dbt Cloud
Run and watch dbt Cloud jobs — trigger runs, poll their status, download manifest and run_results artifacts, and read the projects, environments and access that produce them.
About
dbt Cloud ships in the w6w first-party pack. It declares 23 actions, 3 health checks, and the host runs its code in a sandbox that never sees the credential.
- App id
io.w6w.dbtcloud- Version
- 0.1.1
- Author
- w6w
- Licence
- MIT
- Categories
- Data Warehousing & ETL · DevOps & Infrastructure · Analytics & BI
Overview
dbt Cloud triggers and watches the jobs that build a data warehouse’s tables, downloads the artifacts each run produces, and reads the projects, environments and access behind them — everything a workflow needs to react to a build rather than just kick one off.
Triggering a run only queues it; this app makes the distinction explicit rather than papering over it, since dbt reports completion as a set of boolean flags, not a single status number. Reruns follow dbt’s own two different behaviors — resuming a failed run from its point of failure, or triggering a brand-new full rebuild when the last run succeeded — and a retry against a run that is no longer a job’s most recent one is refused rather than silently escalating into something larger.
Artifacts are where a build’s real story lives: run_results.json for per-model status and errors, manifest.json for the full project graph, and catalog.json for warehouse schema, each readable either as a summary or in full. Environment variables come back masked and service tokens never reveal their value, so configuration and access can be audited without ever exposing a secret.
Read-only access extends to accounts, projects, environments, connections, users, groups and audit logs — dbt Cloud’s own Terraform provider remains the tool for changing any of that infrastructure.
Build with dbt Cloud
Three routes to the same 23 actions. The Workflow tab is generated from dbt Cloud's own manifest and carries its real ids, so it is copy-pasteable; the Code and CLI examples are the same call for any action on any app, so every app-specific value in them is a blank you fill in.
List accounts
account-list The accounts this token can reach — usually one. Useful for confirming which account a connection points at when a job id 404s.
List audit log events
audit-log-list Who changed what in dbt Cloud — the usual explanation for numbers moving with no deploy. Enterprise-only, and reported as such rather than failing.
List warehouse connections
connection-list The data warehouses this account builds into — Snowflake, BigQuery, Databricks and so on. The connection carries the warehouse's shape, not its credentials.
List environments
environment-list Where a project's jobs build — dbt version, warehouse connection and target. `deployment_type` is what makes a failure alarming or not.
List environment variables
environment-variable-list A project's environment variables per environment — the one call that shows whether staging still has the old value. Secret values come back masked by dbt.
List groups
group-list The groups permissions actually hang off. A group mapped to an SSO group is filled from the IdP, so editing it in dbt Cloud reverts at the next sign-in.
Download a job's latest artifact
job-artifact-get An artifact from a job's last SUCCESSFUL run — the current shape of the project. On a job that has been failing, that is an old artifact returned without complaint.
Get a job
job-get One job's definition — its dbt commands, environment and triggers, which together decide what a run will actually do.
List jobs
job-list The account's jobs. Including the most recent run turns this into one call that answers which jobs are currently broken.
Retry a job's last failed run
job-rerun Resume this job's last run from its point of failure — or, if that run SUCCEEDED, start a complete fresh build instead. The same call means both.
Trigger a job run
job-run Kick off a dbt Cloud job. It returns a QUEUED run immediately — nothing is built yet, so poll `run-get` before treating it as a successful build.
Get a project
project-get One project, with the repository its models come from and the warehouse connection they are built into.
List projects
project-list The dbt projects in the account — one repository each, and the map from names people say to the ids the API wants.
Download a run artifact
run-artifact-get Fetch `run_results.json`, `manifest.json` or `catalog.json` from a finished run — the only machine-readable account of what the build did.
List a run's artifacts
run-artifact-list The artifact paths a run produced. Worth asking before downloading — a job with no docs step has no catalog.json, and a 404 reads like a broken integration.
Cancel a run
run-cancel Stop a run in flight. It does NOT undo what has already been built — dbt writes each model as it finishes, so the warehouse is left partially rebuilt.
Get a run
run-get Where a run has got to. Branch on `is_complete` / `is_success`, not on the status number — the numbers skip 4 through 9.
List runs
run-list Run history, filtered by job, project or state. Filtering to the in-flight states before triggering is how you avoid starting a second concurrent run.
Retry a failed run
run-retry Resume a failed run from the point of failure, skipping the models that already succeeded. Only works on a job's MOST RECENT run — check `run-retry-details` first.
Get retry details for a run
run-retry-details Whether a failed run can be retried and, when it cannot, dbt's named reason — plus which models failed, which is what a useful alert says.
Get a run step
run-step-get One command inside a run, with its status and — opt-in — its logs. The debug log can be megabytes, so the default returns neither.
List service tokens
service-token-list The machine credentials reaching this account and the permissions on each — the list an access review needs. dbt never returns a token's value, so this is safe to schedule.
List users
user-list Who can get into dbt Cloud, with their licence types — the number that matters for cost is developer seats, not users.
A workflow step names the app and the action, and the editor fills in the
connection when you pick one. This is the Step shape from the
workflow spec, carrying dbt Cloud's real ids.
{
"manifestVersion": "2",
"name": "dbtcloud-example",
"steps": [
{
"id": "environment-list",
"uses": {
"app": "io.w6w.dbtcloud",
"action": "environment-list",
"connection": "conn_YOUR_CONNECTION_ID"
},
"with": {
"projectId": "<projectId>"
}
}
]
}Here are some of the things you can do
-
List environments
readenvironment-list -
List accounts
readaccount-list -
List audit log events
readaudit-log-list -
List warehouse connections
readconnection-list -
List environment variables
readenvironment-variable-list
+18 more actions available
Every app-specific value here is a blank you have to fill in. An
app action is reached through the connection that authenticates it, so the
address is a connection id, not the app id — and connections belong to your account,
so a public page cannot know yours. Create one for dbt Cloud, then fill in
the three blanks: conn_YOUR_CONNECTION_ID, the action key, and the
parameters that action declares. The call itself is real — the shape is transcribed
from the studio's own snippet builder, which prints the same kind of blanks — but
nothing in it is specific to dbt Cloud. The Workflow tab is where this app's
real ids are.
npm install @w6w/sdkyarn add @w6w/sdkpnpm add @w6w/sdkdeno add npm:@w6w/sdkimport { W6wClient, isActionRun } from "@w6w/sdk";
// Reads W6W_BASE_URL and W6W_TOKEN from the environment when omitted.
const client = new W6wClient();
const envelope = await client.run({
urn: "conn_YOUR_CONNECTION_ID",
action: "environment-list",
payload: {
projectId: "<value>",
// deploymentType: "<value>",
// includeRelated: "<value>",
// returnAll: "<value>",
// limit: "<value>",
},
});
if (isActionRun(envelope)) console.log(envelope.value);npm install -g @w6w/cliw6w run conn_YOUR_CONNECTION_ID --action environment-list --payload '{"projectId":"<value>"}'Give an AI agent dbt Cloud — without giving it dbt Cloud's credentials. One MCP endpoint exposes every app, function and workflow the caller is entitled to, as tools it can discover and run. Access is granted per team while we onboard.
One tool call{
"name": "w6w_invoke",
"arguments": {
"ref": "app:io.w6w.dbtcloud#environment-list",
"input": {
"projectId": "<projectId>"
}
}
}
Every tool names its target with a single ref. The
app: form above doesn't name a connection at all — the
host resolves which of the caller's dbt Cloud connections to sign
with, and refuses rather than guesses when the answer is ambiguous.
What the agent gets
Credentials it can't read
The token is attached host-side, at the moment of the call. It is never a tool argument, never in the model's context, and never in a transcript — so a prompt injection has nothing to exfiltrate.
A tool surface scoped to the caller
Tools are derived per end user from what that person has actually connected and is entitled to — not one shared bot identity carrying the union of everyone's access.
A durable workflow in one call
Multi-step work runs on the workflow engine and returns a run handle the agent can poll — retries, branching and state survive the conversation that started them.
Health-aware discovery
dbt Cloud's declared health checks are on the surface too, so an agent can tell "the vendor is down" from "your credential expired" before it burns a retry on either.
The MCP surface is part of the hosted platform. dbt Cloud itself is MIT, and the runtime that executes it is source-available (FSL).
Health checks
dbt Cloud declares its own checks, so its health is a property of the app rather than something the host guesses at.
dbt Cloud platform status
The overall indicator from dbt's Statuspage — which is all it publishes, since its components list is empty.
Account reachability
Whether this connection's own dbt Cloud account answers — the only check that covers a single-tenant deployment, which is not on the public status page.