OVH Cloud

OVH Public Cloud, VPS, and dedicated servers all merge into the unified instance list with a provider: ovh tag. From there you get the full per-server toolset — SSH, file browsing, log streaming, live resource monitoring — plus a dedicated OVH Manager screen with a state-aware lifecycle toolbar, a region-first create wizard with live pricing, and thirteen MCP tools for AI agents.

Setup

1. Get OVH API credentials

OVH support is an optional install extra. If you haven't added it yet: pipx install 'servonaut[ovh]' (or pipx inject servonaut ovh on an existing install).

OVH supports two auth flows. The setup wizard walks through both:

• 3-key flow (recommended for personal use) — application key + application secret + consumer key. Consumer key is bound to a fixed list of allowed paths.
• OAuth2 (for service accounts) — client ID + client secret, with broader access patterns.

Launch servonaut and open Settings → OVH Setup, or start the same guided wizard straight from your shell with servonaut --setup-ovh. Either way, the wizard walks you through token creation for the 3-key or OAuth2 flow and writes the result to ~/.servonaut/config.json.

Prefer to edit the config by hand — or provision a machine from a script? See Config block below for the exact field names, and Automating & headless use for injecting secrets without an interactive session.

2. Config block

{
  "ovh": {
    "enabled": true,
    "endpoint": "ovh-eu",

    "application_key": "$OVH_APPLICATION_KEY",
    "application_secret": "$OVH_APPLICATION_SECRET",
    "consumer_key": "$OVH_CONSUMER_KEY",

    "client_id": "",
    "client_secret": "",

    "cloud_project_ids": ["$OVH_PROJECT_ID"],
    "include_dedicated": true,
    "include_vps": true,
    "include_cloud": true
  }
}

endpoint selects the OVH API region — ovh-eu, ovh-us, or ovh-ca. The wizard sets it automatically based on your account. Use either the 3-key trio (application_key + application_secret + consumer_key) or the OAuth2 pair (client_id + client_secret) — leave the unused set empty. All secret fields accept $ENV_VAR and file:/path/to/secret prefixes. cloud_project_ids scopes Public Cloud lookups; include_dedicated / include_vps / include_cloud filter which OVH product families appear in the unified instance list.

Using OVH in the TUI

Once configured, your OVH servers appear in the unified 📋 Instances list alongside AWS, Hetzner, and custom servers — searchable, SSH-able, and one click away from the per-instance Server Actions dashboard. The sidebar also gains a dedicated OVH section with the screens below.

OVH Manager screen

The sidebar's OVH → ⚙ Manage entry opens a per-provider table with a state-aware lifecycle toolbar:

• Create opens the region-first create wizard.
• Start / Stop / Reboot — buttons enable based on the selected row's state and route to the correct API (Public Cloud / VPS / dedicated) automatically.
• Delete — typed-name confirmation; permanent.

Region-first create wizard

The create wizard works region-first:

1. Pick a region first. Datacentre name displays next to the region code.
2. Flavor and image pickers refilter to only what's actually deployable in that region, so you can only select combinations that will deploy.
3. Live pricing per flavor is fetched from the OVH catalog API and shown inline.
4. SSH key picker reads from the project-level SSH key registry (see below).

Regions and flavors with no deployable offers are hidden entirely, so you can't pick a dead combination. The wizard auto-cursors through the list and surfaces a clear hint if you have no SSH keys registered yet.

Project-level SSH keys

OVH → 🔑 SSH Keys manages keys at the Public Cloud project level — the registry the create wizard injects from. This is distinct from OVH's account-wide /me/sshKey endpoint, which covers OVH dedicated; Servonaut manages keys at the project level because that is the registry OVH Public Cloud reads at instance-creation time.

Other OVH screens

Read-only inspection screens. The matching MCP tools (ovh_dns_records, ovh_list_ips, ovh_firewall_rules, ovh_snapshots, ovh_billing, ovh_invoices) expose the same data to your agent.

• DNS Zones — list records by zone, with optional record-type filter (A, AAAA, CNAME, MX, TXT, SRV, …).
• IP Management — account-wide IP inventory with routing info and per-IP firewall rules.
• Snapshots — VPS and Public Cloud snapshots in one view.
• Billing & Invoices — current period summary and recent invoice list.

Monitoring OVH servers (incl. VPS)

Two complementary ways to watch an OVH server:

• Live resource monitor (TUI, over SSH). Open the server from the instance list to reach its Server Actions dashboard, then press L to toggle the live monitor — CPU, RAM, load, disk, and uptime polled over SSH only while the pane is open, never in the background. The detail pane also shows an at-a-glance server-memory snapshot (OS, disk, web stack, databases, runtimes, containers).
• API-side metrics (ovh_monitoring). Historical CPU / RAM / network metrics straight from OVH's monitoring API — no SSH session required, so it works even when a box is unreachable over SSH. Covers Public Cloud instances, OVH VPS (metrics are fetched one statistic type at a time, matching how the OVH VPS monitoring API works), and OVH servers you registered manually as custom servers. A period parameter selects the time window: lastday, lastweek, or lastmonth.

ovh_monitoring is a readonly-tier MCP tool, so the built-in AI chat panel (F2) and any connected agent can answer questions like "what was CPU on this VPS over the last week?" without you leaving the TUI.

Automating & headless use

There is no dedicated OVH subcommand tree — OVH automation runs through the MCP tool surface and the config file:

• Credential setup from the shell: servonaut --setup-ovh runs the guided wizard without opening the full TUI. It is interactive (it walks you through token creation), so for fully unattended provisioning write the config block directly instead.
• Secrets without plaintext: every secret field accepts $ENV_VAR and file:/path/to/secret references, and ~/.secrets/servonaut.env is loaded automatically — ideal for CI runners and provisioning scripts.
• Headless agent toolbox: servonaut --mcp runs the MCP server over stdio without ever loading the TUI, exposing all thirteen OVH tools to a local agent on a server or CI box.
• Remote dispatch: servonaut connect (or servonaut connect --bg) keeps a relay open so hosted agents and team-mates can call OVH tools on this machine over the internet — your OVH credentials never leave the machine. The same listener executes tool calls from headless AI chat sessions, governed by the relay.ai_tool_auto_approve policy in config.json (default: auto-approve up to standard tier; dangerous additionally requires the dangerous-AI-tools setting on your account).

MCP tools (13)

Thirteen account-scoped MCP tools. OVH tools are available on the Solo and Teams plans; monthly operation allowances vary by plan — see Pricing for current numbers. The tools appear in an agent's tool list only when OVH credentials are configured — on a machine without OVH set up, agents simply see no OVH tools rather than failing ones.

Create and delete require mcp.guard_level = dangerous and explicit confirmation; start / stop / reboot live at the standard tier so an agent can recover a stuck instance without escalation. When dangerous tools are invoked through Servonaut AI chat, your account must also have the dangerous-AI-tools option enabled, and on Teams plans a per-team approval policy can require human approval for any subset of these. See Guard levels for the full matrix.

Lifecycle (5)

Read-only inspection (8)

All read tools are readonly guard tier and are available as soon as OVH credentials are configured.

Security notes

• OVH credentials are stored in ~/.servonaut/config.json, encrypted at rest if you opt in to a passphrase.
• OVH credentials are stripped from any config-sync upload to servonaut.dev — they never leave this machine, even when cloud config sync is enabled.
• The 3-key consumer key is scoped to a fixed list of API paths. The wizard requests the minimum scope; you can review and revoke at any time in the OVH API console.
• Every MCP tool call — including all OVH tools — is logged locally to ~/.servonaut/mcp_audit.jsonl with timestamp, arguments, and outcome.

Troubleshooting

"403 Forbidden" on instance ops

Your consumer key probably doesn't include the path you're hitting. The 3-key flow scopes the consumer key to a fixed allowlist of API paths. Re-run the wizard (Settings → OVH Setup in the TUI, or servonaut --setup-ovh) to mint a new consumer key with broader scope, or switch to OAuth2 for service accounts that need fully open access.

Empty flavor / image picker after selecting a region

OVH catalog returns no deployable offers for that region right now. Pick another region — the picker will refresh — or check the OVH status page for the region you wanted.

"Metrics temporarily unavailable" from ovh_monitoring

When OVH's metrics API returns a server-side error, ovh_monitoring reports it loudly and clearly rather than returning partial data. This is an OVH-side condition — retry after a short wait. If it persists, check the OVH status page; the server itself is usually fine, and the TUI's SSH-based live resource monitor still works in the meantime.

Region code vs datacentre name

GRA11 = Gravelines (France), SBG5 = Strasbourg (France), BHS5 = Beauharnois (Canada), WAW1 = Warsaw, DE1 = Frankfurt, etc. The TUI shows both code and name in the picker.