lattice-mcp 1.2.0 → 1.4.0

package/AGENTS.md

@@ -227,6 +227,42 @@ kind this repo's rules warn about:
 the API allocates a free port from 20000-29999 and returns 409 naming the conflict if you pin one
 that is taken.
 
+**1.3.0** masks secrets in every response. No tool count change (133).
+
+`api()` now passes every decoded response through `sanitise()` before returning it — see
+*Sensitive value masking* under *How code is written here* for the rules. This closes a real leak
+rather than a theoretical one: this MCP authenticates as a Lattice **admin**, and `lattice-api`
+only masks global env vars server-side for *non-admin* callers
+(`HandleGlobalEnvVars.router.go:39`), so `lattice_list_env_vars` was returning every `is_secret`
+value in plaintext — while its own description claimed they were masked. Container and stack
+`env_vars`, `compose_yaml` environment blocks, database passwords and freshly minted
+deploy/worker/API tokens were all reaching the transcript verbatim too.
+
+Masked values keep their **first two characters** and get a fixed-width tail
+(`"supersecret"` → `"su**********"`), so they stay comparable without staying usable. Set
+`LATTICE_ALLOW_SECRET_VALUES=1` to opt out.
+
+Three tool descriptions changed to match reality: `lattice_list_env_vars` (which was lying),
+`lattice_reveal_database_credentials`, `lattice_create_deploy_token` and
+`lattice_create_worker_token` now each say the value comes back masked and where to get the real
+one. `verify.mjs` gained a tripwire asserting `sanitise()` is still wired into `api()` and still
+defaults to on — unwiring that single call is a silent, total regression that no other check
+would notice.
+
+**1.4.0** exposes parameters added to `lattice-api` alongside the managed-database overhaul. No
+tool-count change.
+
+`lattice_create_database_instance` gains `adopt_existing_volume`. It is off by default because a
+reused data volume makes the engine skip initialisation and keep its previous credentials while the
+API records freshly generated ones — the container reports healthy and nothing looks wrong until a
+connection fails.
+
+`lattice_update_api` and `lattice_update_web` gain `version` and `force`. The compose file
+interpolates the image tag from an env var, so passing `version` writes it to the compose env file
+and deploys or rolls back that tag in one call, persisting across restarts. Requesting a version
+when the compose file does not interpolate the variable returns a 400 rather than silently
+deploying the old image.
+
 **Consolidations.** Where `lattice-api` exposes several paths served by one handler, this repo
 exposes one tool with an enum rather than N tools. `lattice_database_action` covers
 `/start`, `/stop`, `/restart` and `/remove`. Worker actions are the historical exception — they

package/index.js

@@ -221,7 +221,7 @@ function body(obj) {
 
 const server = new McpServer({
     name: "lattice",
-    version: "1.2.0",
+    version: "1.4.0",
 });
 
 // Overview
@@ -497,13 +497,19 @@ server.tool("lattice_start_all_worker", "Start all containers on a worker", {
 });
 
 // Dashboard controls
-server.tool("lattice_update_api", "Trigger Lattice API self-update", {}, async () => {
-    const res = await api("POST", "/admin/update/api");
+server.tool("lattice_update_api", "Update the Lattice API container. Pass `version` to deploy or roll back to a specific tag; omit it to take whatever the compose file resolves to. Returns 'already up to date' without restarting when the resolved image is the one already running", {
+    version: z.string().optional().describe("Image tag to deploy, e.g. v1.3.21. Written to the compose env file, so it persists across restarts. Omit to follow the existing tag"),
+    force: z.boolean().optional().describe("Recreate even when the image is unchanged — use after an environment-variable change"),
+}, async ({ version, force }) => {
+    const res = await api("POST", "/admin/update/api", force ? { force: "true" } : null, body({ version }));
     return { content: text(res) };
 });
 
-server.tool("lattice_update_web", "Trigger Lattice web container update", {}, async () => {
-    const res = await api("POST", "/admin/update/web");
+server.tool("lattice_update_web", "Update the Lattice web container. Pass `version` to deploy or roll back to a specific tag; omit it to take whatever the compose file resolves to", {
+    version: z.string().optional().describe("Image tag to deploy, e.g. v1.3.25. Written to the compose env file, so it persists across restarts. Omit to follow the existing tag"),
+    force: z.boolean().optional().describe("Recreate even when the image is unchanged"),
+}, async ({ version, force }) => {
+    const res = await api("POST", "/admin/update/web", force ? { force: "true" } : null, body({ version }));
     return { content: text(res) };
 });
 
@@ -575,6 +581,7 @@ server.tool("lattice_create_database_instance", "Provision a database instance o
     snapshot_schedule: z.string().optional().describe("Cron expression for automatic snapshots"),
     retention_count: z.number().optional().describe("How many automatic snapshots to keep"),
     backup_destination_id: z.number().optional().describe("Backup destination for snapshots"),
+    adopt_existing_volume: z.boolean().optional().describe("Reuse a leftover data volume of the same name. Off by default — the engine skips initialisation when its data directory is non-empty, so it keeps its OLD credentials while the API records the new ones, and nothing looks wrong until a connection fails"),
 }, async (args) => {
     const res = await api("POST", "/admin/database-instances", null, body(args));
     return { content: text(res) };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lattice-mcp",
-  "version": "1.2.0",
+  "version": "1.4.0",
   "description": "MCP server for Lattice container orchestration platform",
   "type": "module",
   "main": "index.js",