Gemini CLI + xCloud

Manage SSL and domains with Gemini CLI on xCloud

Managing SSL and domains with Gemini CLI means asking Google's terminal agent to read a site's certificate and DNS on xCloud, then install or renew HTTPS after you confirm each step in the terminal.

Skill: xcloud:ssl
Toolsets: ssl-certificates, sites, integrations
Free with every xCloud account

Set up Gemini CLI All Gemini CLI guides

YouCheck SSL for shop.example.com. Print provider, status and days to expiry.

mcp_xcloud_sites_sslread-only

AgentProvider xCloud (Let's Encrypt), status active, 12 days to expiry. A normal renewal would do nothing until it is within seven days. Do you want me to force one now?

YouYes, force it.

mcp_xcloud_sites_ssl_renewneeds approval

AgentRenewal accepted and issued. The certificate now expires in 90 days and https://shop.example.com answers 200.

Last updated: October 2026. Keep a human in the loop: xCloud stops and asks before anything that creates, deploys, updates, reboots, deletes or buys.

Setup

How Do You Set Up Gemini CLI to Manage SSL and domains on xCloud?

Connect Gemini CLI once; every job on this account uses the same connection. Then ask in plain words.

1
Add the xCloud MCP server
Run this in your terminal, then start gemini. The --scope user flag writes the server to ~/.gemini/settings.json so it is available in every project; without it, gemini mcp add writes to the current project's .gemini/settings.json and refuses to run from your home directory. The first time it calls xCloud it finds the OAuth endpoints, opens your browser on the xCloud approval screen and asks you to tick the teams and choose Read-only or Full access.
Terminal
```
gemini mcp add --scope user --transport http xcloud https://app.xcloud.host/mcp
```
2
Or edit settings.json
Add this to ~/.gemini/settings.json for every project, or to .gemini/settings.json in one project. This is the entry gemini mcp add writes: url plus type set to http. The older httpUrl key still works, but a url without a type is treated as an SSE server and will not connect. If the browser sign-in does not start, type /mcp auth xcloud inside Gemini CLI.
JSON
```
{
  "mcpServers": {
    "xcloud": {
      "url": "https://app.xcloud.host/mcp",
      "type": "http"
    }
  }
}
```
3
No browser? Use an API key
For a headless machine, create a token with the mcp:invoke scope plus the read abilities for the areas it will use (read:servers and read:sites, with read:billing and read:addons for billing and add-on tools) and the matching write: abilities if it should change things in Settings, Developers, API Tokens and send it in the headers field. Keep the token out of version control, and keep the quotes: xCloud tokens contain a pipe character.
JSON
```
{
  "mcpServers": {
    "xcloud": {
      "url": "https://app.xcloud.host/mcp",
      "type": "http",
      "headers": {
        "Authorization": "Bearer YOUR_TOKEN"
      }
    }
  }
}
```
✓
Check it worked
Then ask Gemini CLI for the job itself, for example:
Prompt
```
Check SSL for shop.example.com. Print provider, status and days to expiry.
```

In practice

How Does SSL and domains Work from Gemini CLI?

Gemini CLI shows its tool calls in the terminal as it makes them, and that matters for a job where you want to see exactly what is being read. The xCloud tools appear with the prefix mcp_xcloud_ followed by the operation name, so a certificate check is a call to mcp_xcloud_sites_ssl and a DNS lookup is mcp_xcloud_servers_dns_check. You type a short request, such as check the certificate on shop.example.com, and Gemini CLI asks to run the read, prints the provider, the status and the expiry date, and stops. Nothing changes until you ask for it.

The confirmation dialogs are the other half of the story. Gemini CLI asks before it runs a tool, and xCloud holds installs, renewals and deletions for an explicit confirmation of its own, so a certificate change passes two checks, one in the CLI and one at xCloud. This is also why the xcloud entry should not have trust set to true: that setting makes Gemini CLI skip its own dialog, and for a job that can take a site off HTTPS you want to keep it. If the tool list is longer than you like, includeTools on the entry can trim it to the SSL and domain operations.

Gemini CLI is comfortable running shell commands next to the xCloud calls, so you can ask it to compare what it sees locally with what xCloud sees. It runs servers_dns_check for the server's view, repeats it while a record propagates, and reports a proxied Cloudflare record as its own case rather than a failure. After an approved install it polls ssl-certificates_status until the certificate settles, then fetches the HTTPS URL to prove it. A request to add or change a domain on an existing site ends with the dashboard path, Site, then Domain, because that part is not available through the API.

Gemini CLI specific: The browser sign-in redirects to a localhost port, so it needs a browser on the same machine as Gemini CLI. On a remote or headless host, where you might be checking certificates over SSH, use the API-key form with a token that has the mcp:invoke scope plus read:sites (and write:sites if it should renew or install certificates), and keep that token out of version control. The streamable HTTP entry is url plus type set to http, the form gemini mcp add writes; a url with no type is treated as an SSE server and will not connect.

What xCloud does for ssl and domains

xCloud lets the agent read a site's certificate status, domains and DNS, then install or renew a certificate from xCloud (Let's Encrypt), your own files or a connected Cloudflare account. Adding or changing a domain on an existing site stays in the dashboard, and the agent gives you the path.

Find the site and read its SSL. The agent resolves the site by name or domain, then reads its current SSL state and the list of certificates before it changes anything. That shows the provider, the status and the expiry date.
Check the domain and DNS. It reads the site's primary and additional domains and asks xCloud whether the domain's DNS record points at the server. Each check is one lookup, so the agent repeats it while a record propagates. A record behind Cloudflare's proxy is reported separately.
Choose the certificate source. You pick xCloud's free Let's Encrypt certificate, your own certificate, or the team's Cloudflare integration. If the site already uses a different provider, the agent tells you that switching needs an explicit override and asks first.
Install or renew, once you approve. The agent restates the site and the provider, then installs or renews the certificate. A renewal only runs when the certificate is within seven days of expiry unless you ask for a forced renewal. For a WordPress site turning on HTTPS for the first time, it asks whether to run the database search-and-replace.
Poll to issuance and verify. Install and renew report success before issuance completes. The agent polls the certificate status until it settles, then checks the site over HTTPS before it calls the job done.
Hand off domain changes. If you want to add, change or remove a domain on an existing site, the agent gives you the dashboard path (Site > Domain) and the site's dashboard link, because the API only reads domains after creation.

Reference

SSL and domains Settings and Limits on xCloud

The facts Gemini CLI works within when it manages SSL and domains. Where a row names the dashboard, that step stays yours to take there.

Setting or limit	What applies
Certificate status	A site's SSL state, its certificate list and one certificate's detail and status are all readable
xCloud certificate	Free Let's Encrypt certificate issued and renewed by xCloud. The domain's DNS should already point at the server before you ask
Custom certificate	You supply the PEM certificate and its private key. The key is a secret and is never returned by a read
Cloudflare certificate	Uses the team's connected Cloudflare account. When the zone is connected, xCloud writes the DNS record and the certificate itself at site creation
Switching provider	Needs an explicit force when another provider is already configured, so the agent asks before it replaces a working certificate
Renewal rule	A renewal does nothing unless the certificate is within seven days of expiry; a forced renewal skips that guard. Renewing needs the site SSL permission on your team role
WordPress first HTTPS	An optional database search-and-replace moves existing http:// URLs to https:// when a WordPress site adopts HTTPS for the first time
DNS check	One lookup per call. A proxied Cloudflare record is flagged, and on a Cloudflare-managed site the proxied record is the finished state, not a fault
Domains (read)	The primary domain, additional domains and the domain update status are readable through the API
Domains (write)	Adding, changing or removing a domain on an existing site is dashboard-only: Site > Domain. A staging site goes live under Site > Domain > Go Live
Deleting a certificate	Available through the API, but it can take a site off HTTPS, so the agent restates the target and waits for your approval
Cloudflare 526 errors	A 526 or a certificate warning is an SSL problem, so the agent reads the certificate first. A 522 is different: it usually means ports 80 and 443 are blocked at the origin

Rules Gemini CLI has to follow

Installing, renewing, switching or deleting a certificate stops for your approval, and the agent names the site and the provider before it asks.
A success response means xCloud accepted the work, not that the certificate was issued: the agent polls the status and checks the live HTTPS URL.
The agent never replaces a working certificate with a different provider without telling you, and it never turns off the Cloudflare proxy on a site xCloud manages through Cloudflare.
Changing a domain on an existing site is a dashboard step; the agent gives you the path and the dashboard link xCloud returned, not a made-up workaround.
A custom certificate's private key is a secret: it is never returned by a read and should not be pasted into a shared channel.

Example prompts

What Can You Ask Gemini CLI to Do for SSL and domains?

Type these as written and swap in your own repository, site and server names. Reads and routine actions such as backups, cache purges, PageSpeed scans and vulnerability scans run straight away; creating, deploying, updating, rebooting, deleting, buying or starting a broken-link scan stops and asks first.

Prompt

Check SSL for shop.example.com. Print provider, status and days to expiry.

Prompt

Is example.com pointing at my xCloud server yet? Check xCloud's DNS lookup and tell me if the Cloudflare proxy is on.

Prompt

Renew the certificate on the shop site. If it is not due, say so and ask before you force it.

Prompt

Check the SSL certificate on shop.example.com and tell me when it expires.

Prompt

Is the DNS A record for example.com pointing at my Frankfurt server yet? Tell me if the Cloudflare proxy is on.

Prompt

Issue a free SSL certificate for example.com once DNS resolves, then confirm the site loads over HTTPS.

Prompt

Renew the certificate on the shop site and tell me the new expiry date.

Prompt

List every domain and additional domain on the shop site and say which is primary.

Prompt

Which of my sites have a certificate that expires in the next 30 days?

Prompt

Use my connected Cloudflare account for the certificate on shop.example.com, and show me what will change first.

Prompt

Visitors get a Cloudflare 526 error on shop.example.com. Check the certificate and tell me what is wrong.

Gemini CLI and SSL and domains: Frequently Asked Questions

What people ask before they let Gemini CLI manage SSL and domains through xCloud.

What are the xCloud SSL tools called in Gemini CLI?

Gemini CLI prefixes MCP tools with mcp_xcloud_ and the operation name, so the certificate read is mcp_xcloud_sites_ssl and the renewal is mcp_xcloud_sites_ssl_renew. You do not need to type them. Ask in plain words and Gemini CLI chooses the call and shows it to you.

Should I set trust to true on the xcloud entry for certificate work?

No. Trust makes Gemini CLI skip its own tool confirmation dialogs. Installing, renewing or deleting a certificate can take a site off HTTPS, so keep the dialogs on. xCloud also asks for its own explicit confirmation on those changes.

Can an AI agent add a domain to an existing site?

No. The API reads a site's domains, additional domains and domain update status, but adding, changing or removing a domain on an existing site is a dashboard step under Site > Domain. A domain is chosen when the site is created. The agent can tell you what is currently set and give you the path.

Which certificate options can the agent install?

Three: xCloud's free Let's Encrypt certificate, a custom certificate you supply, and a certificate through your connected Cloudflare account. The agent checks the current state first and asks before it changes anything. Switching a site from one provider to another needs an explicit override.

Why did the agent say a renewal did nothing?

A normal renewal only fires when the certificate is within seven days of expiry. If you need it earlier, ask for a forced renewal and the agent will confirm before it runs. Renewing also needs the site SSL permission on your team role.

Does the agent set up my DNS records?

It reads and checks them rather than writing them. It can tell you whether a domain's record points at your server and whether the Cloudflare proxy is on. DNS and the certificate are written for you only at site creation, when the domain's zone is on a Cloudflare account you connected to xCloud.

What does the agent do about a Cloudflare 526 error?

It treats it as an SSL problem. It reads the site's certificate status and expiry, and fixes it with an installation or renewal after your approval. A 522 is a different fault, usually closed ports 80 and 443 on the origin, so it is checked against the firewall instead.

Other agents