Use OpenAPI MCP Server in multi-account scenarios
The multi-account MCP feature lets you use a single, centralized OpenAPI MCP Server and a consistent access model to manage resources across all your Alibaba Cloud accounts.
Multi-account configuration options
On the OpenAPI MCP Server configuration page in the console, use the Multi-account MCP drop-down list to define the server's access scope. The following table describes the available options.
| Option | Description |
| Only this account | The MCP Server can operate only on cloud resources in the current account. |
| Multiple accounts | The MCP Server can operate on cloud resources in both the current account and other accounts. |
Multi-account RAM role name
The following table describes the role types available for Multi-account RAM role name.
| Option | Use case | Description |
| Resource Directory management role ResourceDirectoryAccountAccessRole | If your organization uses Resource Directory to set up a multi-account environment and your RAM user belongs to the management account, you can select this role to manage resources in all member accounts. | Resource Directory automatically creates a RAM role named ResourceDirectoryAccountAccessRole in all member accounts. The trust policy for this role designates the management account as the trusted entity, which allows the management account to assume the role and access the member accounts. |
| Custom role | To delegate access between any two Alibaba Cloud accounts. | You must manually create a RAM role in the target Alibaba Cloud account and set its trusted entity to the Alibaba Cloud account that is used to create the OpenAPI MCP Server. Grant the RAM role the required permissions. |
Choose the example that matches your scenario:
Resource Directory management role — If your organization uses Resource Directory and your RAM user belongs to the management account, follow Example 1: Use the Resource Directory management role.
Custom role — To delegate access between any two Alibaba Cloud accounts, follow Example 2: Use a custom role. You must create a custom RAM role in each target account before you start.
Prerequisites
OAuth authorization — The multi-account MCP feature uses role assumption. You must use a Resource Access Management (RAM) user or RAM role for OAuth authorization. You cannot use an Alibaba Cloud account directly for this purpose.
Example 1 — Your organization uses Resource Directory to set up a multi-account environment, and your RAM user belongs to the management account.
Example 2 — A RAM role must be created in each business account that the operations team needs to access. The role must trust the operations team's Alibaba Cloud account and have the required permissions. For instructions, see Step 1: Create a RAM role in each business account in Example 2.
Common MCP client steps
Both examples in this topic share the following steps. Complete them after you create the OpenAPI MCP Server. This topic uses Tongyi Lingma as the MCP client.
Configure the OpenAPI MCP Server according to the instructions in Configure MCP in Tongyi Lingma.
In the Tongyi Lingma interface, click Agent in the lower-left corner to switch to agent mode.
In the input box, enter a natural language query that specifies the target account and region, such as "Query the running status of ECS instances in account X in region Y", and then click Send.
When the MCP tool runs, the OpenAPI MCP Server automatically assumes the role in the target account (if permissions are sufficient) and performs the operation.
Example 1: use the Resource Directory management role
If your organization uses Resource Directory to manage a multi-account environment, you can assume the RAM role ResourceDirectoryAccountAccessRole in member accounts to access their cloud resources.
Step 1: create an OpenAPI MCP Server in the management account
Go to the Alibaba Cloud OpenAPI MCP Server page to create an MCP service. Select Multiple accounts. For Multi-account RAM role name, select Resource Directory management role ResourceDirectoryAccountAccessRole.
For example, enter multi-account for Name, select Chinese for Documentation Language, and choose Alibaba Cloud Official OAuth for OAuth Configuration.
Step 2: Monitor the status of cloud resources in member accounts in the MCP client
Connect the MCP client and enter a query for the target member account as described in Common MCP client steps.
Tongyi Lingma uses the MCP tool rd-role/Ecs-20140526-DescribeInstanceStatus to query the ECS instance status in the target member account in the China (Hangzhou) (cn-hangzhou) region. The result shows that there is one ECS instance in the account, and its status is Running.
Example 2: Use a custom role
In this example, a company uses a multi-account architecture. Departments such as R&D, marketing, operations, and finance are assigned to separate accounts for resource isolation and access control. The operations team needs to centrally monitor the cloud resources of the business accounts. To access these resources securely, the operations team's account assumes a RAM role created in each business account.
Step 1: Create a RAM role in each business account
In each business account that the operations team needs to access, create a RAM role that the operations team's account can assume.
Go to the Create Role page in the RAM console. Create a RAM role by selecting Cloud Account for the Trusted Entity Type. Select Other Alibaba Cloud Account as the trusted entity, enter the operations team's Alibaba Cloud account ID, and click OK.
O&M engineers access the cloud resources of the business account by assuming this role. Therefore, grant the RAM role permissions on the corresponding resources. To learn how to grant permissions to a RAM role, see Manage the permissions of a RAM role.
Provide the name of this RAM role to the operations team.
Step 2: create an OpenAPI MCP Server
From the operations team's Alibaba Cloud account, go to the Alibaba Cloud OpenAPI MCP Server page to create an MCP service. Select Multiple accounts, and enter the RAM role name provided by the business account for Multi-account RAM role name.
For example, enter multi-account for Name, select Chinese for Documentation Language, choose Alibaba Cloud Official OAuth for OAuth Configuration, and enter a custom role name such as multi-account-test.
Step 3: Run MCP operations in the MCP client
An O&M engineer can monitor the running status of ECS instances in the business accounts from the MCP client. Connect the MCP client and enter a query for the target business account as described in Common MCP client steps. The MCP tool identifies the target account by using the x_assume_account_id parameter.
For example, Tongyi Lingma executes the MCP tool multi-account/Ecs-20140526-DescribeInstances and sets RegionId to cn-hangzhou to query ECS instances in the China (Hangzhou) region. The OpenAPI MCP Server automatically switches to the target account to complete the call. The result shows two ECS instances in the account, both in a Running state.