@groundfloorcloud/mcp 0.1.6 → 0.1.8

package/README.md

@@ -74,23 +74,27 @@ The `command` must be your Node (from `which node`), not `npx` and not Cursor’
 | `coderunner_cancel_deployment` | Delete current (or given) deployment |
 | `apps_list` / `apps_get` | Inspect product Apps |
 | `secrets_list` / `files_list` / `domains_list` / `dataplane_status` | Inspect (no secrets values) |
-| `docs_list` / `docs_get` | Product docs (`coderunner`, `coderunner-runtime`, and `shell` are embedded how-tos) |
-| `suggest_cli` | Command to run: login, deploy, init_app, publish_app, … |
+| `docs_list` / `docs_get` | Product docs (`coderunner`, `shell`, `design-standard`, `css-and-styling`, `databases` are embedded; `access` and `m2m` are live pages) |
+| `suggest_cli` | Command to run: login, deploy, init_app, publish_app, m2m_token, … |
 
 Never create `app_kind=coderunner`. Deploy with `gf deploy`.
 
 **Shell apps:** `docs_get` id `shell`. Always `gf apps init --slug <portal-slug>`,
 then `npm run release` and `gf apps publish --path release.zip`. Do not invent
 `App.tsx` / `vite.config`, zip `dist/`, or upload only `remoteEntry.js`.
+Own CSS framework: `docs_get` id `css-and-styling` (`FederatedStyleRoot`).
+
+**Databases:** `docs_get` id `databases`. Dataplane is not a database. ArangoDB
+is ready through Dataplane; Postgres is what you can deploy today.
 
 **Coderunner how-to** is embedded: `docs_get` id `coderunner` (also
 `coderunner-overview`). That page covers:
 
 - Types: `function`, `job`, `schedule`, `service` (**also called Deployment**)
-- **Authentication must be active** before creating a coderunner
+- App authentication is optional (end-user login); not required to create a coderunner
 - **Dockerfile is required** for `service` / Deployment
 - Runtime contract: Node `scripts.start`, listen on `PORT`/8080, bind `0.0.0.0` (`docs_get` id `coderunner-runtime`)
-- Local development against live vault/files/secrets (`gf env` + `gf token`)
+- Local development against live vault/files/secrets (`gf env`; as the workload use `gf m2m token`, not `gf token`)
 
 `workspace_context` includes a `coderunner_howto` summary so agents see this
 without an extra fetch.

package/dist/index.js

@@ -169,11 +169,31 @@ var CpError = class extends Error {
   }
   status;
 };
+function formatCpErrorDetail(detail, fallback) {
+  if (typeof detail === "string" && detail.trim()) return detail.trim();
+  if (detail && typeof detail === "object") {
+    const obj = detail;
+    if (typeof obj.message === "string" && obj.message.trim()) {
+      return obj.message.trim();
+    }
+    if (typeof obj.detail === "string" && obj.detail.trim()) {
+      return obj.detail.trim();
+    }
+    try {
+      return JSON.stringify(detail);
+    } catch {
+      return fallback;
+    }
+  }
+  return fallback;
+}
 async function parseError(res) {
   let detail = res.statusText;
   try {
     const body = await res.json();
-    if (body?.detail) detail = String(body.detail);
+    if (body?.detail !== void 0) {
+      detail = formatCpErrorDetail(body.detail, res.statusText);
+    }
   } catch {
   }
   return `${res.status} ${detail}`;
@@ -504,13 +524,11 @@ Also \`docs_get\` id \`coderunner-runtime\`.
 
 ## Prerequisites (do these before create/deploy)
 
-1. **Workspace Authentication is required** before creating a coderunner.
-   Portal \u2192 Administer \u2192 Authentication \u2192 set mode to \`groundfloor\` (or
-   \`external\` with an issuer) and wait until the realm is **active**.
-   Code Runner JWTs use the workspace site issuer. Mode \`none\` cannot mint
-   that token \u2014 create/deploy fails with "requires the workspace site issuer".
-2. \`gf login\` (\`--stage\` / \`--dev\` as needed) and \`gf workspaces use <uuid>\`.
-3. Dataplane for vault/files/secrets: \`gf dataplane provision\` if those APIs
+1. \`gf login\` (\`--stage\` / \`--dev\` as needed) and \`gf workspaces use <uuid>\`.
+   Team **write** can create Coderunners without App authentication. Site auth
+   (Groundfloor/external) is only for end-user login. Mode \`none\` mints
+   management JWTs against Portal JWKS (\`GET /v1/public/jwks.json\`).
+2. Dataplane for vault/files: \`gf dataplane provision\` if those APIs
    are needed (local live data or the deployed workload).
 
 ## Workload types
@@ -613,23 +631,159 @@ curl -sS -X POST http://127.0.0.1:8080/ -H 'Content-Type: application/json' \\
 
 Live vault / files / secrets from the laptop:
 
+\`gf token\` is a **builder** credential. Use it for operator Vault. To call
+Vault and Files as a Coderunner does, use an M2M client and \`gf m2m token\`.
+
 \`\`\`bash
+# Builder token:
 curl -sS -H "Authorization: Bearer $(gf token)" \\
   "$CONTROLPLANE_URL/v1/workspaces/$GROUNDFLOOR_WORKSPACE_ID/vault/collections"
+
+# M2M (same class as an attached Coderunner):
+curl -sS -H "Authorization: Bearer $(gf m2m token)" \\
+  "$CONTROLPLANE_URL/v1/workspaces/$GROUNDFLOOR_WORKSPACE_ID/vault/collections"
+curl -sS -H "Authorization: Bearer $(gf m2m token)" \\
+  "$CONTROLPLANE_URL/v1/workspaces/$GROUNDFLOOR_WORKSPACE_ID/files"
 \`\`\`
 
-In app code, use \`CONTROLPLANE_URL\` + Bearer (\`gf token\` locally;
-injected env / workspace secrets after \`gf deploy\`). Never put
-\`DATAPLANE_SERVICE_API_KEY\` in a browser bundle.
+In app code, use \`CONTROLPLANE_URL\` + Bearer from
+\`POST \u2026/m2m/token\` (\`gf m2m token\` locally; injected
+\`GROUNDFLOOR_M2M_CLIENT_ID\` / \`GROUNDFLOOR_M2M_CLIENT_SECRET\` after
+\`gf deploy\`). Never put \`DATAPLANE_SERVICE_API_KEY\` in a browser bundle
+or customer env.
 
 When the handler looks right locally, \`gf deploy\` the same tree.
 
+## M2M tokens (Vault and Files)
+
+New Coderunners cannot call Vault or Files until an M2M client is attached
+and the workload is redeployed. Create the client in Portal **Administer \u2192
+M2M tokens**, attach it on the Coderunner card, then deploy. v1 M2M is Team
+Writer on that workspace (full Vault skip-ACL + Files). Grant site users on
+**Administer \u2192 Access**. Never inject a Dataplane key.
+
 ## Agent actions
 
 Inspect: \`workspace_context\`, \`docs_get\` id \`coderunner\` or \`coderunner-runtime\`, \`suggest_cli\`.
-Act: \`gf deploy\`, \`gf coderunner run|status\`. MCP does not deploy.
+Act: \`gf deploy\`, \`gf coderunner run|status\`, \`gf m2m token\`. MCP does not deploy.
 `.trim();
 
+// src/css-and-styling-guide.ts
+var CSS_AND_STYLING_GUIDE = `
+# CSS and styling (Shell apps)
+
+Default is Tailwind CSS v3.4 \u2014 same as the Shell. Keep it unless the user
+opts for their own framework.
+
+## Default (Tailwind)
+
+1. Import src/index.css from App.tsx.
+2. Wrap in FederatedAppRoot (class gf-federated-app).
+3. Keep important: '.gf-federated-app' and corePlugins.preflight: false.
+4. Scoped form reset lives in @layer base. Do not put unlayered CSS after
+   @tailwind utilities \u2014 that hides input borders.
+
+Visual rules: docs_get id design-standard.
+
+## Using your own CSS framework
+
+This path is available. Do not run Tailwind and a second global framework
+together (Bootstrap, MUI, CSS Modules, \u2026). Pick one.
+
+If they opt out of Tailwind:
+
+1. Do not import that CSS as a global stylesheet.
+2. Import it as a string: import vendorCss from './vendor.css?inline'
+3. Wrap the app in FederatedStyleRoot instead of FederatedAppRoot.
+4. Render modals inside that shadow root, not document.body.
+
+The kit ships FederatedStyleRoot in src/lib/FederatedStyleRoot.tsx.
+
+Human docs: /docs/integrations/shell/css-and-styling
+`;
+
+// src/databases-guide.ts
+var DATABASES_GUIDE = `
+# Databases
+
+Dataplane is not a database. It is how Groundfloor talks to databases.
+
+When the user starts any data or database work, say this first. Do not mention
+infrastructure internals (cluster operators, installers, and the like):
+
+You have ArangoDB ready to use through Dataplane. If you want another
+database, deploy it first. You can use a deployed database through Dataplane,
+or connect to it on your own.
+
+## Options
+
+- ArangoDB \u2014 shared, managed, already there. Default for app data and Vault.
+  No deploy step. Query via Control Plane vault:
+  POST /v1/workspaces/{id}/vault/collections/{name}/query
+- Postgres \u2014 what you can deploy today (portal Data \u2192 Databases). After it is
+  ready, use it through Dataplane or with the connection secrets.
+- A database they already run \u2014 through Dataplane if they wire it, or direct.
+
+Do not list other engines as available to deploy. Do not call Dataplane hosts
+from apps or embed service keys.
+
+## Paths
+
+- Browse / edit rows \u2192 Data Vault (portal or vault APIs)
+- Deploy Postgres \u2192 Customer Portal Databases page, or
+  POST /v1/workspaces/{id}/managed-databases with engine postgres
+- Shell 403 / empty vault \u2192 collection Access for the site role
+
+docs_get id databases. Human docs: /docs/customer-portal/databases
+`;
+
+// src/design-standard-guide.ts
+var DESIGN_STANDARD_GUIDE = `
+# Shell app design standard
+
+Every app from \`gf apps init\` should look like this. Reference: Morguard IT
+Onboarding (flat, grey ground, one accent). Do not restyle to the stock
+Tailwind raised-button look.
+
+## Rules
+
+- Ground: grey page, white header, one white panel per page with the title inside it.
+- Flat: no shadows, no raised buttons, no sunken fields. Hairline borders only.
+  Inputs and secondary buttons share one border weight. Use the kit's scoped
+  reset in src/index.css. Never re-enable Tailwind preflight in the remote.
+- Colour: neutral first. One accent (manifest theme.primaryColor) for primary
+  actions, links, and the tint behind a selected tab. Meaningful colour only
+  in status pills and phase dots. Fallback is a neutral if the hex is missing.
+- Type: Geist Sans / Geist Mono, 13\u201314px working size, tabular numbers, mono
+  for IDs and codes.
+- Sequence: a process with ordered steps gets PhaseChevron \u2014 flat, outlined,
+  soft tints, underline on the selected step. Pass an ordered steps list;
+  do not hard-code client phases.
+- Tables: DataGrid with sentence-case muted headers, search + toggleable
+  filters, icon paging, a real empty state.
+
+## Manifest
+
+theme.primaryColor \u2192 --primary / --ring at runtime.
+theme.logoUrl \u2192 AppHeader (absolute https URL). Bundled images 404 in Shell
+unless the production build uses base: './'.
+
+## Local
+
+npm run dev \u2014 live vault via gf login.
+npm run dev:fixtures \u2014 src/dev/fixtures/<collection>.json, no client data.
+
+## Using your own CSS framework
+
+The kit is Tailwind only. You do not need a second framework.
+
+If you opt out (Bootstrap, MUI, CSS Modules, \u2026), do not import that CSS
+globally. Use FederatedStyleRoot with \`import './vendor.css?inline'\` so styles
+stay in Shadow DOM. Render modals inside that root, not document.body.
+
+Full steps: docs_get id css-and-styling.
+`;
+
 // src/shell-guide.ts
 var SHELL_APP_GUIDE = `
 # Shell federated apps
@@ -655,8 +809,18 @@ gf apps publish --path release.zip
 \`\`\`
 
 \`npm run release\` packs **all** of dist/assets (remoteEntry.js + hashed
-\`__federation_*.js\` + CSS) at the zip root. Do not zip \`dist/\`. Do not
-upload a lone \`remoteEntry.js\`. \`gf apps publish\` rejects incomplete zips.
+\`__federation_*.js\` + CSS) at the zip root and rewrites \`./assets/\` imports
+in remoteEntry.js. Do not zip \`dist/\`. Do not upload a lone \`remoteEntry.js\`.
+\`gf apps publish\` rejects incomplete zips.
+
+Production builds use Vite \`base: './'\` so imported images resolve next to
+remoteEntry.js. Header logos: manifest \`theme.logoUrl\` (absolute https).
+UI look: \`docs_get\` id \`design-standard\`. CSS: Tailwind by default;
+own framework uses FederatedStyleRoot (Shadow DOM) \u2014 \`docs_get\` id
+\`css-and-styling\`. Data: Dataplane is not a database. Say first: you have
+ArangoDB ready through Dataplane; deploy Postgres if you want another
+database; use it through Dataplane or on your own (\`docs_get\` id
+\`databases\`). Local UI without live vault: \`npm run dev:fixtures\`.
 
 ## suggest_cli
 
@@ -671,19 +835,19 @@ var DOC_CATALOG = [
     id: "agents",
     title: "Deploy with agents",
     path: "/docs/customer-portal/agents",
-    summary: "How agents should deploy Coderunner workloads and init/publish Shell apps with gf / MCP. Enable workspace Authentication before create. Service (Deployment) requires a Dockerfile. Shell apps: gf apps init, never invent App.tsx."
+    summary: "How agents should deploy Coderunner workloads and init/publish Shell apps with gf / MCP. App authentication is optional (end-user login). Service (Deployment) requires a Dockerfile. Shell apps: gf apps init, never invent App.tsx."
   },
   {
     id: "developers",
     title: "Developers (gf CLI)",
     path: "/docs/customer-portal/developers",
-    summary: "gf login, workspaces, deploy, secrets, files, apps. Coderunner types: function, job, schedule, service (also called Deployment)."
+    summary: "gf login, workspaces, deploy, secrets, files, apps, gf m2m token. Coderunner types: function, job, schedule, service (also called Deployment). App authentication optional."
   },
   {
     id: "coderunner",
     title: "Coderunner",
     path: "/docs/customer-portal/coderunner",
-    summary: "Workload types (function, job, schedule, service/Deployment), runtime contract (scripts.start, 0.0.0.0:8080), Dockerfile for services, Authentication before create, local live data, gf deploy.",
+    summary: "Workload types (function, job, schedule, service/Deployment), runtime contract (scripts.start, 0.0.0.0:8080), Dockerfile for services, Coderunner identities for Vault, App authentication optional, local live data, gf deploy.",
     embedded: CODERUNNER_GUIDE
   },
   {
@@ -697,14 +861,26 @@ var DOC_CATALOG = [
     id: "coderunner-overview",
     title: "Coderunner overview",
     path: "/docs/integrations/coderunner/overview",
-    summary: "Architecture and lifecycle. Prefer docs_get id coderunner for type usage, Dockerfile, and auth prerequisites.",
+    summary: "Architecture and lifecycle. Prefer docs_get id coderunner for type usage, Dockerfile, and create prerequisites.",
     embedded: CODERUNNER_GUIDE
   },
   {
     id: "authentication",
     title: "Workspace Authentication",
     path: "/docs/customer-portal/authentication",
-    summary: "Workspace site auth (Groundfloor or external) must be active before creating a Coderunner. Separate from portal Team."
+    summary: "Workspace site auth (Groundfloor or external) is optional end-user login. Leaving Groundfloor keeps the realm (disabled) until Delete Groundfloor login. Separate from portal Team. Not required to create Apps or Coderunners."
+  },
+  {
+    id: "access",
+    title: "Access",
+    path: "/docs/customer-portal/access",
+    summary: "Grant site roles Data Vault collections, workspace-wide Files, and Apps launch. Admin is implicit. M2M is not an Access subject. Team membership is unchanged."
+  },
+  {
+    id: "m2m",
+    title: "M2M tokens",
+    path: "/docs/customer-portal/m2m-tokens",
+    summary: "Confidential client secret \u2192 short Control Plane JWT (typ=m2m). Attach on Coderunner or gf m2m token. Never DATAPLANE_SERVICE_API_KEY. v1 is Team Writer, no collection ACL."
   },
   {
     id: "api-authentication",
@@ -718,6 +894,27 @@ var DOC_CATALOG = [
     path: "/docs/integrations/shell",
     summary: "Product Apps vs Coderunner. Always gf apps init --slug <portal-slug>, then npm run release and gf apps publish --path release.zip. Never zip dist/ or upload only remoteEntry.js.",
     embedded: SHELL_APP_GUIDE
+  },
+  {
+    id: "design-standard",
+    title: "Shell app design standard",
+    path: "/docs/integrations/shell/design-standard",
+    summary: "Visual rules for Shell apps: grey ground, flat controls, Geist, one brand accent from theme.primaryColor, DataGrid, PhaseChevron. Use the kit; do not restyle to stock Tailwind.",
+    embedded: DESIGN_STANDARD_GUIDE
+  },
+  {
+    id: "css-and-styling",
+    title: "CSS and styling",
+    path: "/docs/integrations/shell/css-and-styling",
+    summary: "Tailwind is the default. Own CSS framework (Bootstrap, MUI, \u2026) uses FederatedStyleRoot and Shadow DOM \u2014 do not load it globally onto the Shell page.",
+    embedded: CSS_AND_STYLING_GUIDE
+  },
+  {
+    id: "databases",
+    title: "Databases",
+    path: "/docs/customer-portal/databases",
+    summary: "Dataplane is not a database. ArangoDB is ready through Dataplane. Postgres you deploy first, then use through Dataplane or on your own.",
+    embedded: DATABASES_GUIDE
   }
 ];
 function docUrl(entry) {
@@ -788,7 +985,7 @@ function suggestCli(intent, args) {
     case "deploy":
       return {
         command: name ? `gf deploy -n ${name}${ws}` : `gf deploy${ws}`,
-        why: 'Package the current (or --path) folder and deploy as a Coderunner. Workspace Authentication (groundfloor/external) must already be active. workloadType function|job|schedule|service (service = Deployment; requires a Dockerfile). Schedules need --schedule "<cron>" or groundfloor.json schedule. Node bootstrap: scripts.start, listen PORT||8080, bind 0.0.0.0. Do not create an App for this.',
+        why: 'Package the current (or --path) folder and deploy as a Coderunner. App authentication is optional (end-user login only). workloadType function|job|schedule|service (service = Deployment; requires a Dockerfile). Schedules need --schedule "<cron>" or groundfloor.json schedule. Node bootstrap: scripts.start, listen PORT||8080, bind 0.0.0.0. Do not create an App for this.',
         docs: "https://docs.groundfloor.cloud/docs/customer-portal/coderunner"
       };
     case "run":
@@ -847,10 +1044,17 @@ function suggestCli(intent, args) {
         why: "Dataplane is required for vault, files, and secrets.",
         docs: "https://docs.groundfloor.cloud/docs/customer-portal/developers"
       };
+    case "vault_token":
+    case "m2m_token":
+      return {
+        command: `gf m2m token${ws}`,
+        why: "Exchange GROUNDFLOOR_M2M_CLIENT_ID + GROUNDFLOOR_M2M_CLIENT_SECRET for a short Control Plane JWT. Call Vault and Files at $CONTROLPLANE_URL. Never DATAPLANE_SERVICE_API_KEY. gf token is a builder credential.",
+        docs: "https://docs.groundfloor.cloud/docs/customer-portal/m2m-tokens"
+      };
     default:
       return {
         command: "gf --help",
-        why: `Unknown intent "${intent}". Use login | switch_workspace | deploy | run | status | logs | environments | cancel_deployment | init_app | publish_app | secrets | dataplane.`,
+        why: `Unknown intent "${intent}". Use login | switch_workspace | deploy | run | status | logs | environments | cancel_deployment | init_app | publish_app | secrets | dataplane | vault_token.`,
         docs: "https://docs.groundfloor.cloud/docs/customer-portal/developers"
       };
   }
@@ -894,7 +1098,7 @@ async function resolveCoderunnerId(apiUrl, workspaceId, idOrSlug) {
 }
 var server = new McpServer({
   name: "groundfloor",
-  version: "0.1.6"
+  version: "0.1.7"
 });
 server.tool(
   "whoami",
@@ -921,7 +1125,7 @@ server.tool(
 );
 server.tool(
   "workspace_context",
-  "Live context for the selected workspace: session, coderunners, apps, dataplane, suggested gf commands, and Coderunner type/auth/Dockerfile/runtime-contract rules. Use docs_get id coderunner (or coderunner-runtime) before deploying.",
+  "Live context for the selected workspace: session, coderunners, apps, dataplane (access layer, not a database), databases_howto, suggested gf commands. Use docs_get id coderunner before deploying; id databases for data work; id css-and-styling for own CSS framework.",
   { workspace_id: wsId },
   async ({ workspace_id }) => {
     try {
@@ -955,7 +1159,7 @@ server.tool(
         coderunner_howto: {
           docs_get: "coderunner",
           runtime_contract: "coderunner-runtime",
-          before_create: "Enable Administer \u2192 Authentication (mode groundfloor or external, realm active). Mode none cannot mint a Code Runner JWT.",
+          before_create: "Team write can create Coderunners without App authentication. Site auth is optional (end-user login). Mode none uses Portal JWKS (GET /v1/public/jwks.json).",
           types: {
             function: "HTTP handler on PORT/8080 bound to 0.0.0.0. Invoke with gf coderunner run or the Deployment URL. Node requires package.json scripts.start.",
             job: "Run-to-completion worker. Deploy, then gf coderunner run.",
@@ -963,13 +1167,22 @@ server.tool(
             service: "Long-running Deployment (same type as service). Dockerfile at ZIP root is required. Listen on 8080 / 0.0.0.0."
           },
           node: "No Dockerfile \u2192 platform injects node:18-alpine CMD npm start EXPOSE 8080. Require scripts.start; listen on PORT||8080; bind 0.0.0.0. gf deploy fails fast if scripts.start is missing.",
-          local_live_data: 'eval "$(gf env)" then call Control Plane vault/files/secrets with Bearer $(gf token). Do not zip .env files.'
+          local_live_data: 'eval "$(gf env)". For files/secrets as a builder use Bearer $(gf token). For Vault/Files as the deployed workload, attach an M2M client and use Bearer $(gf m2m token). Never DATAPLANE_SERVICE_API_KEY. Do not zip .env files.'
         },
         shell_app_howto: {
           docs_get: "shell",
           rule: "Never invent a Vite + Module Federation app. gf apps init --slug <portal-slug>, npm install, npm run release, gf apps publish --path release.zip. Do not zip dist/ or upload only remoteEntry.js.",
+          css: "Tailwind is the default (docs_get id css-and-styling). Own framework: FederatedStyleRoot + ?inline CSS in Shadow DOM. Do not load a second CSS framework onto the Shell page.",
+          design: "docs_get id design-standard",
           suggest_cli: "init_app | publish_app"
         },
+        databases_howto: {
+          docs_get: "databases",
+          dataplane: "Dataplane is not a database. It is how Groundfloor talks to databases.",
+          say_first: "You have ArangoDB ready to use through Dataplane. If you want another database, deploy it first. You can use a deployed database through Dataplane, or connect to it on your own.",
+          arango: "Shared, managed, already there. Default for app data and Vault. No deploy step.",
+          deploy: "Postgres is what you can deploy today."
+        },
         actions: {
           deploy: suggestCli("deploy"),
           switch_workspace: suggestCli("switch_workspace"),
@@ -977,6 +1190,7 @@ server.tool(
           logs: suggestCli("logs"),
           environments: suggestCli("environments"),
           cancel_deployment: suggestCli("cancel_deployment"),
+          vault_token: suggestCli("m2m_token"),
           init_app: suggestCli("init_app"),
           publish_app: suggestCli("publish_app")
         },
@@ -1245,7 +1459,7 @@ server.tool(
 );
 server.tool(
   "dataplane_status",
-  "Dataplane setup status. Provision with `gf dataplane provision`.",
+  "Dataplane setup status (Dataplane is how Groundfloor talks to databases, not a database itself). ArangoDB is ready through it. Provision with `gf dataplane provision`.",
   { workspace_id: wsId },
   async ({ workspace_id }) => {
     try {
@@ -1275,10 +1489,10 @@ server.tool(
 );
 server.tool(
   "docs_get",
-  "How-to for Coderunner types, runtime contract (scripts.start, 0.0.0.0:8080), Dockerfile, Authentication, local live data, gf CLI, Shell. Pass id from docs_list. Prefer id coderunner or coderunner-runtime before deploying.",
+  "How-to for Coderunner, Shell, design-standard, css-and-styling, databases, access, m2m. Pass id from docs_list. Prefer id coderunner or coderunner-runtime before deploying. For site grants use id access. For Coderunner Vault/Files use id m2m.",
   {
     id: z.string().min(1).describe(
-      "Catalog id, e.g. coderunner | coderunner-runtime | coderunner-overview | agents | developers | authentication | api-authentication | shell"
+      "Catalog id, e.g. coderunner | coderunner-runtime | shell | design-standard | css-and-styling | databases | agents | developers | authentication | access | m2m"
     )
   },
   async ({ id }) => {
@@ -1313,10 +1527,12 @@ server.tool(
       "init_app",
       "publish_app",
       "secrets",
-      "dataplane"
+      "dataplane",
+      "vault_token",
+      "m2m_token"
     ]),
     workspace: z.string().optional(),
-    name: z.string().optional().describe("Coderunner name/id for deploy/run/status/logs/cancel_deployment"),
+    name: z.string().optional().describe("Coderunner name/id for deploy/run/status/logs/cancel_deployment/vault_token"),
     slug: z.string().optional().describe("Portal app slug for init_app / publish_app"),
     cell: z.enum(["production", "stage", "dev"]).optional()
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groundfloorcloud/mcp",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "Groundfloor MCP — inspect workspace state and docs; take actions with the gf CLI.",
   "type": "module",
   "bin": {