deploy_vpn
ActiveTool of cloud.redu/mcp
Stands up a redu VPN gateway (WireGuard tunnelled over wstunnel on WSS/443) on your PRIVATE network, so you (or your team) can reach the private IPs of the VMs you deployed on redu, over a single https endpoint — no UDP, no extra ports. This is the TENANT VPN for reaching your OWN deployed resources; it is NOT a general internet VPN. GUARDRAIL: the first call does NOT deploy — it returns the plan + hourly cost for approval, because it creates a BILLED VM. Show the user, get their explicit 'go', then call again with confirm:true (required even in yolo mode). The gateway asset is redu's, deployed onto YOUR VM (you can SSH in to read it). Fresh WireGuard keys are generated per deploy; the client PRIVATE key is returned ONCE and is never stored server-side.
Parameters schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"keypair_name"
],
"properties": {
"name": {
"type": "string",
"pattern": "^[a-z0-9-]+$",
"maxLength": 48,
"minLength": 1,
"description": "Deployment name (default auto 'vpn-<id>'). Becomes the VM name + the wss://<name>.redu.cloud endpoint."
},
"confirm": {
"type": "boolean",
"default": false,
"description": "Set true ONLY after the user has explicitly approved (the first call returns the plan + cost). Do NOT set it yourself."
},
"flavor_id": {
"type": "string",
"default": "2",
"minLength": 1,
"description": "Gateway VM size (from list_flavors). The gateway is light; m1.small ('2') is plenty."
},
"network_id": {
"type": "string",
"minLength": 1,
"description": "Private network id (from list_networks). Auto-selected from your default private network if omitted — the VMs you want to reach must be on this network."
},
"client_cidr": {
"type": "string",
"description": "Your tenant PRIVATE-network CIDR (e.g. '10.1.0.0/24') so the client routes it through the tunnel. If omitted, the returned client config only routes the tunnel subnet and you add your CIDR to AllowedIPs yourself."
},
"keypair_name": {
"type": "string",
"minLength": 1,
"description": "REQUIRED. An EXISTING SSH keypair name (from list_keypairs / import_keypair) for the gateway VM."
}
},
"additionalProperties": false
}No endpoints wrapped at confidence ≥ 0.70.
Parent server
cloud.redu/mcp
1/7 registries