@mgsoftwarebv/mg-dashboard-mcp 4.0.0 → 6.0.0

package/dist/index.js

@@ -296,57 +296,40 @@ var TRIGGER_TOOLS = [
   },
   {
     name: "trigger-runs",
-    description: "List recent task runs for a Trigger.dev project. Returns run ID, task name, status, duration, and timestamps.",
+    description: "List recent task runs for a Trigger.dev project. Returns run ID, task name, status, duration, and timestamps.\n\nCommon shortcuts: `failedOnly: true` returns only FAILED/CRASHED/SYSTEM_FAILURE/INTERRUPTED/TIMED_OUT. `sinceMinutes: 60` filters to runs created in the last hour (combines with status/taskIdentifier).",
     inputSchema: {
       type: "object",
       properties: {
         project: { type: "string", description: 'Project slug from trigger-list (e.g. "mg-dashboard-bHfS")' },
         status: {
           type: "string",
-          description: "Comma-separated status filter: QUEUED,EXECUTING,COMPLETED,FAILED,CRASHED,CANCELED,SYSTEM_FAILURE"
+          description: "Comma-separated status filter: QUEUED,EXECUTING,COMPLETED,FAILED,CRASHED,CANCELED,SYSTEM_FAILURE. Ignored when failedOnly is true."
+        },
+        failedOnly: {
+          type: "boolean",
+          description: "Shortcut: only return FAILED + CRASHED + SYSTEM_FAILURE + INTERRUPTED + TIMED_OUT runs. Overrides `status` when true."
         },
         taskIdentifier: { type: "string", description: 'Filter by task identifier (e.g. "hello-world")' },
+        sinceMinutes: { type: "number", description: "Only runs created in the last N minutes (uses Trigger filter[from]). Max 10080 (= 1 week)." },
         limit: { type: "number", description: "Max runs to return (default 20, max 100)" }
       },
       required: ["project"]
     }
   },
   {
-    name: "trigger-run-detail",
-    description: "Get full details of a specific run: status, payload, output, and error stack traces. Use after trigger-runs or trigger-test-task to inspect results.",
+    name: "trigger-run",
+    description: 'Inspect, create, or replay a Trigger.dev run. Pick the mode with `action`:\n- "detail": fetch full run state \u2014 status, payload, output, error stack traces, and logs. Required: runId.\n- "test": kick off a task run and (by default) wait for it to complete, returning the final detail in one shot. Required: taskId. Optional: payload (JSON string), waitSeconds (default 60, max 300, set 0 to fire-and-forget).\n- "replay": re-run a previously failed/completed run with the same payload. Required: runId. Optional: waitSeconds (when >0, also waits for the new run to finish and returns its full detail).\n\nTip: replace any old `trigger-run-detail` / `trigger-test-task` / `trigger-replay-run` calls with this single tool \u2014 output format is identical.',
     inputSchema: {
       type: "object",
       properties: {
-        project: { type: "string", description: "Project slug from trigger-list" },
-        runId: { type: "string", description: "Run ID (e.g. run_xxxxx)" }
-      },
-      required: ["project", "runId"]
-    }
-  },
-  {
-    name: "trigger-test-task",
-    description: "Trigger a task run and wait for it to complete. Returns the final status, output, or error with stack trace. The main tool for testing trigger tasks from Cursor.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        project: { type: "string", description: "Project slug from trigger-list" },
-        taskId: { type: "string", description: 'Task identifier (e.g. "hello-world", "execute-pipeline")' },
-        payload: { type: "string", description: "JSON payload string to pass to the task (optional)" },
-        waitSeconds: { type: "number", description: "Max seconds to wait for completion (default 60, max 300)" }
-      },
-      required: ["project", "taskId"]
-    }
-  },
-  {
-    name: "trigger-replay-run",
-    description: "Replay a previously failed or completed run with the same payload. Returns the new run ID.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        project: { type: "string", description: "Project slug from trigger-list" },
-        runId: { type: "string", description: "Run ID to replay (e.g. run_xxxxx)" }
+        action: { type: "string", enum: ["detail", "test", "replay"], description: "Which run operation to perform." },
+        project: { type: "string", description: 'Project slug from trigger-list (e.g. "mg-dashboard-bHfS")' },
+        runId: { type: "string", description: 'Run ID (e.g. run_xxxxx). Required for action="detail" or action="replay".' },
+        taskId: { type: "string", description: 'Task identifier (e.g. "hello-world"). Required for action="test".' },
+        payload: { type: "string", description: 'JSON payload string passed to the task (action="test" only).' },
+        waitSeconds: { type: "number", description: 'Max seconds to wait for completion. Default 60 (action="test") / 0 (action="replay", fire-and-forget). Max 300. Set 0 to skip the wait.' }
       },
-      required: ["project", "runId"]
+      required: ["action", "project"]
     }
   }
 ];
@@ -354,9 +337,7 @@ var TRIGGER_TOOL_NAMES = new Set(TRIGGER_TOOLS.map((t) => t.name));
 var TRIGGER_TOOL_MODULE_MAP = {
   "trigger-list": "ci_cd",
   "trigger-runs": "ci_cd",
-  "trigger-run-detail": "ci_cd",
-  "trigger-test-task": "ci_cd",
-  "trigger-replay-run": "ci_cd"
+  "trigger-run": "ci_cd"
 };
 async function discoverInstance(projectSlug, conn, proxy, sshExec2) {
   const sql = `SELECT re.\\"apiKey\\" FROM \\"RuntimeEnvironment\\" re JOIN \\"Project\\" p ON re.\\"projectId\\" = p.id WHERE p.slug='${projectSlug}' AND re.slug='prod' LIMIT 1`;
@@ -489,8 +470,18 @@ ${lines.join("\n")}` }] };
       const instance = await discoverInstance(project, conn, proxy, sshExec2);
       const limit = Math.min(Math.max(Number(args2.limit) || 20, 1), 100);
       const queryParts = [`page%5Bsize%5D=${limit}`];
-      if (args2.status) queryParts.push(`filter%5Bstatus%5D=${String(args2.status)}`);
-      if (args2.taskIdentifier) queryParts.push(`filter%5BtaskIdentifier%5D=${String(args2.taskIdentifier)}`);
+      const failedOnly = args2.failedOnly === true;
+      const statusArg = failedOnly ? "FAILED,CRASHED,SYSTEM_FAILURE,INTERRUPTED,TIMED_OUT" : args2.status ? String(args2.status) : "";
+      if (statusArg) queryParts.push(`filter%5Bstatus%5D=${encodeURIComponent(statusArg)}`);
+      if (args2.taskIdentifier) {
+        queryParts.push(`filter%5BtaskIdentifier%5D=${encodeURIComponent(String(args2.taskIdentifier))}`);
+      }
+      const sinceMinutes = Number(args2.sinceMinutes);
+      if (Number.isFinite(sinceMinutes) && sinceMinutes > 0) {
+        const capped = Math.min(sinceMinutes, 10080);
+        const fromMs = Date.now() - capped * 6e4;
+        queryParts.push(`filter%5Bfrom%5D=${fromMs}`);
+      }
       const rawJson = await triggerApi(
         conn,
         proxy,
@@ -510,104 +501,69 @@ ${rawJson.substring(0, 500)}` }] };
       return { content: [{ type: "text", text: formatRunsTable(runs) }] };
     }
     // -----------------------------------------------------------------
-    case "trigger-run-detail": {
-      const project = String(args2.project);
-      const runId = String(args2.runId);
-      const instance = await discoverInstance(project, conn, proxy, sshExec2);
-      const [rawJson, logs] = await Promise.all([
-        triggerApi(conn, proxy, sshExec2, instance, "GET", `/api/v3/runs/${encodeURIComponent(runId)}`),
-        fetchRunLogs(runId, conn, proxy, sshExec2)
-      ]);
-      let run;
-      try {
-        run = JSON.parse(rawJson);
-      } catch {
-        return { content: [{ type: "text", text: `Invalid API response:
-${rawJson.substring(0, 500)}` }] };
-      }
-      let text = formatRunDetail(run);
-      if (logs) {
-        text += "\n\n--- Logs ---\n" + logs;
+    case "trigger-run": {
+      const action = String(args2.action);
+      if (action !== "detail" && action !== "test" && action !== "replay") {
+        return { content: [{ type: "text", text: "Error: action must be one of: detail, test, replay" }] };
       }
-      return { content: [{ type: "text", text }] };
-    }
-    // -----------------------------------------------------------------
-    case "trigger-test-task": {
       const project = String(args2.project);
-      const taskId = String(args2.taskId);
-      const waitSeconds = Math.min(Math.max(Number(args2.waitSeconds) || 60, 5), 300);
-      conn.timeout = (waitSeconds + 30) * 1e3;
-      const instance = await discoverInstance(project, conn, proxy, sshExec2);
-      let payload = "{}";
-      if (args2.payload) {
-        try {
-          JSON.parse(String(args2.payload));
-          payload = String(args2.payload);
-        } catch {
-          throw new Error(`Invalid JSON payload: ${String(args2.payload).substring(0, 200)}`);
-        }
+      if (action === "detail") {
+        const runId2 = String(args2.runId ?? "");
+        if (!runId2) return { content: [{ type: "text", text: 'Error: action="detail" requires runId' }] };
+        const instance2 = await discoverInstance(project, conn, proxy, sshExec2);
+        return await fetchAndFormatRun(conn, proxy, sshExec2, instance2, runId2);
       }
-      const triggerBody = JSON.stringify({
-        payload: JSON.parse(payload),
-        options: { tags: ["mcp-test"], test: true }
-      });
-      const triggerJson = await triggerApi(
-        conn,
-        proxy,
-        sshExec2,
-        instance,
-        "POST",
-        `/api/v1/tasks/${encodeURIComponent(taskId)}/trigger`,
-        triggerBody
-      );
-      let triggerResp;
-      try {
-        triggerResp = JSON.parse(triggerJson);
-      } catch {
-        return { content: [{ type: "text", text: `Failed to trigger task. API response:
-${triggerJson.substring(0, 500)}` }] };
-      }
-      const runId = triggerResp.id;
-      if (!runId) {
-        return { content: [{ type: "text", text: `Trigger API did not return a run ID:
-${triggerJson.substring(0, 500)}` }] };
-      }
-      const pollInterval = 3e3;
-      const maxPolls = Math.ceil(waitSeconds * 1e3 / pollInterval);
-      for (let i = 0; i < maxPolls; i++) {
-        await new Promise((r) => setTimeout(r, pollInterval));
-        const pollJson = await triggerApi(
+      if (action === "test") {
+        const taskId = String(args2.taskId ?? "");
+        if (!taskId) return { content: [{ type: "text", text: 'Error: action="test" requires taskId' }] };
+        const waitArg2 = args2.waitSeconds === void 0 ? 60 : Number(args2.waitSeconds);
+        const waitSeconds2 = Math.min(Math.max(Number.isFinite(waitArg2) ? waitArg2 : 60, 0), 300);
+        conn.timeout = (waitSeconds2 + 30) * 1e3;
+        const instance2 = await discoverInstance(project, conn, proxy, sshExec2);
+        let payload = "{}";
+        if (args2.payload) {
+          try {
+            JSON.parse(String(args2.payload));
+            payload = String(args2.payload);
+          } catch {
+            throw new Error(`Invalid JSON payload: ${String(args2.payload).substring(0, 200)}`);
+          }
+        }
+        const triggerBody = JSON.stringify({
+          payload: JSON.parse(payload),
+          options: { tags: ["mcp-test"], test: true }
+        });
+        const triggerJson = await triggerApi(
           conn,
           proxy,
           sshExec2,
-          instance,
-          "GET",
-          `/api/v3/runs/${encodeURIComponent(runId)}`
+          instance2,
+          "POST",
+          `/api/v1/tasks/${encodeURIComponent(taskId)}/trigger`,
+          triggerBody
         );
-        let run;
+        let triggerResp;
         try {
-          run = JSON.parse(pollJson);
+          triggerResp = JSON.parse(triggerJson);
         } catch {
-          continue;
+          return { content: [{ type: "text", text: `Failed to trigger task. API response:
+${triggerJson.substring(0, 500)}` }] };
         }
-        if (TERMINAL_STATUSES.has(run.status)) {
-          let text = formatRunDetail(run);
-          const logs = await fetchRunLogs(runId, conn, proxy, sshExec2);
-          if (logs) text += "\n\n--- Logs ---\n" + logs;
-          return { content: [{ type: "text", text }] };
+        const runId2 = triggerResp.id;
+        if (!runId2) {
+          return { content: [{ type: "text", text: `Trigger API did not return a run ID:
+${triggerJson.substring(0, 500)}` }] };
+        }
+        if (waitSeconds2 === 0) {
+          return { content: [{ type: "text", text: `Run triggered. ID: ${runId2} (fire-and-forget; use action="detail" to check).` }] };
         }
+        return await waitForCompletion(conn, proxy, sshExec2, instance2, runId2, waitSeconds2);
       }
-      return {
-        content: [{
-          type: "text",
-          text: `Run ${runId} did not complete within ${waitSeconds}s (still running). Use trigger-run-detail to check later.`
-        }]
-      };
-    }
-    // -----------------------------------------------------------------
-    case "trigger-replay-run": {
-      const project = String(args2.project);
-      const runId = String(args2.runId);
+      const runId = String(args2.runId ?? "");
+      if (!runId) return { content: [{ type: "text", text: 'Error: action="replay" requires runId' }] };
+      const waitArg = args2.waitSeconds === void 0 ? 0 : Number(args2.waitSeconds);
+      const waitSeconds = Math.min(Math.max(Number.isFinite(waitArg) ? waitArg : 0, 0), 300);
+      if (waitSeconds > 0) conn.timeout = (waitSeconds + 30) * 1e3;
       const instance = await discoverInstance(project, conn, proxy, sshExec2);
       const rawJson = await triggerApi(
         conn,
@@ -624,19 +580,69 @@ ${triggerJson.substring(0, 500)}` }] };
         return { content: [{ type: "text", text: `Replay response:
 ${rawJson.substring(0, 500)}` }] };
       }
-      return {
-        content: [{
-          type: "text",
-          text: result.id ? `Run replayed. New run ID: ${result.id}` : `Replay response:
-${rawJson.substring(0, 500)}`
-        }]
-      };
+      if (!result.id) {
+        return { content: [{ type: "text", text: `Replay response:
+${rawJson.substring(0, 500)}` }] };
+      }
+      if (waitSeconds === 0) {
+        return { content: [{ type: "text", text: `Run replayed. New run ID: ${result.id} (use action="detail" to check status).` }] };
+      }
+      return await waitForCompletion(conn, proxy, sshExec2, instance, result.id, waitSeconds);
     }
     // -----------------------------------------------------------------
     default:
       return { content: [{ type: "text", text: `Unknown trigger tool: ${name}` }] };
   }
 }
+async function fetchAndFormatRun(conn, proxy, sshExec2, instance, runId) {
+  const [rawJson, logs] = await Promise.all([
+    triggerApi(conn, proxy, sshExec2, instance, "GET", `/api/v3/runs/${encodeURIComponent(runId)}`),
+    fetchRunLogs(runId, conn, proxy, sshExec2)
+  ]);
+  let run;
+  try {
+    run = JSON.parse(rawJson);
+  } catch {
+    return { content: [{ type: "text", text: `Invalid API response:
+${rawJson.substring(0, 500)}` }] };
+  }
+  let text = formatRunDetail(run);
+  if (logs) text += "\n\n--- Logs ---\n" + logs;
+  return { content: [{ type: "text", text }] };
+}
+async function waitForCompletion(conn, proxy, sshExec2, instance, runId, waitSeconds) {
+  const pollInterval = 3e3;
+  const maxPolls = Math.ceil(waitSeconds * 1e3 / pollInterval);
+  for (let i = 0; i < maxPolls; i++) {
+    await new Promise((r) => setTimeout(r, pollInterval));
+    const pollJson = await triggerApi(
+      conn,
+      proxy,
+      sshExec2,
+      instance,
+      "GET",
+      `/api/v3/runs/${encodeURIComponent(runId)}`
+    );
+    let run;
+    try {
+      run = JSON.parse(pollJson);
+    } catch {
+      continue;
+    }
+    if (TERMINAL_STATUSES.has(run.status)) {
+      let text = formatRunDetail(run);
+      const logs = await fetchRunLogs(runId, conn, proxy, sshExec2);
+      if (logs) text += "\n\n--- Logs ---\n" + logs;
+      return { content: [{ type: "text", text }] };
+    }
+  }
+  return {
+    content: [{
+      type: "text",
+      text: `Run ${runId} did not complete within ${waitSeconds}s (still running). Use action="detail" with this runId to check later.`
+    }]
+  };
+}
 
 // src/vercel-tools.ts
 var VERCEL_API = "https://api.vercel.com";
@@ -669,6 +675,41 @@ var VERCEL_TOOLS = [
       required: ["project"]
     }
   },
+  {
+    name: "vercel-domains",
+    description: 'Manage domains attached to a Vercel project. Use `action` to pick the operation:\n- "list" (default): list all domains attached to the project, including verification status and any redirect.\n- "add": attach a new domain to the project. Returns DNS records to set if the domain is not yet verified.\n- "verify": re-check verification status and surface required CNAME / A / TXT records if misconfigured.\n- "remove": detach a domain from the project.\nPick the project via vercel-projects first.',
+    inputSchema: {
+      type: "object",
+      properties: {
+        action: {
+          type: "string",
+          enum: ["list", "add", "remove", "verify"],
+          description: "Which operation to perform (default: list)."
+        },
+        project: {
+          type: "string",
+          description: "Vercel project ID or name (from vercel-projects)."
+        },
+        domain: {
+          type: "string",
+          description: 'Domain name (required for action="add", "remove", or "verify").'
+        },
+        gitBranch: {
+          type: "string",
+          description: 'Optional git branch this domain should deploy from (action="add" only).'
+        },
+        redirect: {
+          type: "string",
+          description: 'Optional redirect target domain (action="add" only).'
+        },
+        redirectStatusCode: {
+          type: "number",
+          description: 'Optional redirect status code, e.g. 301 / 302 / 307 / 308 (action="add" only).'
+        }
+      },
+      required: ["project"]
+    }
+  },
   {
     name: "vercel-logs",
     description: 'Unified log inspector for Vercel. Use `kind` to pick the source:\n- "build" (default): build / deployment console events (stdout, stderr, command, exit). Requires deploymentId.\n- "runtime": runtime / function logs after a successful build. Requires project + deploymentId.\n- "webhooks": our own vercel_webhook_logs table (Telegram / push delivery history). No deployment needed.\nPick deployments via vercel-deployments first.',
@@ -698,7 +739,7 @@ var VERCEL_TOOLS = [
         },
         sinceMinutes: {
           type: "number",
-          description: 'Time window in minutes (kind="runtime" only, default 60, max 7 days).'
+          description: `Time window in minutes (kind="runtime" only, max 7 days). When omitted, the tool auto-detects the deployment's created timestamp and queries from there with a 5-minute buffer \u2014 so you don't miss logs by picking a too-small window.`
         },
         limit: {
           type: "number",
@@ -712,11 +753,14 @@ var VERCEL_TOOL_NAMES = new Set(VERCEL_TOOLS.map((t) => t.name));
 var VERCEL_TOOL_MODULE_MAP = {
   "vercel-projects": "ci_cd",
   "vercel-deployments": "ci_cd",
-  "vercel-logs": "ci_cd"
+  "vercel-logs": "ci_cd",
+  "vercel-domains": "ci_cd"
 };
-async function vercelFetch(token, path) {
+async function vercelFetch(token, path, init) {
   const res = await fetch(`${VERCEL_API}${path}`, {
-    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" }
+    method: init?.method ?? "GET",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+    body: init?.body !== void 0 ? JSON.stringify(init.body) : void 0
   });
   const body = await res.text();
   let parsed = null;
@@ -800,6 +844,14 @@ async function getDeploymentBuildEvents(token, deploymentId, limit) {
   }
   return { events, error: null };
 }
+async function getDeploymentCreatedMs(token, deploymentId) {
+  const res = await vercelFetch(
+    token,
+    `/v13/deployments/${encodeURIComponent(deploymentId)}`
+  );
+  if (res.error || !res.data) return null;
+  return res.data.createdAt ?? res.data.created ?? null;
+}
 async function getRuntimeLogs(token, projectIdOrName, deploymentId, limit, sinceMs) {
   const params = new URLSearchParams({
     limit: String(Math.min(Math.max(limit, 1), 1e3))
@@ -840,6 +892,47 @@ async function getRuntimeLogs(token, projectIdOrName, deploymentId, limit, since
   }
   return { logs, error: null };
 }
+async function listProjectDomains(token, projectId) {
+  const res = await vercelFetch(
+    token,
+    `/v9/projects/${encodeURIComponent(projectId)}/domains?limit=100`
+  );
+  if (res.error) return { domains: [], error: res.error };
+  return { domains: res.data?.domains ?? [], error: null };
+}
+async function addProjectDomain(token, projectId, body) {
+  const res = await vercelFetch(
+    token,
+    `/v10/projects/${encodeURIComponent(projectId)}/domains`,
+    { method: "POST", body }
+  );
+  if (res.error) return { domain: null, error: res.error };
+  return { domain: res.data, error: null };
+}
+async function removeProjectDomain(token, projectId, domain) {
+  const res = await vercelFetch(
+    token,
+    `/v9/projects/${encodeURIComponent(projectId)}/domains/${encodeURIComponent(domain)}`,
+    { method: "DELETE" }
+  );
+  return { error: res.error };
+}
+async function getProjectDomain(token, projectId, domain) {
+  const res = await vercelFetch(
+    token,
+    `/v9/projects/${encodeURIComponent(projectId)}/domains/${encodeURIComponent(domain)}`
+  );
+  if (res.error) return { domain: null, error: res.error };
+  return { domain: res.data, error: null };
+}
+async function getDomainConfig(token, domain) {
+  const res = await vercelFetch(
+    token,
+    `/v6/domains/${encodeURIComponent(domain)}/config`
+  );
+  if (res.error) return { config: null, error: res.error };
+  return { config: res.data, error: null };
+}
 async function getVercelToken(deps) {
   const { data, error } = await deps.supabase.from("app_setting").select("vercel_token_encrypted").maybeSingle();
   if (error) throw new Error(`Could not read app_setting: ${error.message}`);
@@ -935,6 +1028,42 @@ function formatWebhookHistory(rows) {
 ${"-".repeat(header.length)}
 ${lines.join("\n")}`;
 }
+function formatDomainsTable(domains) {
+  if (domains.length === 0) return "No domains attached to this project";
+  const lines = domains.map((d) => {
+    const verified = d.verified ? "yes" : "no";
+    const branch = d.gitBranch ?? "";
+    const redirect = d.redirect ? `${d.redirect}${d.redirectStatusCode ? ` (${d.redirectStatusCode})` : ""}` : "";
+    return `${d.name.padEnd(45)}  ${verified.padEnd(9)}  ${branch.padEnd(20)}  ${redirect.padEnd(35)}  ${formatTimestamp(d.createdAt)}`;
+  });
+  const header = `${"DOMAIN".padEnd(45)}  ${"VERIFIED".padEnd(9)}  ${"GIT BRANCH".padEnd(20)}  ${"REDIRECT".padEnd(35)}  CREATED`;
+  return `${header}
+${"-".repeat(header.length)}
+${lines.join("\n")}`;
+}
+function formatDomainStatus(domain, config) {
+  const lines = [];
+  lines.push(`Domain: ${domain.name}`);
+  lines.push(`Verified: ${domain.verified ? "yes" : "no"}`);
+  if (config) {
+    lines.push(`Misconfigured: ${config.misconfigured ? "yes" : "no"}`);
+    if (config.configuredBy) lines.push(`Configured by: ${config.configuredBy}`);
+  }
+  if (domain.gitBranch) lines.push(`Git branch: ${domain.gitBranch}`);
+  if (domain.redirect) {
+    lines.push(
+      `Redirect: ${domain.redirect}${domain.redirectStatusCode ? ` (${domain.redirectStatusCode})` : ""}`
+    );
+  }
+  if (domain.verification && domain.verification.length > 0) {
+    lines.push("");
+    lines.push("Required DNS records to verify ownership:");
+    for (const v of domain.verification) {
+      lines.push(`  ${v.type.padEnd(6)} ${v.domain.padEnd(45)} ${v.value}${v.reason ? `  // ${v.reason}` : ""}`);
+    }
+  }
+  return lines.join("\n");
+}
 async function handleVercelTool(name, args2, deps) {
   switch (name) {
     case "vercel-projects": {
@@ -985,9 +1114,33 @@ async function handleVercelTool(name, args2, deps) {
         const projectInput = String(args2.project);
         const deploymentId = String(args2.deploymentId);
         const limit = Math.min(Math.max(Number(args2.limit) || 200, 1), 1e3);
-        const sinceMinutes = Math.min(Math.max(Number(args2.sinceMinutes) || 60, 1), 7 * 24 * 60);
-        const sinceMs = Date.now() - sinceMinutes * 6e4;
-        const projectId = await resolveProjectId(token, projectInput);
+        const sinceMinutesRaw = Number(args2.sinceMinutes);
+        const sinceExplicit = Number.isFinite(sinceMinutesRaw) && sinceMinutesRaw > 0;
+        const [projectId, deploymentCreatedMs] = await Promise.all([
+          resolveProjectId(token, projectInput),
+          sinceExplicit ? Promise.resolve(null) : getDeploymentCreatedMs(token, deploymentId)
+        ]);
+        const maxWindowMin = 7 * 24 * 60;
+        let sinceMs;
+        let windowNote = "";
+        if (sinceExplicit) {
+          const capped = Math.min(sinceMinutesRaw, maxWindowMin);
+          sinceMs = Date.now() - capped * 6e4;
+          windowNote = `window: last ${capped} min (caller-specified)`;
+        } else if (deploymentCreatedMs) {
+          const bufferMs = 5 * 6e4;
+          sinceMs = deploymentCreatedMs - bufferMs;
+          const ageMin = Math.max(1, Math.round((Date.now() - sinceMs) / 6e4));
+          if (ageMin > maxWindowMin) {
+            sinceMs = Date.now() - maxWindowMin * 6e4;
+            windowNote = `window: capped to ${maxWindowMin} min (deployment is older than 7 days)`;
+          } else {
+            windowNote = `window: auto ${ageMin} min from deployment createdAt - 5 min buffer`;
+          }
+        } else {
+          sinceMs = Date.now() - 60 * 6e4;
+          windowNote = "window: last 60 min (deployment metadata unavailable, used fallback)";
+        }
         const { logs, error } = await getRuntimeLogs(
           token,
           projectId,
@@ -999,7 +1152,10 @@ async function handleVercelTool(name, args2, deps) {
           const hint = error.includes("404") || error.includes("400") ? '\n\nThis endpoint requires both project ID and deployment ID and may not be available on every Vercel plan. Use kind="webhooks" or the supabase MCP (vercel_deployment_log table) for archived runtime logs.' : "";
           return { content: [{ type: "text", text: `Error: ${error}${hint}` }] };
         }
-        return { content: [{ type: "text", text: formatRuntimeLogs(logs) }] };
+        const text = `${formatRuntimeLogs(logs)}
+
+[${windowNote}]`;
+        return { content: [{ type: "text", text }] };
       }
       if (kind === "webhooks") {
         const limit = Math.min(Math.max(Number(args2.limit) || 25, 1), 200);
@@ -1020,6 +1176,67 @@ async function handleVercelTool(name, args2, deps) {
         ]
       };
     }
+    case "vercel-domains": {
+      const action = (args2.action ? String(args2.action) : "list").toLowerCase();
+      if (!args2.project) {
+        return { content: [{ type: "text", text: 'Error: vercel-domains requires "project".' }] };
+      }
+      const token = await getVercelToken(deps);
+      const projectInput = String(args2.project);
+      const projectId = await resolveProjectId(token, projectInput);
+      if (action === "list") {
+        const { domains, error } = await listProjectDomains(token, projectId);
+        if (error) return { content: [{ type: "text", text: `Error: ${error}` }] };
+        return { content: [{ type: "text", text: formatDomainsTable(domains) }] };
+      }
+      if (action === "add") {
+        if (!args2.domain) {
+          return { content: [{ type: "text", text: 'Error: action="add" requires "domain".' }] };
+        }
+        const body = { name: String(args2.domain) };
+        if (args2.gitBranch) body.gitBranch = String(args2.gitBranch);
+        if (args2.redirect) body.redirect = String(args2.redirect);
+        if (args2.redirectStatusCode) body.redirectStatusCode = Number(args2.redirectStatusCode);
+        const { domain, error } = await addProjectDomain(token, projectId, body);
+        if (error) return { content: [{ type: "text", text: `Error: ${error}` }] };
+        if (!domain) {
+          return { content: [{ type: "text", text: `Domain ${body.name} added (no detail returned).` }] };
+        }
+        const { config } = await getDomainConfig(token, domain.name);
+        const status = formatDomainStatus(domain, config);
+        const headline = domain.verified ? `Domain ${domain.name} added and verified.` : `Domain ${domain.name} added. DNS verification still pending.`;
+        return { content: [{ type: "text", text: `${headline}
+
+${status}` }] };
+      }
+      if (action === "verify") {
+        if (!args2.domain) {
+          return { content: [{ type: "text", text: 'Error: action="verify" requires "domain".' }] };
+        }
+        const domainName = String(args2.domain);
+        const { domain, error } = await getProjectDomain(token, projectId, domainName);
+        if (error) return { content: [{ type: "text", text: `Error: ${error}` }] };
+        if (!domain) {
+          return { content: [{ type: "text", text: `Domain ${domainName} not found on this project.` }] };
+        }
+        const { config } = await getDomainConfig(token, domainName);
+        return { content: [{ type: "text", text: formatDomainStatus(domain, config) }] };
+      }
+      if (action === "remove") {
+        if (!args2.domain) {
+          return { content: [{ type: "text", text: 'Error: action="remove" requires "domain".' }] };
+        }
+        const domainName = String(args2.domain);
+        const { error } = await removeProjectDomain(token, projectId, domainName);
+        if (error) return { content: [{ type: "text", text: `Error: ${error}` }] };
+        return { content: [{ type: "text", text: `Domain ${domainName} removed from project.` }] };
+      }
+      return {
+        content: [
+          { type: "text", text: `Error: unknown action "${action}". Use list, add, verify, or remove.` }
+        ]
+      };
+    }
     default:
       return { content: [{ type: "text", text: `Unknown vercel tool: ${name}` }] };
   }
@@ -1186,7 +1403,6 @@ var TOOL_MODULE_MAP = {
   "wait-for": "ssh_servers",
   "db-discover": "ssh_servers",
   "db-tables": "ssh_servers",
-  "db-describe": "ssh_servers",
   "db-query": "ssh_servers",
   "cache-purge": "ssh_servers",
   "env-list": "ci_cd",
@@ -1194,9 +1410,7 @@ var TOOL_MODULE_MAP = {
   "env-store": "ci_cd",
   "domain-list": "domains",
   "dns-list": "domains",
-  "dns-create": "domains",
-  "dns-update": "domains",
-  "dns-delete": "domains",
+  "dns-record": "domains",
   ...TRIGGER_TOOL_MODULE_MAP,
   ...VERCEL_TOOL_MODULE_MAP
 };
@@ -3146,6 +3360,42 @@ var BLOCKED_SQL_PATTERNS = [
   /\bALTER\s+TABLE\s+\w+\s+DROP\b/i,
   /\bDELETE\s+FROM\s+\w+\s*$/i
 ];
+function buildDescribeSql(target, engine) {
+  if (target === "*" || target === "") {
+    if (engine === "postgres") {
+      return "SELECT schemaname, tablename FROM pg_tables WHERE schemaname NOT IN ('pg_catalog','information_schema') ORDER BY schemaname, tablename";
+    }
+    if (engine === "mssql") {
+      return "SELECT TABLE_SCHEMA, TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_TYPE='BASE TABLE' ORDER BY TABLE_SCHEMA, TABLE_NAME";
+    }
+    return "SHOW TABLES";
+  }
+  const safe = target.replace(/[^a-zA-Z0-9_]/g, "");
+  if (!safe) throw new Error(`Invalid describe target: ${target}`);
+  if (engine === "postgres") {
+    return `SELECT column_name, data_type, is_nullable, column_default FROM information_schema.columns WHERE table_name='${safe}' ORDER BY ordinal_position;
+SELECT indexname, indexdef FROM pg_indexes WHERE tablename='${safe}'`;
+  }
+  if (engine === "mssql") {
+    return `EXEC sp_help '${safe}'`;
+  }
+  return `DESCRIBE \`${safe}\`; SHOW INDEX FROM \`${safe}\``;
+}
+function formatDbQueryFooter(output, appliedLimit, maxRows, explainMode) {
+  if (explainMode) {
+    return "\n\n[explain] Plan returned, no rows executed.";
+  }
+  if (!appliedLimit) return "";
+  const rows = output.split("\n").filter((l) => l.trim() && !/^\s*[-+|]/.test(l)).length;
+  if (rows > maxRows) {
+    return `
+
+[truncated] auto-LIMIT ${maxRows} hit \u2014 more rows available. Refine WHERE / ORDER BY or raise maxRows (max 10000).`;
+  }
+  return `
+
+[ok] returned ${rows} row(s), under auto-LIMIT ${maxRows}.`;
+}
 function assertSafeSql(query) {
   const trimmed = query.trim();
   for (const pattern of BLOCKED_SQL_PATTERNS) {
@@ -3217,6 +3467,36 @@ function requireMijnhostApiKey() {
   }
   return mijnhostApiKey;
 }
+function formatDnsDiff(domain, before, after, change) {
+  const fmt = (r) => `${r.type.padEnd(6)} ${r.name.padEnd(30)} ttl=${String(r.ttl).padEnd(5)} ${r.value}`;
+  const lines = [];
+  lines.push(`[dryRun] ${change.verb.toUpperCase()} on ${domain} \u2014 no changes applied.`);
+  lines.push(`Records before: ${before.length}  \u2192  after: ${after.length}`);
+  if (change.removed?.length) {
+    lines.push("", "REMOVED:");
+    for (const r of change.removed) lines.push(`  - ${fmt(r)}`);
+  }
+  if (change.added?.length) {
+    lines.push("", "ADDED:");
+    for (const r of change.added) lines.push(`  + ${fmt(r)}`);
+  }
+  const sensitive = [
+    ...change.added ?? [],
+    ...change.removed ?? []
+  ].filter((r) => {
+    if (r.type === "MX") return true;
+    if (r.type === "TXT") {
+      const v = r.value.toLowerCase();
+      return v.includes("v=spf1") || v.includes("v=dmarc1") || v.includes("_domainkey") || r.name.toLowerCase().includes("_domainkey");
+    }
+    return false;
+  });
+  if (sensitive.length > 0) {
+    lines.push("", "! WARNING: touches mail-auth records (MX / SPF / DMARC / DKIM). Double-check before re-running without dryRun.");
+  }
+  lines.push("", "Re-run without `dryRun: true` to apply.");
+  return lines.join("\n");
+}
 async function mijnhostFetch(path, options = {}) {
   const key = requireMijnhostApiKey();
   const res = await fetch(`${MIJNHOST_BASE_URL}${path}`, {
@@ -3457,35 +3737,25 @@ var TOOLS = [
       required: ["serverId", "sitePath"]
     }
   },
-  {
-    name: "db-describe",
-    description: "Show the structure of a database table (columns, types, keys, defaults). Credentials are auto-discovered from site config files.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        serverId: { type: "string", description: "UUID of the SSH server" },
-        sitePath: { type: "string", description: "Site root path (e.g. /var/www/example.com)" },
-        table: { type: "string", description: "Table name" }
-      },
-      required: ["serverId", "sitePath", "table"]
-    }
-  },
   {
     name: "db-query",
-    description: 'Execute a SQL query against any database. Two routing modes:\n- MySQL via `/var/www` autodiscover (default): pass `sitePath` (and `engine: "mysql"` implicitly). Credentials are read from wp-config.php, parameters.php, .env. Same behaviour as before.\n- Direct via Docker container: pass `containerName` (the container running the DB server). Engine defaults to `postgres`; pass `engine: "mysql"` or `"mssql"` to override. The query is piped via stdin so quotes / `$` / `;` are never re-interpreted.\n\nPostgres example: `{ serverId, containerName: "supabase-db", engine: "postgres", dbName: "main", dbUser: "postgres", query: "SELECT 1" }`. Defaults: dbUser=postgres, dbName=postgres.\nMSSQL example: `{ serverId, containerName: "mssql-1", engine: "mssql", dbUser: "sa", dbPass: "...", query: "SELECT 1" }`.\n\nDestructive operations (DROP, TRUNCATE, etc.) are blocked.',
+    description: 'Execute a SQL query against any database. Two routing modes:\n- MySQL via `/var/www` autodiscover (default): pass `sitePath` (and `engine: "mysql"` implicitly). Credentials are read from wp-config.php, parameters.php, .env. Same behaviour as before.\n- Direct via Docker container: pass `containerName` (the container running the DB server). Engine defaults to `postgres`; pass `engine: "mysql"` or `"mssql"` to override. The query is piped via stdin so quotes / `$` / `;` are never re-interpreted.\n\nPostgres example: `{ serverId, containerName: "supabase-db", engine: "postgres", dbName: "main", dbUser: "postgres", query: "SELECT 1" }`. Defaults: dbUser=postgres, dbName=postgres.\nMSSQL example: `{ serverId, containerName: "mssql-1", engine: "mssql", dbUser: "sa", dbPass: "...", query: "SELECT 1" }`.\n\nResult safety: `maxRows` (default 1000, max 10000) auto-injects a `LIMIT` for SELECT queries that don\'t have one, so unbounded scans never blow up the token budget. The footer reports whether the cap was applied. Pass `maxRows: 0` to disable.\n\nDiagnostics: `explain: true` prepends EXPLAIN (postgres / mysql) or runs `SET SHOWPLAN_TEXT ON` (mssql) so you can inspect the query plan without rewriting the query.\n\nSchema introspection: pass `describe: "tablename"` to get columns + indexes (replaces the old db-describe tool, works for mysql, postgres, and mssql). Pass `describe: "*"` to list all tables in the current database. When `describe` is set, `query` is ignored.\n\nDestructive operations (DROP, TRUNCATE, etc.) are blocked.',
     inputSchema: {
       type: "object",
       properties: {
         serverId: { type: "string", description: "UUID of the SSH server" },
-        query: { type: "string", description: "SQL query to execute" },
+        query: { type: "string", description: "SQL query to execute (ignored when describe is set)" },
+        describe: { type: "string", description: 'Schema introspection shortcut. Pass a table name for columns + indexes, or "*" to list all tables. Works for mysql / postgres / mssql.' },
         sitePath: { type: "string", description: "Site root path (e.g. /var/www/example.com). Used only with engine=mysql autodiscover." },
         containerName: { type: "string", description: 'Docker container running the DB server (e.g. "supabase-db", "trigger-postgres"). Activates direct-query mode.' },
         engine: { type: "string", enum: ["mysql", "postgres", "mssql"], description: 'DB engine. Defaults to "mysql" with sitePath, "postgres" with containerName.' },
         dbName: { type: "string", description: 'Database name (containerName mode). Defaults: postgres \u2192 "postgres", mysql \u2192 server default, mssql \u2192 server default.' },
         dbUser: { type: "string", description: 'Database user (containerName mode). Defaults: postgres \u2192 "postgres", mysql \u2192 "root", mssql \u2192 "sa".' },
-        dbPass: { type: "string", description: "Database password (containerName mode). Required for mssql; optional for mysql; postgres uses trust auth by default." }
+        dbPass: { type: "string", description: "Database password (containerName mode). Required for mssql; optional for mysql; postgres uses trust auth by default." },
+        maxRows: { type: "number", description: "Auto-inject LIMIT for unbounded SELECTs. Default 1000, max 10000, set 0 to disable." },
+        explain: { type: "boolean", description: "Prepend EXPLAIN (postgres/mysql) or SHOWPLAN (mssql) instead of executing. Useful for slow-query diagnosis." }
       },
-      required: ["serverId", "query"]
+      required: ["serverId"]
     }
   },
   {
@@ -3540,63 +3810,44 @@ var TOOLS = [
   // ----- Domains (mijn.host) -----
   {
     name: "domain-list",
-    description: "List all domains from the mijn.host account. Returns domain name, status, renewal date, and tags. Requires MIJNHOST_API_KEY.",
-    inputSchema: { type: "object", properties: {}, required: [] }
-  },
-  {
-    name: "dns-list",
-    description: "List all DNS records for a domain. Returns type (A, AAAA, CNAME, MX, TXT, etc.), name, value, and TTL for each record.",
+    description: "List all domains from the mijn.host account. Returns domain name, status, renewal date (= expiration), and tags. Requires MIJNHOST_API_KEY.\n\nPass `details: true` to also fetch DNS zone summary per domain in parallel: NS records, MX target, and presence of SPF/DMARC. Useful as a single-call overview instead of N follow-up dns-list calls. Skipped for inactive/expired domains.",
     inputSchema: {
       type: "object",
       properties: {
-        domain: { type: "string", description: "Domain name (e.g. example.com)" }
+        details: { type: "boolean", description: "Inline DNS zone summary (NS, MX, SPF/DMARC presence) per domain. Adds N parallel API calls \u2014 use sparingly on large accounts." },
+        concurrency: { type: "number", description: "Max concurrent DNS lookups when details=true (default 8, max 20)." }
       },
-      required: ["domain"]
+      required: []
     }
   },
   {
-    name: "dns-create",
-    description: "Add a new DNS record to a domain. Uses PATCH to add without replacing existing records.",
+    name: "dns-list",
+    description: "List all DNS records for a domain. Returns type (A, AAAA, CNAME, MX, TXT, etc.), name, value, and TTL for each record.",
     inputSchema: {
       type: "object",
       properties: {
-        domain: { type: "string", description: "Domain name (e.g. example.com)" },
-        type: { type: "string", description: "Record type: A, AAAA, CNAME, MX, TXT, NS, SRV, CAA, or TLSA" },
-        name: { type: "string", description: "Record name (e.g. @ or subdomain)" },
-        value: { type: "string", description: "Record value (e.g. IP address, hostname)" },
-        ttl: { type: "number", description: "TTL in seconds (min 60, default 3600)" }
+        domain: { type: "string", description: "Domain name (e.g. example.com)" }
       },
-      required: ["domain", "type", "name", "value"]
+      required: ["domain"]
     }
   },
   {
-    name: "dns-update",
-    description: "Update an existing DNS record. Identifies the record by type+name+oldValue, then replaces it with new values via PATCH.",
+    name: "dns-record",
+    description: 'Mutate a single DNS record on a mijn.host domain. Pick the mutation with `action`:\n- "create": add a new record. Required: type, name, value. Optional: ttl (default 3600).\n- "update": replace an existing record. Required: type, name, oldValue, newValue. Optional: ttl.\n- "delete": remove a record. Required: type, name, value.\n\nAlways pass `dryRun: true` first when touching MX / SPF / DKIM / DMARC \u2014 returns a full before/after diff with a mail-auth warning and applies nothing. Re-run without dryRun once the diff looks correct.\n\nUse `dns-list` to inspect the current zone first if you need to identify the right `oldValue`. Requires MIJNHOST_API_KEY.',
     inputSchema: {
       type: "object",
       properties: {
+        action: { type: "string", enum: ["create", "update", "delete"], description: "Which mutation to perform." },
         domain: { type: "string", description: "Domain name (e.g. example.com)" },
         type: { type: "string", description: "Record type: A, AAAA, CNAME, MX, TXT, NS, SRV, CAA, or TLSA" },
-        name: { type: "string", description: "Record name" },
-        oldValue: { type: "string", description: "Current value of the record to update" },
-        newValue: { type: "string", description: "New value for the record" },
-        ttl: { type: "number", description: "New TTL in seconds (min 60)" }
+        name: { type: "string", description: "Record name (e.g. @ or subdomain)." },
+        value: { type: "string", description: "Record value. Required for create + delete. Use newValue for update." },
+        oldValue: { type: "string", description: "Current value of the record (update only) \u2014 used to identify which record to replace." },
+        newValue: { type: "string", description: "New value for the record (update only)." },
+        ttl: { type: "number", description: "TTL in seconds (min 60). Default 3600 for create; defaults to existing TTL for update." },
+        dryRun: { type: "boolean", description: "Preview the change (returns proposed diff) without applying. Recommended for MX/SPF/DKIM/DMARC." }
       },
-      required: ["domain", "type", "name", "oldValue", "newValue"]
-    }
-  },
-  {
-    name: "dns-delete",
-    description: "Delete a DNS record by type, name, and value. Fetches all records, removes the matching one, then replaces the full set.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        domain: { type: "string", description: "Domain name (e.g. example.com)" },
-        type: { type: "string", description: "Record type to delete" },
-        name: { type: "string", description: "Record name to delete" },
-        value: { type: "string", description: "Record value to delete (must match exactly)" }
-      },
-      required: ["domain", "type", "name", "value"]
+      required: ["action", "domain", "type", "name"]
     }
   },
   // ----- Trigger.dev -----
@@ -3604,7 +3855,7 @@ var TOOLS = [
   // ----- Vercel -----
   ...VERCEL_TOOLS
 ];
-var MCP_VERSION = "4.0.0";
+var MCP_VERSION = "6.0.0";
 async function handleListTools() {
   if (!authContext) return { tools: TOOLS };
   const accessible = TOOLS.filter((tool) => {
@@ -4568,29 +4819,46 @@ ${trail.join("\n")}` }] };
         const output = await execSiteMysql(conn, String(a.sitePath), sql, proxy);
         return { content: [{ type: "text", text: output || "No tables found" }] };
       }
-      case "db-describe": {
-        const table = String(a.table).replace(/[^a-zA-Z0-9_]/g, "");
-        const { conn, proxy } = await getServerConnection(String(a.serverId));
-        const output = await execSiteMysql(
-          conn,
-          String(a.sitePath),
-          `DESCRIBE \`${table}\`; SHOW INDEX FROM \`${table}\``,
-          proxy
-        );
-        return { content: [{ type: "text", text: output }] };
-      }
       case "db-query": {
-        const query = String(a.query).trim();
-        if (!query) return { content: [{ type: "text", text: "Error: query is required" }] };
-        assertSafeSql(query);
         const containerName = typeof a.containerName === "string" && a.containerName ? a.containerName.replace(/[^a-zA-Z0-9._-]/g, "") : "";
         const explicitEngine = a.engine === "mysql" || a.engine === "postgres" || a.engine === "mssql" ? a.engine : null;
         const engine = explicitEngine || (containerName ? "postgres" : "mysql");
+        const describeArg = typeof a.describe === "string" ? a.describe.trim() : "";
+        const explainMode = a.explain === true;
+        const maxRowsRaw = a.maxRows === void 0 ? 1e3 : Number(a.maxRows);
+        const maxRows = Math.min(Math.max(Number.isFinite(maxRowsRaw) ? maxRowsRaw : 0, 0), 1e4);
+        let rawQuery;
+        if (describeArg) {
+          rawQuery = buildDescribeSql(describeArg, engine);
+        } else {
+          rawQuery = String(a.query ?? "").trim();
+          if (!rawQuery) return { content: [{ type: "text", text: "Error: query (or describe) is required" }] };
+        }
+        assertSafeSql(rawQuery);
+        let query = rawQuery.replace(/;\s*$/, "");
+        let appliedLimit = false;
+        if (explainMode && !describeArg) {
+          if (engine === "mssql") {
+            query = `SET SHOWPLAN_TEXT ON;
+${query}`;
+          } else {
+            query = `EXPLAIN ${query}`;
+          }
+        } else if (maxRows > 0 && !describeArg) {
+          const isSelect = /^\s*(with\b[\s\S]+?\bselect\b|select\b)/i.test(query);
+          const alreadyLimited = /\blimit\s+\d+\b/i.test(query) || /\btop\s*\(?\s*\d+/i.test(query);
+          if (isSelect && !alreadyLimited && engine !== "mssql") {
+            query = `${query}
+LIMIT ${maxRows + 1}`;
+            appliedLimit = true;
+          }
+        }
         if (!containerName && engine === "mysql") {
           if (!a.sitePath) return { content: [{ type: "text", text: "Error: sitePath is required for mysql autodiscover (or pass containerName + engine for direct DB queries)" }] };
           const { conn: conn2, proxy: proxy2 } = await getServerConnection(String(a.serverId));
           const output2 = await execSiteMysql(conn2, String(a.sitePath), query, proxy2);
-          return { content: [{ type: "text", text: output2 || "Query executed successfully (no output)" }] };
+          const footer2 = formatDbQueryFooter(output2, appliedLimit, maxRows, explainMode);
+          return { content: [{ type: "text", text: (output2 || "Query executed successfully (no output)") + footer2 }] };
         }
         if (!containerName) {
           return { content: [{ type: "text", text: `Error: engine=${engine} requires containerName (the docker container running the DB server, e.g. "supabase-db" or "trigger-postgres")` }] };
@@ -4629,7 +4897,8 @@ GO
         if (result.exitCode !== 0 && !result.stdout) {
           return { content: [{ type: "text", text: `Error (exit ${result.exitCode}, ${engine}): ${output}` }] };
         }
-        return { content: [{ type: "text", text: output }] };
+        const footer = formatDbQueryFooter(output, appliedLimit, maxRows, explainMode);
+        return { content: [{ type: "text", text: output + footer }] };
       }
       // ----- Env Config -----
       case "env-list": {
@@ -4818,13 +5087,68 @@ echo -e "$R"
         if (!domains.length) {
           return { content: [{ type: "text", text: "No domains found" }] };
         }
+        const details = a.details === true;
+        if (!details) {
+          const lines2 = domains.map((d) => {
+            const tags = d.tags?.length ? ` [${d.tags.join(", ")}]` : "";
+            return `${d.domain}  status=${d.status}  renewal=${d.renewal_date}${tags}`;
+          });
+          return { content: [{ type: "text", text: `${domains.length} domain(s):
+
+${lines2.join("\n")}` }] };
+        }
+        const concurrency = Math.min(Math.max(Number(a.concurrency) || 8, 1), 20);
+        const summaries = /* @__PURE__ */ new Map();
+        const skipStatuses = /* @__PURE__ */ new Set(["expired", "redemptionperiod", "pendingdelete", "inactive"]);
+        const activeDomains = domains.filter((d) => !skipStatuses.has((d.status || "").toLowerCase()));
+        async function fetchSummary(domain) {
+          try {
+            const r = await mijnhostFetch(
+              `/domains/${encodeURIComponent(domain)}/dns`
+            );
+            const recs = r.data.records || [];
+            const ns = recs.filter((x) => x.type === "NS").map((x) => x.value).sort();
+            const mx = recs.filter((x) => x.type === "MX").map((x) => x.value).sort();
+            const hasSpf = recs.some((x) => x.type === "TXT" && x.value.toLowerCase().includes("v=spf1"));
+            const hasDmarc = recs.some(
+              (x) => x.type === "TXT" && (x.name.toLowerCase().startsWith("_dmarc") || x.value.toLowerCase().includes("v=dmarc1"))
+            );
+            return { ns, mx, hasSpf, hasDmarc };
+          } catch (err) {
+            return { ns: [], mx: [], hasSpf: false, hasDmarc: false, error: err instanceof Error ? err.message : String(err) };
+          }
+        }
+        const queue = [...activeDomains];
+        async function worker() {
+          while (queue.length > 0) {
+            const d = queue.shift();
+            if (!d) return;
+            summaries.set(d.domain, await fetchSummary(d.domain));
+          }
+        }
+        await Promise.all(Array.from({ length: Math.min(concurrency, queue.length) }, worker));
         const lines = domains.map((d) => {
           const tags = d.tags?.length ? ` [${d.tags.join(", ")}]` : "";
-          return `${d.domain}  status=${d.status}  renewal=${d.renewal_date}${tags}`;
+          const head = `${d.domain}  status=${d.status}  expires=${d.renewal_date}${tags}`;
+          const s = summaries.get(d.domain);
+          if (!s) return head;
+          if (s.error) return `${head}
+    dns: error: ${s.error}`;
+          const ns = s.ns.length ? s.ns.join(", ") : "(none)";
+          const mx = s.mx.length ? s.mx.join(", ") : "(none)";
+          const mail = `mx=${mx}  spf=${s.hasSpf ? "yes" : "NO"}  dmarc=${s.hasDmarc ? "yes" : "NO"}`;
+          return `${head}
+    ns: ${ns}
+    ${mail}`;
         });
-        return { content: [{ type: "text", text: `${domains.length} domain(s):
+        return {
+          content: [{
+            type: "text",
+            text: `${domains.length} domain(s) (${activeDomains.length} with DNS lookup):
 
-${lines.join("\n")}` }] };
+${lines.join("\n")}`
+          }]
+        };
       }
       case "dns-list": {
         const domain = String(a.domain);
@@ -4847,81 +5171,80 @@ ${header}
 ${sep}
 ${lines.join("\n")}` }] };
       }
-      case "dns-create": {
-        const domain = String(a.domain);
-        const type = String(a.type).toUpperCase();
-        const dnsName = String(a.name);
-        const value = String(a.value);
-        const ttl = Number(a.ttl) || 3600;
-        if (!domain || !type || !dnsName || !value) {
-          throw new Error("domain, type, name, and value are required");
+      case "dns-record": {
+        const action = String(a.action);
+        if (action !== "create" && action !== "update" && action !== "delete") {
+          throw new Error("action must be one of: create, update, delete");
         }
-        const current = await mijnhostFetch(
-          `/domains/${encodeURIComponent(domain)}/dns`
-        );
-        const records = [...current.data.records, { type, name: dnsName, value, ttl }];
-        await mijnhostFetch(`/domains/${encodeURIComponent(domain)}/dns`, {
-          method: "PUT",
-          body: JSON.stringify({ records })
-        });
-        return { content: [{ type: "text", text: `DNS record created: ${type} ${dnsName} \u2192 ${value} (TTL: ${ttl})` }] };
-      }
-      case "dns-update": {
         const domain = String(a.domain);
         const type = String(a.type).toUpperCase();
         const dnsName = String(a.name);
-        const oldValue = String(a.oldValue);
-        const newValue = String(a.newValue);
-        const ttl = Number(a.ttl) || void 0;
-        if (!domain || !type || !dnsName || !oldValue || !newValue) {
-          throw new Error("domain, type, name, oldValue, and newValue are required");
+        const dryRun = a.dryRun === true;
+        if (!domain || !type || !dnsName) {
+          throw new Error("domain, type, and name are required");
         }
         const current = await mijnhostFetch(
           `/domains/${encodeURIComponent(domain)}/dns`
         );
-        const idx = current.data.records.findIndex(
-          (r) => r.type === type && r.name === dnsName && r.value === oldValue
-        );
-        if (idx === -1) {
-          throw new Error(`No matching DNS record found: ${type} ${dnsName} = ${oldValue}`);
-        }
-        const updated = [...current.data.records];
-        const existingTtl = updated[idx].ttl;
-        updated[idx] = {
-          type,
-          name: dnsName,
-          value: newValue,
-          ttl: ttl ?? existingTtl
-        };
-        await mijnhostFetch(`/domains/${encodeURIComponent(domain)}/dns`, {
-          method: "PUT",
-          body: JSON.stringify({ records: updated })
-        });
-        return { content: [{ type: "text", text: `DNS record updated: ${type} ${dnsName} \u2192 ${newValue}${ttl ? ` (TTL: ${ttl})` : ""}` }] };
-      }
-      case "dns-delete": {
-        const domain = String(a.domain);
-        const type = String(a.type).toUpperCase();
-        const dnsName = String(a.name);
-        const value = String(a.value);
-        if (!domain || !type || !dnsName || !value) {
-          throw new Error("domain, type, name, and value are required");
+        let nextRecords;
+        let diffArgs;
+        let okMessage;
+        if (action === "create") {
+          const value = typeof a.value === "string" ? a.value : "";
+          if (!value) throw new Error('action="create" requires value');
+          const ttl = Number(a.ttl) || 3600;
+          const newRecord = { type, name: dnsName, value, ttl };
+          nextRecords = [...current.data.records, newRecord];
+          diffArgs = { verb: "create", added: [newRecord] };
+          okMessage = `DNS record created: ${type} ${dnsName} \u2192 ${value} (TTL: ${ttl})`;
+        } else if (action === "update") {
+          const oldValue = typeof a.oldValue === "string" ? a.oldValue : "";
+          const newValue = typeof a.newValue === "string" ? a.newValue : "";
+          if (!oldValue || !newValue) throw new Error('action="update" requires oldValue and newValue');
+          const ttlArg = a.ttl !== void 0 ? Number(a.ttl) : void 0;
+          const idx = current.data.records.findIndex(
+            (r) => r.type === type && r.name === dnsName && r.value === oldValue
+          );
+          if (idx === -1) {
+            throw new Error(`No matching DNS record found: ${type} ${dnsName} = ${oldValue}`);
+          }
+          const updated = [...current.data.records];
+          const before = updated[idx];
+          const after = {
+            type,
+            name: dnsName,
+            value: newValue,
+            ttl: ttlArg ?? before.ttl
+          };
+          updated[idx] = after;
+          nextRecords = updated;
+          diffArgs = { verb: "update", removed: [before], added: [after] };
+          okMessage = `DNS record updated: ${type} ${dnsName} \u2192 ${newValue}${ttlArg ? ` (TTL: ${ttlArg})` : ""}`;
+        } else {
+          const value = typeof a.value === "string" ? a.value : "";
+          if (!value) throw new Error('action="delete" requires value');
+          const removed = current.data.records.filter(
+            (r) => r.type === type && r.name === dnsName && r.value === value
+          );
+          const remaining = current.data.records.filter(
+            (r) => !(r.type === type && r.name === dnsName && r.value === value)
+          );
+          if (removed.length === 0) {
+            throw new Error(`No matching DNS record found: ${type} ${dnsName} = ${value}`);
+          }
+          nextRecords = remaining;
+          diffArgs = { verb: "delete", removed };
+          okMessage = `DNS record deleted: ${type} ${dnsName} = ${value} (${remaining.length} records remaining)`;
         }
-        const current = await mijnhostFetch(
-          `/domains/${encodeURIComponent(domain)}/dns`
-        );
-        const before = current.data.records.length;
-        const remaining = current.data.records.filter(
-          (r) => !(r.type === type && r.name === dnsName && r.value === value)
-        );
-        if (remaining.length === before) {
-          throw new Error(`No matching DNS record found: ${type} ${dnsName} = ${value}`);
+        if (dryRun) {
+          const diff = formatDnsDiff(domain, current.data.records, nextRecords, diffArgs);
+          return { content: [{ type: "text", text: diff }] };
         }
         await mijnhostFetch(`/domains/${encodeURIComponent(domain)}/dns`, {
           method: "PUT",
-          body: JSON.stringify({ records: remaining })
+          body: JSON.stringify({ records: nextRecords })
         });
-        return { content: [{ type: "text", text: `DNS record deleted: ${type} ${dnsName} = ${value} (${remaining.length} records remaining)` }] };
+        return { content: [{ type: "text", text: okMessage }] };
       }
       default:
         if (TRIGGER_TOOL_NAMES.has(name)) {