@mgsoftwarebv/mg-dashboard-mcp 4.0.0 → 5.0.1

package/dist/index.js

@@ -296,16 +296,21 @@ var TRIGGER_TOOLS = [
   },
   {
     name: "trigger-runs",
-    description: "List recent task runs for a Trigger.dev project. Returns run ID, task name, status, duration, and timestamps.",
+    description: "List recent task runs for a Trigger.dev project. Returns run ID, task name, status, duration, and timestamps.\n\nCommon shortcuts: `failedOnly: true` returns only FAILED/CRASHED/SYSTEM_FAILURE/INTERRUPTED/TIMED_OUT. `sinceMinutes: 60` filters to runs created in the last hour (combines with status/taskIdentifier).",
     inputSchema: {
       type: "object",
       properties: {
         project: { type: "string", description: 'Project slug from trigger-list (e.g. "mg-dashboard-bHfS")' },
         status: {
           type: "string",
-          description: "Comma-separated status filter: QUEUED,EXECUTING,COMPLETED,FAILED,CRASHED,CANCELED,SYSTEM_FAILURE"
+          description: "Comma-separated status filter: QUEUED,EXECUTING,COMPLETED,FAILED,CRASHED,CANCELED,SYSTEM_FAILURE. Ignored when failedOnly is true."
+        },
+        failedOnly: {
+          type: "boolean",
+          description: "Shortcut: only return FAILED + CRASHED + SYSTEM_FAILURE + INTERRUPTED + TIMED_OUT runs. Overrides `status` when true."
         },
         taskIdentifier: { type: "string", description: 'Filter by task identifier (e.g. "hello-world")' },
+        sinceMinutes: { type: "number", description: "Only runs created in the last N minutes (uses Trigger filter[from]). Max 10080 (= 1 week)." },
         limit: { type: "number", description: "Max runs to return (default 20, max 100)" }
       },
       required: ["project"]
@@ -489,8 +494,18 @@ ${lines.join("\n")}` }] };
       const instance = await discoverInstance(project, conn, proxy, sshExec2);
       const limit = Math.min(Math.max(Number(args2.limit) || 20, 1), 100);
       const queryParts = [`page%5Bsize%5D=${limit}`];
-      if (args2.status) queryParts.push(`filter%5Bstatus%5D=${String(args2.status)}`);
-      if (args2.taskIdentifier) queryParts.push(`filter%5BtaskIdentifier%5D=${String(args2.taskIdentifier)}`);
+      const failedOnly = args2.failedOnly === true;
+      const statusArg = failedOnly ? "FAILED,CRASHED,SYSTEM_FAILURE,INTERRUPTED,TIMED_OUT" : args2.status ? String(args2.status) : "";
+      if (statusArg) queryParts.push(`filter%5Bstatus%5D=${encodeURIComponent(statusArg)}`);
+      if (args2.taskIdentifier) {
+        queryParts.push(`filter%5BtaskIdentifier%5D=${encodeURIComponent(String(args2.taskIdentifier))}`);
+      }
+      const sinceMinutes = Number(args2.sinceMinutes);
+      if (Number.isFinite(sinceMinutes) && sinceMinutes > 0) {
+        const capped = Math.min(sinceMinutes, 10080);
+        const fromMs = Date.now() - capped * 6e4;
+        queryParts.push(`filter%5Bfrom%5D=${fromMs}`);
+      }
       const rawJson = await triggerApi(
         conn,
         proxy,
@@ -669,6 +684,41 @@ var VERCEL_TOOLS = [
       required: ["project"]
     }
   },
+  {
+    name: "vercel-domains",
+    description: 'Manage domains attached to a Vercel project. Use `action` to pick the operation:\n- "list" (default): list all domains attached to the project, including verification status and any redirect.\n- "add": attach a new domain to the project. Returns DNS records to set if the domain is not yet verified.\n- "verify": re-check verification status and surface required CNAME / A / TXT records if misconfigured.\n- "remove": detach a domain from the project.\nPick the project via vercel-projects first.',
+    inputSchema: {
+      type: "object",
+      properties: {
+        action: {
+          type: "string",
+          enum: ["list", "add", "remove", "verify"],
+          description: "Which operation to perform (default: list)."
+        },
+        project: {
+          type: "string",
+          description: "Vercel project ID or name (from vercel-projects)."
+        },
+        domain: {
+          type: "string",
+          description: 'Domain name (required for action="add", "remove", or "verify").'
+        },
+        gitBranch: {
+          type: "string",
+          description: 'Optional git branch this domain should deploy from (action="add" only).'
+        },
+        redirect: {
+          type: "string",
+          description: 'Optional redirect target domain (action="add" only).'
+        },
+        redirectStatusCode: {
+          type: "number",
+          description: 'Optional redirect status code, e.g. 301 / 302 / 307 / 308 (action="add" only).'
+        }
+      },
+      required: ["project"]
+    }
+  },
   {
     name: "vercel-logs",
     description: 'Unified log inspector for Vercel. Use `kind` to pick the source:\n- "build" (default): build / deployment console events (stdout, stderr, command, exit). Requires deploymentId.\n- "runtime": runtime / function logs after a successful build. Requires project + deploymentId.\n- "webhooks": our own vercel_webhook_logs table (Telegram / push delivery history). No deployment needed.\nPick deployments via vercel-deployments first.',
@@ -698,7 +748,7 @@ var VERCEL_TOOLS = [
         },
         sinceMinutes: {
           type: "number",
-          description: 'Time window in minutes (kind="runtime" only, default 60, max 7 days).'
+          description: `Time window in minutes (kind="runtime" only, max 7 days). When omitted, the tool auto-detects the deployment's created timestamp and queries from there with a 5-minute buffer \u2014 so you don't miss logs by picking a too-small window.`
         },
         limit: {
           type: "number",
@@ -712,11 +762,14 @@ var VERCEL_TOOL_NAMES = new Set(VERCEL_TOOLS.map((t) => t.name));
 var VERCEL_TOOL_MODULE_MAP = {
   "vercel-projects": "ci_cd",
   "vercel-deployments": "ci_cd",
-  "vercel-logs": "ci_cd"
+  "vercel-logs": "ci_cd",
+  "vercel-domains": "ci_cd"
 };
-async function vercelFetch(token, path) {
+async function vercelFetch(token, path, init) {
   const res = await fetch(`${VERCEL_API}${path}`, {
-    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" }
+    method: init?.method ?? "GET",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+    body: init?.body !== void 0 ? JSON.stringify(init.body) : void 0
   });
   const body = await res.text();
   let parsed = null;
@@ -800,6 +853,14 @@ async function getDeploymentBuildEvents(token, deploymentId, limit) {
   }
   return { events, error: null };
 }
+async function getDeploymentCreatedMs(token, deploymentId) {
+  const res = await vercelFetch(
+    token,
+    `/v13/deployments/${encodeURIComponent(deploymentId)}`
+  );
+  if (res.error || !res.data) return null;
+  return res.data.createdAt ?? res.data.created ?? null;
+}
 async function getRuntimeLogs(token, projectIdOrName, deploymentId, limit, sinceMs) {
   const params = new URLSearchParams({
     limit: String(Math.min(Math.max(limit, 1), 1e3))
@@ -840,6 +901,47 @@ async function getRuntimeLogs(token, projectIdOrName, deploymentId, limit, since
   }
   return { logs, error: null };
 }
+async function listProjectDomains(token, projectId) {
+  const res = await vercelFetch(
+    token,
+    `/v9/projects/${encodeURIComponent(projectId)}/domains?limit=100`
+  );
+  if (res.error) return { domains: [], error: res.error };
+  return { domains: res.data?.domains ?? [], error: null };
+}
+async function addProjectDomain(token, projectId, body) {
+  const res = await vercelFetch(
+    token,
+    `/v10/projects/${encodeURIComponent(projectId)}/domains`,
+    { method: "POST", body }
+  );
+  if (res.error) return { domain: null, error: res.error };
+  return { domain: res.data, error: null };
+}
+async function removeProjectDomain(token, projectId, domain) {
+  const res = await vercelFetch(
+    token,
+    `/v9/projects/${encodeURIComponent(projectId)}/domains/${encodeURIComponent(domain)}`,
+    { method: "DELETE" }
+  );
+  return { error: res.error };
+}
+async function getProjectDomain(token, projectId, domain) {
+  const res = await vercelFetch(
+    token,
+    `/v9/projects/${encodeURIComponent(projectId)}/domains/${encodeURIComponent(domain)}`
+  );
+  if (res.error) return { domain: null, error: res.error };
+  return { domain: res.data, error: null };
+}
+async function getDomainConfig(token, domain) {
+  const res = await vercelFetch(
+    token,
+    `/v6/domains/${encodeURIComponent(domain)}/config`
+  );
+  if (res.error) return { config: null, error: res.error };
+  return { config: res.data, error: null };
+}
 async function getVercelToken(deps) {
   const { data, error } = await deps.supabase.from("app_setting").select("vercel_token_encrypted").maybeSingle();
   if (error) throw new Error(`Could not read app_setting: ${error.message}`);
@@ -935,6 +1037,42 @@ function formatWebhookHistory(rows) {
 ${"-".repeat(header.length)}
 ${lines.join("\n")}`;
 }
+function formatDomainsTable(domains) {
+  if (domains.length === 0) return "No domains attached to this project";
+  const lines = domains.map((d) => {
+    const verified = d.verified ? "yes" : "no";
+    const branch = d.gitBranch ?? "";
+    const redirect = d.redirect ? `${d.redirect}${d.redirectStatusCode ? ` (${d.redirectStatusCode})` : ""}` : "";
+    return `${d.name.padEnd(45)}  ${verified.padEnd(9)}  ${branch.padEnd(20)}  ${redirect.padEnd(35)}  ${formatTimestamp(d.createdAt)}`;
+  });
+  const header = `${"DOMAIN".padEnd(45)}  ${"VERIFIED".padEnd(9)}  ${"GIT BRANCH".padEnd(20)}  ${"REDIRECT".padEnd(35)}  CREATED`;
+  return `${header}
+${"-".repeat(header.length)}
+${lines.join("\n")}`;
+}
+function formatDomainStatus(domain, config) {
+  const lines = [];
+  lines.push(`Domain: ${domain.name}`);
+  lines.push(`Verified: ${domain.verified ? "yes" : "no"}`);
+  if (config) {
+    lines.push(`Misconfigured: ${config.misconfigured ? "yes" : "no"}`);
+    if (config.configuredBy) lines.push(`Configured by: ${config.configuredBy}`);
+  }
+  if (domain.gitBranch) lines.push(`Git branch: ${domain.gitBranch}`);
+  if (domain.redirect) {
+    lines.push(
+      `Redirect: ${domain.redirect}${domain.redirectStatusCode ? ` (${domain.redirectStatusCode})` : ""}`
+    );
+  }
+  if (domain.verification && domain.verification.length > 0) {
+    lines.push("");
+    lines.push("Required DNS records to verify ownership:");
+    for (const v of domain.verification) {
+      lines.push(`  ${v.type.padEnd(6)} ${v.domain.padEnd(45)} ${v.value}${v.reason ? `  // ${v.reason}` : ""}`);
+    }
+  }
+  return lines.join("\n");
+}
 async function handleVercelTool(name, args2, deps) {
   switch (name) {
     case "vercel-projects": {
@@ -985,9 +1123,33 @@ async function handleVercelTool(name, args2, deps) {
         const projectInput = String(args2.project);
         const deploymentId = String(args2.deploymentId);
         const limit = Math.min(Math.max(Number(args2.limit) || 200, 1), 1e3);
-        const sinceMinutes = Math.min(Math.max(Number(args2.sinceMinutes) || 60, 1), 7 * 24 * 60);
-        const sinceMs = Date.now() - sinceMinutes * 6e4;
-        const projectId = await resolveProjectId(token, projectInput);
+        const sinceMinutesRaw = Number(args2.sinceMinutes);
+        const sinceExplicit = Number.isFinite(sinceMinutesRaw) && sinceMinutesRaw > 0;
+        const [projectId, deploymentCreatedMs] = await Promise.all([
+          resolveProjectId(token, projectInput),
+          sinceExplicit ? Promise.resolve(null) : getDeploymentCreatedMs(token, deploymentId)
+        ]);
+        const maxWindowMin = 7 * 24 * 60;
+        let sinceMs;
+        let windowNote = "";
+        if (sinceExplicit) {
+          const capped = Math.min(sinceMinutesRaw, maxWindowMin);
+          sinceMs = Date.now() - capped * 6e4;
+          windowNote = `window: last ${capped} min (caller-specified)`;
+        } else if (deploymentCreatedMs) {
+          const bufferMs = 5 * 6e4;
+          sinceMs = deploymentCreatedMs - bufferMs;
+          const ageMin = Math.max(1, Math.round((Date.now() - sinceMs) / 6e4));
+          if (ageMin > maxWindowMin) {
+            sinceMs = Date.now() - maxWindowMin * 6e4;
+            windowNote = `window: capped to ${maxWindowMin} min (deployment is older than 7 days)`;
+          } else {
+            windowNote = `window: auto ${ageMin} min from deployment createdAt - 5 min buffer`;
+          }
+        } else {
+          sinceMs = Date.now() - 60 * 6e4;
+          windowNote = "window: last 60 min (deployment metadata unavailable, used fallback)";
+        }
         const { logs, error } = await getRuntimeLogs(
           token,
           projectId,
@@ -999,7 +1161,10 @@ async function handleVercelTool(name, args2, deps) {
           const hint = error.includes("404") || error.includes("400") ? '\n\nThis endpoint requires both project ID and deployment ID and may not be available on every Vercel plan. Use kind="webhooks" or the supabase MCP (vercel_deployment_log table) for archived runtime logs.' : "";
           return { content: [{ type: "text", text: `Error: ${error}${hint}` }] };
         }
-        return { content: [{ type: "text", text: formatRuntimeLogs(logs) }] };
+        const text = `${formatRuntimeLogs(logs)}
+
+[${windowNote}]`;
+        return { content: [{ type: "text", text }] };
       }
       if (kind === "webhooks") {
         const limit = Math.min(Math.max(Number(args2.limit) || 25, 1), 200);
@@ -1020,6 +1185,67 @@ async function handleVercelTool(name, args2, deps) {
         ]
       };
     }
+    case "vercel-domains": {
+      const action = (args2.action ? String(args2.action) : "list").toLowerCase();
+      if (!args2.project) {
+        return { content: [{ type: "text", text: 'Error: vercel-domains requires "project".' }] };
+      }
+      const token = await getVercelToken(deps);
+      const projectInput = String(args2.project);
+      const projectId = await resolveProjectId(token, projectInput);
+      if (action === "list") {
+        const { domains, error } = await listProjectDomains(token, projectId);
+        if (error) return { content: [{ type: "text", text: `Error: ${error}` }] };
+        return { content: [{ type: "text", text: formatDomainsTable(domains) }] };
+      }
+      if (action === "add") {
+        if (!args2.domain) {
+          return { content: [{ type: "text", text: 'Error: action="add" requires "domain".' }] };
+        }
+        const body = { name: String(args2.domain) };
+        if (args2.gitBranch) body.gitBranch = String(args2.gitBranch);
+        if (args2.redirect) body.redirect = String(args2.redirect);
+        if (args2.redirectStatusCode) body.redirectStatusCode = Number(args2.redirectStatusCode);
+        const { domain, error } = await addProjectDomain(token, projectId, body);
+        if (error) return { content: [{ type: "text", text: `Error: ${error}` }] };
+        if (!domain) {
+          return { content: [{ type: "text", text: `Domain ${body.name} added (no detail returned).` }] };
+        }
+        const { config } = await getDomainConfig(token, domain.name);
+        const status = formatDomainStatus(domain, config);
+        const headline = domain.verified ? `Domain ${domain.name} added and verified.` : `Domain ${domain.name} added. DNS verification still pending.`;
+        return { content: [{ type: "text", text: `${headline}
+
+${status}` }] };
+      }
+      if (action === "verify") {
+        if (!args2.domain) {
+          return { content: [{ type: "text", text: 'Error: action="verify" requires "domain".' }] };
+        }
+        const domainName = String(args2.domain);
+        const { domain, error } = await getProjectDomain(token, projectId, domainName);
+        if (error) return { content: [{ type: "text", text: `Error: ${error}` }] };
+        if (!domain) {
+          return { content: [{ type: "text", text: `Domain ${domainName} not found on this project.` }] };
+        }
+        const { config } = await getDomainConfig(token, domainName);
+        return { content: [{ type: "text", text: formatDomainStatus(domain, config) }] };
+      }
+      if (action === "remove") {
+        if (!args2.domain) {
+          return { content: [{ type: "text", text: 'Error: action="remove" requires "domain".' }] };
+        }
+        const domainName = String(args2.domain);
+        const { error } = await removeProjectDomain(token, projectId, domainName);
+        if (error) return { content: [{ type: "text", text: `Error: ${error}` }] };
+        return { content: [{ type: "text", text: `Domain ${domainName} removed from project.` }] };
+      }
+      return {
+        content: [
+          { type: "text", text: `Error: unknown action "${action}". Use list, add, verify, or remove.` }
+        ]
+      };
+    }
     default:
       return { content: [{ type: "text", text: `Unknown vercel tool: ${name}` }] };
   }
@@ -1186,7 +1412,6 @@ var TOOL_MODULE_MAP = {
   "wait-for": "ssh_servers",
   "db-discover": "ssh_servers",
   "db-tables": "ssh_servers",
-  "db-describe": "ssh_servers",
   "db-query": "ssh_servers",
   "cache-purge": "ssh_servers",
   "env-list": "ci_cd",
@@ -3146,6 +3371,42 @@ var BLOCKED_SQL_PATTERNS = [
   /\bALTER\s+TABLE\s+\w+\s+DROP\b/i,
   /\bDELETE\s+FROM\s+\w+\s*$/i
 ];
+function buildDescribeSql(target, engine) {
+  if (target === "*" || target === "") {
+    if (engine === "postgres") {
+      return "SELECT schemaname, tablename FROM pg_tables WHERE schemaname NOT IN ('pg_catalog','information_schema') ORDER BY schemaname, tablename";
+    }
+    if (engine === "mssql") {
+      return "SELECT TABLE_SCHEMA, TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_TYPE='BASE TABLE' ORDER BY TABLE_SCHEMA, TABLE_NAME";
+    }
+    return "SHOW TABLES";
+  }
+  const safe = target.replace(/[^a-zA-Z0-9_]/g, "");
+  if (!safe) throw new Error(`Invalid describe target: ${target}`);
+  if (engine === "postgres") {
+    return `SELECT column_name, data_type, is_nullable, column_default FROM information_schema.columns WHERE table_name='${safe}' ORDER BY ordinal_position;
+SELECT indexname, indexdef FROM pg_indexes WHERE tablename='${safe}'`;
+  }
+  if (engine === "mssql") {
+    return `EXEC sp_help '${safe}'`;
+  }
+  return `DESCRIBE \`${safe}\`; SHOW INDEX FROM \`${safe}\``;
+}
+function formatDbQueryFooter(output, appliedLimit, maxRows, explainMode) {
+  if (explainMode) {
+    return "\n\n[explain] Plan returned, no rows executed.";
+  }
+  if (!appliedLimit) return "";
+  const rows = output.split("\n").filter((l) => l.trim() && !/^\s*[-+|]/.test(l)).length;
+  if (rows > maxRows) {
+    return `
+
+[truncated] auto-LIMIT ${maxRows} hit \u2014 more rows available. Refine WHERE / ORDER BY or raise maxRows (max 10000).`;
+  }
+  return `
+
+[ok] returned ${rows} row(s), under auto-LIMIT ${maxRows}.`;
+}
 function assertSafeSql(query) {
   const trimmed = query.trim();
   for (const pattern of BLOCKED_SQL_PATTERNS) {
@@ -3217,6 +3478,36 @@ function requireMijnhostApiKey() {
   }
   return mijnhostApiKey;
 }
+function formatDnsDiff(domain, before, after, change) {
+  const fmt = (r) => `${r.type.padEnd(6)} ${r.name.padEnd(30)} ttl=${String(r.ttl).padEnd(5)} ${r.value}`;
+  const lines = [];
+  lines.push(`[dryRun] ${change.verb.toUpperCase()} on ${domain} \u2014 no changes applied.`);
+  lines.push(`Records before: ${before.length}  \u2192  after: ${after.length}`);
+  if (change.removed?.length) {
+    lines.push("", "REMOVED:");
+    for (const r of change.removed) lines.push(`  - ${fmt(r)}`);
+  }
+  if (change.added?.length) {
+    lines.push("", "ADDED:");
+    for (const r of change.added) lines.push(`  + ${fmt(r)}`);
+  }
+  const sensitive = [
+    ...change.added ?? [],
+    ...change.removed ?? []
+  ].filter((r) => {
+    if (r.type === "MX") return true;
+    if (r.type === "TXT") {
+      const v = r.value.toLowerCase();
+      return v.includes("v=spf1") || v.includes("v=dmarc1") || v.includes("_domainkey") || r.name.toLowerCase().includes("_domainkey");
+    }
+    return false;
+  });
+  if (sensitive.length > 0) {
+    lines.push("", "! WARNING: touches mail-auth records (MX / SPF / DMARC / DKIM). Double-check before re-running without dryRun.");
+  }
+  lines.push("", "Re-run without `dryRun: true` to apply.");
+  return lines.join("\n");
+}
 async function mijnhostFetch(path, options = {}) {
   const key = requireMijnhostApiKey();
   const res = await fetch(`${MIJNHOST_BASE_URL}${path}`, {
@@ -3457,35 +3748,25 @@ var TOOLS = [
       required: ["serverId", "sitePath"]
     }
   },
-  {
-    name: "db-describe",
-    description: "Show the structure of a database table (columns, types, keys, defaults). Credentials are auto-discovered from site config files.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        serverId: { type: "string", description: "UUID of the SSH server" },
-        sitePath: { type: "string", description: "Site root path (e.g. /var/www/example.com)" },
-        table: { type: "string", description: "Table name" }
-      },
-      required: ["serverId", "sitePath", "table"]
-    }
-  },
   {
     name: "db-query",
-    description: 'Execute a SQL query against any database. Two routing modes:\n- MySQL via `/var/www` autodiscover (default): pass `sitePath` (and `engine: "mysql"` implicitly). Credentials are read from wp-config.php, parameters.php, .env. Same behaviour as before.\n- Direct via Docker container: pass `containerName` (the container running the DB server). Engine defaults to `postgres`; pass `engine: "mysql"` or `"mssql"` to override. The query is piped via stdin so quotes / `$` / `;` are never re-interpreted.\n\nPostgres example: `{ serverId, containerName: "supabase-db", engine: "postgres", dbName: "main", dbUser: "postgres", query: "SELECT 1" }`. Defaults: dbUser=postgres, dbName=postgres.\nMSSQL example: `{ serverId, containerName: "mssql-1", engine: "mssql", dbUser: "sa", dbPass: "...", query: "SELECT 1" }`.\n\nDestructive operations (DROP, TRUNCATE, etc.) are blocked.',
+    description: 'Execute a SQL query against any database. Two routing modes:\n- MySQL via `/var/www` autodiscover (default): pass `sitePath` (and `engine: "mysql"` implicitly). Credentials are read from wp-config.php, parameters.php, .env. Same behaviour as before.\n- Direct via Docker container: pass `containerName` (the container running the DB server). Engine defaults to `postgres`; pass `engine: "mysql"` or `"mssql"` to override. The query is piped via stdin so quotes / `$` / `;` are never re-interpreted.\n\nPostgres example: `{ serverId, containerName: "supabase-db", engine: "postgres", dbName: "main", dbUser: "postgres", query: "SELECT 1" }`. Defaults: dbUser=postgres, dbName=postgres.\nMSSQL example: `{ serverId, containerName: "mssql-1", engine: "mssql", dbUser: "sa", dbPass: "...", query: "SELECT 1" }`.\n\nResult safety: `maxRows` (default 1000, max 10000) auto-injects a `LIMIT` for SELECT queries that don\'t have one, so unbounded scans never blow up the token budget. The footer reports whether the cap was applied. Pass `maxRows: 0` to disable.\n\nDiagnostics: `explain: true` prepends EXPLAIN (postgres / mysql) or runs `SET SHOWPLAN_TEXT ON` (mssql) so you can inspect the query plan without rewriting the query.\n\nSchema introspection: pass `describe: "tablename"` to get columns + indexes (replaces the old db-describe tool, works for mysql, postgres, and mssql). Pass `describe: "*"` to list all tables in the current database. When `describe` is set, `query` is ignored.\n\nDestructive operations (DROP, TRUNCATE, etc.) are blocked.',
     inputSchema: {
       type: "object",
       properties: {
         serverId: { type: "string", description: "UUID of the SSH server" },
-        query: { type: "string", description: "SQL query to execute" },
+        query: { type: "string", description: "SQL query to execute (ignored when describe is set)" },
+        describe: { type: "string", description: 'Schema introspection shortcut. Pass a table name for columns + indexes, or "*" to list all tables. Works for mysql / postgres / mssql.' },
         sitePath: { type: "string", description: "Site root path (e.g. /var/www/example.com). Used only with engine=mysql autodiscover." },
         containerName: { type: "string", description: 'Docker container running the DB server (e.g. "supabase-db", "trigger-postgres"). Activates direct-query mode.' },
         engine: { type: "string", enum: ["mysql", "postgres", "mssql"], description: 'DB engine. Defaults to "mysql" with sitePath, "postgres" with containerName.' },
         dbName: { type: "string", description: 'Database name (containerName mode). Defaults: postgres \u2192 "postgres", mysql \u2192 server default, mssql \u2192 server default.' },
         dbUser: { type: "string", description: 'Database user (containerName mode). Defaults: postgres \u2192 "postgres", mysql \u2192 "root", mssql \u2192 "sa".' },
-        dbPass: { type: "string", description: "Database password (containerName mode). Required for mssql; optional for mysql; postgres uses trust auth by default." }
+        dbPass: { type: "string", description: "Database password (containerName mode). Required for mssql; optional for mysql; postgres uses trust auth by default." },
+        maxRows: { type: "number", description: "Auto-inject LIMIT for unbounded SELECTs. Default 1000, max 10000, set 0 to disable." },
+        explain: { type: "boolean", description: "Prepend EXPLAIN (postgres/mysql) or SHOWPLAN (mssql) instead of executing. Useful for slow-query diagnosis." }
       },
-      required: ["serverId", "query"]
+      required: ["serverId"]
     }
   },
   {
@@ -3540,8 +3821,15 @@ var TOOLS = [
   // ----- Domains (mijn.host) -----
   {
     name: "domain-list",
-    description: "List all domains from the mijn.host account. Returns domain name, status, renewal date, and tags. Requires MIJNHOST_API_KEY.",
-    inputSchema: { type: "object", properties: {}, required: [] }
+    description: "List all domains from the mijn.host account. Returns domain name, status, renewal date (= expiration), and tags. Requires MIJNHOST_API_KEY.\n\nPass `details: true` to also fetch DNS zone summary per domain in parallel: NS records, MX target, and presence of SPF/DMARC. Useful as a single-call overview instead of N follow-up dns-list calls. Skipped for inactive/expired domains.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        details: { type: "boolean", description: "Inline DNS zone summary (NS, MX, SPF/DMARC presence) per domain. Adds N parallel API calls \u2014 use sparingly on large accounts." },
+        concurrency: { type: "number", description: "Max concurrent DNS lookups when details=true (default 8, max 20)." }
+      },
+      required: []
+    }
   },
   {
     name: "dns-list",
@@ -3556,7 +3844,7 @@ var TOOLS = [
   },
   {
     name: "dns-create",
-    description: "Add a new DNS record to a domain. Uses PATCH to add without replacing existing records.",
+    description: "Add a new DNS record to a domain. Uses PATCH to add without replacing existing records.\n\nPass `dryRun: true` to preview the proposed change (full before/after diff) without calling the mijn.host PUT \u2014 recommended before touching MX, SPF, DKIM, or DMARC records.",
     inputSchema: {
       type: "object",
       properties: {
@@ -3564,14 +3852,15 @@ var TOOLS = [
         type: { type: "string", description: "Record type: A, AAAA, CNAME, MX, TXT, NS, SRV, CAA, or TLSA" },
         name: { type: "string", description: "Record name (e.g. @ or subdomain)" },
         value: { type: "string", description: "Record value (e.g. IP address, hostname)" },
-        ttl: { type: "number", description: "TTL in seconds (min 60, default 3600)" }
+        ttl: { type: "number", description: "TTL in seconds (min 60, default 3600)" },
+        dryRun: { type: "boolean", description: "Preview the change (returns proposed diff) without applying." }
       },
       required: ["domain", "type", "name", "value"]
     }
   },
   {
     name: "dns-update",
-    description: "Update an existing DNS record. Identifies the record by type+name+oldValue, then replaces it with new values via PATCH.",
+    description: "Update an existing DNS record. Identifies the record by type+name+oldValue, then replaces it with new values via PATCH.\n\nPass `dryRun: true` to preview the change without applying \u2014 strongly recommended for MX/SPF/DKIM/DMARC.",
     inputSchema: {
       type: "object",
       properties: {
@@ -3580,21 +3869,23 @@ var TOOLS = [
         name: { type: "string", description: "Record name" },
         oldValue: { type: "string", description: "Current value of the record to update" },
         newValue: { type: "string", description: "New value for the record" },
-        ttl: { type: "number", description: "New TTL in seconds (min 60)" }
+        ttl: { type: "number", description: "New TTL in seconds (min 60)" },
+        dryRun: { type: "boolean", description: "Preview the change (returns proposed diff) without applying." }
       },
       required: ["domain", "type", "name", "oldValue", "newValue"]
     }
   },
   {
     name: "dns-delete",
-    description: "Delete a DNS record by type, name, and value. Fetches all records, removes the matching one, then replaces the full set.",
+    description: "Delete a DNS record by type, name, and value. Fetches all records, removes the matching one, then replaces the full set.\n\nPass `dryRun: true` to preview the deletion without applying.",
     inputSchema: {
       type: "object",
       properties: {
         domain: { type: "string", description: "Domain name (e.g. example.com)" },
         type: { type: "string", description: "Record type to delete" },
         name: { type: "string", description: "Record name to delete" },
-        value: { type: "string", description: "Record value to delete (must match exactly)" }
+        value: { type: "string", description: "Record value to delete (must match exactly)" },
+        dryRun: { type: "boolean", description: "Preview the deletion (returns proposed diff) without applying." }
       },
       required: ["domain", "type", "name", "value"]
     }
@@ -3604,7 +3895,7 @@ var TOOLS = [
   // ----- Vercel -----
   ...VERCEL_TOOLS
 ];
-var MCP_VERSION = "4.0.0";
+var MCP_VERSION = "5.0.1";
 async function handleListTools() {
   if (!authContext) return { tools: TOOLS };
   const accessible = TOOLS.filter((tool) => {
@@ -4568,29 +4859,46 @@ ${trail.join("\n")}` }] };
         const output = await execSiteMysql(conn, String(a.sitePath), sql, proxy);
         return { content: [{ type: "text", text: output || "No tables found" }] };
       }
-      case "db-describe": {
-        const table = String(a.table).replace(/[^a-zA-Z0-9_]/g, "");
-        const { conn, proxy } = await getServerConnection(String(a.serverId));
-        const output = await execSiteMysql(
-          conn,
-          String(a.sitePath),
-          `DESCRIBE \`${table}\`; SHOW INDEX FROM \`${table}\``,
-          proxy
-        );
-        return { content: [{ type: "text", text: output }] };
-      }
       case "db-query": {
-        const query = String(a.query).trim();
-        if (!query) return { content: [{ type: "text", text: "Error: query is required" }] };
-        assertSafeSql(query);
         const containerName = typeof a.containerName === "string" && a.containerName ? a.containerName.replace(/[^a-zA-Z0-9._-]/g, "") : "";
         const explicitEngine = a.engine === "mysql" || a.engine === "postgres" || a.engine === "mssql" ? a.engine : null;
         const engine = explicitEngine || (containerName ? "postgres" : "mysql");
+        const describeArg = typeof a.describe === "string" ? a.describe.trim() : "";
+        const explainMode = a.explain === true;
+        const maxRowsRaw = a.maxRows === void 0 ? 1e3 : Number(a.maxRows);
+        const maxRows = Math.min(Math.max(Number.isFinite(maxRowsRaw) ? maxRowsRaw : 0, 0), 1e4);
+        let rawQuery;
+        if (describeArg) {
+          rawQuery = buildDescribeSql(describeArg, engine);
+        } else {
+          rawQuery = String(a.query ?? "").trim();
+          if (!rawQuery) return { content: [{ type: "text", text: "Error: query (or describe) is required" }] };
+        }
+        assertSafeSql(rawQuery);
+        let query = rawQuery.replace(/;\s*$/, "");
+        let appliedLimit = false;
+        if (explainMode && !describeArg) {
+          if (engine === "mssql") {
+            query = `SET SHOWPLAN_TEXT ON;
+${query}`;
+          } else {
+            query = `EXPLAIN ${query}`;
+          }
+        } else if (maxRows > 0 && !describeArg) {
+          const isSelect = /^\s*(with\b[\s\S]+?\bselect\b|select\b)/i.test(query);
+          const alreadyLimited = /\blimit\s+\d+\b/i.test(query) || /\btop\s*\(?\s*\d+/i.test(query);
+          if (isSelect && !alreadyLimited && engine !== "mssql") {
+            query = `${query}
+LIMIT ${maxRows + 1}`;
+            appliedLimit = true;
+          }
+        }
         if (!containerName && engine === "mysql") {
           if (!a.sitePath) return { content: [{ type: "text", text: "Error: sitePath is required for mysql autodiscover (or pass containerName + engine for direct DB queries)" }] };
           const { conn: conn2, proxy: proxy2 } = await getServerConnection(String(a.serverId));
           const output2 = await execSiteMysql(conn2, String(a.sitePath), query, proxy2);
-          return { content: [{ type: "text", text: output2 || "Query executed successfully (no output)" }] };
+          const footer2 = formatDbQueryFooter(output2, appliedLimit, maxRows, explainMode);
+          return { content: [{ type: "text", text: (output2 || "Query executed successfully (no output)") + footer2 }] };
         }
         if (!containerName) {
           return { content: [{ type: "text", text: `Error: engine=${engine} requires containerName (the docker container running the DB server, e.g. "supabase-db" or "trigger-postgres")` }] };
@@ -4629,7 +4937,8 @@ GO
         if (result.exitCode !== 0 && !result.stdout) {
           return { content: [{ type: "text", text: `Error (exit ${result.exitCode}, ${engine}): ${output}` }] };
         }
-        return { content: [{ type: "text", text: output }] };
+        const footer = formatDbQueryFooter(output, appliedLimit, maxRows, explainMode);
+        return { content: [{ type: "text", text: output + footer }] };
       }
       // ----- Env Config -----
       case "env-list": {
@@ -4818,13 +5127,68 @@ echo -e "$R"
         if (!domains.length) {
           return { content: [{ type: "text", text: "No domains found" }] };
         }
+        const details = a.details === true;
+        if (!details) {
+          const lines2 = domains.map((d) => {
+            const tags = d.tags?.length ? ` [${d.tags.join(", ")}]` : "";
+            return `${d.domain}  status=${d.status}  renewal=${d.renewal_date}${tags}`;
+          });
+          return { content: [{ type: "text", text: `${domains.length} domain(s):
+
+${lines2.join("\n")}` }] };
+        }
+        const concurrency = Math.min(Math.max(Number(a.concurrency) || 8, 1), 20);
+        const summaries = /* @__PURE__ */ new Map();
+        const skipStatuses = /* @__PURE__ */ new Set(["expired", "redemptionperiod", "pendingdelete", "inactive"]);
+        const activeDomains = domains.filter((d) => !skipStatuses.has((d.status || "").toLowerCase()));
+        async function fetchSummary(domain) {
+          try {
+            const r = await mijnhostFetch(
+              `/domains/${encodeURIComponent(domain)}/dns`
+            );
+            const recs = r.data.records || [];
+            const ns = recs.filter((x) => x.type === "NS").map((x) => x.value).sort();
+            const mx = recs.filter((x) => x.type === "MX").map((x) => x.value).sort();
+            const hasSpf = recs.some((x) => x.type === "TXT" && x.value.toLowerCase().includes("v=spf1"));
+            const hasDmarc = recs.some(
+              (x) => x.type === "TXT" && (x.name.toLowerCase().startsWith("_dmarc") || x.value.toLowerCase().includes("v=dmarc1"))
+            );
+            return { ns, mx, hasSpf, hasDmarc };
+          } catch (err) {
+            return { ns: [], mx: [], hasSpf: false, hasDmarc: false, error: err instanceof Error ? err.message : String(err) };
+          }
+        }
+        const queue = [...activeDomains];
+        async function worker() {
+          while (queue.length > 0) {
+            const d = queue.shift();
+            if (!d) return;
+            summaries.set(d.domain, await fetchSummary(d.domain));
+          }
+        }
+        await Promise.all(Array.from({ length: Math.min(concurrency, queue.length) }, worker));
         const lines = domains.map((d) => {
           const tags = d.tags?.length ? ` [${d.tags.join(", ")}]` : "";
-          return `${d.domain}  status=${d.status}  renewal=${d.renewal_date}${tags}`;
+          const head = `${d.domain}  status=${d.status}  expires=${d.renewal_date}${tags}`;
+          const s = summaries.get(d.domain);
+          if (!s) return head;
+          if (s.error) return `${head}
+    dns: error: ${s.error}`;
+          const ns = s.ns.length ? s.ns.join(", ") : "(none)";
+          const mx = s.mx.length ? s.mx.join(", ") : "(none)";
+          const mail = `mx=${mx}  spf=${s.hasSpf ? "yes" : "NO"}  dmarc=${s.hasDmarc ? "yes" : "NO"}`;
+          return `${head}
+    ns: ${ns}
+    ${mail}`;
         });
-        return { content: [{ type: "text", text: `${domains.length} domain(s):
+        return {
+          content: [{
+            type: "text",
+            text: `${domains.length} domain(s) (${activeDomains.length} with DNS lookup):
 
-${lines.join("\n")}` }] };
+${lines.join("\n")}`
+          }]
+        };
       }
       case "dns-list": {
         const domain = String(a.domain);
@@ -4853,13 +5217,22 @@ ${lines.join("\n")}` }] };
         const dnsName = String(a.name);
         const value = String(a.value);
         const ttl = Number(a.ttl) || 3600;
+        const dryRun = a.dryRun === true;
         if (!domain || !type || !dnsName || !value) {
           throw new Error("domain, type, name, and value are required");
         }
         const current = await mijnhostFetch(
           `/domains/${encodeURIComponent(domain)}/dns`
         );
-        const records = [...current.data.records, { type, name: dnsName, value, ttl }];
+        const newRecord = { type, name: dnsName, value, ttl };
+        const records = [...current.data.records, newRecord];
+        if (dryRun) {
+          const diff = formatDnsDiff(domain, current.data.records, records, {
+            verb: "create",
+            added: [newRecord]
+          });
+          return { content: [{ type: "text", text: diff }] };
+        }
         await mijnhostFetch(`/domains/${encodeURIComponent(domain)}/dns`, {
           method: "PUT",
           body: JSON.stringify({ records })
@@ -4873,6 +5246,7 @@ ${lines.join("\n")}` }] };
         const oldValue = String(a.oldValue);
         const newValue = String(a.newValue);
         const ttl = Number(a.ttl) || void 0;
+        const dryRun = a.dryRun === true;
         if (!domain || !type || !dnsName || !oldValue || !newValue) {
           throw new Error("domain, type, name, oldValue, and newValue are required");
         }
@@ -4887,12 +5261,22 @@ ${lines.join("\n")}` }] };
         }
         const updated = [...current.data.records];
         const existingTtl = updated[idx].ttl;
-        updated[idx] = {
+        const before = updated[idx];
+        const after = {
           type,
           name: dnsName,
           value: newValue,
           ttl: ttl ?? existingTtl
         };
+        updated[idx] = after;
+        if (dryRun) {
+          const diff = formatDnsDiff(domain, current.data.records, updated, {
+            verb: "update",
+            removed: [before],
+            added: [after]
+          });
+          return { content: [{ type: "text", text: diff }] };
+        }
         await mijnhostFetch(`/domains/${encodeURIComponent(domain)}/dns`, {
           method: "PUT",
           body: JSON.stringify({ records: updated })
@@ -4904,6 +5288,7 @@ ${lines.join("\n")}` }] };
         const type = String(a.type).toUpperCase();
         const dnsName = String(a.name);
         const value = String(a.value);
+        const dryRun = a.dryRun === true;
         if (!domain || !type || !dnsName || !value) {
           throw new Error("domain, type, name, and value are required");
         }
@@ -4911,12 +5296,22 @@ ${lines.join("\n")}` }] };
           `/domains/${encodeURIComponent(domain)}/dns`
         );
         const before = current.data.records.length;
+        const removed = current.data.records.filter(
+          (r) => r.type === type && r.name === dnsName && r.value === value
+        );
         const remaining = current.data.records.filter(
           (r) => !(r.type === type && r.name === dnsName && r.value === value)
         );
         if (remaining.length === before) {
           throw new Error(`No matching DNS record found: ${type} ${dnsName} = ${value}`);
         }
+        if (dryRun) {
+          const diff = formatDnsDiff(domain, current.data.records, remaining, {
+            verb: "delete",
+            removed
+          });
+          return { content: [{ type: "text", text: diff }] };
+        }
         await mijnhostFetch(`/domains/${encodeURIComponent(domain)}/dns`, {
           method: "PUT",
           body: JSON.stringify({ records: remaining })