lattice-mcp 1.0.0 → 1.1.0

package/AGENTS.md

@@ -0,0 +1,226 @@
+# AGENTS.md — lattice-mcp
+
+> `lattice-mcp` is the **Model Context Protocol server for Lattice**, the container
+> orchestration platform that runs every `appleby.cloud` service. It exposes the
+> `lattice-api` admin surface to Claude Code as **125 typed tools** — workers, stacks,
+> containers, deployments, databases, registries, networks, volumes and instance config.
+> This file orients any agent/worker before touching code in this repo.
+>
+> **⚠️ Golden rule — keep this file current:** any change that adds, removes or retypes a
+> tool, changes the auth model, or drifts from `lattice-api`'s route surface MUST update this
+> AGENTS.md in the SAME change. Stale context here misleads every future agent. If you finish
+> work and haven't touched AGENTS.md, confirm that's actually correct.
+
+---
+
+## What this repo is
+
+A single-file Node ESM program (`index.js`, ~1,180 lines) that speaks MCP over stdio and
+translates tool calls into HTTP requests against `lattice-api`. It is published to npm as
+`lattice-mcp` and consumed via `npx -y lattice-mcp` from `~/.mcp.json`.
+
+It owns **only the translation layer**: tool names, argument schemas, descriptions, and URL
+construction. It holds no business logic, no caching, and no state. Every behaviour an agent
+observes — pagination limits, validation messages, side effects — comes from `lattice-api`.
+
+It does **not** own: the Lattice data model, deployment mechanics, or the worker protocol.
+Those live in [`lattice-api`](https://github.com/aidenappl/lattice-api) and
+[`lattice-runner`](https://github.com/aidenappl/lattice-runner).
+
+## Stack & dependencies
+
+- **Runtime:** Node ≥18 (needs global `fetch` and `AbortSignal.timeout`). `"type": "module"` —
+  ESM only, top-level `await` is used at the bottom of `index.js`.
+- **`@modelcontextprotocol/sdk` ^1.29.0** — `McpServer` + `StdioServerTransport`.
+- **`zod`** — argument schemas. Supplied transitively by the MCP SDK; it is *not* a declared
+  dependency, which is a latent fragility (see Rules & guardrails).
+- No build step, no bundler, no tests, no lint config. `node --check index.js` is the only
+  static gate.
+
+## Project structure
+
+| Path | Role |
+|------|------|
+| `index.js` | Everything: `--setup` flow, config read, `api()` HTTP helper, `text()`/`body()` helpers, all 125 `server.tool(...)` registrations, transport connect. |
+| `package.json` | npm metadata. `bin.lattice-mcp` → `index.js`, so `npx lattice-mcp` works. |
+| `README.md` | User-facing setup + full tool table. |
+| `AGENTS.md` | This file. |
+
+`index.js` is organised top-to-bottom as: setup block → config/guard → helpers → tools grouped
+by domain under `// ───` banner comments → transport. **Keep new tools inside the matching
+banner group**; do not append to the bottom.
+
+## Running, building & testing
+
+There is no `Devfile.yaml` and no `dev` CLI wiring here — it is a single script.
+
+```bash
+node --check index.js          # syntax gate — the only static check that exists
+npm install                    # needed before running locally (deps are not vendored)
+node index.js --setup          # interactive: writes the lattice block into ~/.mcp.json
+LATTICE_API_URL=... LATTICE_API_TOKEN=... node index.js   # run the server on stdio
+```
+
+**Smoke-testing without an MCP client.** The server speaks JSON-RPC over stdio, so you can
+drive it with a shell pipeline. This is the standard way to verify a change registers cleanly:
+
+```bash
+{ echo '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"probe","version":"1"}}}'
+  sleep 2
+  echo '{"jsonrpc":"2.0","method":"notifications/initialized"}'
+  echo '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}'
+  sleep 2; } | LATTICE_API_URL=x LATTICE_API_TOKEN=x node index.js
+```
+
+The `sleep`s matter — without them the requests race the handshake and you get nothing back.
+For a live call, swap `tools/list` for
+`{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"lattice_get_anomalies","arguments":{}}}`
+and supply the real token.
+
+## How code is written here
+
+- **Every tool follows one shape.** Deviating makes the file harder to scan:
+  ```js
+  server.tool("lattice_<verb>_<noun>", "<description>", { /* zod schema */ }, async (args) => {
+      const res = await api("<METHOD>", `/admin/<path>`, params, body);
+      return { content: text(res) };
+  });
+  ```
+- **Naming:** `lattice_` prefix on every tool, then `list|get|create|update|delete|<verb>` then
+  the noun (`lattice_list_database_instances`). The prefix is what disambiguates these from
+  `monitor_*` and `forta_*` tools in a shared client.
+- **`api(method, path, params, body)`** — `params` become query string entries (undefined/null
+  are dropped), `body` is JSON-encoded. Errors are swallowed and returned as
+  `{success:false, error_message}` so a network failure surfaces as tool output rather than a
+  transport crash.
+- **`body(obj)`** strips `undefined` keys. **Always use it on PUT/PATCH tools.** The API treats
+  a present-but-null field as an explicit clear, so forwarding raw `{...fields}` on an update
+  would wipe every field the caller didn't pass.
+- **Path params are template literals**, query params go through the `params` argument. Never
+  hand-concatenate a query string.
+- **Descriptions are the contract.** An agent picks tools from the description alone, so it
+  must state what the tool does, when to reach for it, and — for anything destructive — the
+  blast radius. Compare `lattice_stop_container` ("stops it") with `lattice_delete_container`
+  ("Destructive — lattice_stop_container only stops it").
+- **Read the handler before adding a tool.** Struct field names are not the request contract;
+  handlers frequently override or ignore them. Two live examples from `lattice-api`:
+  `HandleUpdateCompose` has a `containerConfigFingerprint` helper with short JSON keys
+  (`i`, `t`, `pm`) that is **not** the request body — the body is just `{compose_yaml}`; and
+  `HandleDatabaseAction` derives its action from the **last URL path segment**, not from a body
+  field.
+
+## Domain & architecture
+
+**Auth.** A single long-lived bearer token (`LATTICE_API_TOKEN`) from
+`lattice-api`'s `/admin/api-tokens`, sent on every request. There is no refresh, no expiry
+handling, and no login flow. A 401 means the token was revoked or expired — the fix is a new
+token via `--setup`, not a code change.
+
+**Config.** Read once at startup from `LATTICE_API_URL` and `LATTICE_API_TOKEN`; the process
+exits immediately if either is missing. In practice these come from the `env` block of the
+`lattice` entry in `~/.mcp.json`.
+
+**Tool groups**, in file order:
+
+| Group | Tools | Notes |
+|-------|-------|-------|
+| Overview & health | 2 | `lattice_overview`, `lattice_health` |
+| Workers | 3 + 4 actions | list/get/metrics; reboot, upgrade, stop-all, start-all |
+| Stacks | 2 + 4 actions | list/get; deploy, restart, stop, start, update |
+| Containers | 5 + 8 actions | get/list/logs/lifecycle/metrics; start, stop, restart, kill, pause, unpause, remove, recreate |
+| Deployments | 4 | list/get/logs, rollback, approve |
+| Audit & API tokens | 4 | audit log; token list/create/delete |
+| **Database instances** | **11** | CRUD, `lattice_database_action`, credentials, snapshots, restore |
+| **Backup destinations** | **6** | CRUD + test |
+| **Registries** | **8** | CRUD, test, test-inline, repositories, tags |
+| **Discovery & diagnostics** | **7** | search, anomalies, fleet-metrics, versions, refresh-versions, container metrics, self |
+| **Stacks — compose & tokens** | **13** | create/delete, compose update/sync/import, export/import, save-template, deploy tokens |
+| **Containers — definition CRUD** | **3** | create/update/delete definitions |
+| **Workers — resources** | **16** | worker CRUD, tokens, volumes, networks, force-remove |
+| **Global env vars / templates / webhooks** | **12** | |
+| **Users & instance config** | **12** | users, SSO, SMTP, notification prefs |
+
+Bolded groups were added in **1.1.0**, closing a gap where the MCP had drifted roughly two
+months behind `lattice-api` — database instances shipped in the API in May 2026 and were
+entirely unreachable from the MCP until then.
+
+**Consolidations.** Where `lattice-api` exposes several paths served by one handler, this repo
+exposes one tool with an enum rather than N tools. `lattice_database_action` covers
+`/start`, `/stop`, `/restart` and `/remove`. Worker actions are the historical exception — they
+predate this convention and remain separate tools.
+
+## Ecosystem & related repos
+
+| Repo | Relationship |
+|------|--------------|
+| [`lattice-api`](https://github.com/aidenappl/lattice-api) | The API this wraps. Its `main.go` route table is the source of truth for coverage. |
+| [`lattice-web`](https://github.com/aidenappl/lattice-web) | Next.js dashboard over the same API. |
+| [`lattice-runner`](https://github.com/aidenappl/lattice-runner) | Agent on each worker VM; WebSocket back to `lattice-api`. |
+| [`monitor-mcp`](https://github.com/aidenappl/monitor-mcp) | Sibling MCP, same single-file structure — keep them stylistically aligned. |
+| `forta-mcp` / `keyring-mcp` / `openbucket-mcp` | Newer siblings; they carry a `body()` helper and destructive-blast-radius descriptions that originated here. |
+
+## Operations
+
+- **Published to npm** as `lattice-mcp` (public). Consumers run `npx -y lattice-mcp`, which
+  resolves the latest published version — so **publishing is deployment**. A bug shipped to npm
+  reaches every user on their next MCP server start.
+- **Publishing requires 2FA via passkey.** `npm publish` must run from an interactive terminal:
+  npm's web auth flow needs to open a browser, and from a non-TTY subprocess it degrades to
+  demanding an OTP that a passkey-only account cannot produce.
+- **In-session staleness:** a running MCP server process does not pick up a new npm version.
+  After publishing, the client must be restarted before the new tools/schemas appear.
+- **Common failure modes:**
+  - *All tools return `API request failed: fetch failed`* — `LATTICE_API_URL` is wrong or the
+    TLS proxy in front of Lattice has an expired cert.
+  - *All tools return 401* — token revoked or expired; re-run `--setup`.
+  - *One tool 404s while others work* — the MCP is ahead of the deployed `lattice-api`, or the
+    route moved.
+
+## Rules & guardrails
+
+- **Never hardcode a token, URL or hostname.** Everything comes from env.
+- **Never log request or response bodies.** Responses routinely contain env vars, registry
+  credentials and database passwords. `lattice_get_database_credentials` returns live secrets
+  by design — do not add convenience logging anywhere in `api()`.
+- **Never add a tool without reading its handler in `lattice-api`.** Inferring a request shape
+  from a struct has produced real, shipped bugs across this family of servers.
+- **Do not break tool names.** They are a public contract: renaming one silently breaks any
+  saved workflow or prompt that referenced it. Add a new tool and deprecate in the description
+  instead.
+- **`zod` is used but not declared** in `package.json` — it resolves transitively through the
+  MCP SDK. If the SDK ever drops or hoists it differently, every tool schema breaks at startup.
+  Adding it as an explicit dependency is the correct fix; do it in a standalone change.
+- **Keep destructive descriptions honest.** If a tool destroys data, the description must say so
+  and name the safer alternative.
+- Publishing is outward-facing and effectively irreversible (npm unpublish is restricted after
+  72 hours) — do not publish without explicit instruction.
+
+## Verification — always before "done"
+
+```bash
+node --check index.js                      # must pass
+grep -c 'server.tool(' index.js            # tool count matches what you expect
+```
+
+Then the stdio handshake from *Running, building & testing* above, asserting:
+- the server registers **without stderr output**,
+- the tool count is what you expect,
+- **no duplicate tool names** (`server.tool` silently accepts a duplicate; the last registration
+  wins and the earlier tool disappears — this will not error).
+
+For any tool you added or changed, make **one real call against the live API** and confirm the
+response shape. Schema-only verification is not enough: it catches typos, not wrong units,
+wrong enum values, or parameters the handler ignores.
+
+**Never report work complete on the strength of `tools/list` alone.**
+
+## Keeping this file updated
+
+Update this AGENTS.md in the same change when you:
+- **Add/remove/rename a tool** → update the tool-group table and the count in the header.
+- **Change the auth model or config vars** → update *Domain & architecture*.
+- **Change the `api()`/`body()`/`text()` helpers** → update *How code is written here*.
+- **Bump the version or publish** → note behavioural changes under the relevant group.
+- **Notice `lattice-api` has gained routes** → either add the tools or record the gap here
+  explicitly, so the next agent knows it was a decision and not an oversight.
+- Also keep `README.md`'s tool tables in sync — it is the user-facing surface and drifts fastest.

package/README.md

@@ -0,0 +1,205 @@
+# lattice-mcp
+
+MCP server for the [Lattice](https://github.com/aidenappl/lattice-api) container orchestration platform. Gives Claude Code direct access to manage workers, stacks, containers, and deployments.
+
+## Quick Start
+
+```bash
+npx lattice-mcp --setup
+```
+
+This prompts for your Lattice API URL and API token, writes the config to `~/.mcp.json`, and you're ready to go. Restart Claude Code after setup.
+
+## Manual Setup
+
+Add to `~/.mcp.json`:
+
+```json
+{
+  "mcpServers": {
+    "lattice": {
+      "command": "npx",
+      "args": ["-y", "lattice-mcp"],
+      "env": {
+        "LATTICE_API_URL": "https://lattice-api.appleby.cloud",
+        "LATTICE_API_TOKEN": "your-api-token"
+      }
+    }
+  }
+}
+```
+
+Generate an API token from the Lattice web dashboard under **Settings > API Tokens**.
+
+## Tools
+
+### Overview & Health
+| Tool | Description |
+|------|-------------|
+| `lattice_overview` | Fleet overview — worker counts, stack counts, failed stacks, CPU/memory |
+| `lattice_health` | API health and database connectivity |
+
+### Workers
+| Tool | Description |
+|------|-------------|
+| `lattice_list_workers` | List workers with status, IP, versions |
+| `lattice_get_worker` | Detailed worker info |
+| `lattice_get_worker_metrics` | CPU, memory, disk, network metrics |
+| `lattice_reboot_worker` | Reboot a worker machine |
+| `lattice_upgrade_worker` | Upgrade worker runner to latest |
+| `lattice_stop_all_worker` | Stop all containers on a worker |
+| `lattice_start_all_worker` | Start all containers on a worker |
+
+### Stacks
+| Tool | Description |
+|------|-------------|
+| `lattice_list_stacks` | List stacks with status and worker assignment |
+| `lattice_get_stack` | Full stack details including compose YAML |
+| `lattice_update_stack` | Update stack configuration |
+| `lattice_deploy_stack` | Deploy a stack (all or specific containers) |
+| `lattice_restart_stack` | Restart all containers in a stack |
+| `lattice_stop_stack` | Stop all containers in a stack |
+| `lattice_start_stack` | Start all containers in a stack |
+
+### Containers
+| Tool | Description |
+|------|-------------|
+| `lattice_list_containers` | List containers with status, image, ports, health |
+| `lattice_get_container` | Full container details |
+| `lattice_get_container_logs` | Recent container logs (stdout/stderr) |
+| `lattice_get_container_lifecycle` | Lifecycle events (start, stop, health changes) |
+| `lattice_start_container` | Start a stopped container |
+| `lattice_stop_container` | Stop a running container |
+| `lattice_restart_container` | Restart a container |
+| `lattice_kill_container` | Force kill a container |
+| `lattice_pause_container` | Pause a running container |
+| `lattice_unpause_container` | Unpause a paused container |
+| `lattice_remove_container` | Remove a container |
+| `lattice_recreate_container` | Remove and recreate a container |
+
+### Deployments
+| Tool | Description |
+|------|-------------|
+| `lattice_list_deployments` | List deployments with status and timing |
+| `lattice_get_deployment` | Deployment details with container-level status |
+| `lattice_get_deployment_logs` | Pull, create, start, swap events with timing |
+| `lattice_rollback_deployment` | Rollback to previous state |
+
+### System
+| Tool | Description |
+|------|-------------|
+| `lattice_get_audit_log` | Recent audit log entries |
+| `lattice_update_api` | Trigger API self-update |
+| `lattice_update_web` | Trigger web container update |
+| `lattice_list_api_tokens` | List API tokens |
+| `lattice_create_api_token` | Create a new API token |
+| `lattice_delete_api_token` | Delete an API token |
+
+## Example Prompts
+
+- "What's the status of all stacks?"
+- "Show me logs for the forta-api container"
+- "Deploy stack 5"
+- "Which containers are unhealthy?"
+- "Rollback the last deployment on stack 12"
+
+## Environment Variables
+
+| Variable | Required | Description |
+|----------|----------|-------------|
+| `LATTICE_API_URL` | Yes | Lattice API base URL |
+| `LATTICE_API_TOKEN` | Yes | API token for authentication |
+
+## License
+
+MIT
+
+### Database instances
+| Tool | Description |
+|------|-------------|
+| `lattice_list_database_instances` | List managed databases (filter by worker, engine, status) |
+| `lattice_get_database_instance` | Full instance config |
+| `lattice_create_database_instance` | Provision mysql/mariadb/postgres on a worker |
+| `lattice_update_database_instance` | Update config, limits, snapshot schedule |
+| `lattice_delete_database_instance` | Delete an instance ⚠️ |
+| `lattice_database_action` | start / stop / restart / remove ⚠️ |
+| `lattice_get_database_credentials` | Connection credentials (returns secrets) |
+| `lattice_list_database_snapshots` | Snapshots for an instance |
+| `lattice_create_database_snapshot` | Take a snapshot now |
+| `lattice_restore_database_snapshot` | Restore from a snapshot ⚠️ |
+| `lattice_delete_database_snapshot` | Delete a snapshot ⚠️ |
+
+### Backup destinations
+| Tool | Description |
+|------|-------------|
+| `lattice_list_backup_destinations` / `lattice_get_backup_destination` | Inventory |
+| `lattice_create_backup_destination` / `lattice_update_backup_destination` | Manage destinations |
+| `lattice_delete_backup_destination` | Delete ⚠️ |
+| `lattice_test_backup_destination` | Test connectivity without writing a backup |
+
+### Registries
+| Tool | Description |
+|------|-------------|
+| `lattice_list_registries` | Configured registries |
+| `lattice_create_registry` / `lattice_update_registry` | Manage registries |
+| `lattice_delete_registry` | Delete ⚠️ |
+| `lattice_test_registry` / `lattice_test_registry_inline` | Test stored or unsaved credentials |
+| `lattice_list_registry_repositories` | What images exist |
+| `lattice_list_registry_tags` | **What versions are deployable** |
+
+### Discovery & diagnostics
+| Tool | Description |
+|------|-------------|
+| `lattice_search` | Search workers, stacks and containers in one call |
+| `lattice_get_anomalies` | **Restart loops, unhealthy containers, offline workers — best first call** |
+| `lattice_get_fleet_metrics` | Aggregated fleet CPU/memory/disk/network |
+| `lattice_get_versions` / `lattice_refresh_versions` | Runner versions and what's outdated |
+| `lattice_get_container_metrics` | Per-container metrics over time |
+| `lattice_get_self` | Which user the token authenticates as |
+
+### Stacks — compose, export & deploy tokens
+| Tool | Description |
+|------|-------------|
+| `lattice_create_stack` / `lattice_delete_stack` | Stack lifecycle ⚠️ |
+| `lattice_get_stack_containers` | Containers in a stack |
+| `lattice_update_stack_compose` / `lattice_sync_stack_compose` | Compose YAML management |
+| `lattice_import_compose` | Create a stack from compose YAML |
+| `lattice_export_stack` / `lattice_import_stack_export` | Portable stack backup/restore |
+| `lattice_save_stack_as_template` | Save a stack as a reusable template |
+| `lattice_list_deploy_tokens` | CI deploy tokens — `last_used_at` shows whether CI reaches Lattice |
+| `lattice_create_deploy_token` / `lattice_delete_deploy_token` | Manage CI deploy tokens ⚠️ |
+| `lattice_approve_deployment` | Approve a deployment awaiting approval |
+
+### Container definitions
+| Tool | Description |
+|------|-------------|
+| `lattice_create_container` / `lattice_update_container` | Manage container definitions |
+| `lattice_delete_container` | Delete definition and container ⚠️ |
+
+### Workers — resources
+| Tool | Description |
+|------|-------------|
+| `lattice_create_worker` / `lattice_update_worker` / `lattice_delete_worker` | Worker registration ⚠️ |
+| `lattice_get_worker_container_stats` | Live per-container stats |
+| `lattice_list_worker_tokens` / `lattice_create_worker_token` / `lattice_delete_worker_token` | Runner registration tokens ⚠️ |
+| `lattice_list_worker_volumes` / `lattice_create_worker_volume` / `lattice_delete_worker_volume` | Docker volumes ⚠️ |
+| `lattice_list_worker_networks` / `lattice_create_worker_network` / `lattice_delete_worker_network` | Docker networks ⚠️ |
+| `lattice_list_all_networks` / `lattice_delete_network` | Fleet-wide networks ⚠️ |
+| `lattice_force_remove_container` | Force-remove a wedged container ⚠️ |
+
+### Env vars, templates & webhooks
+| Tool | Description |
+|------|-------------|
+| `lattice_list_env_vars` / `lattice_create_env_var` / `lattice_update_env_var` / `lattice_delete_env_var` | Global `${VAR}` interpolation values ⚠️ |
+| `lattice_list_templates` / `lattice_create_template` / `lattice_delete_template` | Stack templates ⚠️ |
+| `lattice_list_webhooks` / `lattice_create_webhook` / `lattice_update_webhook` / `lattice_delete_webhook` / `lattice_test_webhook` | Outbound event webhooks ⚠️ |
+
+### Users & instance configuration
+| Tool | Description |
+|------|-------------|
+| `lattice_list_users` / `lattice_create_user` / `lattice_update_user` / `lattice_delete_user` | User management ⚠️ |
+| `lattice_get_sso_config` / `lattice_update_sso_config` | Forta SSO ⚠️ |
+| `lattice_get_smtp_config` / `lattice_update_smtp_config` / `lattice_test_smtp` | Alert email |
+| `lattice_get_notification_prefs` / `lattice_update_notification_prefs` | Per-event notification prefs |
+
+⚠️ = destructive. Tool descriptions state the blast radius.

package/index.js

@@ -2,12 +2,58 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
+import { createInterface } from "readline";
+import { readFileSync, writeFileSync, existsSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+
+// --- Interactive setup ---
+
+if (process.argv.includes("--setup")) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    const ask = (q) => new Promise((resolve) => rl.question(q, resolve));
+
+    console.log("\n  Lattice MCP Setup\n");
+
+    const apiUrl = (await ask("  Lattice API URL (https://lattice-api.appleby.cloud): ")).trim() || "https://lattice-api.appleby.cloud";
+    const apiToken = (await ask("  Lattice API Token: ")).trim();
+    rl.close();
+
+    if (!apiToken) {
+        console.error("\n  Error: API token is required.\n");
+        process.exit(1);
+    }
+
+    const mcpPath = join(homedir(), ".mcp.json");
+    let config = { mcpServers: {} };
+    if (existsSync(mcpPath)) {
+        try { config = JSON.parse(readFileSync(mcpPath, "utf-8")); } catch {}
+        if (!config.mcpServers) config.mcpServers = {};
+    }
+
+    config.mcpServers.lattice = {
+        command: "npx",
+        args: ["-y", "lattice-mcp"],
+        env: {
+            LATTICE_API_URL: apiUrl,
+            LATTICE_API_TOKEN: apiToken,
+        },
+    };
+
+    writeFileSync(mcpPath, JSON.stringify(config, null, 2) + "\n");
+    console.log(`\n  Written to ${mcpPath}`);
+    console.log("  Restart Claude Code to load the Lattice MCP server.\n");
+    process.exit(0);
+}
+
+// --- MCP Server ---
 
 const API_URL = process.env.LATTICE_API_URL;
 const API_TOKEN = process.env.LATTICE_API_TOKEN;
 
 if (!API_URL || !API_TOKEN) {
-    console.error("LATTICE_API_URL and LATTICE_API_TOKEN are required");
+    console.error("LATTICE_API_URL and LATTICE_API_TOKEN are required.");
+    console.error("Run `npx lattice-mcp --setup` to configure.");
     process.exit(1);
 }
 
@@ -43,6 +89,12 @@ function text(data) {
     return [{ type: "text", text: JSON.stringify(data, null, 2) }];
 }
 
+// Strips undefined keys so a PUT only sends the fields the caller supplied —
+// the API treats a present-but-null field as an explicit clear.
+function body(obj) {
+    return Object.fromEntries(Object.entries(obj).filter(([, v]) => v !== undefined));
+}
+
 // --- MCP Server ---
 
 const server = new McpServer({
@@ -351,6 +403,773 @@ server.tool("lattice_delete_api_token", "Delete an API token", {
     return { content: text(res) };
 });
 
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Database instances
+// ─────────────────────────────────────────────────────────────────────────────
+
+server.tool("lattice_list_database_instances", "List managed database instances with engine, version, status, worker and health. Filter by worker, engine or status", {
+    worker_id: z.number().optional().describe("Filter by worker ID"),
+    engine: z.enum(["mysql", "mariadb", "postgres"]).optional().describe("Filter by engine"),
+    status: z.string().optional().describe("Filter by status (running, stopped, creating, error)"),
+    limit: z.number().optional().describe("Max instances to return"),
+    offset: z.number().optional().describe("Pagination offset"),
+}, async (args) => {
+    const res = await api("GET", "/admin/database-instances", args);
+    return { content: text(res) };
+});
+
+server.tool("lattice_get_database_instance", "Get one database instance: engine, port, limits, snapshot schedule, retention and backup destination", {
+    id: z.number().describe("Database instance ID"),
+}, async ({ id }) => {
+    const res = await api("GET", `/admin/database-instances/${id}`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_create_database_instance", "Provision a database instance on a worker. Creates a real container — pick a port that is free on that worker", {
+    name: z.string().describe("Instance name (must be unique)"),
+    engine: z.enum(["mysql", "mariadb", "postgres"]).describe("Database engine"),
+    worker_id: z.number().describe("Worker to provision on"),
+    engine_version: z.string().optional().describe("Engine version tag; the API picks a default when omitted"),
+    port: z.number().optional().describe("Host port to expose"),
+    root_password: z.string().optional().describe("Root/superuser password"),
+    database_name: z.string().optional().describe("Initial database to create"),
+    username: z.string().optional().describe("Application user to create"),
+    password: z.string().optional().describe("Application user's password"),
+    cpu_limit: z.number().optional().describe("CPU limit in cores"),
+    memory_limit: z.number().optional().describe("Memory limit in bytes"),
+    snapshot_schedule: z.string().optional().describe("Cron expression for automatic snapshots"),
+    retention_count: z.number().optional().describe("How many automatic snapshots to keep"),
+    backup_destination_id: z.number().optional().describe("Backup destination for snapshots"),
+}, async (args) => {
+    const res = await api("POST", "/admin/database-instances", null, body(args));
+    return { content: text(res) };
+});
+
+server.tool("lattice_update_database_instance", "Update a database instance's configuration. Only the fields you pass are changed", {
+    id: z.number().describe("Database instance ID"),
+    name: z.string().optional(),
+    status: z.string().optional(),
+    port: z.number().optional(),
+    root_password: z.string().optional().describe("New root password"),
+    password: z.string().optional().describe("New application user password"),
+    cpu_limit: z.number().optional(),
+    memory_limit: z.number().optional(),
+    health_status: z.string().optional(),
+    snapshot_schedule: z.string().optional().describe("Cron expression for automatic snapshots"),
+    retention_count: z.number().optional(),
+    backup_destination_id: z.number().optional(),
+    active: z.boolean().optional(),
+}, async ({ id, ...fields }) => {
+    const res = await api("PUT", `/admin/database-instances/${id}`, null, body(fields));
+    return { content: text(res) };
+});
+
+server.tool("lattice_delete_database_instance", "Delete a database instance record. Destructive — data is lost unless a snapshot exists. Check lattice_list_database_snapshots first", {
+    id: z.number().describe("Database instance ID"),
+}, async ({ id }) => {
+    const res = await api("DELETE", `/admin/database-instances/${id}`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_database_action", "Start, stop, restart or remove a database instance's container. 'remove' destroys the container — data survives only if the volume or a snapshot does", {
+    id: z.number().describe("Database instance ID"),
+    action: z.enum(["start", "stop", "restart", "remove"]).describe("Action to perform"),
+}, async ({ id, action }) => {
+    const res = await api("POST", `/admin/database-instances/${id}/${action}`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_get_database_credentials", "Get a database instance's connection credentials. Returns secret values — avoid unless the credentials are actually needed", {
+    id: z.number().describe("Database instance ID"),
+}, async ({ id }) => {
+    const res = await api("GET", `/admin/database-instances/${id}/credentials`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_list_database_snapshots", "List snapshots for a database instance, with size and creation time. Check this before deleting or restoring an instance", {
+    id: z.number().describe("Database instance ID"),
+}, async ({ id }) => {
+    const res = await api("GET", `/admin/database-instances/${id}/snapshots`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_create_database_snapshot", "Take a snapshot of a database instance now, outside its schedule", {
+    id: z.number().describe("Database instance ID"),
+}, async ({ id }) => {
+    const res = await api("POST", `/admin/database-instances/${id}/snapshots`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_restore_database_snapshot", "Restore a database instance from one of its snapshots. Overwrites current data irreversibly — take a fresh snapshot first if the present state matters", {
+    id: z.number().describe("Database instance ID"),
+    snapshot_id: z.number().describe("Snapshot ID to restore from (see lattice_list_database_snapshots)"),
+}, async ({ id, snapshot_id }) => {
+    const res = await api("POST", `/admin/database-instances/${id}/restore`, null, { snapshot_id });
+    return { content: text(res) };
+});
+
+server.tool("lattice_delete_database_snapshot", "Delete a database snapshot. Destructive — that restore point is gone", {
+    snapshot_id: z.number().describe("Snapshot ID"),
+}, async ({ snapshot_id }) => {
+    const res = await api("DELETE", `/admin/database-snapshots/${snapshot_id}`);
+    return { content: text(res) };
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Backup destinations
+// ─────────────────────────────────────────────────────────────────────────────
+
+server.tool("lattice_list_backup_destinations", "List configured backup destinations that database snapshots can be shipped to", {}, async () => {
+    const res = await api("GET", "/admin/backup-destinations");
+    return { content: text(res) };
+});
+
+server.tool("lattice_get_backup_destination", "Get one backup destination's configuration", {
+    id: z.number().describe("Backup destination ID"),
+}, async ({ id }) => {
+    const res = await api("GET", `/admin/backup-destinations/${id}`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_create_backup_destination", "Create a backup destination. config is a free-form object whose shape depends on type (e.g. an S3 destination takes bucket, region, endpoint and credentials)", {
+    name: z.string().describe("Destination name"),
+    type: z.string().describe("Destination type, e.g. 's3'"),
+    config: z.record(z.any()).describe("Type-specific configuration object"),
+}, async (args) => {
+    const res = await api("POST", "/admin/backup-destinations", null, args);
+    return { content: text(res) };
+});
+
+server.tool("lattice_update_backup_destination", "Update a backup destination. Passing config replaces the whole object, it does not merge", {
+    id: z.number().describe("Backup destination ID"),
+    name: z.string().optional(),
+    type: z.string().optional(),
+    config: z.record(z.any()).optional().describe("Replacement configuration object"),
+    active: z.boolean().optional(),
+}, async ({ id, ...fields }) => {
+    const res = await api("PUT", `/admin/backup-destinations/${id}`, null, body(fields));
+    return { content: text(res) };
+});
+
+server.tool("lattice_delete_backup_destination", "Delete a backup destination. Instances pointing at it lose their backup target. Destructive", {
+    id: z.number().describe("Backup destination ID"),
+}, async ({ id }) => {
+    const res = await api("DELETE", `/admin/backup-destinations/${id}`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_test_backup_destination", "Test connectivity and credentials for a backup destination without writing a real backup", {
+    id: z.number().describe("Backup destination ID"),
+    worker_id: z.number().optional().describe("Worker to run the test from"),
+}, async ({ id, worker_id }) => {
+    const res = await api("POST", `/admin/backup-destinations/${id}/test`, { worker_id });
+    return { content: text(res) };
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Registries
+// ─────────────────────────────────────────────────────────────────────────────
+
+server.tool("lattice_list_registries", "List configured container registries", {}, async () => {
+    const res = await api("GET", "/admin/registries");
+    return { content: text(res) };
+});
+
+server.tool("lattice_create_registry", "Add a container registry", {
+    name: z.string().describe("Registry name"),
+    url: z.string().describe("Registry URL, e.g. registry.appleby.cloud"),
+    type: z.string().describe("Registry type, e.g. 'generic', 'dockerhub', 'ghcr'"),
+    username: z.string().optional().describe("Registry username"),
+    password: z.string().optional().describe("Registry password or access token"),
+}, async (args) => {
+    const res = await api("POST", "/admin/registries", null, body(args));
+    return { content: text(res) };
+});
+
+server.tool("lattice_update_registry", "Update a registry's URL, type, credentials or active flag", {
+    id: z.number().describe("Registry ID"),
+    name: z.string().optional(),
+    url: z.string().optional(),
+    type: z.string().optional(),
+    username: z.string().optional(),
+    password: z.string().optional(),
+    active: z.boolean().optional(),
+}, async ({ id, ...fields }) => {
+    const res = await api("PUT", `/admin/registries/${id}`, null, body(fields));
+    return { content: text(res) };
+});
+
+server.tool("lattice_delete_registry", "Delete a registry. Containers pulling from it fail on their next deploy. Destructive", {
+    id: z.number().describe("Registry ID"),
+}, async ({ id }) => {
+    const res = await api("DELETE", `/admin/registries/${id}`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_test_registry", "Test a saved registry's stored credentials", {
+    id: z.number().describe("Registry ID"),
+}, async ({ id }) => {
+    const res = await api("POST", `/admin/registries/${id}/test`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_test_registry_inline", "Test registry credentials before saving them", {
+    url: z.string().describe("Registry URL"),
+    username: z.string().describe("Registry username"),
+    password: z.string().describe("Registry password or access token"),
+}, async (args) => {
+    const res = await api("POST", "/admin/registries/test", null, args);
+    return { content: text(res) };
+});
+
+server.tool("lattice_list_registry_repositories", "List repositories available in a registry — what images exist to deploy", {
+    id: z.number().describe("Registry ID"),
+}, async ({ id }) => {
+    const res = await api("GET", `/admin/registries/${id}/repositories`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_list_registry_tags", "List the tags published for one repository. Use this to answer 'what version can I deploy' or 'is the image my CI just built actually in the registry'", {
+    id: z.number().describe("Registry ID"),
+    repo: z.string().describe("Repository name, e.g. 'openbucket-api'"),
+}, async ({ id, repo }) => {
+    const res = await api("GET", `/admin/registries/${id}/tags`, { repo });
+    return { content: text(res) };
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Discovery & diagnostics
+// ─────────────────────────────────────────────────────────────────────────────
+
+server.tool("lattice_search", "Search across workers, stacks and containers by name in one call. Faster than listing each type and filtering when you only have a partial name", {
+    q: z.string().describe("Search query"),
+    limit: z.number().optional().describe("Max results"),
+}, async ({ q, limit }) => {
+    const res = await api("GET", "/admin/search", { q, limit });
+    return { content: text(res) };
+});
+
+server.tool("lattice_get_anomalies", "Get detected fleet anomalies — restart loops, unhealthy containers, resource spikes, offline workers. The best first call when asked whether anything is wrong", {}, async () => {
+    const res = await api("GET", "/admin/anomalies");
+    return { content: text(res) };
+});
+
+server.tool("lattice_get_fleet_metrics", "Get aggregated fleet-wide CPU, memory, disk and network metrics over a time range", {
+    range: z.string().optional().describe("Time range, e.g. '1h', '6h', '24h'"),
+}, async ({ range }) => {
+    const res = await api("GET", "/admin/fleet-metrics", { range });
+    return { content: text(res) };
+});
+
+server.tool("lattice_get_versions", "Get runner versions across workers and which are outdated. Use before lattice_upgrade_worker to see what actually needs upgrading", {}, async () => {
+    const res = await api("GET", "/admin/versions");
+    return { content: text(res) };
+});
+
+server.tool("lattice_refresh_versions", "Re-poll every worker for its current runner version, refreshing what lattice_get_versions reports", {}, async () => {
+    const res = await api("POST", "/admin/versions/refresh");
+    return { content: text(res) };
+});
+
+server.tool("lattice_get_container_metrics", "Get a single container's CPU, memory and network metrics over time", {
+    id: z.number().describe("Container ID"),
+    limit: z.number().optional().describe("Max data points"),
+    range: z.string().optional().describe("Time range, e.g. '1h', '6h', '24h'"),
+}, async ({ id, limit, range }) => {
+    const res = await api("GET", `/admin/containers/${id}/metrics`, { limit, range });
+    return { content: text(res) };
+});
+
+server.tool("lattice_get_self", "Get the user this API token authenticates as, including role", {}, async () => {
+    const res = await api("GET", "/admin/self");
+    return { content: text(res) };
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Stacks — lifecycle, compose and deploy tokens
+// ─────────────────────────────────────────────────────────────────────────────
+
+server.tool("lattice_create_stack", "Create an empty stack. Add containers with lattice_create_container, or use lattice_import_compose to create one from compose YAML", {
+    name: z.string().describe("Stack name"),
+    description: z.string().optional().describe("Description"),
+    worker_id: z.number().optional().describe("Worker to pin the stack to"),
+    deployment_strategy: z.string().optional().describe("Deployment strategy, e.g. 'rolling', 'recreate'"),
+    auto_deploy: z.boolean().optional().describe("Redeploy automatically when a new image is pushed"),
+    env_vars: z.string().optional().describe("Stack-level env vars as a JSON object string"),
+}, async (args) => {
+    const res = await api("POST", "/admin/stacks", null, body(args));
+    return { content: text(res) };
+});
+
+server.tool("lattice_delete_stack", "Delete a stack and every container in it. Destructive and not recoverable — export it first with lattice_export_stack if you might want it back", {
+    id: z.number().describe("Stack ID"),
+}, async ({ id }) => {
+    const res = await api("DELETE", `/admin/stacks/${id}`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_get_stack_containers", "List the containers belonging to one stack", {
+    id: z.number().describe("Stack ID"),
+}, async ({ id }) => {
+    const res = await api("GET", `/admin/stacks/${id}/containers`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_update_stack_compose", "Replace a stack's compose YAML. This rewrites the stored definition but does not deploy — call lattice_deploy_stack afterwards", {
+    id: z.number().describe("Stack ID"),
+    compose_yaml: z.string().describe("Full compose YAML document"),
+}, async ({ id, compose_yaml }) => {
+    const res = await api("PUT", `/admin/stacks/${id}/compose`, null, { compose_yaml });
+    return { content: text(res) };
+});
+
+server.tool("lattice_sync_stack_compose", "Reconcile a stack's container records against its stored compose YAML, reporting which containers changed and why", {
+    id: z.number().describe("Stack ID"),
+}, async ({ id }) => {
+    const res = await api("POST", `/admin/stacks/${id}/sync-compose`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_import_compose", "Create a new stack from a docker-compose YAML document", {
+    name: z.string().describe("Stack name"),
+    compose_yaml: z.string().describe("Full compose YAML document"),
+    description: z.string().optional().describe("Description"),
+    worker_id: z.number().optional().describe("Worker to pin the stack to"),
+    deployment_strategy: z.string().optional().describe("Deployment strategy"),
+}, async (args) => {
+    const res = await api("POST", "/admin/stacks/import", null, body(args));
+    return { content: text(res) };
+});
+
+server.tool("lattice_export_stack", "Export a stack's full definition — stack settings plus every container config — as a portable JSON document. Take one before any destructive stack change", {
+    id: z.number().describe("Stack ID"),
+}, async ({ id }) => {
+    const res = await api("GET", `/admin/stacks/${id}/export`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_import_stack_export", "Recreate a stack from a document produced by lattice_export_stack", {
+    version: z.string().describe("Export format version, from the exported document"),
+    stack: z.record(z.any()).describe("Stack object from the exported document"),
+    containers: z.array(z.record(z.any())).describe("Container array from the exported document"),
+}, async (args) => {
+    const res = await api("POST", "/admin/stacks/import-export", null, args);
+    return { content: text(res) };
+});
+
+server.tool("lattice_save_stack_as_template", "Save an existing stack's configuration as a reusable template", {
+    id: z.number().describe("Stack ID to snapshot"),
+    name: z.string().describe("Template name"),
+    description: z.string().optional().describe("Description"),
+}, async ({ id, name, description }) => {
+    const res = await api("POST", `/admin/stacks/${id}/save-template`, null, body({ name, description }));
+    return { content: text(res) };
+});
+
+server.tool("lattice_list_deploy_tokens", "List a stack's deploy tokens — the credentials CI uses to trigger deployments. Token values are never returned; last_used_at reveals whether CI is actually reaching Lattice", {
+    id: z.number().describe("Stack ID"),
+}, async ({ id }) => {
+    const res = await api("GET", `/admin/stacks/${id}/deploy-tokens`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_create_deploy_token", "Create a deploy token for a stack. The plaintext is returned once; use it as https://<lattice>/api/deploy/<token>?container=<name>", {
+    id: z.number().describe("Stack ID"),
+    name: z.string().describe("Token name, e.g. 'github-actions'"),
+}, async ({ id, name }) => {
+    const res = await api("POST", `/admin/stacks/${id}/deploy-tokens`, null, { name });
+    return { content: text(res) };
+});
+
+server.tool("lattice_delete_deploy_token", "Delete a deploy token. Any CI pipeline using it stops being able to deploy. Destructive", {
+    token_id: z.number().describe("Deploy token ID"),
+}, async ({ token_id }) => {
+    const res = await api("DELETE", `/admin/deploy-tokens/${token_id}`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_approve_deployment", "Approve a deployment that is waiting on manual approval", {
+    id: z.number().describe("Deployment ID"),
+}, async ({ id }) => {
+    const res = await api("POST", `/admin/deployments/${id}/approve`);
+    return { content: text(res) };
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Containers — definition CRUD
+// ─────────────────────────────────────────────────────────────────────────────
+
+server.tool("lattice_create_container", "Add a container definition to a stack. Creates the record only — deploy the stack to actually start it. JSON-shaped fields are passed as strings, matching the API", {
+    stack_id: z.number().describe("Stack to add the container to"),
+    name: z.string().describe("Container name"),
+    image: z.string().describe("Image, e.g. registry.appleby.cloud/openbucket-api"),
+    tag: z.string().describe("Image tag, e.g. 'latest'"),
+    port_mappings: z.string().optional().describe("JSON array string, e.g. '[{\"container_port\":\"8000\",\"host_port\":\"8080\",\"protocol\":\"tcp\"}]'"),
+    env_vars: z.string().optional().describe("JSON object string of environment variables"),
+    volumes: z.string().optional().describe("JSON object string of host:container volume mappings"),
+    cpu_limit: z.number().optional().describe("CPU limit in cores"),
+    memory_limit: z.number().optional().describe("Memory limit in bytes"),
+    replicas: z.number().optional().describe("Replica count"),
+    restart_policy: z.string().optional().describe("e.g. 'unless-stopped', 'always'"),
+    command: z.string().optional().describe("Override the image command"),
+    entrypoint: z.string().optional().describe("Override the image entrypoint"),
+    health_check: z.string().optional().describe("JSON object string describing the healthcheck"),
+}, async ({ stack_id, ...fields }) => {
+    const res = await api("POST", `/admin/stacks/${stack_id}/containers`, null, body(fields));
+    return { content: text(res) };
+});
+
+server.tool("lattice_update_container", "Update a container definition. Changes the stored record — redeploy or recreate the container for them to take effect", {
+    id: z.number().describe("Container ID"),
+    name: z.string().optional(),
+    image: z.string().optional(),
+    tag: z.string().optional(),
+    status: z.string().optional(),
+    port_mappings: z.string().optional().describe("JSON array string"),
+    env_vars: z.string().optional().describe("JSON object string"),
+    volumes: z.string().optional().describe("JSON object string"),
+    cpu_limit: z.number().optional(),
+    memory_limit: z.number().optional(),
+    replicas: z.number().optional(),
+    restart_policy: z.string().optional(),
+    command: z.string().optional(),
+    entrypoint: z.string().optional(),
+}, async ({ id, ...fields }) => {
+    const res = await api("PUT", `/admin/containers/${id}`, null, body(fields));
+    return { content: text(res) };
+});
+
+server.tool("lattice_delete_container", "Delete a container definition and its running container. Destructive — lattice_stop_container only stops it", {
+    id: z.number().describe("Container ID"),
+}, async ({ id }) => {
+    const res = await api("DELETE", `/admin/containers/${id}`);
+    return { content: text(res) };
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Workers — registration, tokens, volumes, networks
+// ─────────────────────────────────────────────────────────────────────────────
+
+server.tool("lattice_create_worker", "Register a worker. The machine still needs the runner installed and a worker token before it connects", {
+    name: z.string().describe("Worker name"),
+    hostname: z.string().describe("Hostname"),
+    ip_address: z.string().optional().describe("IP address"),
+    labels: z.string().optional().describe("JSON object string of labels used by placement constraints"),
+}, async (args) => {
+    const res = await api("POST", "/admin/workers", null, body(args));
+    return { content: text(res) };
+});
+
+server.tool("lattice_update_worker", "Update a worker's name, hostname, IP, status, labels or active flag", {
+    id: z.number().describe("Worker ID"),
+    name: z.string().optional(),
+    hostname: z.string().optional(),
+    ip_address: z.string().optional(),
+    status: z.string().optional(),
+    labels: z.string().optional().describe("JSON object string of labels"),
+    active: z.boolean().optional(),
+}, async ({ id, ...fields }) => {
+    const res = await api("PUT", `/admin/workers/${id}`, null, body(fields));
+    return { content: text(res) };
+});
+
+server.tool("lattice_delete_worker", "Delete a worker. Every stack pinned to it becomes undeployable. Destructive", {
+    id: z.number().describe("Worker ID"),
+}, async ({ id }) => {
+    const res = await api("DELETE", `/admin/workers/${id}`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_get_worker_container_stats", "Get live per-container resource stats from one worker", {
+    id: z.number().describe("Worker ID"),
+}, async ({ id }) => {
+    const res = await api("GET", `/admin/workers/${id}/container-stats`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_list_worker_tokens", "List a worker's registration tokens. Values are never returned", {
+    id: z.number().describe("Worker ID"),
+}, async ({ id }) => {
+    const res = await api("GET", `/admin/workers/${id}/tokens`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_create_worker_token", "Create a registration token for a worker, used by the runner to connect. Plaintext is returned once", {
+    id: z.number().describe("Worker ID"),
+    name: z.string().describe("Token name"),
+}, async ({ id, name }) => {
+    const res = await api("POST", `/admin/workers/${id}/tokens`, null, { name });
+    return { content: text(res) };
+});
+
+server.tool("lattice_delete_worker_token", "Delete a worker token. If the runner is using it, it cannot reconnect after a restart. Destructive", {
+    token_id: z.number().describe("Worker token ID"),
+}, async ({ token_id }) => {
+    const res = await api("DELETE", `/admin/worker-tokens/${token_id}`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_list_worker_volumes", "List Docker volumes on a worker", {
+    id: z.number().describe("Worker ID"),
+}, async ({ id }) => {
+    const res = await api("GET", `/admin/workers/${id}/volumes`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_create_worker_volume", "Create a Docker volume on a worker", {
+    id: z.number().describe("Worker ID"),
+    name: z.string().describe("Volume name"),
+    driver: z.string().optional().describe("Volume driver (defaults to 'local')"),
+}, async ({ id, name, driver }) => {
+    const res = await api("POST", `/admin/workers/${id}/volumes`, null, body({ name, driver }));
+    return { content: text(res) };
+});
+
+server.tool("lattice_delete_worker_volume", "Delete a Docker volume on a worker. Any data stored in it is destroyed. Destructive", {
+    id: z.number().describe("Worker ID"),
+    name: z.string().describe("Volume name"),
+}, async ({ id, name }) => {
+    const res = await api("DELETE", `/admin/workers/${id}/volumes/${encodeURIComponent(name)}`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_list_worker_networks", "List Docker networks on a worker", {
+    id: z.number().describe("Worker ID"),
+}, async ({ id }) => {
+    const res = await api("GET", `/admin/workers/${id}/networks`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_create_worker_network", "Create a Docker network on a worker", {
+    id: z.number().describe("Worker ID"),
+    name: z.string().describe("Network name"),
+    driver: z.string().optional().describe("Network driver (defaults to 'bridge')"),
+}, async ({ id, name, driver }) => {
+    const res = await api("POST", `/admin/workers/${id}/networks`, null, body({ name, driver }));
+    return { content: text(res) };
+});
+
+server.tool("lattice_delete_worker_network", "Delete a Docker network on a worker. Containers attached to it lose connectivity. Destructive", {
+    id: z.number().describe("Worker ID"),
+    name: z.string().describe("Network name"),
+}, async ({ id, name }) => {
+    const res = await api("DELETE", `/admin/workers/${id}/networks/${encodeURIComponent(name)}`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_list_all_networks", "List every tracked Docker network across the fleet", {}, async () => {
+    const res = await api("GET", "/admin/networks");
+    return { content: text(res) };
+});
+
+server.tool("lattice_delete_network", "Delete a tracked network by its Lattice ID. Destructive", {
+    id: z.number().describe("Network ID"),
+}, async ({ id }) => {
+    const res = await api("DELETE", `/admin/networks/${id}`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_force_remove_container", "Force-remove a container on a worker by name, bypassing the normal lifecycle. For clearing a wedged container that ordinary remove will not shift. Destructive", {
+    id: z.number().describe("Worker ID"),
+    name: z.string().describe("Container name to force-remove"),
+}, async ({ id, name }) => {
+    const res = await api("POST", `/admin/workers/${id}/force-remove`, { name });
+    return { content: text(res) };
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Global env vars, templates, webhooks
+// ─────────────────────────────────────────────────────────────────────────────
+
+server.tool("lattice_list_env_vars", "List global environment variables available for interpolation into stack and container configs as ${NAME}. Values marked is_secret are masked", {}, async () => {
+    const res = await api("GET", "/admin/env-vars");
+    return { content: text(res) };
+});
+
+server.tool("lattice_create_env_var", "Create a global environment variable", {
+    key: z.string().describe("Variable name, referenced as ${KEY}"),
+    value: z.string().describe("Value"),
+    is_secret: z.boolean().optional().describe("Mask the value in listings"),
+}, async (args) => {
+    const res = await api("POST", "/admin/env-vars", null, body(args));
+    return { content: text(res) };
+});
+
+server.tool("lattice_update_env_var", "Update a global environment variable's value or secret flag. Containers pick it up on their next deploy", {
+    id: z.number().describe("Env var ID"),
+    value: z.string().optional().describe("New value"),
+    is_secret: z.boolean().optional().describe("Mask the value in listings"),
+}, async ({ id, ...fields }) => {
+    const res = await api("PUT", `/admin/env-vars/${id}`, null, body(fields));
+    return { content: text(res) };
+});
+
+server.tool("lattice_delete_env_var", "Delete a global environment variable. Any config referencing ${KEY} fails to interpolate on next deploy. Destructive", {
+    id: z.number().describe("Env var ID"),
+}, async ({ id }) => {
+    const res = await api("DELETE", `/admin/env-vars/${id}`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_list_templates", "List saved stack templates", {}, async () => {
+    const res = await api("GET", "/admin/templates");
+    return { content: text(res) };
+});
+
+server.tool("lattice_create_template", "Create a stack template from a config document", {
+    name: z.string().describe("Template name"),
+    config: z.string().describe("Template configuration as a JSON string"),
+    description: z.string().optional().describe("Description"),
+}, async (args) => {
+    const res = await api("POST", "/admin/templates", null, body(args));
+    return { content: text(res) };
+});
+
+server.tool("lattice_delete_template", "Delete a stack template. Destructive", {
+    id: z.number().describe("Template ID"),
+}, async ({ id }) => {
+    const res = await api("DELETE", `/admin/templates/${id}`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_list_webhooks", "List outbound webhooks that fire on fleet events", {}, async () => {
+    const res = await api("GET", "/admin/webhooks");
+    return { content: text(res) };
+});
+
+server.tool("lattice_create_webhook", "Create an outbound webhook. events is a JSON array string, e.g. '[\"container.status\"]' or '[\"*\"]' for everything", {
+    name: z.string().describe("Webhook name"),
+    url: z.string().describe("Destination URL"),
+    events: z.string().describe("JSON array string of event types, or '[\"*\"]' for all"),
+    secret: z.string().optional().describe("Shared secret used to sign deliveries"),
+}, async (args) => {
+    const res = await api("POST", "/admin/webhooks", null, body(args));
+    return { content: text(res) };
+});
+
+server.tool("lattice_update_webhook", "Update a webhook's URL, event list, secret or active flag", {
+    id: z.number().describe("Webhook ID"),
+    name: z.string().optional(),
+    url: z.string().optional(),
+    events: z.string().optional().describe("JSON array string of event types"),
+    secret: z.string().optional(),
+    active: z.boolean().optional(),
+}, async ({ id, ...fields }) => {
+    const res = await api("PUT", `/admin/webhooks/${id}`, null, body(fields));
+    return { content: text(res) };
+});
+
+server.tool("lattice_delete_webhook", "Delete a webhook. Destructive", {
+    id: z.number().describe("Webhook ID"),
+}, async ({ id }) => {
+    const res = await api("DELETE", `/admin/webhooks/${id}`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_test_webhook", "Send a test payload to a webhook to verify the endpoint accepts it", {
+    id: z.number().describe("Webhook ID"),
+}, async ({ id }) => {
+    const res = await api("POST", `/admin/webhooks/${id}/test`);
+    return { content: text(res) };
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Users & instance configuration
+// ─────────────────────────────────────────────────────────────────────────────
+
+server.tool("lattice_list_users", "List Lattice users with roles and status", {}, async () => {
+    const res = await api("GET", "/admin/users");
+    return { content: text(res) };
+});
+
+server.tool("lattice_create_user", "Create a local Lattice user", {
+    email: z.string().describe("Email address"),
+    password: z.string().describe("Initial password"),
+    role: z.string().describe("Role, e.g. 'admin', 'editor', 'viewer'"),
+    name: z.string().optional().describe("Display name"),
+}, async (args) => {
+    const res = await api("POST", "/admin/users", null, body(args));
+    return { content: text(res) };
+});
+
+server.tool("lattice_update_user", "Update a user's name, role or active flag. Setting active=false blocks their access immediately", {
+    id: z.number().describe("User ID"),
+    name: z.string().optional(),
+    role: z.string().optional(),
+    active: z.boolean().optional(),
+}, async ({ id, ...fields }) => {
+    const res = await api("PUT", `/admin/users/${id}`, null, body(fields));
+    return { content: text(res) };
+});
+
+server.tool("lattice_delete_user", "Delete a Lattice user. Destructive", {
+    id: z.number().describe("User ID"),
+}, async ({ id }) => {
+    const res = await api("DELETE", `/admin/users/${id}`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_get_sso_config", "Get the Forta SSO configuration", {}, async () => {
+    const res = await api("GET", "/admin/sso-config");
+    return { content: text(res) };
+});
+
+server.tool("lattice_update_sso_config", "Update the SSO configuration. Misconfiguring this can lock every SSO user out of Lattice — verify local admin access first", {
+    enabled: z.boolean().optional(),
+    client_id: z.string().optional(),
+    client_secret: z.string().optional(),
+    authorize_url: z.string().optional(),
+    token_url: z.string().optional(),
+    userinfo_url: z.string().optional(),
+    redirect_url: z.string().optional(),
+    logout_url: z.string().optional(),
+    scopes: z.string().optional(),
+    user_identifier: z.string().optional().describe("Claim used to identify the user, e.g. 'email' or 'sub'"),
+    button_label: z.string().optional(),
+    auto_provision: z.boolean().optional().describe("Create a local user on first SSO login"),
+    post_login_url: z.string().optional(),
+}, async (args) => {
+    const res = await api("PUT", "/admin/sso-config", null, body(args));
+    return { content: text(res) };
+});
+
+server.tool("lattice_get_smtp_config", "Get the SMTP configuration used for alert emails", {}, async () => {
+    const res = await api("GET", "/admin/smtp-config");
+    return { content: text(res) };
+});
+
+server.tool("lattice_update_smtp_config", "Update the SMTP configuration", {
+    enabled: z.boolean().optional(),
+    host: z.string().optional(),
+    port: z.string().optional().describe("Port as a string, matching the API"),
+    username: z.string().optional(),
+    password: z.string().optional(),
+    from_email: z.string().optional(),
+    from_name: z.string().optional(),
+    recipients: z.string().optional().describe("Comma-separated recipient list"),
+}, async (args) => {
+    const res = await api("PUT", "/admin/smtp-config", null, body(args));
+    return { content: text(res) };
+});
+
+server.tool("lattice_test_smtp", "Send a test email using the saved SMTP configuration", {}, async () => {
+    const res = await api("POST", "/admin/smtp-config/test");
+    return { content: text(res) };
+});
+
+server.tool("lattice_get_notification_prefs", "Get per-event notification preferences", {}, async () => {
+    const res = await api("GET", "/admin/notification-prefs");
+    return { content: text(res) };
+});
+
+server.tool("lattice_update_notification_prefs", "Update notification preferences. Merges into existing prefs; unknown event types are ignored rather than rejected, so verify with lattice_get_notification_prefs afterwards", {
+    preferences: z.record(z.any()).describe("Object keyed by event type, e.g. {\"container.status\":{\"email\":true}}"),
+}, async ({ preferences }) => {
+    const res = await api("PUT", "/admin/notification-prefs", null, preferences);
+    return { content: text(res) };
+});
+
 // --- Start ---
 
 const transport = new StdioServerTransport();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lattice-mcp",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "MCP server for Lattice container orchestration platform",
   "type": "module",
   "main": "index.js",