Tencent Cloud

Tencent Cloud

Use the unified MCP gateway for API 3.0 product actions, still-active qcloud API 2017 actions, COS REST operations, legacy CLS data-plane operations, Enterprise TCR Registry operations, finite ASR/virtual-number/speech-translation/voice-conversion/MPS recognition streams, and MPS streaming TTS. It calculates all signatures in-process, derives only short-lived TCR Registry credentials internally, opens WSS connections internally, and never executes TCCLI, Docker, a credential helper, or returns signed connection URLs.

Workflow

1. Call cloud_provider_status with provider="tencent"; treat available as HTTP adapter readiness and credential_status=unverified as pending live authentication.
2. Use tencent_api_discover for official API 3.0/TC3/qcloud/COS/CLS/TCR/ASR/speech-translation/voice-conversion/MPS recognition/TTS WSS references, then verify endpoint, version, action, region, parameters, and payload format in the product API reference.
3. Use tencent_api_read only for actions classified as read-only (Describe*, List*, Get*, Query*, and similar).
4. For other actions, obtain explicit human approval for the account, region, resources, action, and effect; then use tencent_api_mutate(force=true).
5. Secret-resource operations require the separate sensitive gate. STS role/session credentials, SecretId creation, login tokens, and other credential issuance/export actions are never exposed by the gateway.
6. Do not pass endpoints, proxies, TLS-disable flags, SecretId, SecretKey, session tokens, or authorization data as arguments.

MCP arguments

• auth_scheme: tc3 (default and recommended) for API 3.0 JSON/multipart calls; tc1|tc1-sha256 for the still-documented API 3.0 v1 GET/query or application/x-www-form-urlencoded protocol; qcloud|qcloud-sha256 for still-running legacy product endpoints at *.api.qcloud.com/v2/index.php; cos for COS REST data plane; cls for the still-published legacy CLS data-plane q-sign protocol; tcr-registry for Enterprise TCR Docker/OCI Registry V2 with an internal CAM temporary credential; asr-ws for realtime ASR; virtual-number-ws for virtual-number human detection; soe-ws for realtime oral evaluation; speech-translate-ws for realtime speech translation with optional synthesized audio; voice-convert-ws for realtime PCM voice conversion; mps-ws for MPS private-audio recognition/translation; mps-tts-ws for MPS streaming speech synthesis; tts-ws for standard realtime speech synthesis; tts-stream-ws for incremental streaming-text speech synthesis; podcast-ws for large-model podcast generation.
• service: TC3 signing/product code such as cvm, lighthouse, cdb, or cam; use cos for COS, exact cls for the CLS q-sign entrypoint, and exact tcr for tcr-registry.
• operation: exact action, such as DescribeInstances, used by TC3 headers and read/write classification.
• api_version: required for TC3, such as 2017-03-12.
• region: region context; TC3 sends it as X-TC-Region when present.
• method and url: exact official Tencent Cloud HTTPS request.
• parameters: optional scalar query parameters; API 3.0 normally uses a JSON body.
• headers, body, body_file: non-credential request data.
• response_file: new approved-root file for COS objects, exports, or other large responses. Use the documented single Range above the configured per-call limit; existing files are never overwritten.
• registry_instance_id: required only for tcr-registry; exact Enterprise instance ID used in the internal CreateInstanceToken(TokenType=temp) request, never a Registry credential.

Example read: tencent_api_read(auth_scheme="tc3", service="cvm", operation="DescribeInstances", api_version="2017-03-12", region="ap-shanghai", method="POST", url="https://cvm.tencentcloudapi.com/", body={"Limit":20}).

V1 read: tencent_api_read(auth_scheme="tc1", service="cvm", operation="DescribeInstances", api_version="2017-03-12", region="ap-shanghai", method="GET", url="https://cvm.tencentcloudapi.com/", parameters={"Limit":20}). For a form POST, use tc1 or tc1-sha256, set Content-Type: application/x-www-form-urlencoded, and pass the form string as body. The adapter signs raw decoded values in ASCII name order, RFC3986-encodes the transmitted values, and injects Action, Version, Timestamp, a cryptographically random positive Nonce, SecretId, optional CAM Token, SignatureMethod, and Signature. Those controlled parameters cannot be supplied by MCP callers.

Legacy Direct Connect read: tencent_api_read(auth_scheme="qcloud", service="dc", operation="DescribeDirectConnects", region="ap-guangzhou", method="GET", url="https://dc.api.qcloud.com/v2/index.php", parameters={"offset":0,"limit":20}). Use the exact legacy product endpoint documented for the action. The adapter accepts only a product subdomain ending in .api.qcloud.com and the fixed /v2/index.php path, signs that path, and injects Action, Timestamp, Nonce, SecretId, SignatureMethod, optional CAM Token, and Signature. Unlike API 3.0 v1, this family does not inject Version. Use qcloud-sha256 when the product supports HmacSHA256; qcloud emits the documented HmacSHA1 method.

Legacy CLS data-plane read: tencent_api_read(auth_scheme="cls", service="cls", operation="GetLogset", method="GET", url="https://ap-shanghai.cls.tencentcs.com/logset", parameters={"logset_id":"<id>"}). New CLS management features use API 3.0 tc3; use cls only where the CLS product documentation publishes the older q-sign HTTP protocol. The adapter accepts exact <region>.cls.tencentcs.com public or <region>.cls.tencentyun.com same-region internal endpoints, signs method/path/query and request headers for 15 minutes, and adds an operator CAM temporary token only as internal X-Cls-Token. Writes and log uploads use the mutation tool; callers cannot provide authorization, token, or q-sign fields.

TCR Enterprise Registry read: tencent_api_read(auth_scheme="tcr-registry", service="tcr", operation="ListTags", region="ap-guangzhou", registry_instance_id="tcr-xxxxxxxx", method="GET", url="https://<instance>.tencentcloudcr.com/v2/team/app/tags/list", parameters={"n":20}). Use the exact default public or -vpc endpoint; first operator-pin an official custom domain in CLOUD_SKILLS_TENCENT_ALLOWED_ENDPOINT_HOSTS. The server signs the fixed tcr/2019-09-24 CreateInstanceToken TC3 request with TokenType=temp, rejects any long-term TokenId, keeps the returned username/JWT internal, and sends only their Basic form to Registry V2. Manifest/blob upload, delete, or mount uses tencent_api_mutate(force=true). Do not pass Authorization, /v2/token, login credentials, or personal-edition domains. Personal Edition and its enterprise-compatibility mode use a separately configured personal username/password and are outside this CAM AKSK/IAM-only entrypoint.

ASR WebSocket read: tencent_api_read(auth_scheme="asr-ws", service="asr", operation="RecognizeStream", method="GET", url="wss://asr.cloud.tencent.com/asr/v2/<appid>", parameters={"engine_model_type":"16k_zh","voice_format":1}, body_file="<approved-root>/audio.pcm", response_file="<approved-root>/asr.ndjson"). The server generates a new voice ID and bounded positive nonce, injects timestamp/expiry/SecretId/signature and the official lowercase token when the operator credential tuple contains one, performs the HTTP Upgrade internally, streams binary frames at the documented default 200ms cadence, sends the final {"type":"end"} text frame, and records text responses as bounded NDJSON. It never exposes the signed URL. PCM defaults to 6400-byte 16k or 3200-byte 8k frames; use stream_chunk_bytes for compressed or complete-m4a fragments and stream_interval_ms only when the media timing requires it.

Virtual-number human detection: tencent_api_read(auth_scheme="virtual-number-ws", service="asr", operation="RecognizeHumanStream", method="GET", url="wss://asr.cloud.tencent.com/asr/virtual_number/v1/<appid>", parameters={"voice_format":1,"wait_time":30}, body_file="<approved-root>/call.pcm", response_file="<approved-root>/human.ndjson"). For 8k PCM, the adapter defaults to 640-byte frames every 40ms, stops on the documented human-answer/final result, and keeps all HMAC-SHA1 query credentials and signatures internal.

Realtime oral evaluation: tencent_api_read(auth_scheme="soe-ws", service="soe", operation="EvaluateSpeechStream", method="GET", url="wss://soe.cloud.tencent.com/soe/api/<appid>", parameters={"server_engine_type":"16k_en","eval_mode":1,"score_coeff":1.5,"ref_text":"hello","voice_format":0}, body_file="<approved-root>/speech.pcm", response_file="<approved-root>/soe.ndjson"). The adapter validates the documented engine/evaluation/score/mode fields, defaults realtime PCM to 1280-byte frames every 40ms, and writes bounded intermediate and final evaluation JSON without exposing reference text or the signed URL in audit. With rec_mode=1, omit stream controls; the adapter sends the approved recording as one frame as required by the official protocol.

Realtime speech translation: tencent_api_read(auth_scheme="speech-translate-ws", service="asr", operation="TranslateStream", method="GET", url="wss://asr.cloud.tencent.com/asr/speech_translate/<appid>", parameters={"source":"zh","target":"en","trans_model":"hunyuan-translation-lite","voice_format":1,"enable_tts":1,"codec":"mp3","sample_rate":16000}, body_file="<approved-root>/audio.pcm", response_file="<approved-root>/translated.mp3"). The adapter signs and streams audio like the official protocol, sends the final {"type":"end"}, and waits for final=1 when TTS is disabled or final=2 when enabled. Without TTS, JSON responses are bounded NDJSON and response_file is optional. With TTS, response_file is required and contains only atomically published binary audio; MCP output contains the JSON messages plus audio metadata. Never disconnect at final=1 when enable_tts=1.

Realtime voice conversion: tencent_api_read(auth_scheme="voice-convert-ws", service="vc", operation="ConvertVoice", method="GET", url="wss://tts.cloud.tencent.com/vc_stream/<appid>", parameters={"VoiceType":301005,"SampleRate":16000,"Codec":"pcm","Volume":0}, body_file="<approved-root>/source.pcm", response_file="<approved-root>/converted.pcm"). Input must be 16kHz, 16-bit, mono PCM. The adapter generates VoiceId, injects the controlled SecretId/timestamps/expiry/End/signature query, defaults to 3200-byte frames every 100ms, and encodes each upload and download as the documented four-byte big-endian JSON length plus JSON plus PCM. It publishes converted audio only after matching VoiceId, Code=0, and Final=1.

MPS WebSocket read: tencent_api_read(auth_scheme="mps-ws", service="mps", operation="RecognizeStream", method="GET", url="wss://mps.cloud.tencent.com/wss/v1/<appid>", parameters={"asrDst":"zh","fragmentNotify":0,"timeoutSec":10}, body_file="<approved-root>/audio.pcm", response_file="<approved-root>/mps.ndjson", stream_user_id="speaker-1", stream_format=1). Use asrDst for recognition only, or omit it and provide both transSrc and transDst for recognition plus translation. The adapter generates the required 10-digit nonce, applies the MPS-specific TC3 canonical post signature internally, wraps PCM in the documented network-byte-order binary frame, marks the final frame IsEnd=1, and finishes only on ProcessEof. stream_format=1 is 16 kHz s16 mono and 2 is 8 kHz; the default 40ms frames are 1280 and 640 bytes respectively. timeoutSec is optional and retains the official 120-second default; finite-file callers should normally set a bounded 1–300 second value.

MPS TTS read: tencent_api_read(auth_scheme="mps-tts-ws", service="mps", operation="SynthesizeSpeech", method="GET", url="wss://mps.cloud.tencent.com/tts/v1/<appid>", parameters={"voiceId":"<voice-id>","format":"mp3","sampleRate":22050,"language":"zh","timeoutSec":30}, body=["first text","second text"], response_file="<approved-root>/speech.mp3"). The body is one non-empty string or 1–256 string segments; each segment is at most 5000 Unicode characters. The adapter signs the MPS TTS-specific TC3 canonical request including sha256(""), waits for negotiated format/sample rate, sends each text segment plus the final empty Final=true message, writes binary audio only to the approved new file, and atomically publishes it only after ProcessEof Code=0. The signed URL and text never appear in audit events.

Standard realtime TTS read: tencent_api_read(auth_scheme="tts-ws", service="tts", operation="SynthesizeSpeech", method="GET", url="wss://tts.cloud.tencent.com/stream_ws", parameters={"AppId":1300460000,"Codec":"mp3","VoiceType":101001,"SampleRate":16000,"EnableSubtitle":true}, body="hello", response_file="<approved-root>/speech.mp3"). AppId is a public account identifier, not a credential. The adapter generates SessionId, timestamp and expiry, signs the raw sorted query with HMAC-SHA1, URL-encodes it only after signing, and performs the Upgrade internally. The body must be one UTF-8 string: pure ASCII is limited to 1800 characters and any non-ASCII text is conservatively limited to 600. It returns status/subtitle JSON as messages, writes binary audio only to the approved new file, and atomically publishes only after matching session/request IDs and final=1 with code 0.

Streaming-text TTS read: tencent_api_read(auth_scheme="tts-stream-ws", service="tts", operation="SynthesizeSpeechStream", method="GET", url="wss://tts.cloud.tencent.com/stream_wsv2", parameters={"AppId":1300460000,"Codec":"mp3","VoiceType":101001,"SampleRate":16000}, body=["first generated text, ","second text!"], response_file="<approved-root>/speech.mp3"). The body is one string or 1–1024 UTF-8 fragments with at most 10000 Unicode characters in the session; the protocol does not support SSML. The adapter signs TextToStreamAudioWSv2, waits for ready=1, sends each fragment with a unique message ID and ACTION_SYNTHESIS, then ACTION_COMPLETE. JSON events return as messages; binary audio is atomically published only after matching session/request IDs and final=1. Code 10009 is the documented ignorable timeout notification; other nonzero codes fail without publishing partial audio.

Large-model podcast read: tencent_api_read(auth_scheme="podcast-ws", service="tts", operation="TextToPodcastStreamAudioWS", method="GET", url="wss://tts.cloud.tencent.com/stream_ws_podcast", parameters={"AppId":1300466766,"SampleRate":24000,"Codec":"pcm","SpeakerNumber":2,"Speaker1Voice":"zixin","Speaker2Voice":"acan","EnableWebSearch":false}, body=[{"ObjectType":"TYPE_TEXT","Text":"Create a cloud architecture podcast."},{"ObjectType":"TYPE_TEXT","Text":"Compare control and data planes."}], response_file="<approved-root>/podcast.pcm"). The body is one InputObject or 1–10 same-type objects: TYPE_TEXT totals at most 10000 Unicode characters, while TYPE_URL and TYPE_FILE require non-IP, non-localhost HTTPS DNS hostnames; files use pdf|txt|docx|md. The adapter signs the official TextToPodcastStreamAudioWS HMAC-SHA1 handshake, waits for READY, sends JSON-encoded InputObjects with unique message IDs, and atomically publishes 24kHz mono PCM only after FINAL. Scripts, token usage, heartbeat and code 10009 notifications remain in structured messages.

Credentials

Use TENCENTCLOUD_SECRET_ID / TENCENTCLOUD_SECRET_KEY in the MCP server environment. Temporary CAM/STS credentials also use TENCENTCLOUD_SESSION_TOKEN or TENCENTCLOUD_TOKEN for HTTP schemes and asr-ws; the realtime ASR SDK documents and signs the lowercase token field. The virtual-number, SOE, speech translation, voice conversion, MPS, TTS and podcast WebSocket documents specify AppID plus SecretId/SecretKey but no temporary Token field, so virtual-number-ws, soe-ws, speech-translate-ws, voice-convert-ws, mps-ws, mps-tts-ws, tts-ws, tts-stream-ws, and podcast-ws fail closed when a CAM session token is configured. Never pass credentials in MCP inputs.

Read references/official-docs.md for API 3.0 v1/v3, legacy qcloud API 2017, COS/CLS/TCR, ASR/speech-translation/voice-conversion/MPS WSS, and CAM credentials.

Do not confuse the implemented CAM-authenticated ASR WebSocket with the newer TRTC realtime-ASR WebSocket. The latter requires SdkAppId plus a UserSig derived from the TRTC application SDK secret key, not CAM AKSK, so it is credential-bound under this Skill's AKSK/IAM-only entrypoint contract.