@groundfloorcloud/mcp 0.1.7 → 0.1.9

package/README.md

@@ -74,8 +74,8 @@ The `command` must be your Node (from `which node`), not `npx` and not Cursor’
 | `coderunner_cancel_deployment` | Delete current (or given) deployment |
 | `apps_list` / `apps_get` | Inspect product Apps |
 | `secrets_list` / `files_list` / `domains_list` / `dataplane_status` | Inspect (no secrets values) |
-| `docs_list` / `docs_get` | Product docs (`coderunner`, `shell`, `design-standard`, `css-and-styling`, `databases` are embedded how-tos) |
-| `suggest_cli` | Command to run: login, deploy, init_app, publish_app, … |
+| `docs_list` / `docs_get` | Product docs (`coderunner`, `shell`, `design-standard`, `css-and-styling`, `databases` are embedded; `access` and `m2m` are live pages) |
+| `suggest_cli` | Command to run: login, deploy, init_app, publish_app, m2m_token, … |
 
 Never create `app_kind=coderunner`. Deploy with `gf deploy`.
 
@@ -91,10 +91,10 @@ is ready through Dataplane; Postgres is what you can deploy today.
 `coderunner-overview`). That page covers:
 
 - Types: `function`, `job`, `schedule`, `service` (**also called Deployment**)
-- **Authentication must be active** before creating a coderunner
+- App authentication is optional (end-user login); not required to create a coderunner
 - **Dockerfile is required** for `service` / Deployment
 - Runtime contract: Node `scripts.start`, listen on `PORT`/8080, bind `0.0.0.0` (`docs_get` id `coderunner-runtime`)
-- Local development against live vault/files/secrets (`gf env` + `gf token`)
+- Local development against live vault/files/secrets (`gf env`; as the workload use `gf m2m token`, not `gf token`)
 
 `workspace_context` includes a `coderunner_howto` summary so agents see this
 without an extra fetch.

package/dist/index.js

@@ -169,11 +169,31 @@ var CpError = class extends Error {
   }
   status;
 };
+function formatCpErrorDetail(detail, fallback) {
+  if (typeof detail === "string" && detail.trim()) return detail.trim();
+  if (detail && typeof detail === "object") {
+    const obj = detail;
+    if (typeof obj.message === "string" && obj.message.trim()) {
+      return obj.message.trim();
+    }
+    if (typeof obj.detail === "string" && obj.detail.trim()) {
+      return obj.detail.trim();
+    }
+    try {
+      return JSON.stringify(detail);
+    } catch {
+      return fallback;
+    }
+  }
+  return fallback;
+}
 async function parseError(res) {
   let detail = res.statusText;
   try {
     const body = await res.json();
-    if (body?.detail) detail = String(body.detail);
+    if (body?.detail !== void 0) {
+      detail = formatCpErrorDetail(body.detail, res.statusText);
+    }
   } catch {
   }
   return `${res.status} ${detail}`;
@@ -504,13 +524,11 @@ Also \`docs_get\` id \`coderunner-runtime\`.
 
 ## Prerequisites (do these before create/deploy)
 
-1. **Workspace Authentication is required** before creating a coderunner.
-   Portal \u2192 Administer \u2192 Authentication \u2192 set mode to \`groundfloor\` (or
-   \`external\` with an issuer) and wait until the realm is **active**.
-   Code Runner JWTs use the workspace site issuer. Mode \`none\` cannot mint
-   that token \u2014 create/deploy fails with "requires the workspace site issuer".
-2. \`gf login\` (\`--stage\` / \`--dev\` as needed) and \`gf workspaces use <uuid>\`.
-3. Dataplane for vault/files/secrets: \`gf dataplane provision\` if those APIs
+1. \`gf login\` (\`--stage\` / \`--dev\` as needed) and \`gf workspaces use <uuid>\`.
+   Team **write** can create Coderunners without App authentication. Site auth
+   (Groundfloor/external) is only for end-user login. Mode \`none\` mints
+   management JWTs against Portal JWKS (\`GET /v1/public/jwks.json\`).
+2. Dataplane for vault/files: \`gf dataplane provision\` if those APIs
    are needed (local live data or the deployed workload).
 
 ## Workload types
@@ -549,7 +567,9 @@ Pick **one** type per coderunner. Changing type later means a new coderunner.
 - Same as job, plus a cron expression at deploy:
   \`gf deploy --workload-type schedule --schedule "<cron>"\`
   (or \`groundfloor.json\` \`"schedule"\`).
-- No public invoke URL. Debug with Process Log, not curl.
+- GET/list/status expose top-level \`workload_type\` and \`schedule\`.
+  \`gf coderunner status -c <slug>\` prints type, schedule, last_job.
+- No public invoke URL. Debug with \`gf coderunner logs\`, not curl.
 
 ### Service (Deployment)
 
@@ -613,21 +633,47 @@ curl -sS -X POST http://127.0.0.1:8080/ -H 'Content-Type: application/json' \\
 
 Live vault / files / secrets from the laptop:
 
+\`gf token\` is a **builder** credential. Use it for operator Vault. To call
+Vault and Files as a Coderunner does, use an M2M client and \`gf m2m token\`.
+
 \`\`\`bash
+# Builder token:
 curl -sS -H "Authorization: Bearer $(gf token)" \\
   "$CONTROLPLANE_URL/v1/workspaces/$GROUNDFLOOR_WORKSPACE_ID/vault/collections"
+
+# M2M (same class as an attached Coderunner):
+curl -sS -H "Authorization: Bearer $(gf m2m token)" \\
+  "$CONTROLPLANE_URL/v1/workspaces/$GROUNDFLOOR_WORKSPACE_ID/vault/collections"
+curl -sS -H "Authorization: Bearer $(gf m2m token)" \\
+  "$CONTROLPLANE_URL/v1/workspaces/$GROUNDFLOOR_WORKSPACE_ID/files"
 \`\`\`
 
-In app code, use \`CONTROLPLANE_URL\` + Bearer (\`gf token\` locally;
-injected env / workspace secrets after \`gf deploy\`). Never put
-\`DATAPLANE_SERVICE_API_KEY\` in a browser bundle.
+In app code, use \`CONTROLPLANE_URL\` + Bearer from
+\`POST \u2026/m2m/token\` (\`gf m2m token\` locally; injected
+\`GROUNDFLOOR_M2M_CLIENT_ID\` / \`GROUNDFLOOR_M2M_CLIENT_SECRET\` after
+\`gf deploy\`). Never put \`DATAPLANE_SERVICE_API_KEY\` in a browser bundle
+or customer env.
 
 When the handler looks right locally, \`gf deploy\` the same tree.
 
+## Secrets on deploy
+
+Do not pass credential-shaped keys as \`--env KEY=VALUE\` (\`*_SECRET\`,
+\`*_API_KEY\`, \`DATABASE_URL\`, \u2026). Control Plane returns **422**.
+\`gf secrets set KEY\` then \`gf deploy --secret KEY\` (inject by reference).
+
+## M2M tokens (Vault and Files)
+
+New Coderunners cannot call Vault or Files until an M2M client is attached
+and the workload is redeployed. Create the client in Portal **Administer \u2192
+M2M tokens**, attach it on the Coderunner card, then deploy. v1 M2M is Team
+Writer on that workspace (full Vault skip-ACL + Files). Grant site users on
+**Administer \u2192 Access**. Never inject a Dataplane key.
+
 ## Agent actions
 
 Inspect: \`workspace_context\`, \`docs_get\` id \`coderunner\` or \`coderunner-runtime\`, \`suggest_cli\`.
-Act: \`gf deploy\`, \`gf coderunner run|status\`. MCP does not deploy.
+Act: \`gf deploy\`, \`gf coderunner run|status|logs\`, \`gf m2m token\`, \`gf identities ls|mint\`, \`gf api\`. MCP does not deploy.
 `.trim();
 
 // src/css-and-styling-guide.ts
@@ -673,30 +719,46 @@ Dataplane is not a database. It is how Groundfloor talks to databases.
 When the user starts any data or database work, say this first. Do not mention
 infrastructure internals (cluster operators, installers, and the like):
 
-You have ArangoDB ready to use through Dataplane. If you want another
-database, deploy it first. You can use a deployed database through Dataplane,
-or connect to it on your own.
+You have Postgres ready to use through Dataplane \u2014 a shared, platform-managed
+cluster, already there, no deploy step. If you want a different engine, or a
+database that is entirely your own (own scaling, own backups schedule), you
+can deploy one first.
 
 ## Options
 
-- ArangoDB \u2014 shared, managed, already there. Default for app data and Vault.
-  No deploy step. Query via Control Plane vault:
-  POST /v1/workspaces/{id}/vault/collections/{name}/query
-- Postgres \u2014 what you can deploy today (portal Data \u2192 Databases). After it is
-  ready, use it through Dataplane or with the connection secrets.
+- Postgres (shared) \u2014 platform-managed, already there. Default for app data
+  and Vault. No deploy step. This is NOT a workspace-owned resource: it does
+  not appear on the customer Databases page, and there is nothing to scale,
+  back up, or delete yourself \u2014 it's offered, not provisioned. Query via
+  Control Plane vault: POST /v1/workspaces/{id}/vault/collections/{name}/query
+- ArangoDB \u2014 also shared, managed, already there, no deploy step. Still fully
+  supported; just no longer the pre-selected engine for new collections.
+- A dedicated database you deploy and own (Postgres, Redis, ClickHouse,
+  Qdrant) \u2014 portal Data \u2192 Databases, or
+  POST /v1/workspaces/{id}/managed-databases. Heavier than the shared
+  default: you own its scaling, backups, and lifecycle. Use this when you
+  need a tier/engine the shared default doesn't offer (Redis, ClickHouse,
+  Qdrant) or want a database isolated to this workspace.
 - A database they already run \u2014 through Dataplane if they wire it, or direct.
 
 Do not list other engines as available to deploy. Do not call Dataplane hosts
 from apps or embed service keys.
 
+## Creating a collection / table
+
+Pass the engine explicitly \u2014 do not rely on Dataplane's default connector
+resolution. POST /v1/workspaces/{id}/vault/collections with
+\`"schema": {"engine": "postgresql", ...}\` for the shared default, or
+\`"engine": "arangodb"\` to use ArangoDB instead.
+
 ## Paths
 
 - Browse / edit rows \u2192 Data Vault (portal or vault APIs)
-- Deploy Postgres \u2192 Customer Portal Databases page, or
-  POST /v1/workspaces/{id}/managed-databases with engine postgres
+- Deploy your own database \u2192 Customer Portal Databases page, or
+  POST /v1/workspaces/{id}/managed-databases with engine postgres|redis|clickhouse|qdrant
 - Shell 403 / empty vault \u2192 collection Access for the site role
 
-docs_get id databases. Human docs: /docs/customer-portal/databases
+docs_get id databases. Human docs: /docs/customer-portal/databases and /docs/customer-portal/data-vault
 `;
 
 // src/design-standard-guide.ts
@@ -771,17 +833,20 @@ gf apps publish --path release.zip
 \`\`\`
 
 \`npm run release\` packs **all** of dist/assets (remoteEntry.js + hashed
-\`__federation_*.js\` + CSS) at the zip root. Do not zip \`dist/\`. Do not
-upload a lone \`remoteEntry.js\`. \`gf apps publish\` rejects incomplete zips.
+\`__federation_*.js\` + CSS) at the zip root and rewrites \`./assets/\` imports
+in remoteEntry.js. Do not zip \`dist/\`. Do not upload a lone \`remoteEntry.js\`.
+\`gf apps publish\` rejects incomplete zips.
 
 Production builds use Vite \`base: './'\` so imported images resolve next to
 remoteEntry.js. Header logos: manifest \`theme.logoUrl\` (absolute https).
 UI look: \`docs_get\` id \`design-standard\`. CSS: Tailwind by default;
 own framework uses FederatedStyleRoot (Shadow DOM) \u2014 \`docs_get\` id
 \`css-and-styling\`. Data: Dataplane is not a database. Say first: you have
-ArangoDB ready through Dataplane; deploy Postgres if you want another
-database; use it through Dataplane or on your own (\`docs_get\` id
-\`databases\`). Local UI without live vault: \`npm run dev:fixtures\`.
+Postgres (shared, platform-managed, no deploy step) ready through Dataplane
+by default; ArangoDB is also ready the same way. Deploy your own dedicated
+database only if you need a different engine or workspace-owned isolation
+(\`docs_get\` id \`databases\`). Local UI without live vault:
+\`npm run dev:fixtures\`.
 
 ## suggest_cli
 
@@ -789,6 +854,86 @@ database; use it through Dataplane or on your own (\`docs_get\` id
 - publish_app \u2192 init + npm install + npm run release + gf apps publish --path release.zip
 `;
 
+// src/vault-guide.ts
+var VAULT_GUIDE = `
+# Data Vault collections
+
+Vault is workspace data behind Control Plane
+\`/v1/workspaces/{workspace_id}/vault/\u2026\`. Browser apps send the Shell JWT.
+Coderunners use \`gf m2m token\` (preferred) or a workload-identity Vault JWT.
+
+## Create a collection (JSON Schema)
+
+POST \`/v1/workspaces/{id}/vault/collections\` with a **JSON Schema** object
+(\`type: object\`, \`properties\`, optional \`required\`). A missing schema is a
+**400** with a field error \u2014 not a 500.
+
+Pass \`engine\` explicitly \u2014 don't rely on Dataplane's default connector.
+\`"postgresql"\` is the platform default (shared, no deploy step);
+\`"arangodb"\` is also available the same way.
+
+Example:
+
+\`\`\`json
+{
+  "name": "properties",
+  "engine": "postgresql",
+  "schema": {
+    "type": "object",
+    "properties": {
+      "name": { "type": "string" },
+      "metadata": { "type": "object" }
+    },
+    "required": ["name"]
+  }
+}
+\`\`\`
+
+Or use \`gf api -X POST /v1/workspaces/{workspace_id}/vault/collections --body '{...}'\`.
+
+\`GET \u2026/vault/collections\` lists schema-registered collections. Implicit
+tables created by the first \`POST \u2026/vault/{collection}\` appear when you pass
+\`include_implicit=true\` (or after a schema create).
+
+## Query totals
+
+\`POST \u2026/vault/{collection}/query\` \`total\` is the **unpaged** match count.
+\`limit\` only sizes \`records\`. Do not treat \`total === records.length\` as
+the full table size.
+
+## Filters
+
+Top-level fields work in \`filter\`. Nested paths such as \`metadata.sector\`
+are either supported by the connector or rejected with **400 unsupported
+path** \u2014 never a silent empty page.
+
+## ACLs
+
+Grant site roles on **Administer \u2192 Access**. Workload identities get
+collection grants via \`PUT \u2026/vault/collections/{name}/acl\`. M2M is Team
+Writer (workspace-wide), not an Access subject.
+
+## Identities vs M2M
+
+- Unattended Coderunners: attach an M2M client, \`gf deploy\`, then
+  \`gf m2m token\`.
+- Workload identity mint: \`gf identities mint --identity <id>\`. The **first**
+  mint returns \`refresh_secret\` once. Later mints omit it unless
+  \`--rotate-refresh\`. Prefer M2M for new workloads.
+
+## Scheduled jobs
+
+\`gf deploy --workload-type schedule --schedule "<cron>"\`.
+\`gf coderunner status -c <slug>\` shows **type**, **schedule**, and **last_job**.
+\`gf coderunner logs -c <slug>\` shows stdout. There is no public URL for
+schedules.
+
+## Secrets on deploy
+
+Do not \`--env SENDGRID_SECRET=\u2026\`. That is **422**.
+\`gf secrets set SENDGRID_SECRET\` then \`gf deploy --secret SENDGRID_SECRET\`.
+`.trim();
+
 // src/docs.ts
 var DOCS_ORIGIN = "https://docs.groundfloor.cloud";
 var DOC_CATALOG = [
@@ -796,19 +941,19 @@ var DOC_CATALOG = [
     id: "agents",
     title: "Deploy with agents",
     path: "/docs/customer-portal/agents",
-    summary: "How agents should deploy Coderunner workloads and init/publish Shell apps with gf / MCP. Enable workspace Authentication before create. Service (Deployment) requires a Dockerfile. Shell apps: gf apps init, never invent App.tsx."
+    summary: "How agents should deploy Coderunner workloads and init/publish Shell apps with gf / MCP. App authentication is optional (end-user login). Service (Deployment) requires a Dockerfile. Shell apps: gf apps init, never invent App.tsx."
   },
   {
     id: "developers",
     title: "Developers (gf CLI)",
     path: "/docs/customer-portal/developers",
-    summary: "gf login, workspaces, deploy, secrets, files, apps. Coderunner types: function, job, schedule, service (also called Deployment)."
+    summary: "gf login, workspaces, deploy, secrets, files, apps, gf m2m token. Coderunner types: function, job, schedule, service (also called Deployment). App authentication optional."
   },
   {
     id: "coderunner",
     title: "Coderunner",
     path: "/docs/customer-portal/coderunner",
-    summary: "Workload types (function, job, schedule, service/Deployment), runtime contract (scripts.start, 0.0.0.0:8080), Dockerfile for services, Authentication before create, local live data, gf deploy.",
+    summary: "Workload types (function, job, schedule, service/Deployment), runtime contract (scripts.start, 0.0.0.0:8080), Dockerfile for services, Coderunner identities for Vault, App authentication optional, local live data, gf deploy.",
     embedded: CODERUNNER_GUIDE
   },
   {
@@ -822,14 +967,26 @@ var DOC_CATALOG = [
     id: "coderunner-overview",
     title: "Coderunner overview",
     path: "/docs/integrations/coderunner/overview",
-    summary: "Architecture and lifecycle. Prefer docs_get id coderunner for type usage, Dockerfile, and auth prerequisites.",
+    summary: "Architecture and lifecycle. Prefer docs_get id coderunner for type usage, Dockerfile, and create prerequisites.",
     embedded: CODERUNNER_GUIDE
   },
   {
     id: "authentication",
     title: "Workspace Authentication",
     path: "/docs/customer-portal/authentication",
-    summary: "Workspace site auth (Groundfloor or external) must be active before creating a Coderunner. Separate from portal Team."
+    summary: "Workspace site auth (Groundfloor or external) is optional end-user login. Leaving Groundfloor keeps the realm (disabled) until Delete Groundfloor login. Separate from portal Team. Not required to create Apps or Coderunners."
+  },
+  {
+    id: "access",
+    title: "Access",
+    path: "/docs/customer-portal/access",
+    summary: "Grant site roles Data Vault collections, workspace-wide Files, and Apps launch. Admin is implicit. M2M is not an Access subject. Team membership is unchanged."
+  },
+  {
+    id: "m2m",
+    title: "M2M tokens",
+    path: "/docs/customer-portal/m2m-tokens",
+    summary: "Confidential client secret \u2192 short Control Plane JWT (typ=m2m). Attach on Coderunner or gf m2m token. Never DATAPLANE_SERVICE_API_KEY. v1 is Team Writer, no collection ACL."
   },
   {
     id: "api-authentication",
@@ -862,8 +1019,22 @@ var DOC_CATALOG = [
     id: "databases",
     title: "Databases",
     path: "/docs/customer-portal/databases",
-    summary: "Dataplane is not a database. ArangoDB is ready through Dataplane. Postgres you deploy first, then use through Dataplane or on your own.",
+    summary: "Dataplane is not a database. Postgres (shared, platform-managed) is the default, ready through Dataplane with no deploy step. ArangoDB is also ready the same way. A dedicated database you deploy and own is a separate, heavier path.",
     embedded: DATABASES_GUIDE
+  },
+  {
+    id: "vault",
+    title: "Data Vault",
+    path: "/docs/api/vault",
+    summary: "Create collections with JSON Schema, query totals vs limit, ACLs, implicit tables, nested filters, identities vs M2M.",
+    embedded: VAULT_GUIDE
+  },
+  {
+    id: "scheduled-jobs",
+    title: "Scheduled jobs",
+    path: "/docs/customer-portal/scheduled-jobs",
+    summary: "workload_type=schedule plus cron. gf coderunner status shows type/schedule/last_job. Use Process Log, not a public URL.",
+    embedded: CODERUNNER_GUIDE
   }
 ];
 function docUrl(entry) {
@@ -934,7 +1105,7 @@ function suggestCli(intent, args) {
     case "deploy":
       return {
         command: name ? `gf deploy -n ${name}${ws}` : `gf deploy${ws}`,
-        why: 'Package the current (or --path) folder and deploy as a Coderunner. Workspace Authentication (groundfloor/external) must already be active. workloadType function|job|schedule|service (service = Deployment; requires a Dockerfile). Schedules need --schedule "<cron>" or groundfloor.json schedule. Node bootstrap: scripts.start, listen PORT||8080, bind 0.0.0.0. Do not create an App for this.',
+        why: 'Package the current (or --path) folder and deploy as a Coderunner. App authentication is optional (end-user login only). workloadType function|job|schedule|service (service = Deployment; requires a Dockerfile). Schedules need --schedule "<cron>" or groundfloor.json schedule. Node bootstrap: scripts.start, listen PORT||8080, bind 0.0.0.0. Do not create an App for this.',
         docs: "https://docs.groundfloor.cloud/docs/customer-portal/coderunner"
       };
     case "run":
@@ -993,10 +1164,17 @@ function suggestCli(intent, args) {
         why: "Dataplane is required for vault, files, and secrets.",
         docs: "https://docs.groundfloor.cloud/docs/customer-portal/developers"
       };
+    case "vault_token":
+    case "m2m_token":
+      return {
+        command: `gf m2m token${ws}`,
+        why: "Exchange GROUNDFLOOR_M2M_CLIENT_ID + GROUNDFLOOR_M2M_CLIENT_SECRET for a short Control Plane JWT. Call Vault and Files at $CONTROLPLANE_URL. Never DATAPLANE_SERVICE_API_KEY. gf token is a builder credential.",
+        docs: "https://docs.groundfloor.cloud/docs/customer-portal/m2m-tokens"
+      };
     default:
       return {
         command: "gf --help",
-        why: `Unknown intent "${intent}". Use login | switch_workspace | deploy | run | status | logs | environments | cancel_deployment | init_app | publish_app | secrets | dataplane.`,
+        why: `Unknown intent "${intent}". Use login | switch_workspace | deploy | run | status | logs | environments | cancel_deployment | init_app | publish_app | secrets | dataplane | vault_token.`,
         docs: "https://docs.groundfloor.cloud/docs/customer-portal/developers"
       };
   }
@@ -1101,7 +1279,7 @@ server.tool(
         coderunner_howto: {
           docs_get: "coderunner",
           runtime_contract: "coderunner-runtime",
-          before_create: "Enable Administer \u2192 Authentication (mode groundfloor or external, realm active). Mode none cannot mint a Code Runner JWT.",
+          before_create: "Team write can create Coderunners without App authentication. Site auth is optional (end-user login). Mode none uses Portal JWKS (GET /v1/public/jwks.json).",
           types: {
             function: "HTTP handler on PORT/8080 bound to 0.0.0.0. Invoke with gf coderunner run or the Deployment URL. Node requires package.json scripts.start.",
             job: "Run-to-completion worker. Deploy, then gf coderunner run.",
@@ -1109,7 +1287,7 @@ server.tool(
             service: "Long-running Deployment (same type as service). Dockerfile at ZIP root is required. Listen on 8080 / 0.0.0.0."
           },
           node: "No Dockerfile \u2192 platform injects node:18-alpine CMD npm start EXPOSE 8080. Require scripts.start; listen on PORT||8080; bind 0.0.0.0. gf deploy fails fast if scripts.start is missing.",
-          local_live_data: 'eval "$(gf env)" then call Control Plane vault/files/secrets with Bearer $(gf token). Do not zip .env files.'
+          local_live_data: 'eval "$(gf env)". For files/secrets as a builder use Bearer $(gf token). For Vault/Files as the deployed workload, attach an M2M client and use Bearer $(gf m2m token). Never DATAPLANE_SERVICE_API_KEY. Do not zip .env files.'
         },
         shell_app_howto: {
           docs_get: "shell",
@@ -1121,9 +1299,10 @@ server.tool(
         databases_howto: {
           docs_get: "databases",
           dataplane: "Dataplane is not a database. It is how Groundfloor talks to databases.",
-          say_first: "You have ArangoDB ready to use through Dataplane. If you want another database, deploy it first. You can use a deployed database through Dataplane, or connect to it on your own.",
-          arango: "Shared, managed, already there. Default for app data and Vault. No deploy step.",
-          deploy: "Postgres is what you can deploy today."
+          say_first: "You have Postgres ready to use through Dataplane \u2014 shared, platform-managed, already there, no deploy step. ArangoDB is also available the same way. If you want your own dedicated database instead, deploy it first.",
+          shared_postgres: 'Default for app data and Vault. Platform-managed, not workspace-owned \u2014 nothing to scale/backup/delete yourself. Pass engine "postgresql" explicitly when creating a collection.',
+          arango: "Also shared, managed, already there, no deploy step. Still fully supported; just no longer pre-selected.",
+          deploy: "A dedicated Postgres/Redis/ClickHouse/Qdrant you own is what you can deploy today (portal Data \u2192 Databases)."
         },
         actions: {
           deploy: suggestCli("deploy"),
@@ -1132,6 +1311,7 @@ server.tool(
           logs: suggestCli("logs"),
           environments: suggestCli("environments"),
           cancel_deployment: suggestCli("cancel_deployment"),
+          vault_token: suggestCli("m2m_token"),
           init_app: suggestCli("init_app"),
           publish_app: suggestCli("publish_app")
         },
@@ -1400,7 +1580,7 @@ server.tool(
 );
 server.tool(
   "dataplane_status",
-  "Dataplane setup status (Dataplane is how Groundfloor talks to databases, not a database itself). ArangoDB is ready through it. Provision with `gf dataplane provision`.",
+  "Dataplane setup status (Dataplane is how Groundfloor talks to databases, not a database itself). Postgres (shared, platform-managed) is ready through it by default; ArangoDB is also ready. Provision with `gf dataplane provision`.",
   { workspace_id: wsId },
   async ({ workspace_id }) => {
     try {
@@ -1430,10 +1610,10 @@ server.tool(
 );
 server.tool(
   "docs_get",
-  "How-to for Coderunner, Shell, design-standard, css-and-styling, databases. Pass id from docs_list. Prefer id coderunner or coderunner-runtime before deploying. For data work use id databases. For own CSS framework use id css-and-styling.",
+  "How-to for Coderunner, Shell, design-standard, css-and-styling, databases, access, m2m. Pass id from docs_list. Prefer id coderunner or coderunner-runtime before deploying. For site grants use id access. For Coderunner Vault/Files use id m2m.",
   {
     id: z.string().min(1).describe(
-      "Catalog id, e.g. coderunner | coderunner-runtime | shell | design-standard | css-and-styling | databases | agents | developers | authentication"
+      "Catalog id, e.g. coderunner | coderunner-runtime | shell | design-standard | css-and-styling | databases | agents | developers | authentication | access | m2m"
     )
   },
   async ({ id }) => {
@@ -1468,10 +1648,12 @@ server.tool(
       "init_app",
       "publish_app",
       "secrets",
-      "dataplane"
+      "dataplane",
+      "vault_token",
+      "m2m_token"
     ]),
     workspace: z.string().optional(),
-    name: z.string().optional().describe("Coderunner name/id for deploy/run/status/logs/cancel_deployment"),
+    name: z.string().optional().describe("Coderunner name/id for deploy/run/status/logs/cancel_deployment/vault_token"),
     slug: z.string().optional().describe("Portal app slug for init_app / publish_app"),
     cell: z.enum(["production", "stage", "dev"]).optional()
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groundfloorcloud/mcp",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Groundfloor MCP — inspect workspace state and docs; take actions with the gf CLI.",
   "type": "module",
   "bin": {