Developer & CI · wired today
What can agents actually do with Pulumi?
Build, review and release state is where agents earn their keep. The Pulumi connector is one of 205 executable connectors and gives agents 3 read-only tools, with the credential held in the vault and every call receipted.
The Pulumi tool list, exactly as agents see it
whoami— Get the Pulumi Cloud identity behind this access token: login, display name, email and the organisations it belongs to with the role held in eachlist_stacks— List the Pulumi stacks this access token can see, optionally narrowed to one organisation, one project or one stack tag; returns a continuation token when more pages remainget_stack— Get one Pulumi stack by organisation, project and stack name: its current version number, tags, the UUID of the most recent update, and any operation currently in flight
Every tool above is read-only. Write surfaces ship only after live testing, and always behind approval gates.
What the Pulumi connector needs
You provide access token from your Pulumi account; Quox sends it as an API key sent as a header. The credential is stored encrypted in the vault and resolved just-in-time, so agents use it without ever seeing it.
Where to get it: Pulumi's own API documentation ↗ covers creating and scoping the credential.
How proven is this?
This connector was blind shape-proven against the real Pulumi API: every endpoint it declares answered measurably differently from a deliberately bogus control request, without any account or credential involved. It is Beta: proven against the live API surface, not yet run with a real credential.
Pulumi integration FAQ
What can Quox agents do with Pulumi?
Agents can run 3 read-only tools against Pulumi: whoami, list stacks, get stack. Every call is receipted in the evidence trail.
What does the Pulumi integration need?
You provide access token from your Pulumi account; Quox sends it as an API key sent as a header. The credential is stored encrypted in the vault and resolved just-in-time, so agents use it without ever seeing it.
Do agents see my Pulumi credentials?
No. Credentials live encrypted in the Quox vault and are resolved server-side at call time. Agents invoke tools; they never receive the underlying secret.
How proven is the Pulumi connector?
This connector was blind shape-proven against the real Pulumi API: every endpoint it declares answered measurably differently from a deliberately bogus control request, without any account or credential involved. It is Beta: proven against the live API surface, not yet run with a real credential.