Be the first to get access to new connectors. Get early access →
ConnectorBay Early access

Pulumi Policy (BYOK) — connector documentation

  • MCP endpoint: https://byok-pulumi-policy.connectorbay.com/mcp
  • REST API: POST https://byok-pulumi-policy.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://byok-pulumi-policy.connectorbay.com/openapi.json
  • Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
  • Authentication: your own Pulumi Policy Pulumi access token (pul-...), sent in the X-Upstream-Key header of every request (never stored, logged or cached)
  • Health: https://byok-pulumi-policy.connectorbay.com/health · Tool schemas: https://byok-pulumi-policy.connectorbay.com/tools.json
  • Publisher: Unify Dynamics LLC · connectorbay.com/byok-pulumi-policy · agent@connectorbay.com

What Pulumi Policy (BYOK) is for

Pulumi Policy (BYOK) lets an AI assistant read your own Pulumi Policy data through the Pulumi Policy API with a key you supply (Pulumi access token (pul-...)). Read-only: 9 tools (list_policy_groups, get_policy_group, get_policy_group_metadata, list_policy_packs, get_policy_pack_version, get_stack_policy_groups, get_stack_policy_packs, get_policy_results_summary, get_policy_issue). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to api.pulumi.com. Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Pulumi Policy. Pulumi Policy and its logos are trademarks of their owners and are used only to say which service the connector works with.

Ask your assistant things like:

  • "Which Pulumi policy groups does acme have?"
  • "Which policy packs does the production policy group enforce?"
  • "How many of our Pulumi stacks are covered by policy groups?"
  • "Which policy packs has acme published to Pulumi Cloud?"
  • "What policies are in version 3 of the aws-guard policy pack?"
  • "Which policy groups apply to the acme/web-app/prod stack?"

What it does

  • list_policy_groups: List the policy groups of an organization with name, mode (audit or preventative), whether it is the org default and how many stacks, accounts and policy packs it has.
  • get_policy_group: Get one policy group: mode, member stacks and Insights accounts, and the applied policy pack versions with their configuration.
  • get_policy_group_metadata: Get organization-wide policy coverage numbers: stacks and resources protected by preventative and audit groups versus totals.
  • list_policy_packs: List the policy packs published to an organization with name, display name, version numbers and version tags. Optionally filter by pack name.
  • get_policy_pack_version: Get one policy pack version and the policies inside it: name, description, enforcement level (advisory, mandatory, remediate, disabled), message, severity, tags and remediation steps.
  • get_stack_policy_groups: List the policy groups that include one stack, with mode and how many policy packs each enables.
  • get_stack_policy_packs: List the policy pack versions enforced on one stack through its policy groups. Filter by audit or preventative mode.
  • get_policy_results_summary: Get organization policy compliance totals: policies, policies with issues, resources covered and resources with issues.
  • get_policy_issue: Get one policy issue: the policy pack and policy that flagged it, the resource, level, severity, priority and triage status.

BYOK key

You bring your own Pulumi Policy Pulumi access token (pul-...) (https://app.pulumi.com/account/tokens). Your assistant sends it in the X-Upstream-Key header with each request. ConnectorBay uses it for that one call only: it is never stored, logged or cached, never shown in an answer, and it is only sent to api.pulumi.com over https, with no redirects followed. Create a key with the fewest permissions the tools need (read-only if the provider offers it), and revoke it at the provider whenever you like.

Data sources

Live from the Pulumi Policy API (api.pulumi.com) with a BYOK key; documentation: https://www.pulumi.com/docs/reference/cloud-rest-api/. Endpoints checked against that documentation on 2026-10-16.

What it is not

Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Pulumi Policy. Pulumi Policy and its logos are trademarks of their owners and are used only to say which service the connector works with. It is read-only: it never creates, changes, sends or deletes anything in your Pulumi Policy account.

Built for: Worldwide. Languages: English.