lattice-mcp 1.4.0 → 1.6.0

package/AGENTS.md

@@ -2,8 +2,9 @@
 
 > `lattice-mcp` is the **Model Context Protocol server for Lattice**, the container
 > orchestration platform that runs every `appleby.cloud` service. It exposes the
-> `lattice-api` admin surface to Claude Code as **133 typed tools** — workers, stacks,
-> containers, deployments, databases, registries, networks, volumes and instance config.
+> `lattice-api` admin surface to Claude Code as **146 typed tools** — workers, stacks,
+> containers, deployments, databases, automations, registries, networks, volumes and instance
+> config.
 > This file orients any agent/worker before touching code in this repo.
 >
 > **⚠️ Golden rule — keep this file current:** any change that adds, removes or retypes a
@@ -42,7 +43,8 @@ Those live in [`lattice-api`](https://github.com/aidenappl/lattice-api) and
 
 | Path | Role |
 |------|------|
-| `index.js` | Everything: `--setup` flow, config read, `api()` HTTP helper, `text()`/`body()` helpers, all 133 `server.tool(...)` registrations, transport connect. |
+| `index.js` | Everything: `--setup` flow, config read, `api()` HTTP helper, `text()`/`body()` helpers, all 146 `server.tool(...)` registrations, transport connect. |
+| `verify.mjs` | `npm test` — static checks: syntax, duplicate tool names, doc counts, version consistency, `sanitise()` wiring. |
 | `package.json` | npm metadata. `bin.lattice-mcp` → `index.js`, so `npx lattice-mcp` works. |
 | `README.md` | User-facing setup + full tool table. |
 | `AGENTS.md` | This file. |
@@ -131,7 +133,8 @@ Four rules, in the order `sanitise()` applies them:
 | `env_vars` | Parsed as JSON, then values whose **key** matches `isSecretName()` are masked. The blob is not masked wholesale — variable names are the useful half. An unparseable blob *is* masked wholesale rather than passed through. |
 | `compose_yaml` | Assignment lines (`- NAME=value` and `NAME: value`) whose name matches `isSecretName()` are masked, without tracking YAML block structure. |
 | `value` when the sibling `is_secret` is `true` | Masked. Global env vars are only secret when flagged, and masking the rest would hide image tags, ports and hostnames. |
-| anything in `SECRET_FIELDS` | Masked at any nesting depth, in objects and arrays alike. |
+| `config` of an object whose `type` is `http_request` | An automation step's outbound request. Header values are masked unless the header is `Content-Type`/`Accept`/`User-Agent`, the body is masked, and the URL keeps its origin with the path masked — Slack/Discord-style hooks carry the secret in the path. Method, host and header names stay readable. |
+| anything in `SECRET_FIELDS` | Masked at any nesting depth, in objects and arrays alike. Includes `webhook_token` and `webhook_path` (the path embeds the automation's token). |
 
 `isSecretName()` matches password/secret/token/key/credential/dsn shapes but **excludes names
 ending in `_url`, `_uri`, `_endpoint`, `_host`, `_port`, `_issuer`** — `TOKEN_URL` and
@@ -160,9 +163,11 @@ exits immediately if either is missing. In practice these come from the `env` bl
 
 **Tool groups**, in file order:
 
-The counts below sum to **133**, matching the header and `grep -c 'server.tool(' index.js`. The
-first rows are the original, pre-`1.1.0` tools (registered top-of-file with no banner comment);
-every bolded row corresponds to a `// ───` banner group and matches its exact in-file name.
+The header figure is the authoritative count — `npm test` checks it against
+`grep -c 'server.tool(' index.js`. The per-group counts below are descriptive and had already
+drifted from it before 1.6.0 (they summed to 138 against 136 registrations); don't trust their
+sum. The first rows are the original, pre-`1.1.0` tools (registered top-of-file with no banner
+comment); every bolded row corresponds to a `// ───` banner group and matches its exact in-file name.
 
 | Group | Tools | Notes |
 |-------|-------|-------|
@@ -173,12 +178,13 @@ every bolded row corresponds to a `// ───` banner group and matches its ex
 | Deployments | 4 | list/get/logs, rollback. (`lattice_approve_deployment` is *not* here — it lives under **Stacks — lifecycle, compose & deploy tokens**.) |
 | Instance self-update | 2 | `lattice_update_api`, `lattice_update_web` — tell the API/web container to pull its latest image and redeploy itself |
 | Audit & API tokens | 4 | `lattice_get_audit_log`; API token list/create/delete |
-| **Database instances** | **19** | CRUD, `lattice_database_action` (start/stop/restart/remove enum), `lattice_get_database_connection`, `lattice_reveal_database_credentials`, `lattice_get_database_credentials` (deprecated), `lattice_get_database_events`, `lattice_get_database_logs`, `lattice_get_database_lifecycle_logs`, `lattice_open_database_console`, snapshot list/create/restore/delete |
+| **Database instances** | **22** | CRUD, `lattice_database_action` (start/stop/restart/remove enum), `lattice_get_database_connection`, `lattice_reveal_database_credentials`, `lattice_get_database_credentials` (deprecated), `lattice_get_database_events`, `lattice_get_database_logs`, `lattice_get_database_lifecycle_logs`, `lattice_get_database_metrics`, `lattice_get_database_runs`, `lattice_get_database_backup_posture`, `lattice_open_database_console`, snapshot list/create/restore/delete |
 | **Worker port allocation** | **1** | `lattice_get_worker_port_availability` — claimed host ports on a worker plus a free suggestion |
 | **Backup destinations** | **6** | list/get/create/update/delete + `lattice_test_backup_destination` |
 | **Registries** | **8** | list/create/update/delete, `lattice_test_registry`, `lattice_test_registry_inline`, `lattice_list_registry_repositories`, `lattice_list_registry_tags` |
 | **Discovery & diagnostics** | **7** | `lattice_search`, `lattice_get_anomalies`, `lattice_get_fleet_metrics`, `lattice_get_versions`, `lattice_refresh_versions`, `lattice_get_container_metrics`, `lattice_get_self` |
 | **Stacks — lifecycle, compose & deploy tokens** | **13** | create/delete, `lattice_get_stack_containers`, compose update/sync/import, export/import, `lattice_save_stack_as_template`, deploy-token list/create/delete, `lattice_approve_deployment` |
+| **Automations** | **10** | list/get/create/update/delete, enable, disable, `lattice_run_automation` (65 s client timeout — a run's budget is 50 s), `lattice_rotate_automation_token`, `lattice_list_automation_runs`. `actions` is a typed `z.discriminatedUnion` on `type`, mirroring the API's config shapes |
 | **Containers — definition CRUD** | **3** | `lattice_create_container`, `lattice_update_container`, `lattice_delete_container` |
 | **Workers — registration, tokens, volumes, networks** | **16** | worker create/update/delete, `lattice_get_worker_container_stats`, worker-token ×3, volume ×3, worker-network ×3, `lattice_list_all_networks`, `lattice_delete_network`, `lattice_force_remove_container` |
 | **Global env vars, templates, webhooks** | **12** | env-var CRUD (4), template list/create/delete (3), webhook list/create/update/delete/test (5) |
@@ -249,6 +255,52 @@ one. `verify.mjs` gained a tripwire asserting `sanitise()` is still wired into `
 defaults to on — unwiring that single call is a silent, total regression that no other check
 would notice.
 
+**1.5.0** exposes the durability work that landed in `lattice-api` v1.3.27–v1.3.30. Three new
+tools, 133 → 136.
+
+`lattice_get_database_metrics` reads CPU/memory samples addressed by instance. Those samples were
+always collected but had no read path: a managed database has no row in the `containers` table, and
+every other metrics reader takes a container id.
+
+`lattice_get_database_runs` answers "did the backup run?", which the snapshot list cannot. Scheduling
+moved into the control plane, so every slot leaves a row whether or not it produced a snapshot — an
+absent snapshot is a mystery, while a skipped run states its reason. This is not a hypothetical
+convenience: the first production run of the new scheduler skipped four consecutive slots, and the
+diagnosis came from these rows rather than from reading code.
+
+`lattice_get_database_backup_posture` scores a database against 3-2-1 and is deliberately
+conservative — an unconfirmed destination locality is never counted as off-site, because Lattice
+cannot tell a bucket on the worker being backed up from one in another country.
+
+Parameters added: `locality` on backup destinations, `mirror_backup_destination_id` and
+`deletion_protection` on database update, `final_snapshot` on delete. The delete tool's `force`
+description now also states what force does *not* do — it does not override deletion protection.
+
+**1.6.0** mirrors `lattice-api` automations (`/admin/automations*`). Ten new tools, 136 → 146.
+Unpublished at the time of writing — lattice-api's automation routes must be deployed first, or
+every one of these tools 404s.
+
+An automation is one trigger (webhook or UTC cron) plus ordered steps (`redeploy_container`,
+`http_request`). It exists because a deploy token reaches exactly one stack: monitor-core's CI
+redeployed one zone through `?container=` and the second zone silently fell a release and eight
+migrations behind. Request shapes were taken from `routers/HandleAutomations.router.go`, not from
+the structs, and every tool was exercised against a locally running `lattice-api` before
+release. Three things an agent must know, all stated in the descriptions:
+
+- **An automation created here runs as this server's token owner**, and every step is authorised
+  against that user each time it runs. Redefining (trigger/actions) or enabling re-binds the
+  run-as identity to the caller; renaming does not.
+- **`redeploy_container` names a container by `stack_id` + `container_name`**, never an id — a
+  compose edit re-creates container ids.
+- **`lattice_run_automation` is synchronous** and performs the real actions. It is the one tool
+  that raises `api()`'s timeout (to 65 s), because the API allows a run 50 s and aborting early
+  would report a failure for a run still going. `api()` gained an optional fifth `timeoutMs`
+  argument for this; the default is unchanged.
+
+Masking was extended in the same change, because the new responses would otherwise have leaked:
+`webhook_token` and `webhook_path` joined `SECRET_FIELDS`, and `http_request` step configs get a
+dedicated rule (see *Sensitive value masking*).
+
 **1.4.0** exposes parameters added to `lattice-api` alongside the managed-database overhaul. No
 tool-count change.
 
@@ -268,6 +320,13 @@ exposes one tool with an enum rather than N tools. `lattice_database_action` cov
 `/start`, `/stop`, `/restart` and `/remove`. Worker actions are the historical exception — they
 predate this convention and remain separate tools.
 
+**`remove` and delete are not the same operation, and the tool descriptions have to say so.**
+`lattice_database_action("remove")` destroys a database's container and **keeps** its data volume;
+`lattice_delete_database_instance` destroys the volume too and is irreversible except via snapshots.
+The latter is asynchronous — the instance sits in `deleting` until the worker confirms — and returns
+**409** when the worker is offline, which `force: true` overrides at the price of abandoning the
+container and volume on disk.
+
 ## Ecosystem & related repos
 
 | Repo | Relationship |

package/README.md

@@ -8,7 +8,7 @@ Model Context Protocol server for [Lattice](https://github.com/aidenappl/lattice
 
 ## Overview
 
-`lattice-mcp` is a single-file Node ESM program (`index.js`) that speaks MCP over stdio and translates tool calls into HTTP requests against the `lattice-api` admin surface. It exposes **133 typed tools** and holds no business logic, caching or state of its own — every behaviour (pagination, validation, side effects) comes from `lattice-api`.
+`lattice-mcp` is a single-file Node ESM program (`index.js`) that speaks MCP over stdio and translates tool calls into HTTP requests against the `lattice-api` admin surface. It exposes **146 typed tools** and holds no business logic, caching or state of its own — every behaviour (pagination, validation, side effects) comes from `lattice-api`.
 
 Once configured, ask Claude Code things like:
 
@@ -17,6 +17,8 @@ Once configured, ask Claude Code things like:
 - "Which containers are unhealthy?" (`lattice_get_anomalies` is the best first call)
 - "Deploy stack 5" / "Rollback the last deployment on stack 12"
 - "What image tags can I deploy from the registry?"
+- "Create an automation that redeploys monitor-core in both zones from one webhook"
+- "Why didn't the nightly automation run?" (`lattice_list_automation_runs` — skipped firings say why)
 
 ## Role in the appleby.cloud ecosystem
 
@@ -87,9 +89,11 @@ something, and not enough to use. The tail is a fixed width so the mask does not
 length.
 
 This covers container and stack `env_vars`, `compose_yaml` environment blocks, global env vars
-flagged `is_secret`, database passwords, and freshly minted deploy/worker/API tokens. Variable
-*names* are left readable — they are the useful half — as are addresses like `TOKEN_URL` and
-`AUTH_URL`.
+flagged `is_secret`, database passwords, freshly minted deploy/worker/API tokens, automation
+webhook tokens (`webhook_token` and the `webhook_path` that embeds it), and automation
+`http_request` steps — header values, the body, and the URL path, where Slack/Discord-style hooks
+keep their secret. Variable and header *names* are left readable — they are the useful half — as
+are the URL's host and addresses like `TOKEN_URL` and `AUTH_URL`.
 
 This server authenticates as a Lattice **admin**, and the API only masks global env vars
 server-side for *non-admin* callers. Without this step, `lattice_list_env_vars` returns every
@@ -105,12 +109,13 @@ Set `LATTICE_ALLOW_SECRET_VALUES=1` to turn masking off if you genuinely need a
 | `npm install` | Install dependencies (not vendored) |
 | `node --check index.js` | Syntax gate — the only static check that exists |
 | `LATTICE_API_URL=… LATTICE_API_TOKEN=… node index.js` | Run the server on stdio |
-| `grep -c 'server.tool(' index.js` | Confirm the tool count (should be 133) |
+| `grep -c 'server.tool(' index.js` | Confirm the tool count (should be 146) |
+| `npm test` | `verify.mjs` — syntax, duplicate names, doc counts, version consistency, masking wiring |
 | `npm publish` | Publish to npm — **this is deployment** (requires 2FA passkey from an interactive terminal) |
 
 ## Tools
 
-All 133 tools, grouped as they appear in `index.js`. ⚠️ marks destructive tools; their descriptions state the blast radius.
+All 146 tools, grouped as they appear in `index.js`. ⚠️ marks destructive tools; their descriptions state the blast radius.
 
 ### Overview & health
 | Tool | Description |
@@ -186,12 +191,15 @@ All 133 tools, grouped as they appear in `index.js`. ⚠️ marks destructive to
 | `lattice_get_database_instance` | Full instance config |
 | `lattice_create_database_instance` | Provision mysql/mariadb/postgres on a worker (omit `port` to auto-allocate) |
 | `lattice_update_database_instance` | Update config, limits, snapshot schedule |
-| `lattice_delete_database_instance` | Delete an instance ⚠️ |
-| `lattice_database_action` | start / stop / restart / remove ⚠️ |
+| `lattice_delete_database_instance` | Destroy an instance **and its data volume** ⚠️ — async; `force` only for an offline worker |
+| `lattice_database_action` | start / stop / restart / remove ⚠️ — `remove` is container-only, the data volume survives |
 | `lattice_get_database_connection` | Host, port, database and username — no secrets |
 | `lattice_reveal_database_credentials` | Reveal live credentials (audited; root only on request) |
 | `lattice_get_database_credentials` | **Deprecated** — root credentials via GET; use the reveal tool |
 | `lattice_get_database_events` | Lifecycle history — start here when a database looks wrong |
+| `lattice_get_database_backup_posture` | 3-2-1 standing — copies, media, off-site, with warnings |
+| `lattice_get_database_runs` | Scheduled snapshot attempts, including skipped slots and why |
+| `lattice_get_database_metrics` | CPU/memory samples for a database (no containers-table row needed) |
 | `lattice_get_database_logs` | Container stdout/stderr |
 | `lattice_get_database_lifecycle_logs` | Worker lifecycle messages, incl. why a create failed |
 | `lattice_open_database_console` | Authorise an interactive SQL console session |
@@ -255,6 +263,22 @@ All 133 tools, grouped as they appear in `index.js`. ⚠️ marks destructive to
 | `lattice_delete_deploy_token` | Delete a CI deploy token ⚠️ |
 | `lattice_approve_deployment` | Approve a deployment awaiting approval |
 
+### Automations
+A trigger (webhook or UTC cron) plus ordered steps. One webhook can redeploy containers in any number of stacks — a deploy token reaches one. Automations created here run as the user who owns this server's API token, authorised each time they run.
+
+| Tool | Description |
+|------|-------------|
+| `lattice_list_automations` | Automations with their run-as user and last run — start here when a CI redeploy "didn't happen" |
+| `lattice_get_automation` | One automation's trigger, steps, run-as user and last run |
+| `lattice_create_automation` | Create one — webhook token returned once and masked |
+| `lattice_update_automation` | Rename, or redefine trigger/steps (redefining makes you the run-as user) |
+| `lattice_enable_automation` | Switch on — re-validates, makes you the run-as user |
+| `lattice_disable_automation` | Switch off — the webhook then answers 200 `disabled` |
+| `lattice_run_automation` | Fire now and wait for the verdict (up to 50s) — performs real actions |
+| `lattice_rotate_automation_token` | New webhook token; the old URL 401s immediately |
+| `lattice_delete_automation` | Delete — stops firing, kills the webhook URL ⚠️ |
+| `lattice_list_automation_runs` | Run history incl. skipped firings and why, with every step's result |
+
 ### Container definitions
 | Tool | Description |
 |------|-------------|
@@ -319,7 +343,7 @@ Everything lives in one file:
 
 | Path | Role |
 |------|------|
-| `index.js` | The whole server: `--setup` flow, config read, `api()` HTTP helper, `text()`/`body()` helpers, all 133 `server.tool(...)` registrations, transport connect. |
+| `index.js` | The whole server: `--setup` flow, config read, `api()` HTTP helper, `text()`/`body()` helpers, all 146 `server.tool(...)` registrations, transport connect. |
 | `package.json` | npm metadata; `bin.lattice-mcp` → `index.js`. |
 | `AGENTS.md` | Contributor/agent guide — conventions, handler contracts, verification. |
 | `README.md` | This file. |

package/index.js

@@ -90,8 +90,46 @@ const SECRET_FIELDS = new Set([
     "secret_access_key", "access_key", "access_key_id", "token", "api_token",
     "admin_token", "deploy_token", "worker_token", "plaintext", "private_key",
     "encryption_key", "signing_key", "connection_string", "dsn",
+    // An automation's webhook secret, and the path that embeds it — either one
+    // is the whole credential for firing the automation.
+    "webhook_token", "webhook_path",
 ]);
 
+// An automation's http_request step is an outbound request someone wrote, and
+// its credentials live in three places: header values (Authorization,
+// X-Api-Key, …), the body, and — for Slack/Discord-style hooks — the URL path
+// itself. lattice-api returns all three to an admin, and this MCP is an admin.
+// The method, the host and the header NAMES stay readable, because those are
+// what a diagnosis needs.
+const BENIGN_HEADERS = new Set(["content-type", "accept", "user-agent"]);
+
+function maskUrlPath(raw) {
+    if (typeof raw !== "string" || raw === "") return raw;
+    try {
+        const u = new URL(raw);
+        const rest = raw.slice(u.origin.length);
+        return rest && rest !== "/" ? u.origin + mask(rest) : raw;
+    } catch {
+        return mask(raw);
+    }
+}
+
+function maskHttpRequestConfig(cfg) {
+    const out = sanitise(cfg);
+    if (out === null || typeof out !== "object" || Array.isArray(out)) return out;
+    if (typeof out.url === "string") out.url = maskUrlPath(out.url);
+    if (out.headers && typeof out.headers === "object" && !Array.isArray(out.headers)) {
+        out.headers = Object.fromEntries(
+            Object.entries(out.headers).map(([name, value]) => [
+                name,
+                BENIGN_HEADERS.has(name.toLowerCase()) ? value : mask(value),
+            ]),
+        );
+    }
+    if (typeof out.body === "string") out.body = mask(out.body);
+    return out;
+}
+
 // Env-var and compose keys are free-form, so they are matched by shape rather
 // than by name. The `_url`/`_uri`/`_endpoint` exclusion keeps TOKEN_URL and
 // AUTH_URL readable — they are addresses, not credentials, and masking them
@@ -151,6 +189,8 @@ function sanitise(node) {
             out[k] = maskEnvBlob(v);
         } else if (k === "compose_yaml") {
             out[k] = maskComposeYAML(v);
+        } else if (k === "config" && node.type === "http_request") {
+            out[k] = maskHttpRequestConfig(v);
         } else if (k === "value" && node.is_secret === true) {
             // Global env vars: the value is only a secret when flagged as one,
             // and masking the rest would hide image tags, ports and hostnames.
@@ -166,7 +206,10 @@ function sanitise(node) {
 
 // --- HTTP helper ---
 
-async function api(method, path, params, body) {
+// timeoutMs defaults to 30s. The one caller that raises it is
+// lattice_run_automation: a run is synchronous and bounded by lattice-api's 50s
+// budget, and aborting early would report a failure for a run still going.
+async function api(method, path, params, body, timeoutMs = 30000) {
     const url = new URL(path, API_URL);
     if (params) {
         for (const [k, v] of Object.entries(params)) {
@@ -178,7 +221,7 @@ async function api(method, path, params, body) {
         headers: {
             Authorization: `Bearer ${API_TOKEN}`,
         },
-        signal: AbortSignal.timeout(30000),
+        signal: AbortSignal.timeout(timeoutMs),
     };
     if (body) {
         opts.headers["Content-Type"] = "application/json";
@@ -221,7 +264,7 @@ function body(obj) {
 
 const server = new McpServer({
     name: "lattice",
-    version: "1.4.0",
+    version: "1.6.0",
 });
 
 // Overview
@@ -578,7 +621,7 @@ server.tool("lattice_create_database_instance", "Provision a database instance o
     password: z.string().optional().describe("Application user's password"),
     cpu_limit: z.number().optional().describe("CPU limit in cores"),
     memory_limit: z.number().optional().describe("Memory limit in MEGABYTES (the API converts to bytes; values under 6MB are rejected by Docker)"),
-    snapshot_schedule: z.string().optional().describe("Cron expression for automatic snapshots"),
+    snapshot_schedule: z.string().optional().describe("5-field cron expression for automatic snapshots, evaluated on the worker. Requires backup_destination_id — a schedule with no destination is rejected, because the control plane only registers schedules that have somewhere to write and it would otherwise save and never run"),
     retention_count: z.number().optional().describe("How many automatic snapshots to keep"),
     backup_destination_id: z.number().optional().describe("Backup destination for snapshots"),
     adopt_existing_volume: z.boolean().optional().describe("Reuse a leftover data volume of the same name. Off by default — the engine skips initialisation when its data directory is non-empty, so it keeps its OLD credentials while the API records the new ones, and nothing looks wrong until a connection fails"),
@@ -597,23 +640,28 @@ server.tool("lattice_update_database_instance", "Update a database instance's co
     cpu_limit: z.number().optional(),
     memory_limit: z.number().optional().describe("Memory limit in MEGABYTES"),
     health_status: z.enum(["none", "starting", "healthy", "unhealthy"]).optional(),
-    snapshot_schedule: z.string().optional().describe("Cron expression for automatic snapshots"),
+    snapshot_schedule: z.string().optional().describe("5-field cron expression for automatic snapshots, evaluated on the worker. Requires backup_destination_id — a schedule with no destination is rejected, because the control plane only registers schedules that have somewhere to write and it would otherwise save and never run"),
     retention_count: z.number().optional(),
     backup_destination_id: z.number().optional(),
+    mirror_backup_destination_id: z.number().optional().describe("Second destination each snapshot is copied to after the primary succeeds. An off-site mirror is what satisfies the '1' in 3-2-1; a mirror failure degrades backup posture without failing the backup"),
     active: z.boolean().optional(),
+    deletion_protection: z.boolean().optional().describe("Refuse any delete of this database while true, including a forced one"),
 }, async ({ id, ...fields }) => {
     const res = await api("PUT", `/admin/database-instances/${id}`, null, body(fields));
     return { content: text(res) };
 });
 
-server.tool("lattice_delete_database_instance", "Delete a database instance record. Destructive — data is lost unless a snapshot exists. Check lattice_list_database_snapshots first", {
+server.tool("lattice_delete_database_instance", "Permanently destroy a database: its container AND its data volume are removed on the worker, then the record is retired once the worker confirms. Irreversible — every table is gone; only existing snapshots survive, so check lattice_list_database_snapshots first. Asynchronous: the instance sits in 'deleting' until the worker confirms, and a failed teardown leaves it in 'error' rather than disappearing. Returns 409 if the worker is offline, since nothing can be destroyed then — pass force to retire the record anyway and abandon the container and volume on disk. To keep the data, use lattice_database_action with 'remove' instead", {
     id: z.number().describe("Database instance ID"),
-}, async ({ id }) => {
-    const res = await api("DELETE", `/admin/database-instances/${id}`);
+    force: z.boolean().optional().describe("Retire the record even though the worker is offline, abandoning its container and data volume on the worker (default false). Does NOT override deletion protection"),
+    final_snapshot: z.boolean().optional().describe("Take one last snapshot first and destroy the database only once it completes. Returns with the database still present; a failed snapshot means nothing is deleted. Requires a backup destination and a running instance"),
+}, async ({ id, force, final_snapshot }) => {
+    const qs = [force ? "force=true" : null, final_snapshot ? "final_snapshot=true" : null].filter(Boolean).join("&");
+    const res = await api("DELETE", `/admin/database-instances/${id}${qs ? `?${qs}` : ""}`);
     return { content: text(res) };
 });
 
-server.tool("lattice_database_action", "Start, stop, restart or remove a database instance's container. 'remove' destroys the container — data survives only if the volume or a snapshot does", {
+server.tool("lattice_database_action", "Start, stop, restart or remove a database instance's container. 'remove' destroys the container but KEEPS the data volume and the record, so the database can be started again with its data — it is not a delete, and is idempotent on an already-removed container. Use lattice_delete_database_instance to destroy the data too", {
     id: z.number().describe("Database instance ID"),
     action: z.enum(["start", "stop", "restart", "remove"]).describe("Action to perform"),
 }, async ({ id, action }) => {
@@ -652,6 +700,30 @@ server.tool("lattice_get_database_events", "Get a database instance's lifecycle
     return { content: text(res) };
 });
 
+server.tool("lattice_get_database_backup_posture", "A database's standing against the 3-2-1 rule (three copies, two media, one off-site). Reports what is TRUE rather than what was configured: a destination that has produced no fresh snapshot is not a copy, and one whose locality nobody confirmed is never counted as off-site — Lattice cannot tell a bucket on the worker being backed up from one in another country. Returns per-axis pass/fail, detail lines and warnings", {
+    id: z.number().describe("Database instance ID"),
+}, async ({ id }) => {
+    const res = await api("GET", `/admin/database-instances/${id}/backup-posture`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_get_database_runs", "Recent scheduled-snapshot attempts for a database, newest first — INCLUDING slots that were skipped and why. Scheduling lives in the control plane, so every slot leaves a row whether or not it produced a snapshot. Reach for this to answer 'did the backup run?', which lattice_list_database_snapshots cannot: an absent snapshot is a mystery, a skipped run states its reason (previous run still going, database stopped, worker offline, slot beyond the catch-up window)", {
+    id: z.number().describe("Database instance ID"),
+    limit: z.number().optional().describe("Max runs to return, newest first (default 50, max 500)"),
+}, async ({ id, ...params }) => {
+    const res = await api("GET", `/admin/database-instances/${id}/runs`, params);
+    return { content: text(res) };
+});
+
+server.tool("lattice_get_database_metrics", "Get CPU and memory samples for a managed database instance. These samples were always collected but had no read path: managed databases have no row in the containers table, and every other metrics reader takes a container id. Use this rather than lattice_get_container_metrics for a database", {
+    id: z.number().describe("Database instance ID"),
+    limit: z.number().optional().describe("Max samples, newest first (default 50, max 500)"),
+    since: z.string().optional().describe("RFC3339 timestamp — only samples at or after this time"),
+}, async ({ id, ...params }) => {
+    const res = await api("GET", `/admin/database-instances/${id}/metrics`, params);
+    return { content: text(res) };
+});
+
 server.tool("lattice_get_database_logs", "Get a database container's stdout/stderr. Use together with lattice_get_database_events when diagnosing a failed or degraded instance — the events say what happened, the logs say why", {
     id: z.number().describe("Database instance ID"),
     stream: z.enum(["stdout", "stderr"]).optional().describe("Filter by stream"),
@@ -993,6 +1065,134 @@ server.tool("lattice_approve_deployment", "Approve a deployment that is waiting
     return { content: text(res) };
 });
 
+// ─────────────────────────────────────────────────────────────────────────────
+// Automations
+// ─────────────────────────────────────────────────────────────────────────────
+//
+// An automation is one trigger (webhook or UTC cron) plus ordered steps. It
+// exists because a deploy token is bound to ONE stack: redeploying the same
+// service in two zones needed two tokens, and monitor-core's second zone was
+// silently never redeployed. Request shapes mirror
+// lattice-api routers/HandleAutomations.router.go; the rules they enforce live in
+// lattice-api automations/.
+
+const automationTriggerSchema = z.object({
+    type: z.enum(["webhook", "schedule"]).describe(
+        "webhook: fired by POST /api/automations/<token> — requires the admin role, since the URL is a bearer credential. schedule: a 5-field cron evaluated in UTC",
+    ),
+    cron: z.string().optional().describe(
+        "5-field UTC cron, schedule triggers only, e.g. \"0 3 * * *\". Values that could never fire (minute 60, day-of-week 7) are rejected",
+    ),
+});
+
+const continueOnError = z.boolean().optional().describe(
+    "Run later steps even if this one fails. It changes flow, not the verdict: the run is still marked failed",
+);
+
+const automationActionSchema = z.discriminatedUnion("type", [
+    z.object({
+        type: z.literal("redeploy_container").describe("Recreate (pull image:tag, replace) one container on whichever worker runs its stack. Editor role"),
+        continue_on_error: continueOnError,
+        config: z.object({
+            stack_id: z.number().describe("Stack the container belongs to — lattice_list_stacks"),
+            container_name: z.string().describe(
+                "Container NAME within that stack — lattice_get_stack_containers. A name, not an id: a compose edit re-creates container ids",
+            ),
+        }),
+    }),
+    z.object({
+        type: z.literal("http_request").describe("One outbound HTTP request; succeeds only on a 2xx. Admin role"),
+        continue_on_error: continueOnError,
+        config: z.object({
+            method: z.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD"]),
+            url: z.string().describe("HTTPS URL on a public host — private and internal addresses are refused"),
+            headers: z.record(z.string(), z.string()).optional().describe(
+                "Header name → value. Stored in plaintext by lattice-api; this server masks the values in every response",
+            ),
+            body: z.string().optional().describe("Request body; not allowed on GET/HEAD. Content-Type defaults to application/json"),
+            timeout_seconds: z.number().int().min(0).max(30).optional().describe("Per-request timeout, default 10, max 30"),
+        }),
+    }),
+]);
+
+server.tool("lattice_list_automations", "List automations — a trigger (webhook or cron) plus ordered steps — with each one's run_as user and last_run. Start here when a CI redeploy 'didn't happen': last_run says what the latest firing did, and an inactive run_as means every firing is being refused", {}, async () => {
+    const res = await api("GET", "/admin/automations");
+    return { content: text(res) };
+});
+
+server.tool("lattice_get_automation", "Get one automation: trigger, ordered steps, run_as user, running_run_id (set while a run holds its guard) and last_run. http_request header values, bodies and URL paths come back masked", {
+    id: z.number().describe("Automation ID"),
+}, async ({ id }) => {
+    const res = await api("GET", `/admin/automations/${id}`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_create_automation", "Create an automation: one trigger plus ordered steps. Use it to redeploy containers in SEVERAL stacks from one CI call — a deploy token only reaches one stack. Steps run in order and stop at the first failure unless continue_on_error. The automation runs as the user who owns this MCP's API token, and every step is authorised against that user each time it runs. A webhook trigger and http_request steps require the admin role. For a webhook trigger the response carries webhook_token/webhook_path once; this server masks them — read the URL from the Lattice UI, or set LATTICE_ALLOW_SECRET_VALUES=1. CI calls it as POST https://<lattice>/api/automations/<token>?commit=<sha>: 200 succeeded or disabled, 409 skipped (already running), 424 failed", {
+    name: z.string().describe("Display name, up to 128 characters"),
+    description: z.string().optional().describe("Optional description"),
+    enabled: z.boolean().optional().describe("Default true — it fires on its trigger as soon as it is created"),
+    trigger: automationTriggerSchema,
+    actions: z.array(automationActionSchema).min(1).max(20).describe("Ordered steps, 1-20"),
+}, async ({ name, description, enabled, trigger, actions }) => {
+    const res = await api("POST", "/admin/automations", null, body({ name, description, enabled, trigger, actions }));
+    return { content: text(res) };
+});
+
+server.tool("lattice_update_automation", "Update an automation. Omitted fields are left alone; description \"\" clears it. Passing trigger or actions REDEFINES it, which moves its run-as identity to this MCP token's user — who must be able to run every step — while a rename does not. Changing the trigger to webhook mints a token (returned once, masked); changing it away from webhook kills the old URL. To switch it on or off use lattice_enable_automation / lattice_disable_automation", {
+    id: z.number().describe("Automation ID"),
+    name: z.string().optional().describe("New name"),
+    description: z.string().optional().describe("New description; \"\" clears it"),
+    trigger: automationTriggerSchema.optional().describe("Replacement trigger — redefines the automation"),
+    actions: z.array(automationActionSchema).min(1).max(20).optional().describe("Replacement step list — redefines the automation"),
+}, async ({ id, name, description, trigger, actions }) => {
+    const res = await api("PUT", `/admin/automations/${id}`, null, body({ name, description, trigger, actions }));
+    return { content: text(res) };
+});
+
+server.tool("lattice_enable_automation", "Switch an automation on. Re-validates it first — a renamed container or deleted stack is refused here rather than on the next firing — and makes this MCP token's user its run-as identity", {
+    id: z.number().describe("Automation ID"),
+}, async ({ id }) => {
+    const res = await api("POST", `/admin/automations/${id}/enable`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_disable_automation", "Switch an automation off. It fires nothing while disabled: its webhook answers 200 with result \"disabled\", and each firing is still recorded as a skipped run", {
+    id: z.number().describe("Automation ID"),
+}, async ({ id }) => {
+    const res = await api("POST", `/admin/automations/${id}/disable`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_run_automation", "Fire an automation now and wait for the verdict (a run is bounded to 50s). Returns {result, run}: result is succeeded | failed | skipped | disabled, and run.steps has every step's outcome. This performs the real actions — it redeploys containers and sends HTTP requests", {
+    id: z.number().describe("Automation ID"),
+}, async ({ id }) => {
+    const res = await api("POST", `/admin/automations/${id}/run`, null, null, 65000);
+    return { content: text(res) };
+});
+
+server.tool("lattice_rotate_automation_token", "Replace a webhook automation's token. The old URL stops working immediately — CI still calling it gets 401 until updated. The new token is returned once and masked by this server; read it from the Lattice UI, or set LATTICE_ALLOW_SECRET_VALUES=1", {
+    id: z.number().describe("Automation ID (webhook trigger only)"),
+}, async ({ id }) => {
+    const res = await api("POST", `/admin/automations/${id}/rotate-token`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_delete_automation", "Delete an automation. It stops firing and its webhook URL stops working immediately; its run history is no longer reachable, though the audit log keeps every action it took. Destructive — lattice_disable_automation only switches it off", {
+    id: z.number().describe("Automation ID"),
+}, async ({ id }) => {
+    const res = await api("DELETE", `/admin/automations/${id}`);
+    return { content: text(res) };
+});
+
+server.tool("lattice_list_automation_runs", "An automation's run history, newest first — the first thing to reach for when an automation 'didn't work'. Every firing is a row, including skipped ones (disabled, already running, no runner slot, stale schedule slot) with skip_reason; failed_step names the first failing step, error explains a refused run, and steps[] carries each step's summary and error", {
+    id: z.number().describe("Automation ID"),
+    limit: z.number().optional().describe("Max runs (default 50, max 500)"),
+    offset: z.number().optional().describe("Offset for pagination"),
+}, async ({ id, limit, offset }) => {
+    const res = await api("GET", `/admin/automations/${id}/runs`, { limit, offset });
+    return { content: text(res) };
+});
+
 // ─────────────────────────────────────────────────────────────────────────────
 // Containers — definition CRUD
 // ─────────────────────────────────────────────────────────────────────────────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lattice-mcp",
-  "version": "1.4.0",
+  "version": "1.6.0",
   "description": "MCP server for Lattice container orchestration platform",
   "type": "module",
   "main": "index.js",

package/verify.mjs

@@ -125,6 +125,19 @@ if (!/const ALLOW_SECRETS = process\.env\.LATTICE_ALLOW_SECRET_VALUES === "1"/.t
     fail("the masking opt-out is not the expected LATTICE_ALLOW_SECRET_VALUES === \"1\" check — masking may no longer default to on");
 }
 
+// Automation responses carry two credentials the generic field list did not
+// cover when automations were added: the webhook token (and the path that
+// embeds it), and http_request step configs, whose secrets sit in header values,
+// the body and the URL path. Dropping either rule leaks a working credential.
+for (const field of ["webhook_token", "webhook_path"]) {
+    if (!new RegExp(`const SECRET_FIELDS = new Set\\(\\[[^\\]]*"${field}"`, "s").test(source)) {
+        fail(`"${field}" is no longer in SECRET_FIELDS — automation webhook credentials would reach the transcript`);
+    }
+}
+if (!/k === "config" && node\.type === "http_request"[\s\S]{0,80}maskHttpRequestConfig\(v\)/.test(source)) {
+    fail("sanitise() no longer routes http_request step configs through maskHttpRequestConfig() — header values, bodies and webhook URL paths would leak");
+}
+
 // ── Report ───────────────────────────────────────────────────────────────────
 if (failures.length > 0) {
     console.error("verification failed:\n");
@@ -138,3 +151,4 @@ console.log(`✓ ${toolCount} tools registered, no duplicates, all lattice_-pref
 console.log(`✓ README.md and AGENTS.md agree on the tool count`);
 console.log(`✓ every tool appears in the README tool tables`);
 console.log(`✓ sanitise() is wired into api() and masking defaults to on`);
+console.log(`✓ automation webhook tokens and http_request configs are masked`);