# Tencent Cloud > Operate or inspect any Tencent Cloud resource through TC3, API 3.0 v1, legacy qcloud API 2017, COS/CLS signed HTTPS, TCR Enterprise Docker/OCI Registry HTTP, or internally connected ASR/virtual-number/SOE/speech-translation/voice-conversion/MPS recognition/MPS TTS/standard realtime TTS/streaming-text TTS/large-model podcast WSS in cloud-skills-mcp. Use for Tencent Cloud, CVM, Lighthouse, COS, CLS, TCR, container images, CDB, VPC, CAM, TKE, CloudBase, ASR, human detection, oral evaluation, translation, voice conversion, MPS, TTS, podcast, or any documented Tencent Cloud API. - Skill: `tttboy123/tencent-cloud` (Agent Skill, multi-file: 3 files) - Install (CLI): `npx skillmds@latest add tttboy123/tencent-cloud` - Raw SKILL.md: https://api.skillmd.com/api/skills/tttboy123/tencent-cloud/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: tttboy123 (https://skillmd.com/u/tttboy123) - Updated: 2026-09-22 - Page: https://skillmd.com/skills/tttboy123/tencent-cloud --- # Tencent Cloud Use the unified MCP gateway for API 3.0 product actions, still-active qcloud API 2017 actions, COS REST operations, legacy CLS data-plane operations, Enterprise TCR Registry operations, finite ASR/virtual-number/speech-translation/voice-conversion/MPS recognition streams, and MPS streaming TTS. It calculates all signatures in-process, derives only short-lived TCR Registry credentials internally, opens WSS connections internally, and never executes TCCLI, Docker, a credential helper, or returns signed connection URLs. ## Workflow 1. Call `cloud_provider_status` with `provider="tencent"`; treat `available` as HTTP adapter readiness and `credential_status=unverified` as pending live authentication. 2. Use `tencent_api_discover` for official API 3.0/TC3/qcloud/COS/CLS/TCR/ASR/speech-translation/voice-conversion/MPS recognition/TTS WSS references, then verify endpoint, version, action, region, parameters, and payload format in the product API reference. 3. Use `tencent_api_read` only for actions classified as read-only (`Describe*`, `List*`, `Get*`, `Query*`, and similar). 4. For other actions, obtain explicit human approval for the account, region, resources, action, and effect; then use `tencent_api_mutate(force=true)`. 5. Secret-resource operations require the separate sensitive gate. STS role/session credentials, SecretId creation, login tokens, and other credential issuance/export actions are never exposed by the gateway. 6. Do not pass endpoints, proxies, TLS-disable flags, SecretId, SecretKey, session tokens, or authorization data as arguments. ## MCP arguments - `auth_scheme`: `tc3` (default and recommended) for API 3.0 JSON/multipart calls; `tc1|tc1-sha256` for the still-documented API 3.0 v1 GET/query or `application/x-www-form-urlencoded` protocol; `qcloud|qcloud-sha256` for still-running legacy product endpoints at `*.api.qcloud.com/v2/index.php`; `cos` for COS REST data plane; `cls` for the still-published legacy CLS data-plane q-sign protocol; `tcr-registry` for Enterprise TCR Docker/OCI Registry V2 with an internal CAM temporary credential; `asr-ws` for realtime ASR; `virtual-number-ws` for virtual-number human detection; `soe-ws` for realtime oral evaluation; `speech-translate-ws` for realtime speech translation with optional synthesized audio; `voice-convert-ws` for realtime PCM voice conversion; `mps-ws` for MPS private-audio recognition/translation; `mps-tts-ws` for MPS streaming speech synthesis; `tts-ws` for standard realtime speech synthesis; `tts-stream-ws` for incremental streaming-text speech synthesis; `podcast-ws` for large-model podcast generation. - `service`: TC3 signing/product code such as `cvm`, `lighthouse`, `cdb`, or `cam`; use `cos` for COS, exact `cls` for the CLS q-sign entrypoint, and exact `tcr` for `tcr-registry`. - `operation`: exact action, such as `DescribeInstances`, used by TC3 headers and read/write classification. - `api_version`: required for TC3, such as `2017-03-12`. - `region`: region context; TC3 sends it as `X-TC-Region` when present. - `method` and `url`: exact official Tencent Cloud HTTPS request. - `parameters`: optional scalar query parameters; API 3.0 normally uses a JSON `body`. - `headers`, `body`, `body_file`: non-credential request data. - `response_file`: new approved-root file for COS objects, exports, or other large responses. Use the documented single `Range` above the configured per-call limit; existing files are never overwritten. - `registry_instance_id`: required only for `tcr-registry`; exact Enterprise instance ID used in the internal `CreateInstanceToken(TokenType=temp)` request, never a Registry credential. Example read: `tencent_api_read(auth_scheme="tc3", service="cvm", operation="DescribeInstances", api_version="2017-03-12", region="ap-shanghai", method="POST", url="https://cvm.tencentcloudapi.com/", body={"Limit":20})`. V1 read: `tencent_api_read(auth_scheme="tc1", service="cvm", operation="DescribeInstances", api_version="2017-03-12", region="ap-shanghai", method="GET", url="https://cvm.tencentcloudapi.com/", parameters={"Limit":20})`. For a form POST, use `tc1` or `tc1-sha256`, set `Content-Type: application/x-www-form-urlencoded`, and pass the form string as `body`. The adapter signs raw decoded values in ASCII name order, RFC3986-encodes the transmitted values, and injects Action, Version, Timestamp, a cryptographically random positive Nonce, SecretId, optional CAM Token, SignatureMethod, and Signature. Those controlled parameters cannot be supplied by MCP callers. Legacy Direct Connect read: `tencent_api_read(auth_scheme="qcloud", service="dc", operation="DescribeDirectConnects", region="ap-guangzhou", method="GET", url="https://dc.api.qcloud.com/v2/index.php", parameters={"offset":0,"limit":20})`. Use the exact legacy product endpoint documented for the action. The adapter accepts only a product subdomain ending in `.api.qcloud.com` and the fixed `/v2/index.php` path, signs that path, and injects Action, Timestamp, Nonce, SecretId, `SignatureMethod`, optional CAM Token, and Signature. Unlike API 3.0 v1, this family does not inject Version. Use `qcloud-sha256` when the product supports HmacSHA256; `qcloud` emits the documented HmacSHA1 method. Legacy CLS data-plane read: `tencent_api_read(auth_scheme="cls", service="cls", operation="GetLogset", method="GET", url="https://ap-shanghai.cls.tencentcs.com/logset", parameters={"logset_id":""})`. New CLS management features use API 3.0 `tc3`; use `cls` only where the CLS product documentation publishes the older q-sign HTTP protocol. The adapter accepts exact `.cls.tencentcs.com` public or `.cls.tencentyun.com` same-region internal endpoints, signs method/path/query and request headers for 15 minutes, and adds an operator CAM temporary token only as internal `X-Cls-Token`. Writes and log uploads use the mutation tool; callers cannot provide authorization, token, or q-sign fields. TCR Enterprise Registry read: `tencent_api_read(auth_scheme="tcr-registry", service="tcr", operation="ListTags", region="ap-guangzhou", registry_instance_id="tcr-xxxxxxxx", method="GET", url="https://.tencentcloudcr.com/v2/team/app/tags/list", parameters={"n":20})`. Use the exact default public or `-vpc` endpoint; first operator-pin an official custom domain in `CLOUD_SKILLS_TENCENT_ALLOWED_ENDPOINT_HOSTS`. The server signs the fixed `tcr/2019-09-24 CreateInstanceToken` TC3 request with `TokenType=temp`, rejects any long-term TokenId, keeps the returned username/JWT internal, and sends only their Basic form to Registry V2. Manifest/blob upload, delete, or mount uses `tencent_api_mutate(force=true)`. Do not pass `Authorization`, `/v2/token`, login credentials, or personal-edition domains. Personal Edition and its enterprise-compatibility mode use a separately configured personal username/password and are outside this CAM AKSK/IAM-only entrypoint. ASR WebSocket read: `tencent_api_read(auth_scheme="asr-ws", service="asr", operation="RecognizeStream", method="GET", url="wss://asr.cloud.tencent.com/asr/v2/", parameters={"engine_model_type":"16k_zh","voice_format":1}, body_file="/audio.pcm", response_file="/asr.ndjson")`. The server generates a new voice ID and bounded positive nonce, injects timestamp/expiry/SecretId/signature and the official lowercase `token` when the operator credential tuple contains one, performs the HTTP Upgrade internally, streams binary frames at the documented default 200ms cadence, sends the final `{"type":"end"}` text frame, and records text responses as bounded NDJSON. It never exposes the signed URL. PCM defaults to 6400-byte 16k or 3200-byte 8k frames; use `stream_chunk_bytes` for compressed or complete-m4a fragments and `stream_interval_ms` only when the media timing requires it. Virtual-number human detection: `tencent_api_read(auth_scheme="virtual-number-ws", service="asr", operation="RecognizeHumanStream", method="GET", url="wss://asr.cloud.tencent.com/asr/virtual_number/v1/", parameters={"voice_format":1,"wait_time":30}, body_file="/call.pcm", response_file="/human.ndjson")`. For 8k PCM, the adapter defaults to 640-byte frames every 40ms, stops on the documented human-answer/final result, and keeps all HMAC-SHA1 query credentials and signatures internal. Realtime oral evaluation: `tencent_api_read(auth_scheme="soe-ws", service="soe", operation="EvaluateSpeechStream", method="GET", url="wss://soe.cloud.tencent.com/soe/api/", parameters={"server_engine_type":"16k_en","eval_mode":1,"score_coeff":1.5,"ref_text":"hello","voice_format":0}, body_file="/speech.pcm", response_file="/soe.ndjson")`. The adapter validates the documented engine/evaluation/score/mode fields, defaults realtime PCM to 1280-byte frames every 40ms, and writes bounded intermediate and final evaluation JSON without exposing reference text or the signed URL in audit. With `rec_mode=1`, omit stream controls; the adapter sends the approved recording as one frame as required by the official protocol. Realtime speech translation: `tencent_api_read(auth_scheme="speech-translate-ws", service="asr", operation="TranslateStream", method="GET", url="wss://asr.cloud.tencent.com/asr/speech_translate/", parameters={"source":"zh","target":"en","trans_model":"hunyuan-translation-lite","voice_format":1,"enable_tts":1,"codec":"mp3","sample_rate":16000}, body_file="/audio.pcm", response_file="/translated.mp3")`. The adapter signs and streams audio like the official protocol, sends the final `{"type":"end"}`, and waits for `final=1` when TTS is disabled or `final=2` when enabled. Without TTS, JSON responses are bounded NDJSON and `response_file` is optional. With TTS, `response_file` is required and contains only atomically published binary audio; MCP output contains the JSON messages plus audio metadata. Never disconnect at `final=1` when `enable_tts=1`. Realtime voice conversion: `tencent_api_read(auth_scheme="voice-convert-ws", service="vc", operation="ConvertVoice", method="GET", url="wss://tts.cloud.tencent.com/vc_stream/", parameters={"VoiceType":301005,"SampleRate":16000,"Codec":"pcm","Volume":0}, body_file="/source.pcm", response_file="/converted.pcm")`. Input must be 16kHz, 16-bit, mono PCM. The adapter generates `VoiceId`, injects the controlled SecretId/timestamps/expiry/End/signature query, defaults to 3200-byte frames every 100ms, and encodes each upload and download as the documented four-byte big-endian JSON length plus JSON plus PCM. It publishes converted audio only after matching `VoiceId`, `Code=0`, and `Final=1`. MPS WebSocket read: `tencent_api_read(auth_scheme="mps-ws", service="mps", operation="RecognizeStream", method="GET", url="wss://mps.cloud.tencent.com/wss/v1/", parameters={"asrDst":"zh","fragmentNotify":0,"timeoutSec":10}, body_file="/audio.pcm", response_file="/mps.ndjson", stream_user_id="speaker-1", stream_format=1)`. Use `asrDst` for recognition only, or omit it and provide both `transSrc` and `transDst` for recognition plus translation. The adapter generates the required 10-digit nonce, applies the MPS-specific TC3 canonical `post` signature internally, wraps PCM in the documented network-byte-order binary frame, marks the final frame `IsEnd=1`, and finishes only on `ProcessEof`. `stream_format=1` is 16 kHz s16 mono and `2` is 8 kHz; the default 40ms frames are 1280 and 640 bytes respectively. `timeoutSec` is optional and retains the official 120-second default; finite-file callers should normally set a bounded 1–300 second value. MPS TTS read: `tencent_api_read(auth_scheme="mps-tts-ws", service="mps", operation="SynthesizeSpeech", method="GET", url="wss://mps.cloud.tencent.com/tts/v1/", parameters={"voiceId":"","format":"mp3","sampleRate":22050,"language":"zh","timeoutSec":30}, body=["first text","second text"], response_file="/speech.mp3")`. The body is one non-empty string or 1–256 string segments; each segment is at most 5000 Unicode characters. The adapter signs the MPS TTS-specific TC3 canonical request including `sha256("")`, waits for negotiated format/sample rate, sends each text segment plus the final empty `Final=true` message, writes binary audio only to the approved new file, and atomically publishes it only after `ProcessEof Code=0`. The signed URL and text never appear in audit events. Standard realtime TTS read: `tencent_api_read(auth_scheme="tts-ws", service="tts", operation="SynthesizeSpeech", method="GET", url="wss://tts.cloud.tencent.com/stream_ws", parameters={"AppId":1300460000,"Codec":"mp3","VoiceType":101001,"SampleRate":16000,"EnableSubtitle":true}, body="hello", response_file="/speech.mp3")`. `AppId` is a public account identifier, not a credential. The adapter generates `SessionId`, timestamp and expiry, signs the raw sorted query with HMAC-SHA1, URL-encodes it only after signing, and performs the Upgrade internally. The body must be one UTF-8 string: pure ASCII is limited to 1800 characters and any non-ASCII text is conservatively limited to 600. It returns status/subtitle JSON as `messages`, writes binary audio only to the approved new file, and atomically publishes only after matching session/request IDs and `final=1` with code 0. Streaming-text TTS read: `tencent_api_read(auth_scheme="tts-stream-ws", service="tts", operation="SynthesizeSpeechStream", method="GET", url="wss://tts.cloud.tencent.com/stream_wsv2", parameters={"AppId":1300460000,"Codec":"mp3","VoiceType":101001,"SampleRate":16000}, body=["first generated text, ","second text!"], response_file="/speech.mp3")`. The body is one string or 1–1024 UTF-8 fragments with at most 10000 Unicode characters in the session; the protocol does not support SSML. The adapter signs `TextToStreamAudioWSv2`, waits for `ready=1`, sends each fragment with a unique message ID and `ACTION_SYNTHESIS`, then `ACTION_COMPLETE`. JSON events return as `messages`; binary audio is atomically published only after matching session/request IDs and `final=1`. Code 10009 is the documented ignorable timeout notification; other nonzero codes fail without publishing partial audio. Large-model podcast read: `tencent_api_read(auth_scheme="podcast-ws", service="tts", operation="TextToPodcastStreamAudioWS", method="GET", url="wss://tts.cloud.tencent.com/stream_ws_podcast", parameters={"AppId":1300466766,"SampleRate":24000,"Codec":"pcm","SpeakerNumber":2,"Speaker1Voice":"zixin","Speaker2Voice":"acan","EnableWebSearch":false}, body=[{"ObjectType":"TYPE_TEXT","Text":"Create a cloud architecture podcast."},{"ObjectType":"TYPE_TEXT","Text":"Compare control and data planes."}], response_file="/podcast.pcm")`. The body is one InputObject or 1–10 same-type objects: `TYPE_TEXT` totals at most 10000 Unicode characters, while `TYPE_URL` and `TYPE_FILE` require non-IP, non-localhost HTTPS DNS hostnames; files use `pdf|txt|docx|md`. The adapter signs the official `TextToPodcastStreamAudioWS` HMAC-SHA1 handshake, waits for READY, sends JSON-encoded InputObjects with unique message IDs, and atomically publishes 24kHz mono PCM only after FINAL. Scripts, token usage, heartbeat and code 10009 notifications remain in structured `messages`. ## Credentials Use `TENCENTCLOUD_SECRET_ID` / `TENCENTCLOUD_SECRET_KEY` in the MCP server environment. Temporary CAM/STS credentials also use `TENCENTCLOUD_SESSION_TOKEN` or `TENCENTCLOUD_TOKEN` for HTTP schemes and `asr-ws`; the realtime ASR SDK documents and signs the lowercase `token` field. The virtual-number, SOE, speech translation, voice conversion, MPS, TTS and podcast WebSocket documents specify AppID plus SecretId/SecretKey but no temporary Token field, so `virtual-number-ws`, `soe-ws`, `speech-translate-ws`, `voice-convert-ws`, `mps-ws`, `mps-tts-ws`, `tts-ws`, `tts-stream-ws`, and `podcast-ws` fail closed when a CAM session token is configured. Never pass credentials in MCP inputs. Read [references/official-docs.md](references/official-docs.md) for API 3.0 v1/v3, legacy qcloud API 2017, COS/CLS/TCR, ASR/speech-translation/voice-conversion/MPS WSS, and CAM credentials. Do not confuse the implemented CAM-authenticated ASR WebSocket with the newer TRTC realtime-ASR WebSocket. The latter requires `SdkAppId` plus a `UserSig` derived from the TRTC application SDK secret key, not CAM AKSK, so it is credential-bound under this Skill's AKSK/IAM-only entrypoint contract.