@selfhost.dev/mcp-server 0.9.0 → 0.9.1

package/README.md

@@ -6,8 +6,8 @@ The power of your own server. The simplicity of a PaaS. Driven by AI.
 
 **One platform, two capabilities:**
 
-- **Projects** - your apps, shipped. Connect a GitHub repo, click deploy, and it's live: auto-detected builds (Nixpacks, Dockerfile, Docker Compose, or static), auto-deploy on every push, live streaming build logs, environment variables, custom domains, pause and resume to scale to zero, and databases right inside the project. The ease of Railway, Render, and Vercel, with a server you actually control.
-- **Managed Databases** - production-grade database hosting, your way. Managed PostgreSQL, MySQL, Redis, and ClickHouse on AWS, in our cloud or your own AWS account (BYOC), with TimescaleDB and pgvector a flag away on PostgreSQL. Automated backups, snapshots, replicas, and metrics across engines; PITR and parameter tuning on PostgreSQL and MySQL; connection pooling on PostgreSQL, MySQL, and ClickHouse.
+- **Projects** - your apps, shipped. Connect a GitHub repo, click deploy, and it's live: auto-detected builds (Nixpacks, Dockerfile, Docker Compose, or static), auto-deploy on every push, live streaming build logs, environment variables, custom domains, pause and resume to scale to zero, and databases right inside the project. Pick which of six locations across three continents the server runs in, add one-click apps (Supabase, n8n, n8n with Postgres, Twenty CRM) next to your own code, and turn on free daily server backups. The ease of Railway, Render, and Vercel, with a server you actually control.
+- **Managed Databases** - production-grade database hosting, your way. Managed PostgreSQL, MySQL, Redis, and ClickHouse on AWS, in our cloud or your own AWS account (BYOC), with TimescaleDB and pgvector a flag away on PostgreSQL. Automated backups, snapshots, replicas, and metrics across engines; PITR, client TLS and parameter tuning on PostgreSQL; parameter tuning on MySQL; connection pooling on PostgreSQL, MySQL, and ClickHouse; offsite data backups and zero-downtime cluster tier scaling on ClickHouse. Read engine logs and sample the live query workload without SSH.
 
 One account, one bill, one AI control plane. Pay only for what you run: prepaid credits from $5, no plans or tiers.
 
@@ -90,8 +90,14 @@ Connect a repo, deploy, and it's live - SelfHost takes your code from GitHub to
 | *"Create a project and deploy my GitHub repo into it"* | Provisions the project, waits until it's ready, auto-detects the build, and deploys the repo |
 | *"Deploy the main branch of my-org/api"* | Creates the deployment, triggers the build, and streams live logs until it's running |
 | *"Turn on auto-deploy so every push ships"* | Enables auto-deploy; future pushes to the branch redeploy automatically |
+| *"Put my project's server in Singapore"* | Shows what each family costs there, with live stock, and provisions it where you picked. A server cannot be moved later, so this is asked up front |
 | *"Add a private Postgres database to my project"* | Provisions a Postgres database inside the project, with the credentials and visibility you choose |
-| *"Spin up Supabase in this project"* | Deploys the Supabase template alongside your app |
+| *"Spin up Supabase in this project"* | Deploys the Supabase template alongside your app and hands you the Studio credentials once it is up |
+| *"I want n8n for my automations"* | Deploys n8n (or n8n backed by Postgres, if it is more than light use) and warns you the first person to open the URL claims the owner account |
+| *"Give me a CRM"* | Deploys Twenty, and tells you it takes up to 15 minutes rather than leaving you wondering if it hung |
+| *"Turn on backups for this project"* | Enables daily server backups, seven kept. Free - there is no backup charge for projects |
+| *"Why did my project go down last night?"* | Reads the merged feed of Hetzner server actions and platform events, so "we stopped it for billing" is distinguishable from "the machine was rebuilt" |
+| *"Roll this project's server back to yesterday's backup"* | Lists the backups, tells you exactly what you lose, and rebuilds the disk once you confirm |
 | *"Set DATABASE_URL on my app and redeploy"* | Updates the env var (without wiping the others) and rolls out the change |
 | *"Point app.example.com at my deployment"* | Attaches the custom domain and returns the exact DNS records to add, then verifies them |
 | *"Show me the build logs for the last deploy"* | Streams the build and container logs for that run |
@@ -125,6 +131,16 @@ Production-grade, standalone database hosting.
 | *"Add a read-only database user for the reporting app"* | Creates a DBMS-level credential with the right grants |
 | *"Restore my prod database to 14:30 yesterday into a new instance"* | Sets up a point-in-time recovery from WAL + base backups |
 | *"How has my prod database been doing this week?"* | Summarizes CPU / memory / disk / engine metrics from the agent heartbeats |
+| *"Why is my database slow right now?"* | Samples the live query workload and reads the engine log, no SSH involved |
+| *"Show me the Postgres error log"* | Fetches the tail of whichever log you name, from a list of what that engine actually has |
+| *"Encrypt connections to my Postgres"* | Turns on client TLS across the primary and every replica, and reminds you to move clients to sslmode=require |
+| *"Back up my ClickHouse data offsite every night"* | Creates a BACKUP ALL schedule streaming to its own S3 bucket, with the retention you pick |
+| *"Restore that ClickHouse backup"* | Restores it, after telling you plainly that it MERGES rather than rolling back |
+| *"Let my ClickHouse cluster grow and shrink with load"* | Sets the tier floor and ceiling, quotes what the ceiling costs, and adds the up and down triggers |
+| *"My cluster stopped autoscaling"* | Finds the failed scale plan blocking it - which nothing else surfaces - and retries or discards it |
+| *"Make Priya an admin"* | Changes the member's role, and explains it if the hierarchy refuses |
+| *"POST to my service whenever a deploy fails"* | Registers a webhook endpoint and hands you the signing secret |
+| *"How long will my credit last?"* | Reports the balance, the burn rate, the runway, and any credit about to expire |
 | *"Scale my instance to r6i.2xlarge and 1TB"* | Issues a manual scale, polls the resize event, and warns if the storage cascades to cluster peers |
 | *"Grow storage automatically before the disk fills up"* | Creates a doubling storage rule up to a ceiling you approve, priced per node |
 | *"Auto-stop my staging DB at 7pm weekdays"* | Creates a scheduled scaling policy with start/stop times |
@@ -167,13 +183,18 @@ Multi-tenant - everything is scoped to your org.
 | `update_organization` | Change name, description, or IAM role |
 | `delete_organization` | Soft-delete org and all related resources |
 | `list_members` | See team members and their roles |
+| `update_member_role` | Promote or demote an existing member (the only way to change a role after they've joined) |
 | `remove_member` | Remove a member (owner/admin only) |
-| `invite_to_org` | Send org invitation with role assignment |
+| `invite_to_org` | Send org invitation at a role you pick, by name |
 | `list_org_invitations` | Pending invitations |
 | `cancel_invitation` | Revoke a pending invitation |
 | `get_my_invitations` | Invitations sent to you |
 | `list_activity_logs` | Audit trail of all actions in the org |
 
+Five roles, highest first: **Owner** (100), **Admin** (80), **Billing** (60), **Manager** (40), **Member** (20). Both invite and role-change take the role by name, so you never have to hunt for an id.
+
+The hierarchy is enforced and the refusals are worth knowing in advance: an owner manages everyone, but an **admin can only manage strictly below their own level** - never a peer admin, and never granting a role at or above their own. Nobody can change **their own** role (self-demotion locks you out, self-promotion is an escalation), so an owner stepping down has to be demoted by another owner, and the last owner cannot be demoted or removed at all.
+
 #### Cloud Credentials
 Bring your own AWS account (BYOC) or use SelfHost's managed infrastructure.
 
@@ -264,6 +285,15 @@ Neither is a separate engine - both are PostgreSQL plus a flag. Pass `timescaled
 
 Once TimescaleDB is installed, five extra metrics join the instance's `postgresql.database` alert set: `timescaledb_hypertable_count`, `timescaledb_chunk_count`, `timescaledb_compressed_chunk_count`, `timescaledb_compression_ratio`, and `timescaledb_total_size_bytes`. They're absent from heartbeats until then, so don't write rules against them on a plain Postgres instance - they'd never fire.
 
+#### PostgreSQL Client TLS
+Encryption in transit for client connections. **Group-wide**: one call covers the primary and every replica, and certificates are issued per group.
+
+| Tool | Description |
+|------|-------------|
+| `set_postgres_tls` | Turn client TLS on or off across a Postgres instance group (turning it off asks for confirmation - it downgrades every client connection) |
+
+Once it's on, move clients to `sslmode=require` or stricter; a client left on the default may keep connecting in the clear. And note that **a restore or a fork starts with TLS off** even when the source had it on, because the new group has no certificate yet - re-enable it explicitly rather than assuming it carried over.
+
 #### MySQL Configuration
 Tune MySQL server parameters on a managed instance. No preview step - read the current config, then apply overrides.
 
@@ -561,14 +591,51 @@ Events: `instance.scaling_failed`, `deploy_run.succeeded` / `.failed` / `.aborte
 ```
 You: "Deploy my-org/web to a new project"
 
-Claude: Creates a project → polls until it's provisioned and active
+Claude: Shows sizes and locations with live prices → you pick
+        → creates the project → polls until provisioned and active
         → detects the build config from the repo (build pack, port)
-        → creates the deployment and triggers the first build
+        → creates the deployment; it comes back `provisioning` with no
+          URL yet, which is normal, so it keeps polling
         → streams the build logs until the app is live
         → hands you the deploy URL
 ```
 
-Then: *"add a private Postgres to it"*, *"set my env vars"*, *"point app.example.com at it"*, or *"turn on auto-deploy"* to round out the app.
+The deployment's URL is null on creation. Registration happens in the background
+(it used to run inline and time out on private repos), so the deploy URL appears
+when the status reaches `active`, not in the create response.
+
+Then: *"add a private Postgres to it"*, *"drop n8n next to it"*, *"set my env vars"*, *"point app.example.com at it"*, *"turn on backups"*, or *"turn on auto-deploy"* to round out the app.
+
+### Add a one-click app to a project
+
+```
+You: "I want n8n in my project"
+
+Claude: Asks whether you want it public, and whether the Postgres-backed
+        variant (durability and concurrency; it cannot be switched later)
+        → deploys it → polls until active (up to ~10 min)
+        → fetches the URL, and tells you the FIRST person to open it
+          becomes the owner, so finish setup before sharing it
+```
+
+Supabase is the exception: it takes a dashboard username and password up front
+and those become the Studio login. n8n and Twenty have no admin credentials at
+all - the first visitor claims the account.
+
+### Diagnose a slow database
+
+```
+You: "My prod Postgres feels slow"
+
+Claude: Samples the live query workload (5-60s window)
+        → reads the engine log tail
+        → checks CPU / memory / disk and the replica count
+        → tells you what the numbers actually say
+```
+
+Both the log fetch and the workload sample are request-then-read: the platform
+agent collects them and the result is read back a moment later. Sample while the
+problem is happening - a quiet window will make a struggling database look fine.
 
 ### Switch AWS Account (BYOC vs Platform-Managed)
 
@@ -606,6 +673,12 @@ Claude: Calls reauthenticate → clears stored credentials
 
 ### Restore from Backup
 
+Three different things get called "restore" here and they do not do the same
+thing. Whichever one you ask for, the tools state which you are getting before
+touching anything.
+
+**A disk snapshot** becomes a NEW instance - the original is untouched:
+
 ```
 You: "Restore my prod database from yesterday's snapshot"
 
@@ -614,6 +687,14 @@ Claude: Lists snapshots → you pick one
         → shows you the new password (save it!)
 ```
 
+**A ClickHouse data backup MERGES into a running instance.** It is not a
+rollback: rows written after the backup was taken survive it. You can also
+restore into a different instance, which is how you clone a dataset.
+
+**A project backup IS a rollback.** It overwrites the server's whole disk, so
+Coolify, every service and every project database revert, and anything written
+since is gone. It asks for the project's exact name before doing it.
+
 ---
 
 ## Rate Limiting

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@selfhost.dev/mcp-server",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "MCP server for SelfHost.dev - provision managed databases and deploy apps (PaaS) via natural language",
   "type": "module",
   "main": "dist/index.js",