credential duration in seconds. Alibaba Cloud STS accepts 900 to 43200, limited by the RAM role maximum session duration.
policyOPTIONAL- An optional inline session policy JSON string used only to narrow the temporary credential permissions.
PROVIDER-SPECIFIC WORKFLOWS
Jobs this Agent App can support
Inspect Assume Role
Use a connected Alibaba Cloud RAM AccessKey pair to call STS AssumeRole and return temporary credentials. Use this as a bounded discovery step, retain the returned identifier, and avoid expanding the read beyond the task's stated scope.
assume_roleVerify with Assume Role
Use a connected Alibaba Cloud RAM AccessKey pair to call STS AssumeRole and return temporary credentials. Compare the returned provider state with the intended outcome and preserve stable IDs or canonical links in the run record.
assume_roleSAFETY BOUNDARY
Operate Alibaba Cloud STS with explicit limits
- Authorize Alibaba Cloud STS with Custom credentials and grant only the provider access required by the selected actions.
- The current action names appear read-oriented, but returned Alibaba Cloud STS data may still be sensitive and should be minimized before it enters model context.
- Do not infer permission from catalog visibility. Workspace policy, connection identity, and upstream authorization still govern execution.
- No provider scope string is declared on the sampled actions. Verify the connected account's actual permissions in Alibaba Cloud STS rather than assuming unrestricted access.
- After a call, inspect the structured result and execution record before reporting that the Alibaba Cloud STS task completed successfully.
CONNECTION MODEL
Custom credentials
Alibaba Cloud STS uses Custom credentials. Connection requirements and availability are determined by the provider and the Working Machines deployment.
Working Machines stores provider credentials behind the execution boundary. An agent can use an authorized connection identity, but catalog discovery alone does not reveal OAuth tokens, API keys, or provider secrets.
- READ SIGNALS
- 0
- WRITE SIGNALS
- 0
- HIGH IMPACT
- 0
- REVIEW SIGNALS
- 1
EVIDENCE AND AVAILABILITY
Provider reference
Action names, input fields, authentication types, and counts on this page are generated from the Working Machines provider catalog. Provider behavior, quotas, object semantics, account eligibility, and regional availability remain governed by Alibaba Cloud STS.