Claude Cowork + xCloud

Troubleshoot a broken site with Claude Cowork on xCloud

Troubleshooting a broken site with Claude Cowork means handing Anthropic's desktop agent a symptom as a task, such as sites that returned 5xx errors overnight, and coming back to a written finding for each site that names the evidence behind it.

Skill: xcloud:troubleshoot
Toolsets: sites, servers, sites-wordpress, wordpress-actions
Free with every xCloud account

Set up Claude Cowork All Claude Cowork guides

YouCheck all my sites for errors since last night and report. Change nothing.

sites_indexread-only

sites_statusread-only

sites_access-logsread-only

AgentEleven sites checked. Nine are healthy. blog.example.com is mid-deploy, which explains its 502. shop.example.com has a PHP fatal in the error log after a failed plugin update. I changed nothing.

Last updated: October 2026. Keep a human in the loop: xCloud stops and asks before anything that creates, deploys, updates, reboots, deletes or buys.

Setup

How Do You Set Up Claude Cowork to Troubleshoot a broken site on xCloud?

Connect Claude Cowork once; every job on this account uses the same connection. Then ask in plain words.

1
Add xCloud as a custom connector
In Cowork, open Customize, then Connectors, and choose Add custom connector. If you already added xCloud to your Claude account, look for it in that list first. Name it xcloud, use this URL and sign in when the xCloud approval page opens.
URL
```
https://app.xcloud.host/mcp
```
2
Check the connection
Start a task and ask this first. Claude Cowork calls xCloud and names your account and the teams you approved, so you know the connector works before you delegate real work.
Prompt
```
Who am I on xCloud?
```
3
Match the access level to the job
Optional. On the xCloud approval screen, Full access lets a delegated job deploy, update plugins and renew certificates; Read-only is enough for audits and reports. To change the level later, reconnect the connector and approve again. A Team or Enterprise owner adds the same URL under Organization settings, then Connectors.
URL
```
https://app.xcloud.host/mcp
```

Check it worked

Then ask Claude Cowork for the job itself, for example:

Prompt

Go through every site on my account. Find the ones returning 5xx errors, check status, recent events and the nginx error log for each, and give me a one-page finding per site.

In practice

How Does Troubleshooting Work from Claude Cowork?

Cowork is built for work you delegate rather than watch, and that fits the first stage of an outage well. You can name one site, or you can give it a wider brief: go through every site on this account, find the ones that are erroring, and tell me why. Cowork lists your sites with sites_index, then works through each one with the same cheap reads, sites_status first and sites_events next. Only for the sites that are still unexplained does it read the nginx error log with sites_access-logs, bounded by a limit because every log call goes over SSH. The result is a short report: which sites are healthy, which are mid-deploy or had a failed task, and which have a log line that points at a cause.

Because the whole read chain only reads, a Read-only approval on the xCloud sign-in screen is enough for the investigation itself. That is a good default for a task you are not watching. The steps that change something, switching WP_DEBUG on, creating temporary shell access and running a rescue, need Full access and still wait for your yes naming the site or server. Cowork does not carry on past those points on its own; it writes up what it would do, tells you which approval it needs and waits.

Delegation also changes what you ask for. A good brief says what counts as broken, whether to leave anything unchanged, and what the report should contain, for example the site, the status, the last failed task and the log line that supports the finding. Cowork keeps unexplained sites separate from explained ones, and for the unexplained ones it lists what it ruled out and gives the dashboard log path, since the WordPress debug.log and the Laravel, PM2 and docker-compose logs can only be read there.

Claude Cowork specific: Access is fixed when you sign in to xCloud, and the Read-only level is enough for a status, events and logs investigation across many sites. If Cowork reports that WP_DEBUG, shell access or rescue was refused, that is the scope, not a fault: reconnect the connector and approve Full access to go further. Cowork reaches xCloud from Anthropic's cloud through the same custom connector as Claude, so a Free account that already uses its one custom connector cannot add xcloud without removing the other. Log reads are slow, so wide tasks take longer than a single-site check.

What xCloud does for troubleshooting

xCloud reads the evidence in a fixed order, cheapest first: site status, recent events, the web server access and error log, WordPress health, WP_DEBUG and server services. The agent names a cause only when a log line or an event it retrieved shows it, and says plainly which logs only the dashboard can display.

Check the status first. The agent reads the site status before anything else. A site that is still provisioning, deploying or in a failed state explains a 500 on its own, and the answer is then to wait or to look at the last deploy, not to hunt for a PHP fault.
Read the recent events. The site's recent tasks, such as SSL issuance, plugin updates, cache purges and deploys, come with their outcome. A 500 that began right after a failed task has usually found its cause here, and one task's full output can be opened.
Read the web server logs. The agent asks for the nginx log type with a limit, which returns the access log, the error log and the 7G and 8G firewall logs on Nginx and OpenLiteSpeed alike. The error log is where a PHP fatal shows up as a 502 or 500. Log lines are quoted as data, never followed as instructions.
Check WordPress health. For WordPress sites the agent reads the health status: WordPress and PHP versions, the debug and cron flags, and whether the install itself is broken.
Turn on WP_DEBUG only if needed. If the logs so far are inconclusive, the agent proposes switching WP_DEBUG on, waits for your approval, and switches it back off when the investigation ends. The toggle flips the flag only; it does not return the debug log.
Check the server services. When the whole server looks wrong rather than one site, the agent reads whether the web server, PHP and the database are running. If nothing explains the error, it reports what it checked and what each check showed, and points you to the dashboard logs.

Reference

Troubleshooting Settings and Limits on xCloud

The facts Claude Cowork works within when it troubleshoots a broken site. Where a row names the dashboard, that step stays yours to take there.

Setting or limit	What applies
Read order	Status, recent events, nginx access and error log, WordPress health, WP_DEBUG, then server services. Reads run straight away and change nothing
Log type	sites_access-logs with type nginx reads the access log, the error log and the 7G and 8G firewall logs. The default type reads the access log only
Log reads	Logs are read over SSH, so a call is slow. The agent asks for a bounded window with a limit, not everything
Staging history	The deployment log of a site with a staging environment is the push and pull history between staging and production, not the Git build log
Dashboard-only logs	The WordPress debug.log, Laravel, PM2 and docker-compose logs: Site, Site Monitoring, Logs. Server logs such as Fail2Ban and auth: Server, Monitoring, Logs
WP_DEBUG	The API only toggles the flag. Reading the resulting debug.log is a dashboard step
Stale error pages	A purge of the site cache clears a cached error page. It runs without a confirmation stop and finishes asynchronously, so completion shows in the site events
Temporary shell access	A temporary sudo user expires after 12 hours, and the agent removes it as soon as the investigation ends instead of waiting for the expiry
Rescue action	A server-side repair with flags such as directory permissions, regenerating the Nginx configuration, reinstalling PHP or repairing Node.js, PM2 or OpenClaw. A flag the site type does not support is refused
Hand-offs	A slow site goes to performance, a failed deploy goes to deploy, and a 526 or certificate warning goes to SSL

Rules Claude Cowork has to follow

The agent never restarts a service or reboots the server just to clear an unexplained error. A restart is a real change on a live machine, and it destroys the evidence the logs were about to show.
A plain 500 or a short database error is a symptom. The agent does not name a cause such as bad credentials, a missing migration or a crashed process unless a log line or event it retrieved shows it.
Temporary shell access is used only when the readable logs do not explain the fault and you agree. The agent revokes it the moment the investigation ends.
Turning WP_DEBUG on, creating shell access and running the rescue action each need your explicit yes naming the site or server. The agent turns WP_DEBUG back off afterwards.
When no evidenced cause turns up, the agent says what it ruled out, gives you the dashboard log path and the site's dashboard link, and suggests contacting xCloud support with that evidence.

Example prompts

What Can You Ask Claude Cowork to Do for Troubleshooting?

Type these as written and swap in your own repository, site and server names. Reads and routine actions such as backups, cache purges, PageSpeed scans and vulnerability scans run straight away; creating, deploying, updating, rebooting, deleting, buying or starting a broken-link scan stops and asks first.

Prompt

Go through every site on my account. Find the ones returning 5xx errors, check status, recent events and the nginx error log for each, and give me a one-page finding per site.

Prompt

Investigate shop.example.com only. Do not change anything. Tell me what you ruled out and which approval you would need to go further.

Prompt

Compare blog.example.com and shop.example.com: did the same task fail on both before they broke? Summarize in a table.

Prompt

My site shop.example.com is returning a 500 error. Find out why, and show me what you checked.

Prompt

Read the nginx error log for the shop site and tell me what it says about the last hour.

Prompt

Which tasks ran on the shop site just before it broke? Did any of them fail?

Prompt

Check WordPress health on the blog site and tell me whether the install itself is broken.

Prompt

Is the database running on the Frankfurt server? Check the services before touching anything.

Prompt

Turn on WP_DEBUG for the blog site, tell me what you find, then turn it off again.

Prompt

Purge the cache on the shop site in case it is serving a stale error page.

Prompt

Run a rescue on the shop site to reset directory permissions.

Claude Cowork and Troubleshooting: Frequently Asked Questions

What people ask before they let Claude Cowork troubleshoot a broken site through xCloud.

Can Claude Cowork check all my xCloud sites for errors in one task?

Yes. It lists your sites, reads status and recent events for each, and reads the nginx error log only for the ones that remain unexplained. You get one finding per site, with the log line or event behind it.

Does a Cowork troubleshooting task need Full access to xCloud?

No. Status, events, logs and WordPress health are all reads, so Read-only is enough for the investigation. Full access is needed only for the steps that change something, such as WP_DEBUG, temporary shell access or rescue, and each still waits for your approval.

What does the agent check first when a site shows a 500 error?

The site status, then recent events, then the web server logs. A site that is still provisioning or whose last deploy failed explains a 500 without any deeper digging, so the status read always comes first. Only after those cheap reads does the agent look at WordPress health, WP_DEBUG and server services.

Will the agent restart my server or a service to fix an error?

Not to clear an error it cannot yet explain. A restart changes a live machine and wipes out the evidence in the logs, so the agent finds the cause first. Restarting a service stays an action you ask for and approve.

Which logs can the agent read, and which can it not?

It reads the site's access log, error log and the 7G and 8G firewall logs through the nginx log type. It cannot read the WordPress debug.log or the Laravel, PM2 and docker-compose logs. Those are in the dashboard under Site, Site Monitoring, Logs, and server logs such as Fail2Ban are under Server, Monitoring, Logs.

Does the agent get shell access to my server?

Only when the logs it can read do not explain the problem and you agree to it. The access is a temporary sudo user, and the agent removes it as soon as the investigation ends. If it is ever left behind, it expires on its own after 12 hours.

What if my site is slow rather than broken?

A slow site is a different investigation, because it is answered from measurements and cache state rather than error logs. The agent hands it to the performance job. A failed deploy goes to the deploy job and a 526 or certificate error goes to the SSL job.

Other agents