Grok + xCloud
Manage SSL and domains with Grok on xCloud
Managing SSL and domains with Grok Build means typing a short request into xAI's terminal agent and having it read the certificate, check the DNS record and install or renew HTTPS on xCloud.
- Skill: xcloud:ssl
- Toolsets: ssl-certificates, sites, integrations
- Free with every xCloud account
YouInstall a free cert on example.com once DNS resolves.
servers_dns_checkread-only
AgentThe record points at your Frankfurt server and it is not proxied. I will issue xCloud's free certificate for example.com. Go ahead?
YouYes.
sites_sslCertificates_createneeds approval
AgentAccepted. Polling the certificate status now, then I will request https://example.com and report the result.
. Keep a human in the loop: xCloud stops and asks before anything that creates, deploys, updates, reboots, deletes or buys.
Setup
How Do You Set Up Grok to Manage SSL and domains on xCloud?
Connect Grok once; every job on this account uses the same connection. Then ask in plain words.
Add the xCloud MCP server
Run this in your terminal, then start grok. The first time it calls xCloud, a browser opens on the xCloud approval screen, where you tick the teams and choose Read-only or Full access. Add --scope project to save the entry in .grok/config.toml for one repository instead.
grok mcp add --transport http xcloud https://app.xcloud.host/mcpOr edit ~/.grok/config.toml
Add this table to ~/.grok/config.toml, then run grok mcp doctor xcloud to check the connection. The url key is the one for HTTP servers.
[mcp_servers.xcloud] url = "https://app.xcloud.host/mcp"No browser? Use an API key
For a headless machine, create a token with the mcp:invoke scope plus the read abilities for the areas it will use (read:servers and read:sites, with read:billing and read:addons for billing and add-on tools) and the matching write: abilities if it should change things in Settings, Developers, API Tokens. Put it in an environment variable the machine starts Grok with, such as XCLOUD_TOKEN in a systemd EnvironmentFile or your shell profile, and pass a reference to it with --header. Keep the single quotes so the shell leaves ${XCLOUD_TOKEN} alone: Grok expands ${VAR} in headers when it loads the config, so the token itself never lands in your shell history or in config.toml. Run grok mcp doctor xcloud to confirm it works.
grok mcp add --transport http --header 'Authorization: Bearer ${XCLOUD_TOKEN}' xcloud https://app.xcloud.host/mcpCheck it worked
Then ask Grok for the job itself, for example:
Check the SSL cert on shop.example.com. Provider, status, days left.
In practice
How Does SSL and domains Work from Grok?
Grok Build is a terminal agent, so the exchange is brief. You are in a shell, a site shows a browser warning, and you type check the cert on shop.example.com. Grok Build calls xCloud to resolve the site, reads its SSL state and certificate list, and prints the provider, the status and the expiry date. It does not need a dashboard tab, and it does not need you to remember which server the site lives on, because it finds the site by its domain. If more than one site matches, it asks which one you mean before it does anything else.
The part that earns the terminal is the loop around a DNS change. You have just pointed a domain at the server, and you want HTTPS as soon as it works. Ask Grok Build whether the record resolves yet, and it runs the DNS check, reports the result and, because a lookup is a single call, runs it again while the record propagates. A proxied Cloudflare record is called out separately, and when the site is managed through Cloudflare by xCloud it explains that the proxied record is the finished state, not a fault. When the record is right, it offers the free certificate and restates the site and the provider. After your yes, it sends the install, polls the certificate status and fetches the HTTPS URL.
Grok Build also keeps its xCloud entry where you put it. A global entry in ~/.grok/config.toml makes certificate checks available in every project, and a project-scoped entry keeps them to one repository, which suits a team that wants only some checkouts to reach hosting. If the agent hits a change it cannot make, such as adding or removing a domain on a live site, it says so and gives you the dashboard path rather than guessing at a command.
Grok specific: This page is about Grok Build, the terminal agent, which keeps its credentials in ~/.grok. A command run without --transport http treats the URL as a local command, so a certificate tool that never appears usually means the server was added the wrong way. Run grok mcp doctor xcloud, then restart grok. Grok at grok.com is a separate surface with its own connector settings.
What xCloud does for ssl and domains
xCloud lets the agent read a site's certificate status, domains and DNS, then install or renew a certificate from xCloud (Let's Encrypt), your own files or a connected Cloudflare account. Adding or changing a domain on an existing site stays in the dashboard, and the agent gives you the path.
- Find the site and read its SSL. The agent resolves the site by name or domain, then reads its current SSL state and the list of certificates before it changes anything. That shows the provider, the status and the expiry date.
- Check the domain and DNS. It reads the site's primary and additional domains and asks xCloud whether the domain's DNS record points at the server. Each check is one lookup, so the agent repeats it while a record propagates. A record behind Cloudflare's proxy is reported separately.
- Choose the certificate source. You pick xCloud's free Let's Encrypt certificate, your own certificate, or the team's Cloudflare integration. If the site already uses a different provider, the agent tells you that switching needs an explicit override and asks first.
- Install or renew, once you approve. The agent restates the site and the provider, then installs or renews the certificate. A renewal only runs when the certificate is within seven days of expiry unless you ask for a forced renewal. For a WordPress site turning on HTTPS for the first time, it asks whether to run the database search-and-replace.
- Poll to issuance and verify. Install and renew report success before issuance completes. The agent polls the certificate status until it settles, then checks the site over HTTPS before it calls the job done.
- Hand off domain changes. If you want to add, change or remove a domain on an existing site, the agent gives you the dashboard path (Site > Domain) and the site's dashboard link, because the API only reads domains after creation.
Reference
SSL and domains Settings and Limits on xCloud
The facts Grok works within when it manages SSL and domains. Where a row names the dashboard, that step stays yours to take there.
| Setting or limit | What applies |
|---|---|
| Certificate status | A site's SSL state, its certificate list and one certificate's detail and status are all readable |
| xCloud certificate | Free Let's Encrypt certificate issued and renewed by xCloud. The domain's DNS should already point at the server before you ask |
| Custom certificate | You supply the PEM certificate and its private key. The key is a secret and is never returned by a read |
| Cloudflare certificate | Uses the team's connected Cloudflare account. When the zone is connected, xCloud writes the DNS record and the certificate itself at site creation |
| Switching provider | Needs an explicit force when another provider is already configured, so the agent asks before it replaces a working certificate |
| Renewal rule | A renewal does nothing unless the certificate is within seven days of expiry; a forced renewal skips that guard. Renewing needs the site SSL permission on your team role |
| WordPress first HTTPS | An optional database search-and-replace moves existing http:// URLs to https:// when a WordPress site adopts HTTPS for the first time |
| DNS check | One lookup per call. A proxied Cloudflare record is flagged, and on a Cloudflare-managed site the proxied record is the finished state, not a fault |
| Domains (read) | The primary domain, additional domains and the domain update status are readable through the API |
| Domains (write) | Adding, changing or removing a domain on an existing site is dashboard-only: Site > Domain. A staging site goes live under Site > Domain > Go Live |
| Deleting a certificate | Available through the API, but it can take a site off HTTPS, so the agent restates the target and waits for your approval |
| Cloudflare 526 errors | A 526 or a certificate warning is an SSL problem, so the agent reads the certificate first. A 522 is different: it usually means ports 80 and 443 are blocked at the origin |
Rules Grok has to follow
- Installing, renewing, switching or deleting a certificate stops for your approval, and the agent names the site and the provider before it asks.
- A success response means xCloud accepted the work, not that the certificate was issued: the agent polls the status and checks the live HTTPS URL.
- The agent never replaces a working certificate with a different provider without telling you, and it never turns off the Cloudflare proxy on a site xCloud manages through Cloudflare.
- Changing a domain on an existing site is a dashboard step; the agent gives you the path and the dashboard link xCloud returned, not a made-up workaround.
- A custom certificate's private key is a secret: it is never returned by a read and should not be pasted into a shared channel.
Example prompts
What Can You Ask Grok to Do for SSL and domains?
Type these as written and swap in your own repository, site and server names. Reads and routine actions such as backups, cache purges, PageSpeed scans and vulnerability scans run straight away; creating, deploying, updating, rebooting, deleting, buying or starting a broken-link scan stops and asks first.
Check the SSL cert on shop.example.com. Provider, status, days left.Does example.com resolve to my Frankfurt server yet? Is Cloudflare proxying it?Install a free certificate on example.com once DNS resolves, then curl the HTTPS URL.Check the SSL certificate on shop.example.com and tell me when it expires.Is the DNS A record for example.com pointing at my Frankfurt server yet? Tell me if the Cloudflare proxy is on.Issue a free SSL certificate for example.com once DNS resolves, then confirm the site loads over HTTPS.Renew the certificate on the shop site and tell me the new expiry date.List every domain and additional domain on the shop site and say which is primary.Which of my sites have a certificate that expires in the next 30 days?Use my connected Cloudflare account for the certificate on shop.example.com, and show me what will change first.Visitors get a Cloudflare 526 error on shop.example.com. Check the certificate and tell me what is wrong.Grok and SSL and domains: Frequently Asked Questions
What people ask before they let Grok manage SSL and domains through xCloud.
Can Grok Build tell me when DNS has propagated so I can install HTTPS?
Yes. Ask it to check the domain's record and it runs xCloud's DNS check, reporting whether the record points at your server and whether Cloudflare's proxy is on. It repeats the lookup while the record propagates and offers the certificate once it resolves.
Does Grok Build ask before it installs or renews a certificate?
Yes. Installing, renewing, switching or deleting a certificate stops for your approval, and Grok Build names the site and the provider first. Reads such as the certificate status and the DNS check run without a prompt.
Can an AI agent add a domain to an existing site?
No. The API reads a site's domains, additional domains and domain update status, but adding, changing or removing a domain on an existing site is a dashboard step under Site > Domain. A domain is chosen when the site is created. The agent can tell you what is currently set and give you the path.
Which certificate options can the agent install?
Three: xCloud's free Let's Encrypt certificate, a custom certificate you supply, and a certificate through your connected Cloudflare account. The agent checks the current state first and asks before it changes anything. Switching a site from one provider to another needs an explicit override.
Why did the agent say a renewal did nothing?
A normal renewal only fires when the certificate is within seven days of expiry. If you need it earlier, ask for a forced renewal and the agent will confirm before it runs. Renewing also needs the site SSL permission on your team role.
Does the agent set up my DNS records?
It reads and checks them rather than writing them. It can tell you whether a domain's record points at your server and whether the Cloudflare proxy is on. DNS and the certificate are written for you only at site creation, when the domain's zone is on a Cloudflare account you connected to xCloud.
What does the agent do about a Cloudflare 526 error?
It treats it as an SSL problem. It reads the site's certificate status and expiry, and fixes it with an installation or renewal after your approval. A 522 is a different fault, usually closed ports 80 and 443 on the origin, so it is checked against the firewall instead.
Other agents
SSL and domains with Other Agents
The same job, the same xCloud tools, a guide for each client.
- Manage SSL and domains with Claude CodeAnthropic's terminal coding agent. One claude mcp add command, plus the xCloud skills plugin with nine skills on top.
- Manage SSL and domains with ClaudeAnthropic's chat assistant on the web and desktop. Add xCloud as a custom connector, no terminal needed.
- Manage SSL and domains with Claude CoworkAnthropic's desktop agent for delegated work. Add the xCloud connector, then hand off hosting jobs.
- Manage SSL and domains with CursorThe AI code editor. One mcp.json entry with the compact URL, because Cursor stops at 40 tools.
- Manage SSL and domains with CodexOpenAI's coding agent for the terminal. A codex mcp add command or a config.toml entry, then codex mcp login.
- Manage SSL and domains with OpenCodeThe open-source terminal coding agent. One remote MCP entry, then opencode mcp auth xcloud.
- Manage SSL and domains with Hermes AgentNous Research's agent with memory and a built-in scheduler. An mcp_servers entry in config.yaml and one login.
- Manage SSL and domains with OpenClawThe open-source agent runtime with chat apps and automations. ClawHub skill plus the MCP client.
- Manage SSL and domains with WindsurfThe Cognition editor, now Devin Desktop. devin mcp add for the Devin Local agent, a serverUrl entry for legacy Cascade.
- Manage SSL and domains with GitHub CopilotCopilot agent mode in VS Code. One .vscode/mcp.json entry, or the Agent Plugins package.
- Manage SSL and domains with Gemini CLIGoogle's terminal agent. One gemini mcp add command, OAuth found automatically.
- Manage SSL and domains with ChatGPTOpenAI's chat assistant. A developer-mode app with the xCloud MCP URL and OAuth.
- Manage SSL and domains with ChatGPT dotsOpenAI's always-on agent in ChatGPT. Uses the xCloud MCP plugin you add in ChatGPT, with custom rules and scheduled tasks.
- Manage SSL and domains with Grok BotxAI's always-on Bots on a cloud computer. One Remote HTTPS MCP plugin, OAuth sign-in, routines on a schedule.
- Manage SSL and domains with KiroAWS's agentic IDE. One url entry in .kiro/settings/mcp.json, plus the portable xCloud Agent Plugins package.
- Manage SSL and domains with AntigravityGoogle's agentic IDE. One serverUrl entry in mcp_config.json and a browser sign-in.
- Manage SSL and domains with ZedThe Zed editor's Agent Panel. One context_servers entry in settings.json and a browser sign-in.
More Grok guides
Run Your Hosting from Grok
xCloud MCP, the Agent Skills and the Public API are free with every account. Connect once and ask.