@selfhost.dev/mcp-server 0.1.0 → 0.2.0

package/README.md

@@ -4,8 +4,6 @@ A full-featured [Model Context Protocol](https://modelcontextprotocol.io/) serve
 
 Works with **Claude Code**, **Cursor**, **Windsurf**, **Cline**, and any MCP-compatible client.
 
-> **JIRA Epic:** [SELFHOST-110](https://selfhost.atlassian.net/browse/SELFHOST-110)
-
 ---
 
 ## Quick Start
@@ -83,6 +81,12 @@ Claude: Authenticates → fetches your orgs → selects org → lists instances
 | *"Fork my production database for testing"* | Creates an independent clone with a new password |
 | *"What's my estimated monthly cost for an r6i.xlarge with 500GB gp3?"* | Calculates itemized cost breakdown |
 | *"Tune shared_buffers on my instance"* | Previews defaults, applies the override, syncs to replicas |
+| *"Enable PgBouncer on my prod DB with 200 max clients"* | Configures connection pooling, clients connect on port 6432 |
+| *"Add a read-only database user for the reporting app"* | Creates a DBMS-level credential with the right grants |
+| *"Restore my prod database to 14:30 yesterday into a new instance"* | Sets up a point-in-time recovery from WAL + base backups |
+| *"Scale my instance to r6i.2xlarge and 1TB"* | Issues a manual scale, polls the resize event |
+| *"Auto-stop my staging DB at 7pm weekdays"* | Creates a scheduled scaling policy with start/stop times |
+| *"Upgrade my org to the Pro plan"* | Confirms billing state, creates or changes the subscription |
 
 ### Safety Built In
 
@@ -92,7 +96,7 @@ Destructive operations (delete, stop, reboot) require explicit confirmation. The
 
 ## Features
 
-### 76 tools across 8 modules
+### 104 tools across 13 modules
 
 Every tool maps to a real API endpoint. No mock data, no shortcuts.
 
@@ -220,6 +224,63 @@ Monitor your databases and get notified when things go wrong.
 | `delete_notification_channel` | Remove channel (with confirmation) |
 | `test_notification_channel` | Send test notification |
 
+#### Connection Pooling (PgBouncer)
+PostgreSQL-only. Reduces connection overhead for high-concurrency workloads. Clients connect on port 6432 once enabled.
+
+| Tool | Description |
+|------|-------------|
+| `get_pgbouncer` | Get current pooling config (or null if never configured) |
+| `enable_pgbouncer` | Enable pooling with pool mode, max client conn, pool sizes |
+| `reconfigure_pgbouncer` | Apply new settings on an enabled instance (PATCH-style) |
+| `disable_pgbouncer` | Drain pool and disable (with confirmation) |
+
+#### Database Users
+DBMS-level credentials — distinct from the SelfHost platform login. Use for apps and people that need their own DB user.
+
+| Tool | Description |
+|------|-------------|
+| `list_database_users` | List users with role, status, target DB, expiry metadata |
+| `create_database_user` | Create user with role (read_only / read_write / admin) and optional connection limit + password expiry |
+| `update_database_user` | Change role, connection limit, or password expiry |
+| `delete_database_user` | Soft-delete user (with confirmation) — drops active connections |
+| `rotate_database_user_password` | Rotate password (with confirmation) — new value shown once |
+
+#### Scaling
+Manual one-off resize plus auto-scaling policies (reactive metric-based, scheduled cron, and auto start/stop).
+
+| Tool | Description |
+|------|-------------|
+| `scale_instance` | Manual resize — change instance type, volume type, size, IOPS, throughput |
+| `list_scaling_policies` | List policies, optionally filtered to one instance |
+| `create_scaling_policy` | Create policy — reactive metric breach, scheduled cron, or auto start/stop schedule |
+| `update_scaling_policy` | Modify thresholds, schedule, or action details |
+| `delete_scaling_policy` | Remove a policy (with confirmation) |
+
+#### Point-in-Time Recovery (PITR)
+PostgreSQL-only, Pro+. Continuous WAL archiving to S3 + restore to any second within the retention window. Restore creates a brand-new instance — the source is untouched.
+
+| Tool | Description |
+|------|-------------|
+| `get_pitr` | Current config + restore window (oldest / latest restorable moments) |
+| `enable_pitr` | Set up WAL archiving to an S3 bucket with retention days |
+| `configure_pitr` | Toggle between `enabled` (resume) and `disabled` (pause) |
+| `retry_pitr` | Retry after an `error` state (e.g. fix IAM, then retry) |
+| `trigger_pitr_base_backup` | Run a one-off base backup now |
+| `list_pitr_base_backups` | List historical base backups with status + timestamps |
+| `restore_pitr` | Restore to a target time into a new instance (with confirmation) |
+
+#### Billing & Subscriptions
+Subscription lifecycle and payment-method linking. All endpoints scoped to the active org.
+
+| Tool | Description |
+|------|-------------|
+| `get_subscription` | Get current subscription (404 = no subscription, on Free) |
+| `create_subscription` | Start a paid subscription (plan goes `pending` → `active` via Razorpay webhook) |
+| `change_subscription` | Upgrade or downgrade plan (downgrades scheduled at cycle end) |
+| `cancel_subscription` | Cancel — keeps access until cycle end (with confirmation) |
+| `link_billing_payment_method` | Initiate Razorpay link — returns short URL to open in browser |
+| `update_billing_contact` | Update billing phone / tax ID / country / state for invoices |
+
 ---
 
 ## Common Workflows

package/dist/index.js

@@ -12,6 +12,11 @@ import { registerInstanceTools } from "./tools/instances.js";
 import { registerPgConfigTools } from "./tools/pg-config.js";
 import { registerBackupTools } from "./tools/backups.js";
 import { registerAlertTools } from "./tools/alerts.js";
+import { registerPgBouncerTools } from "./tools/pgbouncer.js";
+import { registerDatabaseUserTools } from "./tools/database-users.js";
+import { registerScalingTools } from "./tools/scaling.js";
+import { registerPitrTools } from "./tools/pitr.js";
+import { registerBillingTools } from "./tools/billing.js";
 const server = new McpServer({
     name: "selfhost",
     version: "0.1.0",
@@ -32,6 +37,16 @@ registerPgConfigTools(server);
 registerBackupTools(server);
 // Module 8: Alerts & Notifications
 registerAlertTools(server);
+// Module 9: PgBouncer connection pooling (Postgres, paid)
+registerPgBouncerTools(server);
+// Module 10: Database users (DBMS-level credentials)
+registerDatabaseUserTools(server);
+// Module 11: Scaling — manual + auto-scaling policies + auto start/stop
+registerScalingTools(server);
+// Module 12: Point-in-Time Recovery (Postgres, Pro+)
+registerPitrTools(server);
+// Module 13: Billing — subscriptions + payment-method linking
+registerBillingTools(server);
 // Server utility tools
 server.tool("reauthenticate", "Clear stored credentials and sign in again (use to switch accounts or fix auth issues)", {}, async () => {
     try {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC1G,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;IAC3B,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC;AAEH,yBAAyB;AACzB,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAE1B,oCAAoC;AACpC,yBAAyB,CAAC,MAAM,CAAC,CAAC;AAElC,8BAA8B;AAC9B,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAEhC,wDAAwD;AACxD,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAEhC,+BAA+B;AAC/B,qBAAqB,CAAC,MAAM,CAAC,CAAC;AAE9B,8BAA8B;AAC9B,qBAAqB,CAAC,MAAM,CAAC,CAAC;AAE9B,gCAAgC;AAChC,mBAAmB,CAAC,MAAM,CAAC,CAAC;AAE5B,mCAAmC;AACnC,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAE3B,uBAAuB;AACvB,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,wFAAwF,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE;IACrI,IAAI,CAAC;QACH,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,WAAW,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,oJAAoJ;iBAC3J,CAAC;SACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;IACxH,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAC9C,MAAM,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAExC,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,iGAAiG;IACjG,IAAI,CAAC,CAAC,MAAM,cAAc,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,eAAe,EAAE,CAAC,EAAE,CAAC;QAC5D,gBAAgB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnC,aAAa,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YACzB,sDAAsD;QACxD,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,MAAM,CAAC,GAAG,CAAC,gBAAgB,GAAG,EAAE,CAAC,CAAC;IAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC1G,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;IAC3B,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC;AAEH,yBAAyB;AACzB,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAE1B,oCAAoC;AACpC,yBAAyB,CAAC,MAAM,CAAC,CAAC;AAElC,8BAA8B;AAC9B,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAEhC,wDAAwD;AACxD,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAEhC,+BAA+B;AAC/B,qBAAqB,CAAC,MAAM,CAAC,CAAC;AAE9B,8BAA8B;AAC9B,qBAAqB,CAAC,MAAM,CAAC,CAAC;AAE9B,gCAAgC;AAChC,mBAAmB,CAAC,MAAM,CAAC,CAAC;AAE5B,mCAAmC;AACnC,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAE3B,0DAA0D;AAC1D,sBAAsB,CAAC,MAAM,CAAC,CAAC;AAE/B,qDAAqD;AACrD,yBAAyB,CAAC,MAAM,CAAC,CAAC;AAElC,wEAAwE;AACxE,oBAAoB,CAAC,MAAM,CAAC,CAAC;AAE7B,qDAAqD;AACrD,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAE1B,8DAA8D;AAC9D,oBAAoB,CAAC,MAAM,CAAC,CAAC;AAE7B,uBAAuB;AACvB,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,wFAAwF,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE;IACrI,IAAI,CAAC;QACH,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,WAAW,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,oJAAoJ;iBAC3J,CAAC;SACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;IACxH,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAC9C,MAAM,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAExC,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,iGAAiG;IACjG,IAAI,CAAC,CAAC,MAAM,cAAc,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,eAAe,EAAE,CAAC,EAAE,CAAC;QAC5D,gBAAgB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnC,aAAa,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YACzB,sDAAsD;QACxD,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,MAAM,CAAC,GAAG,CAAC,gBAAgB,GAAG,EAAE,CAAC,CAAC;IAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/tools/billing.d.ts

@@ -0,0 +1,2 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function registerBillingTools(server: McpServer): void;

package/dist/tools/billing.js

@@ -0,0 +1,248 @@
+import { z } from "zod";
+import { apiRequest } from "../client.js";
+import { session } from "../session.js";
+/**
+ * Billing — subscription lifecycle + payment method linking.
+ *
+ * Endpoints:
+ * - GET    /organizations/:pid/billing/subscription      — current subscription
+ * - POST   /organizations/:pid/billing/subscriptions     — create (first time)
+ * - PATCH  /organizations/:pid/billing/subscriptions     — change plan (up/downgrade)
+ * - DELETE /organizations/:pid/billing/subscriptions     — cancel
+ * - POST   /organizations/:pid/billing/link              — initiate Razorpay link
+ * - PATCH  /organizations/:pid/billing/contact           — update contact / tax info
+ *
+ * All endpoints are org-scoped via the path. The org PID is taken from the
+ * MCP session by default; pass `organization_id` to target a different org.
+ *
+ * Note: actually entering card details happens in a browser (Razorpay
+ * checkout). `link_billing_payment_method` returns the short URL the user
+ * needs to open; it does not complete the payment flow from here.
+ */
+const PLANS = ["free", "starter", "pro", "enterprise"];
+function resolveOrgId(organization_id) {
+    return organization_id || session.getActiveOrgId();
+}
+const noOrgMessage = "No organization selected. Call `select_organization` first or pass an organization_id.";
+export function registerBillingTools(server) {
+    server.tool("get_subscription", "Get the current billing subscription for an organization. Returns 404 (success=false, statusCode=404) for orgs that have never subscribed (i.e. on Free from day one). Response includes billing_plan, lifecycle_state (pending | active | past_due | cancelling | cancelled | paused | revoked), next_billing_date, and Razorpay metadata.", {
+        organization_id: z.string().optional()
+            .describe("Org PID (defaults to active org)"),
+    }, async ({ organization_id }) => {
+        const orgId = resolveOrgId(organization_id);
+        if (!orgId) {
+            return { content: [{ type: "text", text: noOrgMessage }] };
+        }
+        const result = await apiRequest(`/organizations/${orgId}/billing/subscription`, {
+            toolName: "get_subscription",
+            skipOrgInjection: true,
+        });
+        if (!result.success) {
+            return {
+                content: [{
+                        type: "text",
+                        text: `Failed to get subscription (${result.statusCode}): ${result.message}`,
+                    }],
+            };
+        }
+        return { content: [{ type: "text", text: JSON.stringify(result.data, null, 2) }] };
+    });
+    server.tool("create_subscription", "Start a paid subscription on an organization that doesn't have one yet. BE optimistically flips org.billing_plan + lifecycle_state=`pending`, then awaits the Razorpay `subscription.activated` webhook to move it to `active`. If the org isn't already linked (no payment method), call `link_billing_payment_method` first.", {
+        organization_id: z.string().optional(),
+        billing_plan: z.enum(PLANS).describe("Target plan (starter | pro | enterprise)"),
+    }, async ({ organization_id, billing_plan }) => {
+        if (billing_plan === "free") {
+            return {
+                content: [{
+                        type: "text",
+                        text: "Free is the default — no subscription needed. Use `change_subscription` with billing_plan=free to downgrade an existing paid subscription.",
+                    }],
+            };
+        }
+        const orgId = resolveOrgId(organization_id);
+        if (!orgId) {
+            return { content: [{ type: "text", text: noOrgMessage }] };
+        }
+        const result = await apiRequest(`/organizations/${orgId}/billing/subscriptions`, {
+            method: "POST",
+            body: { organization: { billing_plan } },
+            toolName: "create_subscription",
+            skipOrgInjection: true,
+        });
+        if (!result.success) {
+            return {
+                content: [{
+                        type: "text",
+                        text: `Failed to create subscription (${result.statusCode}): ${result.message}`,
+                    }],
+            };
+        }
+        return {
+            content: [
+                { type: "text", text: `Subscription create requested for plan \`${billing_plan}\`. The lifecycle state will move from \`pending\` to \`active\` once Razorpay confirms — poll \`get_subscription\`.` },
+                { type: "text", text: JSON.stringify(result.data, null, 2) },
+            ],
+        };
+    });
+    server.tool("change_subscription", "Change an existing subscription's plan (upgrade or downgrade). Upgrades apply immediately and prorate; downgrades are scheduled at the end of the current billing cycle. A downgrade may return 422 DOWNGRADE_BLOCKED if the org has resources above the target plan's caps (e.g. >3 instances on Starter) — surface the BE error message to the user.", {
+        organization_id: z.string().optional(),
+        billing_plan: z.enum(PLANS).describe("Target plan"),
+    }, async ({ organization_id, billing_plan }) => {
+        const orgId = resolveOrgId(organization_id);
+        if (!orgId) {
+            return { content: [{ type: "text", text: noOrgMessage }] };
+        }
+        const result = await apiRequest(`/organizations/${orgId}/billing/subscriptions`, {
+            method: "PATCH",
+            body: { organization: { billing_plan } },
+            toolName: "change_subscription",
+            skipOrgInjection: true,
+        });
+        if (!result.success) {
+            return {
+                content: [{
+                        type: "text",
+                        text: `Failed to change subscription (${result.statusCode}): ${result.message}`,
+                    }],
+            };
+        }
+        return {
+            content: [
+                { type: "text", text: `Subscription change requested to \`${billing_plan}\`. Upgrades apply immediately; downgrades are scheduled at cycle end.` },
+                { type: "text", text: JSON.stringify(result.data, null, 2) },
+            ],
+        };
+    });
+    server.tool("cancel_subscription", "Cancel the active subscription. BE moves the org to `cancelling` for the rest of the current billing cycle, then `cancelled` (which drops to Free with reduced caps). Resources above Free caps remain reachable but new ones cannot be created.", {
+        organization_id: z.string().optional(),
+        confirm: z.boolean().describe("Must be true to proceed. Cancellation takes effect at the end of the current billing cycle."),
+    }, async ({ organization_id, confirm }) => {
+        if (!confirm) {
+            return {
+                content: [{
+                        type: "text",
+                        text: `⚠️  About to CANCEL the subscription on the active org. You'll keep access until the end of the current billing cycle, then drop to Free.\n\nCall again with confirm=true to proceed.`,
+                    }],
+            };
+        }
+        const orgId = resolveOrgId(organization_id);
+        if (!orgId) {
+            return { content: [{ type: "text", text: noOrgMessage }] };
+        }
+        const result = await apiRequest(`/organizations/${orgId}/billing/subscriptions`, {
+            method: "DELETE",
+            toolName: "cancel_subscription",
+            skipOrgInjection: true,
+        });
+        if (!result.success) {
+            return {
+                content: [{
+                        type: "text",
+                        text: `Failed to cancel subscription (${result.statusCode}): ${result.message}`,
+                    }],
+            };
+        }
+        return {
+            content: [
+                { type: "text", text: "Subscription cancellation scheduled — org will move to `cancelling` until cycle end, then `cancelled`." },
+                { type: "text", text: JSON.stringify(result.data, null, 2) },
+            ],
+        };
+    });
+    server.tool("link_billing_payment_method", "Initiate Razorpay payment-method linking. Returns a `short_url` the user must open in a browser to add a card / UPI. Until they do, paid features stay locked. `billing_contact_phone` is required; tax_id / country_code / state_code are optional and only used for invoices.", {
+        organization_id: z.string().optional(),
+        billing_contact_phone: z.string().min(1)
+            .describe("Required by Razorpay (E.164 preferred, e.g. +14155551234)"),
+        billing_email: z.string().email().optional()
+            .describe("Defaults to the current user's email on the BE if omitted"),
+        tax_id: z.string().optional()
+            .describe("GSTIN / VAT / equivalent for invoices"),
+        country_code: z.string().optional()
+            .describe("ISO 3166-1 alpha-2, e.g. IN, US, GB"),
+        state_code: z.string().optional()
+            .describe("ISO 3166-2 region code, e.g. KA for Karnataka"),
+    }, async ({ organization_id, billing_contact_phone, billing_email, tax_id, country_code, state_code }) => {
+        const orgId = resolveOrgId(organization_id);
+        if (!orgId) {
+            return { content: [{ type: "text", text: noOrgMessage }] };
+        }
+        const orgFields = {
+            billing_contact_phone,
+        };
+        if (billing_email)
+            orgFields.billing_email = billing_email;
+        if (tax_id)
+            orgFields.tax_id = tax_id;
+        if (country_code)
+            orgFields.country_code = country_code;
+        if (state_code)
+            orgFields.state_code = state_code;
+        const result = await apiRequest(`/organizations/${orgId}/billing/link`, {
+            method: "POST",
+            body: { organization: orgFields },
+            toolName: "link_billing_payment_method",
+            skipOrgInjection: true,
+        });
+        if (!result.success) {
+            return {
+                content: [{
+                        type: "text",
+                        text: `Failed to start billing link (${result.statusCode}): ${result.message}`,
+                    }],
+            };
+        }
+        return {
+            content: [
+                { type: "text", text: "Razorpay link initiated. Open the `short_url` in a browser to add a card / UPI. The MCP can't complete the checkout — it's a browser-only flow." },
+                { type: "text", text: JSON.stringify(result.data, null, 2) },
+            ],
+        };
+    });
+    server.tool("update_billing_contact", "Update billing contact info on an already-linked org. Doesn't re-run Razorpay — only persists DB overrides for invoices.", {
+        organization_id: z.string().optional(),
+        billing_contact_phone: z.string().optional(),
+        tax_id: z.string().optional()
+            .describe("Pass empty string to clear"),
+        country_code: z.string().optional(),
+        state_code: z.string().optional(),
+    }, async ({ organization_id, billing_contact_phone, tax_id, country_code, state_code }) => {
+        const orgId = resolveOrgId(organization_id);
+        if (!orgId) {
+            return { content: [{ type: "text", text: noOrgMessage }] };
+        }
+        const orgFields = {};
+        if (billing_contact_phone !== undefined && billing_contact_phone.length > 0) {
+            orgFields.billing_contact_phone = billing_contact_phone;
+        }
+        if (tax_id !== undefined)
+            orgFields.tax_id = tax_id;
+        if (country_code !== undefined)
+            orgFields.country_code = country_code;
+        if (state_code !== undefined)
+            orgFields.state_code = state_code;
+        if (Object.keys(orgFields).length === 0) {
+            return {
+                content: [{
+                        type: "text",
+                        text: "No changes to apply — pass at least one of billing_contact_phone / tax_id / country_code / state_code.",
+                    }],
+            };
+        }
+        const result = await apiRequest(`/organizations/${orgId}/billing/contact`, {
+            method: "PATCH",
+            body: { organization: orgFields },
+            toolName: "update_billing_contact",
+            skipOrgInjection: true,
+        });
+        if (!result.success) {
+            return {
+                content: [{
+                        type: "text",
+                        text: `Failed to update billing contact (${result.statusCode}): ${result.message}`,
+                    }],
+            };
+        }
+        return { content: [{ type: "text", text: "Billing contact updated." }] };
+    });
+}
+//# sourceMappingURL=billing.js.map

package/dist/tools/billing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing.js","sourceRoot":"","sources":["../../src/tools/billing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,CAAU,CAAC;AAEhE,SAAS,YAAY,CAAC,eAAwB;IAC5C,OAAO,eAAe,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,YAAY,GAAG,wFAAwF,CAAC;AAE9G,MAAM,UAAU,oBAAoB,CAAC,MAAiB;IAEpD,MAAM,CAAC,IAAI,CACT,kBAAkB,EAClB,6UAA6U,EAC7U;QACE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;aACjC,QAAQ,CAAC,kCAAkC,CAAC;KAClD,EACD,KAAK,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAC7B,kBAAkB,KAAK,uBAAuB,EAC9C;YACE,QAAQ,EAAE,kBAAkB;YAC5B,gBAAgB,EAAE,IAAI;SACvB,CACF,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,+BAA+B,MAAM,CAAC,UAAU,MAAM,MAAM,CAAC,OAAO,EAAE;qBAC7E,CAAC;aACH,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACrF,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,qBAAqB,EACrB,gUAAgU,EAChU;QACE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACtC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,0CAA0C,CAAC;KACjF,EACD,KAAK,EAAE,EAAE,eAAe,EAAE,YAAY,EAAE,EAAE,EAAE;QAC1C,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,4IAA4I;qBACnJ,CAAC;aACH,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAC7B,kBAAkB,KAAK,wBAAwB,EAC/C;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,YAAY,EAAE,EAAE,YAAY,EAAE,EAAE;YACxC,QAAQ,EAAE,qBAAqB;YAC/B,gBAAgB,EAAE,IAAI;SACvB,CACF,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,kCAAkC,MAAM,CAAC,UAAU,MAAM,MAAM,CAAC,OAAO,EAAE;qBAChF,CAAC;aACH,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE;gBACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,4CAA4C,YAAY,sHAAsH,EAAE;gBACtM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;aAC7D;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,qBAAqB,EACrB,wVAAwV,EACxV;QACE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACtC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;KACpD,EACD,KAAK,EAAE,EAAE,eAAe,EAAE,YAAY,EAAE,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAC7B,kBAAkB,KAAK,wBAAwB,EAC/C;YACE,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,EAAE,YAAY,EAAE,EAAE,YAAY,EAAE,EAAE;YACxC,QAAQ,EAAE,qBAAqB;YAC/B,gBAAgB,EAAE,IAAI;SACvB,CACF,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,kCAAkC,MAAM,CAAC,UAAU,MAAM,MAAM,CAAC,OAAO,EAAE;qBAChF,CAAC;aACH,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE;gBACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,sCAAsC,YAAY,wEAAwE,EAAE;gBAClJ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;aAC7D;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,qBAAqB,EACrB,kPAAkP,EAClP;QACE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,6FAA6F,CAAC;KAC7H,EACD,KAAK,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,EAAE;QACrC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,uLAAuL;qBAC9L,CAAC;aACH,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAC7B,kBAAkB,KAAK,wBAAwB,EAC/C;YACE,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,qBAAqB;YAC/B,gBAAgB,EAAE,IAAI;SACvB,CACF,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,kCAAkC,MAAM,CAAC,UAAU,MAAM,MAAM,CAAC,OAAO,EAAE;qBAChF,CAAC;aACH,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE;gBACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,wGAAwG,EAAE;gBAChI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;aAC7D;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,6BAA6B,EAC7B,iRAAiR,EACjR;QACE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACtC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;aACnC,QAAQ,CAAC,2DAA2D,CAAC;QAC1E,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;aACvC,QAAQ,CAAC,2DAA2D,CAAC;QAC1E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;aACxB,QAAQ,CAAC,uCAAuC,CAAC;QACtD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;aAC9B,QAAQ,CAAC,qCAAqC,CAAC;QACpD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;aAC5B,QAAQ,CAAC,+CAA+C,CAAC;KAC/D,EACD,KAAK,EAAE,EAAE,eAAe,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,EAAE;QACpG,MAAM,KAAK,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,SAAS,GAA4B;YACzC,qBAAqB;SACtB,CAAC;QACF,IAAI,aAAa;YAAE,SAAS,CAAC,aAAa,GAAG,aAAa,CAAC;QAC3D,IAAI,MAAM;YAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC;QACtC,IAAI,YAAY;YAAE,SAAS,CAAC,YAAY,GAAG,YAAY,CAAC;QACxD,IAAI,UAAU;YAAE,SAAS,CAAC,UAAU,GAAG,UAAU,CAAC;QAElD,MAAM,MAAM,GAAG,MAAM,UAAU,CAC7B,kBAAkB,KAAK,eAAe,EACtC;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE;YACjC,QAAQ,EAAE,6BAA6B;YACvC,gBAAgB,EAAE,IAAI;SACvB,CACF,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,iCAAiC,MAAM,CAAC,UAAU,MAAM,MAAM,CAAC,OAAO,EAAE;qBAC/E,CAAC;aACH,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE;gBACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iJAAiJ,EAAE;gBACzK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;aAC7D;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,wBAAwB,EACxB,0HAA0H,EAC1H;QACE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACtC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;aACxB,QAAQ,CAAC,4BAA4B,CAAC;QAC3C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAClC,EACD,KAAK,EAAE,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,EAAE;QACrF,MAAM,KAAK,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,SAAS,GAA4B,EAAE,CAAC;QAC9C,IAAI,qBAAqB,KAAK,SAAS,IAAI,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5E,SAAS,CAAC,qBAAqB,GAAG,qBAAqB,CAAC;QAC1D,CAAC;QACD,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC;QACpD,IAAI,YAAY,KAAK,SAAS;YAAE,SAAS,CAAC,YAAY,GAAG,YAAY,CAAC;QACtE,IAAI,UAAU,KAAK,SAAS;YAAE,SAAS,CAAC,UAAU,GAAG,UAAU,CAAC;QAEhE,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxC,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,wGAAwG;qBAC/G,CAAC;aACH,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAC7B,kBAAkB,KAAK,kBAAkB,EACzC;YACE,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE;YACjC,QAAQ,EAAE,wBAAwB;YAClC,gBAAgB,EAAE,IAAI;SACvB,CACF,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,qCAAqC,MAAM,CAAC,UAAU,MAAM,MAAM,CAAC,OAAO,EAAE;qBACnF,CAAC;aACH,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,EAAE,CAAC;IAC3E,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/database-users.d.ts

@@ -0,0 +1,2 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function registerDatabaseUserTools(server: McpServer): void;

package/dist/tools/database-users.js

@@ -0,0 +1,181 @@
+import { z } from "zod";
+import { apiRequest } from "../client.js";
+/**
+ * Database users — DBMS-level credentials (distinct from the platform login).
+ *
+ * Endpoints:
+ * - GET    /aws/v1/instances/:id/database_users
+ * - POST   /aws/v1/instances/:id/database_users
+ * - PATCH  /aws/v1/instances/:id/database_users/:user_id
+ * - DELETE /aws/v1/instances/:id/database_users/:user_id
+ * - POST   /aws/v1/instances/:id/database_users/:user_id/rotate_password
+ *
+ * Use these to provision separate credentials for apps / people instead of
+ * sharing the master admin password.
+ */
+const ROLES = ["read_only", "read_write", "admin"];
+export function registerDatabaseUserTools(server) {
+    server.tool("list_database_users", "List DBMS-level users on an instance. Returns each user's id, username, role, status (active | pending | deleting), target database, connection limit, and password expiry metadata.", {
+        instance_id: z.string().min(1),
+    }, async ({ instance_id }) => {
+        const result = await apiRequest(`/aws/v1/instances/${instance_id}/database_users`, {
+            toolName: "list_database_users",
+            skipOrgInjection: true,
+        });
+        if (!result.success) {
+            return {
+                content: [{
+                        type: "text",
+                        text: `Failed to list database users (${result.statusCode}): ${result.message}`,
+                    }],
+            };
+        }
+        return { content: [{ type: "text", text: JSON.stringify(result.data, null, 2) }] };
+    });
+    server.tool("create_database_user", "Create a DBMS-level user on an instance. Username 1-31 chars, letters/digits/underscores only. Password 8-128 printable chars. Role determines DB privileges: read_only (SELECT), read_write (SELECT/INSERT/UPDATE/DELETE), admin (broader DDL). Target database scopes the grant to one DB; leave empty for cluster-level access.", {
+        instance_id: z.string().min(1),
+        username: z.string().min(1).max(31).regex(/^[a-zA-Z0-9_]+$/, "letters, digits, underscores only"),
+        password: z.string().min(8).max(128),
+        role: z.enum(ROLES),
+        target_database: z.string().optional().describe("Specific DB to grant on; omit for cluster-wide"),
+        connection_limit: z.number().int().min(1).max(1000).optional()
+            .describe("Max concurrent connections for this user (default unlimited)"),
+        password_expiry_days: z.number().int().min(1).max(365).optional()
+            .describe("Days until the password expires; omit for no expiry"),
+    }, async ({ instance_id, username, password, role, target_database, connection_limit, password_expiry_days }) => {
+        const body = {
+            username,
+            password,
+            role,
+        };
+        if (target_database !== undefined)
+            body.target_database = target_database;
+        if (connection_limit !== undefined)
+            body.connection_limit = connection_limit;
+        if (password_expiry_days !== undefined)
+            body.password_expiry_days = password_expiry_days;
+        const result = await apiRequest(`/aws/v1/instances/${instance_id}/database_users`, {
+            method: "POST",
+            body,
+            toolName: "create_database_user",
+            skipOrgInjection: true,
+        });
+        if (!result.success) {
+            return {
+                content: [{
+                        type: "text",
+                        text: `Failed to create database user (${result.statusCode}): ${result.message}`,
+                    }],
+            };
+        }
+        return {
+            content: [
+                { type: "text", text: `Database user \`${username}\` create requested. Status will transition from \`pending\` to \`active\` once applied — poll \`list_database_users\`.` },
+                { type: "text", text: JSON.stringify(result.data, null, 2) },
+            ],
+        };
+    });
+    server.tool("update_database_user", "Update a database user — change role, connection limit, or password expiry. Username and target database are immutable (delete + recreate to change them).", {
+        instance_id: z.string().min(1),
+        user_id: z.string().min(1).describe("Database user PID (from list_database_users)"),
+        role: z.enum(ROLES).optional(),
+        connection_limit: z.number().int().min(1).max(1000).optional(),
+        password_expiry_days: z.number().int().min(0).max(365).optional()
+            .describe("0 removes expiry; otherwise sets a new countdown from now"),
+    }, async ({ instance_id, user_id, role, connection_limit, password_expiry_days }) => {
+        const body = {};
+        if (role !== undefined)
+            body.role = role;
+        if (connection_limit !== undefined)
+            body.connection_limit = connection_limit;
+        if (password_expiry_days !== undefined)
+            body.password_expiry_days = password_expiry_days;
+        if (Object.keys(body).length === 0) {
+            return {
+                content: [{
+                        type: "text",
+                        text: "No changes to apply — pass at least one of role / connection_limit / password_expiry_days.",
+                    }],
+            };
+        }
+        const result = await apiRequest(`/aws/v1/instances/${instance_id}/database_users/${user_id}`, {
+            method: "PATCH",
+            body,
+            toolName: "update_database_user",
+            skipOrgInjection: true,
+        });
+        if (!result.success) {
+            return {
+                content: [{
+                        type: "text",
+                        text: `Failed to update database user (${result.statusCode}): ${result.message}`,
+                    }],
+            };
+        }
+        return { content: [{ type: "text", text: JSON.stringify(result.data, null, 2) }] };
+    });
+    server.tool("delete_database_user", "Soft-delete a database user. Existing connections opened by this user are terminated. The record is preserved for audit — contact support to recover.", {
+        instance_id: z.string().min(1),
+        user_id: z.string().min(1),
+        username: z.string().optional().describe("Username for the confirmation message (cosmetic)"),
+        confirm: z.boolean().describe("Must be true to proceed. Existing connections will be dropped."),
+    }, async ({ instance_id, user_id, username, confirm }) => {
+        if (!confirm) {
+            const label = username ? `\`${username}\` (${user_id})` : user_id;
+            return {
+                content: [{
+                        type: "text",
+                        text: `⚠️  About to DELETE database user ${label} on instance ${instance_id}. Apps/scripts using this credential will lose access immediately.\n\nCall again with confirm=true to proceed.`,
+                    }],
+            };
+        }
+        const result = await apiRequest(`/aws/v1/instances/${instance_id}/database_users/${user_id}`, {
+            method: "DELETE",
+            toolName: "delete_database_user",
+            skipOrgInjection: true,
+        });
+        if (!result.success) {
+            return {
+                content: [{
+                        type: "text",
+                        text: `Failed to delete database user (${result.statusCode}): ${result.message}`,
+                    }],
+            };
+        }
+        return { content: [{ type: "text", text: "Database user delete requested — status will move to `deleting` and then disappear from the list." }] };
+    });
+    server.tool("rotate_database_user_password", "Rotate the password for a database user. The new password is generated server-side and returned ONCE in the response. SECURITY: save it immediately — there is no way to retrieve it later. Existing connections using the old password are terminated.", {
+        instance_id: z.string().min(1),
+        user_id: z.string().min(1),
+        confirm: z.boolean().describe("Must be true. Old password is invalidated immediately; apps and scripts must pick up the new value."),
+    }, async ({ instance_id, user_id, confirm }) => {
+        if (!confirm) {
+            return {
+                content: [{
+                        type: "text",
+                        text: `⚠️  About to ROTATE the password for database user ${user_id} on instance ${instance_id}.\n\nThe new password is shown ONCE in the response — save it before doing anything else.\nApps and scripts using the old password will lose connections immediately.\n\nCall again with confirm=true to proceed.`,
+                    }],
+            };
+        }
+        const result = await apiRequest(`/aws/v1/instances/${instance_id}/database_users/${user_id}/rotate_password`, {
+            method: "POST",
+            toolName: "rotate_database_user_password",
+            skipOrgInjection: true,
+        });
+        if (!result.success) {
+            return {
+                content: [{
+                        type: "text",
+                        text: `Failed to rotate password (${result.statusCode}): ${result.message}`,
+                    }],
+            };
+        }
+        return {
+            content: [
+                { type: "text", text: "🔑 New password generated. Copy it now — it will not be shown again." },
+                { type: "text", text: JSON.stringify(result.data, null, 2) },
+            ],
+        };
+    });
+}
+//# sourceMappingURL=database-users.js.map

package/dist/tools/database-users.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-users.js","sourceRoot":"","sources":["../../src/tools/database-users.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C;;;;;;;;;;;;GAYG;AAEH,MAAM,KAAK,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAU,CAAC;AAE5D,MAAM,UAAU,yBAAyB,CAAC,MAAiB;IAEzD,MAAM,CAAC,IAAI,CACT,qBAAqB,EACrB,sLAAsL,EACtL;QACE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,EACD,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;QACxB,MAAM,MAAM,GAAG,MAAM,UAAU,CAC7B,qBAAqB,WAAW,iBAAiB,EACjD;YACE,QAAQ,EAAE,qBAAqB;YAC/B,gBAAgB,EAAE,IAAI;SACvB,CACF,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,kCAAkC,MAAM,CAAC,UAAU,MAAM,MAAM,CAAC,OAAO,EAAE;qBAChF,CAAC;aACH,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACrF,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,sBAAsB,EACtB,oUAAoU,EACpU;QACE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,mCAAmC,CAAC;QACjG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QACpC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;QACnB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gDAAgD,CAAC;QACjG,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;aACzD,QAAQ,CAAC,8DAA8D,CAAC;QAC7E,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;aAC5D,QAAQ,CAAC,qDAAqD,CAAC;KACrE,EACD,KAAK,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,EAAE,EAAE;QAC3G,MAAM,IAAI,GAA4B;YACpC,QAAQ;YACR,QAAQ;YACR,IAAI;SACL,CAAC;QACF,IAAI,eAAe,KAAK,SAAS;YAAE,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QAC1E,IAAI,gBAAgB,KAAK,SAAS;YAAE,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QAC7E,IAAI,oBAAoB,KAAK,SAAS;YAAE,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAC;QAEzF,MAAM,MAAM,GAAG,MAAM,UAAU,CAC7B,qBAAqB,WAAW,iBAAiB,EACjD;YACE,MAAM,EAAE,MAAM;YACd,IAAI;YACJ,QAAQ,EAAE,sBAAsB;YAChC,gBAAgB,EAAE,IAAI;SACvB,CACF,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,mCAAmC,MAAM,CAAC,UAAU,MAAM,MAAM,CAAC,OAAO,EAAE;qBACjF,CAAC;aACH,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE;gBACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,QAAQ,yHAAyH,EAAE;gBAC5K,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;aAC7D;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,sBAAsB,EACtB,4JAA4J,EAC5J;QACE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,8CAA8C,CAAC;QACnF,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;QAC9B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;QAC9D,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;aAC5D,QAAQ,CAAC,2DAA2D,CAAC;KAC3E,EACD,KAAK,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,EAAE,EAAE;QAC/E,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,IAAI,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACzC,IAAI,gBAAgB,KAAK,SAAS;YAAE,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QAC7E,IAAI,oBAAoB,KAAK,SAAS;YAAE,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAC;QAEzF,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,4FAA4F;qBACnG,CAAC;aACH,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAC7B,qBAAqB,WAAW,mBAAmB,OAAO,EAAE,EAC5D;YACE,MAAM,EAAE,OAAO;YACf,IAAI;YACJ,QAAQ,EAAE,sBAAsB;YAChC,gBAAgB,EAAE,IAAI;SACvB,CACF,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,mCAAmC,MAAM,CAAC,UAAU,MAAM,MAAM,CAAC,OAAO,EAAE;qBACjF,CAAC;aACH,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACrF,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,sBAAsB,EACtB,uJAAuJ,EACvJ;QACE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kDAAkD,CAAC;QAC5F,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,gEAAgE,CAAC;KAChG,EACD,KAAK,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE;QACpD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,OAAO,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAClE,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,qCAAqC,KAAK,gBAAgB,WAAW,gHAAgH;qBAC5L,CAAC;aACH,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAC7B,qBAAqB,WAAW,mBAAmB,OAAO,EAAE,EAC5D;YACE,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,sBAAsB;YAChC,gBAAgB,EAAE,IAAI;SACvB,CACF,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,mCAAmC,MAAM,CAAC,UAAU,MAAM,MAAM,CAAC,OAAO,EAAE;qBACjF,CAAC;aACH,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mGAAmG,EAAE,CAAC,EAAE,CAAC;IACpJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,+BAA+B,EAC/B,yPAAyP,EACzP;QACE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,qGAAqG,CAAC;KACrI,EACD,KAAK,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,sDAAsD,OAAO,gBAAgB,WAAW,mNAAmN;qBAClT,CAAC;aACH,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAC7B,qBAAqB,WAAW,mBAAmB,OAAO,kBAAkB,EAC5E;YACE,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,+BAA+B;YACzC,gBAAgB,EAAE,IAAI;SACvB,CACF,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,8BAA8B,MAAM,CAAC,UAAU,MAAM,MAAM,CAAC,OAAO,EAAE;qBAC5E,CAAC;aACH,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE;gBACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,sEAAsE,EAAE;gBAC9F,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;aAC7D;SACF,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}