Server providing Argo CD integration for MCP clients.
Nothing to run from here
InsideOut (Riley) is installed from its publisher's own source and answers where it runs, so this marketplace is not in the path of a single call. There is no address here to send one to, and a panel that pretended otherwise would be showing you an answer we made up. Install it and call it from your own client — the Installation tab has the entry for each one.
24
tools declared
—
trust score
remote
at its publisher
—
calls last 7d
What it does
Designs, prices, and deploys AWS/GCP cloud infrastructure from plain-English requirements.
Quickstart
# 1 — add it to Claude Code
claude mcp add --scope user --transport http insideout-riley-mcp https://app.luthersystems.com/v1/insideout-mcp
# 2 — ask your agent for something these tools do
# awsinspect, awsinspect_batch, convoawait and 21 more
InsideOut (Riley) costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.
Publishernot claimed
ALAll 1 server
app.luthersystems.com1 server
1 category
Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.
Installation
Where are you running it?
Every route below installs the same thing and ends at the same approval screen. Nothing here runs on your machine and nothing runs on ours: this server answers at its publisher’s own address, and what you install is the connection straight to it.
Claude Codedeclared by this listing
This is a public server: it answers at its publisher’s own address and this marketplace is not in the path. Claude Code registers it in one command; --scope user makes it available in every project. The transport below is http, read from the address; if the publisher says otherwise, swap that one word.
claude mcp add --scope user --transport http insideout-riley-mcp https://app.luthersystems.com/v1/insideout-mcpReconnect, or start a new session, and the tools appear in the model’s tool list.
Free on mcprush, and it answers at its publisher’s own address: this marketplace is not in the path, so there is no key of ours to hold and no card to add.
What it writes
One config entry pointing straight at the publisher’s own address — this marketplace is not in the path, and nothing from this listing executes on your machine.
What you approve
24 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
INSPECTION: Inspect AWS infrastructure for a deployed project ⚠️ PREREQUISITE: This tool requires a prior deployment ATTEMPT (successful or failed). Check convostatus for hasDeployAttempt=true before calling. Works even after failed deploys to inspect orphaned resources. Inspect deployed AWS resources after a deployment attempt. Use this tool when the user asks about the status or details of
| Parameter | Type | Required | Notes |
|---|---|---|---|
| session_id | string | yes | Session ID from convoopen — pass back EXACTLY as returned, including the ?token=... suffix (format: sess_v2_*?token=*). The suffix is part of the session credential; never strip it when summarizing. T |
| service | string | yes | AWS service to query. Examples: 'ec2', 'rds', 'vpc', 's3', 'lambda', 'eks', 'ecs', 'cost-explorer'. Use action='list-actions' to discover the supported actions for a service. |
| action | string | yes | Operation on the service. Examples: 'describe-instances' (ec2), 'list-buckets' (s3), 'list-keys' (kms), 'get-cost-summary' (cost-explorer), 'list-actions' (discovery), 'list-metrics' / 'get-metrics' ( |
| filters | string | yes | Optional JSON-encoded filter object passed through to the underlying AWS API. Examples: '{"hours":6}' for metric windows, '{"days":7,"granularity":"DAILY"}' for cost queries. |
| detail | boolean | yes | When true, returns full metadata for a single resource (requires a resource ID in filters). When false (default), returns a summary. |
| raw | boolean | yes | When true, returns the unprocessed AWS API response. Escape hatch for fields the summarized response doesn't surface. |
BATCH INSPECTION: run up to 32 AWS inspect probes in one call. ⚠️ PREREQUISITE: Same as awsinspect — deploy attempt required. Check convostatus for hasDeployAttempt=true before calling. Use this when you need to check more than ~3 resources. The backend fetches Oracle credentials ONCE per batch and fans out probes against a single AWS config — for a 12-resource health check this is ~5–8× fast
| Parameter | Type | Required | Notes |
|---|---|---|---|
| session_id | string | yes | Session ID from convoopen — pass back EXACTLY as returned, including the ?token=... suffix (format: sess_v2_*?token=*). The suffix is part of the session credential; never strip it when summarizing. T |
| subs | null/array | yes | Up to 32 sub-probes, each with {service, action, filters?, detail?, raw?}. The backend fetches credentials once per batch and fans out probes in parallel (concurrency 8, 30s per-sub timeout, 60s total |
Wait for a pending response from Riley after a convoreply timeout. 🎯 USE THIS TOOL WHEN: convoreply returned a timeout error. This allows you to continue waiting for the response without resending the message. REQUIRES: - session_id: from convoopen response OPTIONAL: - message_id: if known (from convoreply timeout error) - timeout (integer): seconds to wait. For Cursor, use 50 (default). Max 5
| Parameter | Type | Required | Notes |
|---|---|---|---|
| session_id | string | yes | Session ID from convoopen — pass back EXACTLY as returned, including the ?token=... suffix (format: sess_v2_*?token=*). The suffix is part of the session credential; never strip it when summarizing. |
| message_id | string | no | Optional message ID from a convoreply timeout error. Not required for normal turn-based flow. |
| timeout | null/integer | no | Max seconds to wait. Default 50, max 55. |
INSPECTION: View a session's conversation transcript and metadata Returns the full message history (user / assistant / tool turns) plus the session's meta — workflow step, cloud, deployment status, drift state. This is the transcript-reader companion to the other read tools — combine it with: • convostatus for the live stack / config / pricing • tfruns for deployment history (apply / dest
| Parameter | Type | Required | Notes |
|---|---|---|---|
| session_id | string | yes | Session ID from convoopen — pass back EXACTLY as returned, including the ?token=... suffix (format: sess_v2_*?token=*). The suffix is part of the session credential; never strip it when summarizing. |
WORKFLOW: Step 1 of 4 - Start infrastructure design conversation Open an InsideOut V2 session and receive the assistant's intro message. The response contains a clean message from Riley (the infrastructure advisor) - display it to the user. ⚠️ Riley will ask questions - forward these to the user, DO NOT answer on their behalf. CRITICAL: This tool returns a session_id in the response metadata. You
| Parameter | Type | Required | Notes |
|---|---|---|---|
| project_context | string | no | Optional tech-stack summary so Riley can skip discovery questions (e.g. 'Next.js 14 + Postgres on AWS, ~50k MAU'). No PII, secrets, file paths, or source code — only general metadata useful to a cloud |
| source | string | no | IDE/tool identifier so the connect screen can show the right 'Open {IDE}' button. Use lowercase: 'claude-code', 'codex', 'antigravity', 'kiro', 'cursor', 'vscode', 'windsurf', 'zed', 'aider', 'copilot |
| github_username | string | no | GitHub username used for deploy commit attribution; pre-fills the GitHub username field on the connect screen. |
WORKFLOW: Step 2 of 4 - Continue infrastructure design conversation Send a user message to the active InsideOut session and receive the assistant reply. The response contains a clean message from Riley - display it to the user. ⚠️ CRITICAL: DO NOT answer Riley's questions yourself! Forward questions to the user and wait for their response. NEVER fabricate or assume the user's answer, even if you
| Parameter | Type | Required | Notes |
|---|---|---|---|
| session_id | string | yes | Session ID from convoopen — pass back EXACTLY as returned, including the ?token=... suffix (format: sess_v2_*?token=*). The suffix is part of the session credential; never strip it when summarizing. |
| text | string | yes | User message to send to Riley. Forward verbatim what the user said — do not summarize or rewrite. |
| retry | null/boolean | no | When true, re-send the most recent user turn instead of submitting a new one. |
| timeout | null/integer | no | Max seconds to wait for Riley's response. Default 50, max 55. |
| project_context | string | no | Only NEW project details revealed after convoopen (e.g. user mentions a new constraint mid-conversation). Don't re-send context already provided in convoopen. No PII or secrets. |
INSPECTION: View the current infrastructure stack for a session Returns the current state of the user's infrastructure design including: Components - Selected infrastructure services (VPC, databases, caching, etc.) • Shows what services the user has chosen (e.g., PostgreSQL, Redis, S3) • Includes architecture decisions (EKS vs EC2, monolith vs microservices) Config - Configuration de
| Parameter | Type | Required | Notes |
|---|---|---|---|
| session_id | string | yes | Session ID from convoopen — pass back EXACTLY as returned, including the ?token=... suffix (format: sess_v2_*?token=*). The suffix is part of the session credential; never strip it when summarizing. |
| job_id | string | no | Optional. Specific job ID to inspect. When omitted, returns the status of the latest job for the session. |
Wait for the user to securely connect their cloud account and subscribe to Luther Systems. Polls until credentials appear on the session. 🎯 USE THIS TOOL WHEN: tfdeploy returns an 'auth_required', 'no_credentials', or 'credentials_expired' error. The user needs to visit the connect URL to: 1. Connect their cloud credentials (AWS or GCP) 2. Sign up and subscribe to a Luther Systems plan (require
| Parameter | Type | Required | Notes |
|---|---|---|---|
| session_id | string | yes | Session ID from convoopen — pass back EXACTLY as returned, including the ?token=... suffix (format: sess_v2_*?token=*). The suffix is part of the session credential; never strip it when summarizing. |
| cloud | string | no | Cloud provider whose credentials are awaited: 'aws' or 'gcp'. Defaults to 'aws'. |
| timeout | null/integer | no | Max seconds to wait for the user to complete the browser-based credential connect flow. Default 300, max 600. |
INSPECTION: Inspect GCP infrastructure for a deployed project ⚠️ PREREQUISITE: This tool requires a prior deployment ATTEMPT (successful or failed). Check convostatus for hasDeployAttempt=true before calling. Works even after failed deploys to inspect orphaned resources. Inspect deployed GCP resources after a deployment attempt. Use this tool when the user asks about the status or details of
| Parameter | Type | Required | Notes |
|---|---|---|---|
| session_id | string | yes | Session ID from convoopen — pass back EXACTLY as returned, including the ?token=... suffix (format: sess_v2_*?token=*). The suffix is part of the session credential; never strip it when summarizing. T |
| service | string | yes | GCP service to query. Examples: 'compute', 'storage', 'cloudsql', 'gke', 'cloudrun', 'pubsub', 'firestore'. Use action='list-actions' to discover supported actions for a service. |
| action | string | yes | Operation on the service. Examples: 'list-instances' (compute), 'list-buckets' (storage), 'list-clusters' (gke), 'list-actions' (discovery), 'list-metrics' / 'get-metrics' (Cloud Monitoring). |
| filters | string | yes | Optional JSON-encoded filter object passed through to the underlying GCP API. Examples: '{"hours":6}' for metric windows, '{"zone":"us-central1-a"}' for zone-scoped queries. |
| detail | boolean | yes | When true, returns full metadata for a single resource. When false (default), returns a summary. |
| raw | boolean | yes | When true, returns the unprocessed GCP API response. Escape hatch for fields the summarized response doesn't surface. |
BATCH INSPECTION: run up to 32 GCP inspect probes in one call. ⚠️ PREREQUISITE: Same as gcpinspect — deploy attempt required. Check convostatus for hasDeployAttempt=true before calling. Use this when you need to check more than ~3 resources. The backend fetches Oracle credentials ONCE per batch and fans out probes against a single GCP credentials blob — a 12-resource health check is ~5–8× fas
| Parameter | Type | Required | Notes |
|---|---|---|---|
| session_id | string | yes | Session ID from convoopen — pass back EXACTLY as returned, including the ?token=... suffix (format: sess_v2_*?token=*). The suffix is part of the session credential; never strip it when summarizing. T |
| subs | null/array | yes | Up to 32 sub-probes, each with {service, action, filters?, detail?, raw?}. The backend fetches credentials once per batch and fans out probes in parallel (concurrency 8, 30s per-sub timeout, 60s total |
Get workflow guidance for using InsideOut infrastructure tools. Call help() for a compact overview, or help(section=...) for a detailed guide. Sections: workflow, tools, examples, inspect. Responses include hints with next_actions and related_tools.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| section | string | no | Optional section to focus the response. One of: 'workflow', 'tools', 'examples', 'inspect'. When omitted, returns a compact overview (~500 tokens). |
Structured diff showing what would be deployed if the user ran tfdeploy now. Returns component-level changes (added/removed/modified), field-level details, and pricing deltas. Defaults (#1392): with no version arguments, compares the LAST SUCCESSFULLY DEPLOYED version against the user's CURRENT LIVE DESIGN (the same data the UI shows). Empty baseline if nothing has been deployed or after a destro
| Parameter | Type | Required | Notes |
|---|---|---|---|
| session_id | string | yes | Session ID from convoopen — pass back EXACTLY as returned, including the ?token=... suffix (format: sess_v2_*?token=*). The suffix is part of the session credential; never strip it when summarizing. |
| from_version | null/integer | no | Starting stack version number for the diff. Defaults to the latest applied version. |
| to_version | null/integer | no | Ending stack version number for the diff. Defaults to the current draft. |
Create a draft version by reverting to a previous version's config. Copies components, config, and pricing from the target version. If a draft already exists, updates it in-place (single-draft rule). Use stackversions first to find available version numbers. REQUIRES: session_id from convoopen response (format: sess_v2_...), version (target version number).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| session_id | string | yes | Session ID from convoopen — pass back EXACTLY as returned, including the ?token=... suffix (format: sess_v2_*?token=*). The suffix is part of the session credential; never strip it when summarizing. |
| version | integer | yes | Target stack version number to roll back to. Use stackversions to list available versions. |
List all stack versions for a session (newest first). Shows version history including version number, status (draft/confirmed/applied), change summaries, and timestamps. Use this tool to see the design history, review what changed between iterations, or find a version number to roll back to. REQUIRES: session_id from convoopen response (format: sess_v2_...).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| session_id | string | yes | Session ID from convoopen — pass back EXACTLY as returned, including the ?token=... suffix (format: sess_v2_*?token=*). The suffix is part of the session credential; never strip it when summarizing. |
FEEDBACK: Submit feedback, bug reports, or feature requests to Luther Systems Use this tool to forward user feedback directly to the Luther Systems team. This includes bug reports, feature requests, questions, or general feedback about InsideOut. The agent itself can also use this tool to report issues it encounters during operation. REQUIRES: session_id, category, message OPTIONAL: user_email (f
| Parameter | Type | Required | Notes |
|---|---|---|---|
| session_id | string | yes | Session ID from convoopen — pass back EXACTLY as returned, including the ?token=... suffix (format: sess_v2_*?token=*). The suffix is part of the session credential; never strip it when summarizing. I |
| category | string | yes | Feedback category. One of: bug_report, feature_request, general_feedback, question. |
| message | string | yes | Feedback content. Free-form text describing the issue, request, or comment. |
| user_email | string | no | Optional email address for follow-up. |
| user_name | string | no | Optional display name for attribution. |
| source | string | no | Optional source channel: 'mcp', 'cli', or 'web'. |
| initiator | string | no | Optional originator: 'user' (human triggered) or 'agent' (automated). |
WORKFLOW: Step 4 of 4 - Deploy infrastructure to the cloud Deploy infrastructure by starting a Terraform job for an InsideOut session. This tool initiates the actual deployment process after Terraform files have been generated. IMPORTANT: This starts a long-running job (15+ minutes). Use tfstatus to monitor progress. SINGLE-FLIGHT: only one TF job (apply/plan/destroy/drift) runs per session at a t
| Parameter | Type | Required | Notes |
|---|---|---|---|
| session_id | string | yes | Session ID from convoopen — pass back EXACTLY as returned, including the ?token=... suffix (format: sess_v2_*?token=*). The suffix is part of the session credential; never strip it when summarizing. |
| sandbox | null/boolean | no | When true (default for MCP), deploys a small sandbox stack instead of the real generated Terraform. Set false to deploy the actual user stack. |
| version | null/integer | no | Deploy a specific stack version number. Defaults to the current draft. |
| plan_id | string | no | Apply a previously created plan from tfplan. When set, project_id should also be provided. |
| project_id | string | no | Project ID returned by tfplan. Required alongside plan_id. |
| ignore_drift | null/boolean | no | When true, proceed with deploy even if drift is detected on the existing stack. |
| force_new | null/boolean | no | When true, bypass the session-level single-flight guard and start a new deploy even if another job is in flight. Use only when an existing run is provably wedged. |
DESTROY: Tear down previously deployed infrastructure Destroys infrastructure by calling the Oracle destroy endpoint for a session that has a prior successful deployment. IMPORTANT: This starts a long-running job. Use tfstatus/tflogs to monitor progress. SINGLE-FLIGHT: only one TF job per session at a time. If another job is already in flight, tfdestroy returns tf_job_conflict with the live job_id
| Parameter | Type | Required | Notes |
|---|---|---|---|
| session_id | string | yes | Session ID from convoopen — pass back EXACTLY as returned, including the ?token=... suffix (format: sess_v2_*?token=*). The suffix is part of the session credential; never strip it when summarizing. T |
| force_new | null/boolean | no | When true, bypass the single-flight guard and force a new destroy even if another job is in flight. |
DRIFT CHECK: Run a read-only drift detection check Checks whether deployed infrastructure has drifted from the expected Terraform state. This is a read-only operation — it does NOT modify any infrastructure. Returns job_id. Use tflogs to stream the drift check results. SINGLE-FLIGHT: only one TF job per session at a time. If another job is already in flight, tfdrift returns tf_job_conflict with th
| Parameter | Type | Required | Notes |
|---|---|---|---|
| session_id | string | yes | Session ID from convoopen — pass back EXACTLY as returned, including the ?token=... suffix (format: sess_v2_*?token=*). The suffix is part of the session credential; never strip it when summarizing. |
| force_new | null/boolean | no | When true, bypass the single-flight guard and force a new drift check even if another job is in flight. |
WORKFLOW: Step 3 of 4 - Generate Terraform files from completed design Generate Terraform files from an InsideOut session that has completed infrastructure design. ⚠️ PREREQUISITE: Only call this AFTER convoreply returns with terraform_ready=true in the response metadata. DO NOT call this while convoreply is still running or before terraform_ready is confirmed! If you get 'session has not reach
| Parameter | Type | Required | Notes |
|---|---|---|---|
| session_id | string | yes | Session ID from convoopen — pass back EXACTLY as returned, including the ?token=... suffix (format: sess_v2_*?token=*). The suffix is part of the session credential; never strip it when summarizing. R |
| include_code | null/boolean | no | When true, the response inlines the full generated Terraform source. Use as a fallback when the host can't read the on-disk archive (sandbox or security restrictions). |
MONITORING: Fetch Terraform deployment logs with pagination Fetches logs from a running or completed Terraform deployment job. For completed jobs: uses REST endpoint for instant retrieval (supports tail for server-side filtering). For running jobs: streams via SSE with timeout-based pagination. PAGINATION (running jobs only): Use last_event_id from the response to fetch more: 1. F
| Parameter | Type | Required | Notes |
|---|---|---|---|
| session_id | string | yes | Session ID from convoopen — pass back EXACTLY as returned, including the ?token=... suffix (format: sess_v2_*?token=*). The suffix is part of the session credential; never strip it when summarizing. |
| job_id | string | no | Optional. Target a specific job. Use tfruns to discover job IDs. When omitted, streams the latest job for the session. |
| timeout | null/integer | no | Max seconds to collect logs. Default 50, max 55. |
| last_event_id | string | no | Resume cursor for pagination. Pass back the last_event_id from a previous tflogs response to fetch only newer entries. |
| tail | null/integer | no | Return only the last N log entries. Use 0 (or omit) for all available entries. |
INSPECTION: Retrieve Terraform outputs from a completed deployment Returns structured output values (VPC IDs, endpoints, cluster names, etc.) after a successful deploy. Sensitive outputs are redacted (shown as '(sensitive)'). By default returns outputs for the latest successful deploy. Optionally specify job_id to get outputs for a specific deployment. REQUIRES: session_id from convoopen respons
| Parameter | Type | Required | Notes |
|---|---|---|---|
| session_id | string | yes | Session ID from convoopen — pass back EXACTLY as returned, including the ?token=... suffix (format: sess_v2_*?token=*). The suffix is part of the session credential; never strip it when summarizing. |
| job_id | string | no | Optional. Specific job ID to fetch outputs from. When omitted, returns outputs from the latest successful apply. |
| lifecycle | string | no | Optional Oracle deploy-step filter for the outputs. Common values are 'provision', 'cloud-provision', 'k8s-provision' — these correspond to the lifecycle stages of the deployed stack. When omitted, re |
PREVIEW: Run terraform plan to preview infrastructure changes Runs a terraform plan for an InsideOut session without applying any changes. This lets the user review what will be created/changed/destroyed before committing. Returns job_id, plan_id, and project_id. Use tflogs to stream the plan output. After the plan completes, use tfdeploy with plan_id to apply the exact plan. SINGLE-FLIGHT: only o
| Parameter | Type | Required | Notes |
|---|---|---|---|
| session_id | string | yes | Session ID from convoopen — pass back EXACTLY as returned, including the ?token=... suffix (format: sess_v2_*?token=*). The suffix is part of the session credential; never strip it when summarizing. |
| sandbox | null/boolean | no | When true, plan against the sandbox stack; when false (default), plan the real generated Terraform. |
| force_new | null/boolean | no | When true, bypass the single-flight guard and force a new plan even if one is already running. |
INSPECTION: List all Terraform deployment runs for a session Returns job IDs, statuses, types (apply/destroy), and timestamps for every run. Use this to see deployment history, find job IDs for log inspection, or check which deployments succeeded or failed. REQUIRES: session_id from convoopen response (format: sess_v2_...).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| session_id | string | yes | Session ID from convoopen — pass back EXACTLY as returned, including the ?token=... suffix (format: sess_v2_*?token=*). The suffix is part of the session credential; never strip it when summarizing. R |
MONITORING: Quick status check for Terraform deployments Check the current status of a Terraform deployment job. Use this tool to quickly check if a deployment is running, completed, or failed. Returns job status, job_id, and other metadata without streaming logs. Use tflogs to stream the actual deployment logs. REQUIRES: session_id from convoopen response (format: sess_v2_...). OPTIONAL: job_id t
| Parameter | Type | Required | Notes |
|---|---|---|---|
| session_id | string | yes | Session ID from convoopen — pass back EXACTLY as returned, including the ?token=... suffix (format: sess_v2_*?token=*). The suffix is part of the session credential; never strip it when summarizing. |
| job_id | string | no | Optional. Specific job ID to inspect. When omitted, returns the status of the latest job for the session. |
Free
$0 forever
- Every tool — any call limit is its publisher’s, not ours
- No card, and mcprush charges nothing for it
- Runs at its publisher’s own address — this marketplace is not in the path
- Nothing to cap, because mcprush bills nothing
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
Nothing here is billable: mcprush charges nothing to install InsideOut (Riley) or to call it, at any volume.
Call allowance · this installenforced at the gateway
Monthly allowance, in calls
—
—
Alert at 80% · then the tool returns a normal MCP error
Used this month: —
—Grade not published
No rule-by-rule report on file for this release
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
This listing is an address its publisher runs, and you connect to it directly — this marketplace is not in the path. The scanner reads packages and public source, and an address is neither. So there is no grade — not a withheld one, an unmeasured one.
Release history
No release history has been published for this listing yet.
No release history
This listing has published no versions to the marketplace yet.
—
no reviews yet
Who can review
One review per account, from a signed-in account that does not publish this listing. Nothing else is asked — you can say what you think before you install it. Publishers can reply once per review, and a review can be edited or deleted by whoever wrote it.
Sign in to write one
Any signed-in account that does not publish InsideOut (Riley) can review it, once — before installing it or after. A review from an account that has installed it is marked as one.
No reviews yet
Nobody has reviewed this listing. The rating on the card is the mean of the reviews written here and nothing else, so there is no rating until somebody writes the first — which takes a signed-in account that does not publish it, and nothing else.