@selfhost.dev/mcp-server 0.3.0 → 0.4.1

package/README.md

@@ -1,6 +1,13 @@
 # SelfHost MCP Server
 
-A full-featured [Model Context Protocol](https://modelcontextprotocol.io/) server that brings [SelfHost's](https://selfhost.dev) database management capabilities directly into AI coding assistants. Provision, monitor, scale, and manage production database infrastructure — all through natural language, without leaving your editor.
+The [SelfHost](https://selfhost.dev) cloud platform, one sentence away inside your AI coding assistant. Spin up production databases, ship apps straight from GitHub, wire up domains and environment variables, and watch builds stream live, all in plain English without ever leaving your editor.
+
+SelfHost pairs the power of production-grade managed databases with the effortless, deploy-from-GitHub simplicity of a modern app platform. This [Model Context Protocol](https://modelcontextprotocol.io/) server puts the whole thing at your fingertips.
+
+**Two products, one server:**
+
+- **Projects** - your apps, shipped. Connect a GitHub repo, click deploy, and it's live: auto-detected builds (Nixpacks, Dockerfile, Docker Compose, or static), auto-deploy on every push, live streaming build logs, environment variables, custom domains, pause and resume to scale to zero, and databases right inside the project. The ease of Railway, Render, and Vercel, with nothing to manage.
+- **Managed Databases** - production-grade database hosting, your way. PostgreSQL, MySQL, and MongoDB on AWS, or Postgres on Hetzner, in our cloud or your own account (BYOC), with backups, point-in-time recovery, autoscaling, alerting, and connection pooling.
 
 Works with **Claude Code**, **Cursor**, **Windsurf**, **Cline**, and any MCP-compatible client.
 
@@ -57,7 +64,7 @@ That's it. The server handles authentication, token refresh, and everything else
 
 ### First Run
 
-On first use, the MCP server opens your browser to sign in via SelfHost's console. After you authorize, credentials are saved locally (`~/.selfhost/credentials.json`) and auto-refreshed — you won't need to sign in again.
+On first use, the MCP server opens your browser to sign in via SelfHost's console. After you authorize, credentials are saved locally (`~/.selfhost/credentials.json`) and auto-refreshed - you won't need to sign in again.
 
 ```
 You: "Show me my databases"
@@ -70,7 +77,29 @@ Claude: Authenticates → fetches your orgs → selects org → lists instances
 
 ## What Can You Do?
 
-### Talk to your infrastructure in plain English
+Talk to both products in plain English.
+
+### Ship and run apps with Projects
+
+Connect a repo, deploy, and it's live - SelfHost takes your code from GitHub to a running app.
+
+| You say | What happens |
+|---------|-------------|
+| *"Create a project and deploy my GitHub repo into it"* | Provisions the project, waits until it's ready, auto-detects the build, and deploys the repo |
+| *"Deploy the main branch of my-org/api"* | Creates the deployment, triggers the build, and streams live logs until it's running |
+| *"Turn on auto-deploy so every push ships"* | Enables auto-deploy; future pushes to the branch redeploy automatically |
+| *"Add a private Postgres database to my project"* | Provisions a Postgres database inside the project, with the credentials and visibility you choose |
+| *"Spin up Supabase in this project"* | Deploys the Supabase template alongside your app |
+| *"Set DATABASE_URL on my app and redeploy"* | Updates the env var (without wiping the others) and rolls out the change |
+| *"Point app.example.com at my deployment"* | Attaches the custom domain and returns the exact DNS records to add, then verifies them |
+| *"Show me the build logs for the last deploy"* | Streams the build and container logs for that run |
+| *"Pause my staging app so I stop paying for it"* | Pauses the deployment (scales to zero); resume instantly when you need it |
+| *"Roll back to the last working deploy"* | Re-deploys the commit from the previous successful run |
+| *"Notify my team channel when a deploy fails"* | Binds a notification channel to the app's deploy outcomes |
+
+### Manage database infrastructure with Managed Databases
+
+Production-grade, standalone database hosting.
 
 | You say | What happens |
 |---------|-------------|
@@ -92,13 +121,13 @@ Claude: Authenticates → fetches your orgs → selects org → lists instances
 
 ### Safety Built In
 
-Destructive operations (delete, stop, reboot) require explicit confirmation. The server will always ask before proceeding — you'll never accidentally delete a production database.
+Destructive operations (delete, stop, reboot) require explicit confirmation. The server will always ask before proceeding - you'll never accidentally delete a production database.
 
 ---
 
 ## Features
 
-### 111 tools across 14 modules
+### 151 tools across 22 modules
 
 Every tool maps to a real API endpoint. No mock data, no shortcuts.
 
@@ -117,7 +146,7 @@ Automatic browser-based sign-in with Firebase. Tokens refresh transparently.
 | `reauthenticate` | Sign out and sign in again (switch accounts) |
 
 #### Organizations & Team Management
-Multi-tenant — everything is scoped to your org.
+Multi-tenant - everything is scoped to your org.
 
 | Tool | Description |
 |------|-------------|
@@ -147,7 +176,7 @@ Bring your own AWS account (BYOC) or use SelfHost's managed infrastructure.
 | `get_aws_account_info` | AWS account ID and free tier status |
 
 #### Networking
-VPCs, subnets, and security groups. Optional — auto-created during provisioning if not specified.
+VPCs, subnets, and security groups. Optional - auto-created during provisioning if not specified.
 
 | Tool | Description |
 |------|-------------|
@@ -237,29 +266,29 @@ PostgreSQL-only. Reduces connection overhead for high-concurrency workloads. Cli
 | `disable_pgbouncer` | Drain pool and disable (with confirmation) |
 
 #### Database Users
-DBMS-level credentials — distinct from the SelfHost platform login. Use for apps and people that need their own DB user.
+DBMS-level credentials - distinct from the SelfHost platform login. Use for apps and people that need their own DB user.
 
 | Tool | Description |
 |------|-------------|
 | `list_database_users` | List users with role, status, target DB, expiry metadata |
 | `create_database_user` | Create user with role (read_only / read_write / admin) and optional connection limit + password expiry |
 | `update_database_user` | Change role, connection limit, or password expiry |
-| `delete_database_user` | Soft-delete user (with confirmation) — drops active connections |
-| `rotate_database_user_password` | Rotate password (with confirmation) — new value shown once |
+| `delete_database_user` | Soft-delete user (with confirmation) - drops active connections |
+| `rotate_database_user_password` | Rotate password (with confirmation) - new value shown once |
 
 #### Scaling
 Manual one-off resize plus auto-scaling policies (reactive metric-based, scheduled cron, and auto start/stop).
 
 | Tool | Description |
 |------|-------------|
-| `scale_instance` | Manual resize — change instance type, volume type, size, IOPS, throughput |
+| `scale_instance` | Manual resize - change instance type, volume type, size, IOPS, throughput |
 | `list_scaling_policies` | List policies, optionally filtered to one instance |
-| `create_scaling_policy` | Create policy — reactive metric breach, scheduled cron, or auto start/stop schedule |
+| `create_scaling_policy` | Create policy - reactive metric breach, scheduled cron, or auto start/stop schedule |
 | `update_scaling_policy` | Modify thresholds, schedule, or action details |
 | `delete_scaling_policy` | Remove a policy (with confirmation) |
 
 #### Point-in-Time Recovery (PITR)
-PostgreSQL-only, Pro+. Continuous WAL archiving to S3 + restore to any second within the retention window. Restore creates a brand-new instance — the source is untouched.
+PostgreSQL-only, Pro+. Continuous WAL archiving to S3 + restore to any second within the retention window. Restore creates a brand-new instance - the source is untouched.
 
 | Tool | Description |
 |------|-------------|
@@ -279,18 +308,18 @@ Subscription lifecycle and payment-method linking. All endpoints scoped to the a
 | `get_subscription` | Get current subscription (404 = no subscription, on Free) |
 | `create_subscription` | Start a paid subscription (plan goes `pending` → `active` via Razorpay webhook) |
 | `change_subscription` | Upgrade or downgrade plan (downgrades scheduled at cycle end) |
-| `cancel_subscription` | Cancel — keeps access until cycle end (with confirmation) |
-| `link_billing_payment_method` | Initiate Razorpay link — returns short URL to open in browser |
+| `cancel_subscription` | Cancel - keeps access until cycle end (with confirmation) |
+| `link_billing_payment_method` | Initiate Razorpay link - returns short URL to open in browser |
 | `update_billing_contact` | Update billing phone / tax ID / country / state for invoices |
 
 #### Hetzner Cloud (Postgres-only)
-Provisioning on Hetzner Cloud as an alternative to AWS. Currently provision / get / status / delete only — no start / stop / reboot / update / scaling / PITR / pooling yet. Call `list_cloud_providers` at the start of any create-database intent to surface both options to the user.
+Provisioning on Hetzner Cloud as an alternative to AWS. Currently provision / get / status / delete only - no start / stop / reboot / update / scaling / PITR / pooling yet. Call `list_cloud_providers` at the start of any create-database intent to surface both options to the user.
 
 | Tool | Description |
 |------|-------------|
 | `list_cloud_providers` | List available cloud providers (AWS, Hetzner) with capabilities + the create tool to use for each |
 | `list_hetzner_locations` | Hetzner datacenter locations (fsn1, nbg1, hel1, ash, sin) with country + continent |
-| `list_hetzner_server_types` | Hetzner server types (cpx11–cpx51) with vCPU / RAM / local disk |
+| `list_hetzner_server_types` | Hetzner server types (cpx11-cpx51) with vCPU / RAM / local disk |
 | `create_hetzner_instance` | Provision a Postgres instance on Hetzner Cloud (region, server type, storage size, HA toggle, CIDR allowlist) |
 | `get_hetzner_instance` | Fetch a Hetzner instance's full details by PID |
 | `get_hetzner_instance_status` | Poll provisioning progress (per-step status: network → firewall → ssh_key → server → volume → load_balancer → ansible → finalize) |
@@ -298,8 +327,102 @@ Provisioning on Hetzner Cloud as an alternative to AWS. Currently provision / ge
 
 ---
 
+### PaaS - Projects (app containers)
+A **project** is a per-app container: a provisioned server + Coolify install + wildcard DNS that deployments, databases, and services attach to. Creation is async (~2-5 min) - poll `get_project` until status is `active` before deploying into it.
+
+| Tool | Description |
+|------|-------------|
+| `list_projects` | List projects in the org (pid, name, status, public_ip, domain) |
+| `get_project` | Get one project; poll this for provisioning progress (active / failed) |
+| `create_project` | Create a project and start async provisioning (returns status `pending`) |
+| `update_project` | Rename / re-describe a project |
+| `delete_project` | Tear down the server and everything in the project (with confirmation; blocked while provisioning or with running deployments) |
+| `get_project_metrics` | Time-series server + database + deployment metrics from the monitoring agent (start_date/end_date) |
+
+### PaaS - Deployments (GitHub apps)
+A **deployment** is an app built from a GitHub repo, living inside an `active` project. Build/run history is returned inline on the deployment.
+
+| Tool | Description |
+|------|-------------|
+| `list_deployments` | List apps in the org, each with inline build runs (newest 50) |
+| `get_deployment` | Get one app + runs; poll this for deploy/run progress |
+| `create_deployment` | Deploy a GitHub repo into a project (repo_url, branch, build_pack, port, env_vars, …) |
+| `update_deployment` | Pause/resume, toggle auto-deploy, set ignore_paths / max preview deployments |
+| `update_deployment_build_config` | Change build_pack / base_directory / port / dockerfile / env_vars |
+| `delete_deployment` | Remove the app and its Coolify resources (with confirmation) |
+| `trigger_deploy` | Manually deploy the current branch (new run) |
+| `get_deployment_logs` | Current application/container logs |
+| `get_deployment_health` | Reachability of the deploy URL + attached domains |
+| `get_run_logs` | Full build + container logs for one run (poll until terminal) |
+| `redeploy_run` | Re-run a build from the same commit |
+| `rollback_run` | Re-deploy the commit from a prior successful run |
+
+### PaaS - Custom Domains
+| Tool | Description |
+|------|-------------|
+| `add_deployment_domain` | Attach a custom domain to a deployment (returns DNS records to add) |
+| `sync_deployment_domains` | Set the full domain list for a deployment (set primary / remove several) |
+| `remove_deployment_domain` | Remove one domain from a deployment |
+| `verify_custom_domain` | Check DNS (TXT + CNAME) and advance verification → live HTTPS |
+| `list_custom_domains` | List the org's custom-domain verification states |
+
+### PaaS - Environment Variables
+| Tool | Description |
+|------|-------------|
+| `list_env_vars` | List a deployment's env vars (values returned in cleartext) |
+| `set_env_vars` | **Replace** the entire env-var set (omitted keys are deleted) |
+| `merge_env_vars` | Add/update env vars without deleting others (safe upsert) |
+| `delete_env_var` | Remove one variable by key |
+
+### PaaS - GitHub
+| Tool | Description |
+|------|-------------|
+| `list_github_installations` | Connected GitHub App installations + their accessible repos |
+| `list_repo_branches` | Branches for a repo via an installation |
+| `detect_repo_config` | Auto-detect build_pack / port / monorepo dirs / env-var hints for a repo |
+| `get_github_connect_url` | Get a browser URL to connect GitHub (interactive; then re-list installations) |
+
+### PaaS - Project Databases
+Postgres/Redis/MySQL/MongoDB provisioned inside a project (distinct from AWS/Hetzner managed instances).
+
+| Tool | Description |
+|------|-------------|
+| `list_project_databases` | List databases attached to a project |
+| `create_project_database` | Provision a Postgres/Redis/MySQL/MongoDB in a project (type-specific credentials) |
+| `delete_project_database` | Delete a project database (exact name match + confirmation) |
+
+### PaaS - Project Services (templates)
+| Tool | Description |
+|------|-------------|
+| `list_project_services` | List service-template instances (e.g. Supabase) in a project |
+| `create_project_service` | Deploy a service template (currently `supabase`) into a project |
+| `delete_project_service` | Delete a project service (exact name match + confirmation) |
+
+### PaaS - Deployment Notifications
+| Tool | Description |
+|------|-------------|
+| `list_deployment_notification_bindings` | Channels notified on a deployment's deploy outcomes |
+| `bind_deployment_notification_channel` | Notify an org channel (nchan_…) on deploy success/failure |
+| `unbind_deployment_notification_channel` | Stop notifying a channel for a deployment |
+
+---
+
 ## Common Workflows
 
+### Deploy an app from GitHub (Projects)
+
+```
+You: "Deploy my-org/web to a new project"
+
+Claude: Creates a project → polls until it's provisioned and active
+        → detects the build config from the repo (build pack, port)
+        → creates the deployment and triggers the first build
+        → streams the build logs until the app is live
+        → hands you the deploy URL
+```
+
+Then: *"add a private Postgres to it"*, *"set my env vars"*, *"point app.example.com at it"*, or *"turn on auto-deploy"* to round out the app.
+
 ### Switch AWS Account (BYOC vs Platform-Managed)
 
 ```
@@ -370,12 +493,12 @@ Reference data lookups (regions, instance types, storage types) are unlimited.
 | `API_URL` | `https://api.selfhost.dev` | SelfHost API endpoint |
 | `CONSOLE_URL` | `https://console.selfhost.dev` | SelfHost Console URL (for browser auth) |
 | `TIER` | Auto-detected | Override rate limit tier (`FREE`, `STARTER`, `PRO`, `ENTERPRISE`, `ADMIN`) |
-| `FIREBASE_API_KEY` | — | Skip browser auth (CI/headless) |
-| `FIREBASE_REFRESH_TOKEN` | — | Skip browser auth (CI/headless) |
+| `FIREBASE_API_KEY` | - | Skip browser auth (CI/headless) |
+| `FIREBASE_REFRESH_TOKEN` | - | Skip browser auth (CI/headless) |
 
 ### Local Development
 
-Both `API_URL` and `CONSOLE_URL` are optional overrides — they default to the production endpoints when not set.
+Both `API_URL` and `CONSOLE_URL` are optional overrides - they default to the production endpoints when not set.
 
 **1. Local Rails API + Local Console**
 
@@ -452,7 +575,7 @@ Set `FIREBASE_API_KEY` and `FIREBASE_REFRESH_TOKEN` environment variables to ski
 ## Security
 
 - **Credentials stored locally** at `~/.selfhost/credentials.json` with `chmod 0600` (owner-only read/write)
-- **JWT auto-refresh** — tokens refresh 5 minutes before expiry, refresh tokens are rotated
-- **Sensitive fields stripped** — passwords, AWS keys, tokens, and secrets are redacted from API responses
-- **Destructive operations gated** — delete, stop, and reboot require explicit `confirm: true`
-- **No console.log** — all logging goes to stderr to avoid corrupting the MCP JSON-RPC stream on stdout
+- **JWT auto-refresh** - tokens refresh 5 minutes before expiry, refresh tokens are rotated
+- **Sensitive fields stripped** - passwords, AWS keys, tokens, and secrets are redacted from API responses
+- **Destructive operations gated** - delete, stop, and reboot require explicit `confirm: true`
+- **No console.log** - all logging goes to stderr to avoid corrupting the MCP JSON-RPC stream on stdout

package/dist/auth.d.ts

@@ -2,7 +2,7 @@ export declare function wasAuthPrompted(): Promise<boolean>;
 export declare function markAuthPrompted(): Promise<void>;
 /**
  * Returns true if credentials are available (env vars or stored file).
- * No network calls — just a fast file existence check.
+ * No network calls - just a fast file existence check.
  */
 export declare function hasCredentials(): Promise<boolean>;
 /**

package/dist/auth.js

@@ -130,7 +130,7 @@ async function resolveCredentials() {
 }
 /**
  * Returns true if credentials are available (env vars or stored file).
- * No network calls — just a fast file existence check.
+ * No network calls - just a fast file existence check.
  */
 export async function hasCredentials() {
     if (config.firebaseApiKey && config.firebaseRefreshToken)
@@ -169,7 +169,7 @@ async function _getValidTokenImpl() {
         return jwt;
     }
     catch {
-        // Refresh token expired — re-authenticate via browser
+        // Refresh token expired - re-authenticate via browser
         cachedJwt = null;
         jwtExpiresAt = 0;
         const newCreds = await browserLogin();
@@ -192,7 +192,7 @@ export async function forceReauth() {
         await unlink(config.credentialsPath);
     }
     catch {
-        // File may not exist — that's fine
+        // File may not exist - that's fine
     }
     const creds = await browserLogin();
     await saveCredentials(creds.apiKey, creds.refreshToken);

package/dist/client.js

@@ -63,7 +63,7 @@ export async function apiRequest(path, options = {}) {
         };
     }
     catch (error) {
-        // Rate limit errors are thrown before fetch — re-throw as-is
+        // Rate limit errors are thrown before fetch - re-throw as-is
         if (error instanceof Error && error.message.includes("Rate limit")) {
             throw error;
         }

package/dist/config.js

@@ -5,7 +5,7 @@ function log(message) {
 const API_URL = process.env.API_URL || "https://api.selfhost.dev";
 const CONSOLE_URL = process.env.CONSOLE_URL || "https://console.selfhost.dev";
 const TIER_OVERRIDE = process.env.TIER;
-// Headless/CI fallback — skip browser login if these are set
+// Headless/CI fallback - skip browser login if these are set
 const FIREBASE_API_KEY = process.env.FIREBASE_API_KEY;
 const FIREBASE_REFRESH_TOKEN = process.env.FIREBASE_REFRESH_TOKEN;
 export const config = {

package/dist/index.js

@@ -18,6 +18,14 @@ import { registerScalingTools } from "./tools/scaling.js";
 import { registerPitrTools } from "./tools/pitr.js";
 import { registerBillingTools } from "./tools/billing.js";
 import { registerHetznerTools } from "./tools/hetzner.js";
+import { registerProjectTools } from "./tools/projects.js";
+import { registerDeploymentTools } from "./tools/deployments.js";
+import { registerDeploymentDomainTools } from "./tools/deployment-domains.js";
+import { registerEnvVarTools } from "./tools/env-vars.js";
+import { registerGithubTools } from "./tools/github.js";
+import { registerProjectDatabaseTools } from "./tools/project-databases.js";
+import { registerProjectServiceTools } from "./tools/project-services.js";
+import { registerDeploymentNotificationTools } from "./tools/deployment-notifications.js";
 const server = new McpServer({
     name: "selfhost",
     version: "0.1.0",
@@ -42,14 +50,31 @@ registerAlertTools(server);
 registerPgBouncerTools(server);
 // Module 10: Database users (DBMS-level credentials)
 registerDatabaseUserTools(server);
-// Module 11: Scaling — manual + auto-scaling policies + auto start/stop
+// Module 11: Scaling - manual + auto-scaling policies + auto start/stop
 registerScalingTools(server);
 // Module 12: Point-in-Time Recovery (Postgres, Pro+)
 registerPitrTools(server);
-// Module 13: Billing — subscriptions + payment-method linking
+// Module 13: Billing - subscriptions + payment-method linking
 registerBillingTools(server);
-// Module 14: Hetzner Cloud — Postgres-only provision/get/status/delete + provider discovery
+// Module 14: Hetzner Cloud - Postgres-only provision/get/status/delete + provider discovery
 registerHetznerTools(server);
+// ─── PaaS / Apps surface (/api/v1/platform/...) ──────────────────────────────
+// Module 15: Projects - CoolifyProject app-container lifecycle + metrics
+registerProjectTools(server);
+// Module 16: Deployments - GitHub-repo apps, build runs, deploy/redeploy/rollback, logs, health
+registerDeploymentTools(server);
+// Module 17: Custom domains - deployment-scoped add/sync/remove + org DNS verification
+registerDeploymentDomainTools(server);
+// Module 18: Environment variables - list / set (replace) / merge / delete
+registerEnvVarTools(server);
+// Module 19: GitHub - installations (+repos), branches, repo config detection, connect URL
+registerGithubTools(server);
+// Module 20: Project databases - Postgres/Redis/MySQL/MongoDB inside a project
+registerProjectDatabaseTools(server);
+// Module 21: Project services - service templates (Supabase) inside a project
+registerProjectServiceTools(server);
+// Module 22: Deployment notifications - bind/unbind org channels to deploy outcomes
+registerDeploymentNotificationTools(server);
 // Server utility tools
 server.tool("reauthenticate", "Clear stored credentials and sign in again (use to switch accounts or fix auth issues)", {}, async () => {
     try {
@@ -78,7 +103,7 @@ async function main() {
     if (!(await hasCredentials()) && !(await wasAuthPrompted())) {
         markAuthPrompted().catch(() => { });
         getValidToken().catch(() => {
-            // Timeout or error — user can retry via any tool call
+            // Timeout or error - user can retry via any tool call
         });
     }
 }

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC1G,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;IAC3B,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC;AAEH,yBAAyB;AACzB,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAE1B,oCAAoC;AACpC,yBAAyB,CAAC,MAAM,CAAC,CAAC;AAElC,8BAA8B;AAC9B,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAEhC,wDAAwD;AACxD,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAEhC,+BAA+B;AAC/B,qBAAqB,CAAC,MAAM,CAAC,CAAC;AAE9B,8BAA8B;AAC9B,qBAAqB,CAAC,MAAM,CAAC,CAAC;AAE9B,gCAAgC;AAChC,mBAAmB,CAAC,MAAM,CAAC,CAAC;AAE5B,mCAAmC;AACnC,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAE3B,0DAA0D;AAC1D,sBAAsB,CAAC,MAAM,CAAC,CAAC;AAE/B,qDAAqD;AACrD,yBAAyB,CAAC,MAAM,CAAC,CAAC;AAElC,wEAAwE;AACxE,oBAAoB,CAAC,MAAM,CAAC,CAAC;AAE7B,qDAAqD;AACrD,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAE1B,8DAA8D;AAC9D,oBAAoB,CAAC,MAAM,CAAC,CAAC;AAE7B,4FAA4F;AAC5F,oBAAoB,CAAC,MAAM,CAAC,CAAC;AAE7B,uBAAuB;AACvB,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,wFAAwF,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE;IACrI,IAAI,CAAC;QACH,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,WAAW,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,oJAAoJ;iBAC3J,CAAC;SACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;IACxH,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAC9C,MAAM,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAExC,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,iGAAiG;IACjG,IAAI,CAAC,CAAC,MAAM,cAAc,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,eAAe,EAAE,CAAC,EAAE,CAAC;QAC5D,gBAAgB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnC,aAAa,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YACzB,sDAAsD;QACxD,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,MAAM,CAAC,GAAG,CAAC,gBAAgB,GAAG,EAAE,CAAC,CAAC;IAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC1G,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EAAE,mCAAmC,EAAE,MAAM,qCAAqC,CAAC;AAE1F,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;IAC3B,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC;AAEH,yBAAyB;AACzB,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAE1B,oCAAoC;AACpC,yBAAyB,CAAC,MAAM,CAAC,CAAC;AAElC,8BAA8B;AAC9B,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAEhC,wDAAwD;AACxD,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAEhC,+BAA+B;AAC/B,qBAAqB,CAAC,MAAM,CAAC,CAAC;AAE9B,8BAA8B;AAC9B,qBAAqB,CAAC,MAAM,CAAC,CAAC;AAE9B,gCAAgC;AAChC,mBAAmB,CAAC,MAAM,CAAC,CAAC;AAE5B,mCAAmC;AACnC,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAE3B,0DAA0D;AAC1D,sBAAsB,CAAC,MAAM,CAAC,CAAC;AAE/B,qDAAqD;AACrD,yBAAyB,CAAC,MAAM,CAAC,CAAC;AAElC,wEAAwE;AACxE,oBAAoB,CAAC,MAAM,CAAC,CAAC;AAE7B,qDAAqD;AACrD,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAE1B,8DAA8D;AAC9D,oBAAoB,CAAC,MAAM,CAAC,CAAC;AAE7B,4FAA4F;AAC5F,oBAAoB,CAAC,MAAM,CAAC,CAAC;AAE7B,gFAAgF;AAEhF,yEAAyE;AACzE,oBAAoB,CAAC,MAAM,CAAC,CAAC;AAE7B,gGAAgG;AAChG,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAEhC,uFAAuF;AACvF,6BAA6B,CAAC,MAAM,CAAC,CAAC;AAEtC,2EAA2E;AAC3E,mBAAmB,CAAC,MAAM,CAAC,CAAC;AAE5B,2FAA2F;AAC3F,mBAAmB,CAAC,MAAM,CAAC,CAAC;AAE5B,+EAA+E;AAC/E,4BAA4B,CAAC,MAAM,CAAC,CAAC;AAErC,8EAA8E;AAC9E,2BAA2B,CAAC,MAAM,CAAC,CAAC;AAEpC,oFAAoF;AACpF,mCAAmC,CAAC,MAAM,CAAC,CAAC;AAE5C,uBAAuB;AACvB,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,wFAAwF,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE;IACrI,IAAI,CAAC;QACH,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,WAAW,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,oJAAoJ;iBAC3J,CAAC;SACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;IACxH,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAC9C,MAAM,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAExC,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,iGAAiG;IACjG,IAAI,CAAC,CAAC,MAAM,cAAc,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,eAAe,EAAE,CAAC,EAAE,CAAC;QAC5D,gBAAgB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnC,aAAa,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YACzB,sDAAsD;QACxD,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,MAAM,CAAC,GAAG,CAAC,gBAAgB,GAAG,EAAE,CAAC,CAAC;IAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/rate-limiter.js

@@ -43,7 +43,7 @@ class RateLimiter {
         this.tier = tier;
         this.isAdmin = tier === "ADMIN";
         if (this.isAdmin) {
-            config.log("Admin tier set — rate limits disabled.");
+            config.log("Admin tier set - rate limits disabled.");
             return;
         }
         const tierConfig = TIER_CONFIGS[tier];

package/dist/tools/billing.js

@@ -2,15 +2,15 @@ import { z } from "zod";
 import { apiRequest } from "../client.js";
 import { session } from "../session.js";
 /**
- * Billing — subscription lifecycle + payment method linking.
+ * Billing - subscription lifecycle + payment method linking.
  *
  * Endpoints:
- * - GET    /organizations/:pid/billing/subscription      — current subscription
- * - POST   /organizations/:pid/billing/subscriptions     — create (first time)
- * - PATCH  /organizations/:pid/billing/subscriptions     — change plan (up/downgrade)
- * - DELETE /organizations/:pid/billing/subscriptions     — cancel
- * - POST   /organizations/:pid/billing/link              — initiate Razorpay link
- * - PATCH  /organizations/:pid/billing/contact           — update contact / tax info
+ * - GET    /organizations/:pid/billing/subscription      - current subscription
+ * - POST   /organizations/:pid/billing/subscriptions     - create (first time)
+ * - PATCH  /organizations/:pid/billing/subscriptions     - change plan (up/downgrade)
+ * - DELETE /organizations/:pid/billing/subscriptions     - cancel
+ * - POST   /organizations/:pid/billing/link              - initiate Razorpay link
+ * - PATCH  /organizations/:pid/billing/contact           - update contact / tax info
  *
  * All endpoints are org-scoped via the path. The org PID is taken from the
  * MCP session by default; pass `organization_id` to target a different org.
@@ -55,7 +55,7 @@ export function registerBillingTools(server) {
             return {
                 content: [{
                         type: "text",
-                        text: "Free is the default — no subscription needed. Use `change_subscription` with billing_plan=free to downgrade an existing paid subscription.",
+                        text: "Free is the default - no subscription needed. Use `change_subscription` with billing_plan=free to downgrade an existing paid subscription.",
                     }],
             };
         }
@@ -79,12 +79,12 @@ export function registerBillingTools(server) {
         }
         return {
             content: [
-                { type: "text", text: `Subscription create requested for plan \`${billing_plan}\`. The lifecycle state will move from \`pending\` to \`active\` once Razorpay confirms — poll \`get_subscription\`.` },
+                { type: "text", text: `Subscription create requested for plan \`${billing_plan}\`. The lifecycle state will move from \`pending\` to \`active\` once Razorpay confirms - poll \`get_subscription\`.` },
                 { type: "text", text: JSON.stringify(result.data, null, 2) },
             ],
         };
     });
-    server.tool("change_subscription", "Change an existing subscription's plan (upgrade or downgrade). Upgrades apply immediately and prorate; downgrades are scheduled at the end of the current billing cycle. A downgrade may return 422 DOWNGRADE_BLOCKED if the org has resources above the target plan's caps (e.g. >3 instances on Starter) — surface the BE error message to the user.", {
+    server.tool("change_subscription", "Change an existing subscription's plan (upgrade or downgrade). Upgrades apply immediately and prorate; downgrades are scheduled at the end of the current billing cycle. A downgrade may return 422 DOWNGRADE_BLOCKED if the org has resources above the target plan's caps (e.g. >3 instances on Starter) - surface the BE error message to the user.", {
         organization_id: z.string().optional(),
         billing_plan: z.enum(PLANS).describe("Target plan"),
     }, async ({ organization_id, billing_plan }) => {
@@ -144,7 +144,7 @@ export function registerBillingTools(server) {
         }
         return {
             content: [
-                { type: "text", text: "Subscription cancellation scheduled — org will move to `cancelling` until cycle end, then `cancelled`." },
+                { type: "text", text: "Subscription cancellation scheduled - org will move to `cancelling` until cycle end, then `cancelled`." },
                 { type: "text", text: JSON.stringify(result.data, null, 2) },
             ],
         };
@@ -193,12 +193,12 @@ export function registerBillingTools(server) {
         }
         return {
             content: [
-                { type: "text", text: "Razorpay link initiated. Open the `short_url` in a browser to add a card / UPI. The MCP can't complete the checkout — it's a browser-only flow." },
+                { type: "text", text: "Razorpay link initiated. Open the `short_url` in a browser to add a card / UPI. The MCP can't complete the checkout - it's a browser-only flow." },
                 { type: "text", text: JSON.stringify(result.data, null, 2) },
             ],
         };
     });
-    server.tool("update_billing_contact", "Update billing contact info on an already-linked org. Doesn't re-run Razorpay — only persists DB overrides for invoices.", {
+    server.tool("update_billing_contact", "Update billing contact info on an already-linked org. Doesn't re-run Razorpay - only persists DB overrides for invoices.", {
         organization_id: z.string().optional(),
         billing_contact_phone: z.string().optional(),
         tax_id: z.string().optional()
@@ -224,7 +224,7 @@ export function registerBillingTools(server) {
             return {
                 content: [{
                         type: "text",
-                        text: "No changes to apply — pass at least one of billing_contact_phone / tax_id / country_code / state_code.",
+                        text: "No changes to apply - pass at least one of billing_contact_phone / tax_id / country_code / state_code.",
                     }],
             };
         }

package/dist/tools/credentials.js

@@ -15,7 +15,7 @@ When selecting credentials for instance creation:
 - Filter by cloud_provider matching the user's chosen provider (e.g. "aws")
 - Only use credentials with status "active"
 - is_platform_managed=true → SelfHost's cloud account (no VPC needed)
-- is_platform_managed=false → user's own cloud account (BYOC — VPC required, use list_vpcs)
+- is_platform_managed=false → user's own cloud account (BYOC - VPC required, use list_vpcs)
 - Present the user with a choice between platform-managed and their own credentials`, {
         organization_id: z.string().optional().describe("Organization PID (defaults to active org)"),
     }, async ({ organization_id }) => {

package/dist/tools/database-users.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { apiRequest } from "../client.js";
 /**
- * Database users — DBMS-level credentials (distinct from the platform login).
+ * Database users - DBMS-level credentials (distinct from the platform login).
  *
  * Endpoints:
  * - GET    /aws/v1/instances/:id/database_users
@@ -70,12 +70,12 @@ export function registerDatabaseUserTools(server) {
         }
         return {
             content: [
-                { type: "text", text: `Database user \`${username}\` create requested. Status will transition from \`pending\` to \`active\` once applied — poll \`list_database_users\`.` },
+                { type: "text", text: `Database user \`${username}\` create requested. Status will transition from \`pending\` to \`active\` once applied - poll \`list_database_users\`.` },
                 { type: "text", text: JSON.stringify(result.data, null, 2) },
             ],
         };
     });
-    server.tool("update_database_user", "Update a database user — change role, connection limit, or password expiry. Username and target database are immutable (delete + recreate to change them).", {
+    server.tool("update_database_user", "Update a database user - change role, connection limit, or password expiry. Username and target database are immutable (delete + recreate to change them).", {
         instance_id: z.string().min(1),
         user_id: z.string().min(1).describe("Database user PID (from list_database_users)"),
         role: z.enum(ROLES).optional(),
@@ -94,7 +94,7 @@ export function registerDatabaseUserTools(server) {
             return {
                 content: [{
                         type: "text",
-                        text: "No changes to apply — pass at least one of role / connection_limit / password_expiry_days.",
+                        text: "No changes to apply - pass at least one of role / connection_limit / password_expiry_days.",
                     }],
             };
         }
@@ -114,7 +114,7 @@ export function registerDatabaseUserTools(server) {
         }
         return { content: [{ type: "text", text: JSON.stringify(result.data, null, 2) }] };
     });
-    server.tool("delete_database_user", "Soft-delete a database user. Existing connections opened by this user are terminated. The record is preserved for audit — contact support to recover.", {
+    server.tool("delete_database_user", "Soft-delete a database user. Existing connections opened by this user are terminated. The record is preserved for audit - contact support to recover.", {
         instance_id: z.string().min(1),
         user_id: z.string().min(1),
         username: z.string().optional().describe("Username for the confirmation message (cosmetic)"),
@@ -142,9 +142,9 @@ export function registerDatabaseUserTools(server) {
                     }],
             };
         }
-        return { content: [{ type: "text", text: "Database user delete requested — status will move to `deleting` and then disappear from the list." }] };
+        return { content: [{ type: "text", text: "Database user delete requested - status will move to `deleting` and then disappear from the list." }] };
     });
-    server.tool("rotate_database_user_password", "Rotate the password for a database user. The new password is generated server-side and returned ONCE in the response. SECURITY: save it immediately — there is no way to retrieve it later. Existing connections using the old password are terminated.", {
+    server.tool("rotate_database_user_password", "Rotate the password for a database user. The new password is generated server-side and returned ONCE in the response. SECURITY: save it immediately - there is no way to retrieve it later. Existing connections using the old password are terminated.", {
         instance_id: z.string().min(1),
         user_id: z.string().min(1),
         confirm: z.boolean().describe("Must be true. Old password is invalidated immediately; apps and scripts must pick up the new value."),
@@ -153,7 +153,7 @@ export function registerDatabaseUserTools(server) {
             return {
                 content: [{
                         type: "text",
-                        text: `⚠️  About to ROTATE the password for database user ${user_id} on instance ${instance_id}.\n\nThe new password is shown ONCE in the response — save it before doing anything else.\nApps and scripts using the old password will lose connections immediately.\n\nCall again with confirm=true to proceed.`,
+                        text: `⚠️  About to ROTATE the password for database user ${user_id} on instance ${instance_id}.\n\nThe new password is shown ONCE in the response - save it before doing anything else.\nApps and scripts using the old password will lose connections immediately.\n\nCall again with confirm=true to proceed.`,
                     }],
             };
         }
@@ -172,7 +172,7 @@ export function registerDatabaseUserTools(server) {
         }
         return {
             content: [
-                { type: "text", text: "🔑 New password generated. Copy it now — it will not be shown again." },
+                { type: "text", text: "🔑 New password generated. Copy it now - it will not be shown again." },
                 { type: "text", text: JSON.stringify(result.data, null, 2) },
             ],
         };

package/dist/tools/deployment-domains.d.ts

@@ -0,0 +1,2 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function registerDeploymentDomainTools(server: McpServer): void;