vpsnet-mcp 2.3.12 → 2.3.14

package/README.md

@@ -25,6 +25,8 @@ The remote profile also includes scoped DNS, domain and certificate management,
 The remote connector uses `https://mcp.vpsnet.com/mcp` and customer consent through
 VPSnet. See [Remote AI connections](docs/REMOTE_MCP.md) for connection setup,
 permissions and supported operations.
+For expired or revoked authorization and unavailable consent choices, see
+[reconnecting and requested permissions](docs/REMOTE_MCP.md#reconnect-after-losing-authorization).
 
 The distributable [plugin README](plugin/README.md), manifests and skills are in English.
 See [directory readiness](docs/DIRECTORY_READINESS.md) for package validation and

package/build/http-server.js

@@ -3,6 +3,7 @@ import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/
 import { createVpsnetServer } from "./index.js";
 import { resolveApiBase } from "./api.js";
 import { requireRequestAuthorization, withAuthorization } from "./request-context.js";
+import { scopeDescriptions } from "./scope-catalog.js";
 import { supportedScopes, orderScopes } from "./remote-policy.js";
 function publicUrl(value) {
     const url = new URL(value);
@@ -70,7 +71,7 @@ export function createRemoteServer(options) {
             return;
         }
         if (req.method === 'GET' && ['/.well-known/oauth-protected-resource', '/.well-known/oauth-protected-resource/mcp'].includes(req.url ?? '')) {
-            return json(res, 200, { resource: resource.href, authorization_servers: [issuer], scopes_supported: allowedScopes, bearer_methods_supported: ['header'], resource_name: 'VPSnet' });
+            return json(res, 200, { resource: resource.href, authorization_servers: [issuer], scopes_supported: allowedScopes, scope_descriptions: scopeDescriptions(allowedScopes), bearer_methods_supported: ['header'], resource_name: 'VPSnet' });
         }
         if (req.url !== '/mcp')
             return json(res, 404, { error: 'not_found' });

package/build/networking-tools.js

@@ -76,7 +76,7 @@ const policy = `${project}/networks/{network_id}/security-policy`;
 const address = `${N}/public-addresses/{address_id}`;
 const binding = `${N}/public-bindings/{binding_id}`;
 const scope = "Requires explicit networking:read for reads or networking:manage for changes; full/read defaults do not grant networking. The backend enforces ownership, feature availability and service 2FA locks.";
-const writes = "Read current capabilities and owned resource state first; obtain approval for the exact change. An accepted operation is pending, not proof of connectivity. Preserve reason_code and poll the returned operation/resource. On transport uncertainty inspect state and reuse only the original key and unchanged request; never automatically retry.";
+const writes = "Read current capabilities and owned resource state first; obtain approval for the exact change. An accepted operation is pending, not proof of connectivity. Poll the returned operation/resource on its in_progress flag, waiting next_check_seconds between reads: while in_progress is true its reason_code is what is awaited (reason_kind waiting, e.g. a queued or pending reason, or a control plane that has not answered yet), never an error; only in_progress false with reason_kind failure is a failure. Preserve reason_code. On transport uncertainty inspect state and reuse only the original key and unchanged request; never automatically retry.";
 const paid = "Requires full API access, networking:manage, enabled paid operations, networking:order and spend caps. Choose a supported live catalog tier and its documented request kind; preserve the exact quote; disclose its gross_amount in EUR before user approval. The same Idempotency-Key is required for quote and confirmation. API-key checkout supports the advertised account-balance payment method only. Payment acceptance is not resource readiness.";
 function tool(name, method, path, description, fields = {}, options = {}) {
     const pathFields = [...path.matchAll(/\{([^}]+)\}/g)].map(match => match[1]);
@@ -104,7 +104,7 @@ export const networkingTools = [
     tool("get_networking_overview", "GET", `${N}/overview`, "Read owned networks, quota and operation snapshot. operations_has_more signals a bounded backend feed."),
     tool("get_networking_topology", "GET", `${N}/topology`, "Read the account topology with network-scoped identities. Optional metrics=current requests measured traffic.", { metrics: z.literal("current").optional() }, { query: ["metrics"] }),
     tool("list_networking_operations", "GET", `${N}/operations`, "Read recent network operations and operations_has_more. This endpoint has no pagination parameter."),
-    tool("get_networking_operation", "GET", `${N}/operations/{operation_id}`, "Read an accepted network or port operation only. A successful network_graph_created operation permits checking network.port_intent_ready for the first attachment; it does not prove guest connectivity. Security-policy, appliance and public-binding operation IDs belong to different stores. Poll security policies with get_network_security_policy, appliances with get_network_appliance_operation, public bindings with get_network_public_binding, and DNS changes through get_private_network.settings.dns_change."),
+    tool("get_networking_operation", "GET", `${N}/operations/{operation_id}`, "Read an accepted network or port operation only. Poll on in_progress (true until succeeded, failed or cancelled) and wait next_check_seconds between reads; reason_kind says what reason_code is: waiting (progress, including queued, pending and control-plane-not-yet-answered reasons - not an error), failure or outcome. A port reserve (the operation an attach returns) names its activation_operation_id once the activation that finishes the attachment exists; the completed history line names both ids. A successful network_graph_created operation permits checking network.port_intent_ready for the first attachment; it does not prove guest connectivity. Security-policy, appliance and public-binding operation IDs belong to different stores. Poll security policies with get_network_security_policy, appliances with get_network_appliance_operation, public bindings with get_network_public_binding, and DNS changes through get_private_network.settings.dns_change."),
     tool("list_private_networks", "GET", `${N}/networks`, "List owned private networks, including deletion awaiting verified cleanup. An empty list is a starting state for creating an approved network, not evidence that existing servers cannot use private networking."),
     tool("get_private_network", "GET", networks, "Read one owned network including DHCP reservations, DNS change progress, generation and project_id."),
     tool("create_private_network", "POST", `${N}/networks`, "Create an approved private network for existing services when no suitable owned network exists. A false new-order private_network.available or order_availability result alone does not block this route; honor this endpoint's own quota and feature refusal. Every subnet is unique on the whole platform and comes from 100.64.0.0/10. Omit subnet and the platform allocates a free block of subnet_prefix_length (28..24, default 26 = 64 addresses; capabilities.private_network.subnet_sizes lists each size with its server count and suggested block); or name an aligned /28 through /24 inside 100.64.0.0/10 that no network holds (409 subnet_in_use), never both. Creation is asynchronous: poll its operation and get_private_network until network.port_intent_ready is true, then check attachment candidates. A successful network_graph_created operation and provisioning_status=configured describe the graph stage; the first guest has not yet qualified connectivity. Never wait for applied_generation to equal generation before the first attachment. Creation does not itself attach a server or buy a public address.", { name, subnet: z.object({ cidr: z.string().regex(/^100\.(?:6[4-9]|[7-9]\d|1[01]\d|12[0-7])(?:\.\d{1,3}){2}\/(?:2[4-8])$/) }).strict().optional(), subnet_prefix_length: z.union([z.literal(24), z.literal(25), z.literal(26), z.literal(27), z.literal(28)]).optional().describe("Size of the allocated subnet when subnet is omitted; default 26"), settings: settings.optional(), default_policy: z.enum(["accept", "deny"]).optional() }, { idempotent: true }),
@@ -115,7 +115,7 @@ export const networkingTools = [
     tool("list_private_network_ports", "GET", `${networks}/ports`, "Read owned network ports, their fixed DHCP addresses, generations and attachment states. Reserved is not connected."),
     tool("list_service_private_ports", "GET", `${N}/services/{service_id}/ports`, "Read private ports and order attachment recovery state for one owned service order number."),
     tool("list_network_attachment_candidates", "GET", `${networks}/attachment-candidates`, "For a network with port_intent_ready=true, check each existing service's attachment eligibility and attachment_mode; service_id selects one owned service. Follow next_cursor using after while candidates_has_more is true. Use this per-service result and its reason_code for existing-VM attachment, not new-server order_availability. Do not attach a service the backend marks ineligible.", { after: z.string().optional(), service_id: serviceId.optional() }, { query: ["after", "service_id"] }),
-    tool("attach_private_network_port", "POST", `${networks}/ports`, "Attach an eligible existing owned service to a private network with port_intent_ready=true; omit ipv4 for automatic allocation or pass a fixed usable address. Check list_network_attachment_candidates for this network and service first, including pagination and attachment_mode. Set restart=true only after the user approves a required restart. An accepted attach is pending: poll its operation and verify the final port and service attachment state. Honor this endpoint's own refusal and reason_code.", { service_id: serviceId, ipv4: ipv4.optional(), restart }, { idempotent: true }),
+    tool("attach_private_network_port", "POST", `${networks}/ports`, "Attach an eligible existing owned service to a private network with port_intent_ready=true; omit ipv4 for automatic allocation or pass a fixed usable address. Check list_network_attachment_candidates for this network and service first, including pagination and attachment_mode. Set restart=true only after the user approves a required restart. An accepted attach is pending: it returns the port's reserve operation (queued with private_port_apply_pending; reserve, activate and detach take 13-81 s through the host) - poll it with get_networking_operation on in_progress, read its activation_operation_id once the activation that finishes the attachment exists, and verify the final port and service attachment state. Honor this endpoint's own refusal and reason_code.", { service_id: serviceId, ipv4: ipv4.optional(), restart }, { idempotent: true }),
     tool("detach_private_network_port", "DELETE", `${networks}/ports/{port_id}`, "Detach the owned server port. Use the PORT generation and confirm any required restart.", { expected_generation: generation, restart }, { idempotent: true, destructive: true }),
     tool("retry_private_network_port", "POST", `${networks}/ports/{port_id}/retry`, "Retry the failed current port operation with the PORT generation and any required restart approval. Inspect the failed operation: a detach retry can remove the server's private connectivity.", { expected_generation: generation, restart }, { idempotent: true, destructive: true }),
     tool("get_network_vpn_summary", "GET", `${networks}/vpn`, "Read the network's VPN summary, including truthful absence. Native site-to-site is not supported by this tool set."),
@@ -135,7 +135,7 @@ export const networkingTools = [
     tool("get_network_appliance_capabilities", "GET", `${A}/capabilities`, "Read available load balancer providers/tiers, public qualification, VPN capabilities and quota. Tier availability and prices are returned by the backend, never hardcoded."),
     tool("list_network_appliances", "GET", A, "Read owned load balancers and VPN gateways with one stream cursor."),
     tool("get_network_appliance_billing", "GET", `${A}/billing`, "Read current customer-visible recurring appliance lines and currency."),
-    tool("get_network_appliance_operation", "GET", `${A}/operations/{operation_id}`, "Poll an accepted appliance operation. Creation succeeds only when its actual resource state and health confirm readiness."),
+    tool("get_network_appliance_operation", "GET", `${A}/operations/{operation_id}`, "Poll an accepted appliance operation on in_progress (true until succeeded, failed or cancelled), waiting next_check_seconds between reads (a load balancer or VPN change settles in a few seconds). A fresh change is queued with appliance_dispatch_pending and then waiting_dependency while the control plane answers; reason_kind waiting marks every such reason as progress, not an error. Creation succeeds only when its actual resource state and health confirm readiness."),
     tool("list_network_load_balancers", "GET", `${A}/load-balancers`, "List private and public load balancers and customer-safe health/qualification state."),
     tool("get_network_load_balancer", "GET", lb, "Read one owned load balancer, listeners, members, generation and health. A pending or unqualified public endpoint is not ready."),
     tool("estimate_network_load_balancer", "POST", `${A}/load-balancers/quote`, "Read a technical load balancer estimate for this exact configuration. This does not issue a paid purchase token; buy through quote_network_product and order_network_product. Legacy POST /appliances/load-balancers refuses unpaid creation.", loadBalancerSpec, { readOnly: true }),
@@ -208,6 +208,29 @@ export function networkingRequest(definition, args) {
     };
     return { method: definition.method, path, body, headers, readOnly: definition.options.readOnly === true };
 }
+/**
+ * One line a client can act on without knowing the reason vocabulary (PROD QA 2026-10-14: an AI client read the
+ * waiting reason of a fresh operation as an error and stopped). Reads the operation of a receipt or of an
+ * operation read; null when the result carries no operation with a progress label.
+ */
+export function networkingProgressHint(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        return null;
+    const value = data;
+    const operation = value.operation && typeof value.operation === "object" ? value.operation
+        : typeof value.in_progress === "boolean" ? value : null;
+    if (!operation || typeof operation.in_progress !== "boolean")
+        return null;
+    const reason = typeof operation.reason_code === "string" && operation.reason_code !== "" ? operation.reason_code : "none";
+    if (operation.in_progress) {
+        const wait = Number.isInteger(operation.next_check_seconds) ? `${operation.next_check_seconds} s` : "a few seconds";
+        return `Operation ${operation.id ?? ""} in progress (state=${operation.state}, reason_code=${reason}, reason_kind=${operation.reason_kind ?? "waiting"}): this is progress, not an error. Poll the follow-up read again in ${wait}; do not repeat the change.`;
+    }
+    if (operation.reason_kind === "failure") {
+        return `Operation ${operation.id ?? ""} failed (state=${operation.state}, reason_code=${reason}). Do not retry automatically; report the reason_code.`;
+    }
+    return `Operation ${operation.id ?? ""} finished (state=${operation.state}, reason_code=${reason}).`;
+}
 /** Read-only recovery targets. IDs are copied from validated inputs or owned API results, never guessed. */
 export function networkingFollowUpReads(definition, args, data) {
     if (!data || typeof data !== "object" || Array.isArray(data))
@@ -290,8 +313,10 @@ export function registerNetworkingTools(server) {
             const request = networkingRequest(definition, args);
             const result = await apiRequest(request.method, request.path, request.body, request.headers, { readOnly: request.readOnly });
             const reads = result.status < 400 ? networkingFollowUpReads(definition, args, result.data) : [];
+            const progress = result.status < 400 ? networkingProgressHint(result.data) : null;
             return { content: [
                     { type: "text", text: formatJson(result.data) },
+                    ...(progress ? [{ type: "text", text: progress }] : []),
                     ...(reads.length ? [{ type: "text", text: `Follow-up reads (do not repeat the change): ${JSON.stringify(reads)}` }] : []),
                 ], ...(result.status >= 400 ? { isError: true } : {}) };
         });

package/build/scope-catalog.js

@@ -0,0 +1,417 @@
+// Generated from backend app/Services/Mcp/scope-catalog.json.
+// Update with scripts/sync-scope-catalog.py; OAuth policy is enforced separately.
+export const scopeCatalog = {
+    "services:read": {
+        "label": {
+            "en": "View selected servers",
+            "lt": "Peržiūrėti pasirinktus serverius"
+        },
+        "description": {
+            "en": "View selected servers, status, graphs, history, backups and snapshots; browsing backup files may queue a saved browse operation.",
+            "lt": "Peržiūrėti pasirinktus serverius, būseną, grafikus, istoriją, atsargines ir momentines kopijas; kopijų failų naršymas gali sukurti išsaugomą užduotį."
+        },
+        "implies": [],
+        "billing": "none",
+        "legacy": false
+    },
+    "services:manage": {
+        "label": {
+            "en": "Manage selected servers",
+            "lt": "Valdyti pasirinktus serverius"
+        },
+        "description": {
+            "en": "Start, stop or restart selected servers and change their settings, including guest DNS and firewall reset. Includes viewing selected servers.",
+            "lt": "Paleisti, stabdyti ar perkrauti pasirinktus serverius ir keisti jų nustatymus, įskaitant DNS bei ugniasienės atkūrimą. Apima serverių peržiūrą."
+        },
+        "implies": [
+            "services:read"
+        ],
+        "billing": "none",
+        "legacy": false
+    },
+    "applications:read": {
+        "label": {
+            "en": "View selected server applications",
+            "lt": "Peržiūrėti pasirinktų serverių programas"
+        },
+        "description": {
+            "en": "View applications, recipes, health and logs on selected servers; diagnostics may start saved inspection jobs.",
+            "lt": "Peržiūrėti pasirinktų serverių programas, receptus, būseną ir žurnalus; diagnostika gali paleisti išsaugomas patikros užduotis."
+        },
+        "implies": [],
+        "billing": "none",
+        "legacy": false
+    },
+    "applications:manage": {
+        "label": {
+            "en": "Manage selected server applications",
+            "lt": "Valdyti pasirinktų serverių programas"
+        },
+        "description": {
+            "en": "Install, configure, update, stop, remove or roll back applications and recipes on selected servers. May replace or delete application data. Includes application viewing.",
+            "lt": "Diegti, konfigūruoti, atnaujinti, stabdyti, šalinti ar atkurti pasirinktų serverių programas ir receptus. Gali pakeisti ar ištrinti programų duomenis. Apima programų peržiūrą."
+        },
+        "implies": [
+            "applications:read"
+        ],
+        "billing": "none",
+        "legacy": false
+    },
+    "networking:read": {
+        "label": {
+            "en": "View account networks",
+            "lt": "Peržiūrėti paskyros tinklus"
+        },
+        "description": {
+            "en": "View existing networks, attachments, routes and network appliance status across your account.",
+            "lt": "Peržiūrėti esamus paskyros tinklus, jungtis, maršrutus ir tinklo įrenginių būseną."
+        },
+        "implies": [],
+        "billing": "none",
+        "legacy": false
+    },
+    "networking:manage": {
+        "label": {
+            "en": "Manage account networks",
+            "lt": "Valdyti paskyros tinklus"
+        },
+        "description": {
+            "en": "Create, change or remove existing-account networks, routes, attachments and appliances. May interrupt connectivity. Includes network viewing; excludes purchases and renewals.",
+            "lt": "Kurti, keisti ar šalinti paskyros tinklus, maršrutus, jungtis ir įrenginius. Gali sutrikdyti ryšį. Apima tinklų peržiūrą; pirkimai ir pratęsimai neįtraukti."
+        },
+        "implies": [
+            "networking:read"
+        ],
+        "billing": "none",
+        "legacy": false
+    },
+    "functions:read": {
+        "label": {
+            "en": "View Functions and run results",
+            "lt": "Peržiūrėti Functions ir vykdymo rezultatus"
+        },
+        "description": {
+            "en": "View account Functions, their configuration, history and invocation results.",
+            "lt": "Peržiūrėti paskyros Functions, jų konfigūraciją, istoriją ir vykdymo rezultatus."
+        },
+        "implies": [],
+        "billing": "none",
+        "legacy": false
+    },
+    "functions:manage": {
+        "label": {
+            "en": "Manage Functions",
+            "lt": "Valdyti Functions"
+        },
+        "description": {
+            "en": "Create, update or delete account Functions and their code. Includes viewing Functions; running them requires separate paid execution permission.",
+            "lt": "Kurti, atnaujinti ar trinti paskyros Functions ir jų kodą. Apima Functions peržiūrą; vykdymui reikia atskiro mokamo vykdymo leidimo."
+        },
+        "implies": [
+            "functions:read"
+        ],
+        "billing": "none",
+        "legacy": false
+    },
+    "functions:invoke": {
+        "label": {
+            "en": "Run Functions (usage charges)",
+            "lt": "Vykdyti Functions (mokama pagal naudojimą)"
+        },
+        "description": {
+            "en": "Run existing account Functions using your VPSnet balance. Usage charges apply; your AI subscription does not cover them. Includes viewing Functions and run results. The daily limit counts total account Functions spending, including pending runs.",
+            "lt": "Vykdyti paskyros Functions naudojant VPSnet balansą. Taikomi naudojimo mokesčiai; AI prenumerata jų nepadengia. Apima Functions ir rezultatų peržiūrą. Dienos riba apima visas paskyros Functions išlaidas, įskaitant laukiančius vykdymus."
+        },
+        "implies": [
+            "functions:read"
+        ],
+        "billing": "usage_balance",
+        "legacy": false
+    },
+    "vm:diagnostics": {
+        "label": {
+            "en": "Inspect selected servers",
+            "lt": "Tikrinti pasirinktus serverius"
+        },
+        "description": {
+            "en": "Run bounded diagnostics on selected servers and save operation results. Does not grant arbitrary commands or file access.",
+            "lt": "Vykdyti ribotą pasirinktų serverių diagnostiką ir išsaugoti rezultatus. Nesuteikia savavališkų komandų ar failų prieigos."
+        },
+        "implies": [],
+        "billing": "none",
+        "legacy": false
+    },
+    "vm:files:read": {
+        "label": {
+            "en": "Read selected server files as root",
+            "lt": "Skaityti pasirinktų serverių failus root teisėmis"
+        },
+        "description": {
+            "en": "Read files on selected servers with root privileges through saved guest operations. Files may contain secrets.",
+            "lt": "Skaityti pasirinktų serverių failus root teisėmis per išsaugomas užduotis. Failuose gali būti paslapčių."
+        },
+        "implies": [],
+        "billing": "none",
+        "legacy": false
+    },
+    "vm:files:write": {
+        "label": {
+            "en": "Read and change selected server files as root",
+            "lt": "Skaityti ir keisti pasirinktų serverių failus root teisėmis"
+        },
+        "description": {
+            "en": "Create or overwrite files on selected servers with root privileges. Includes reading files; changes can replace data or affect server operation.",
+            "lt": "Kurti ar perrašyti pasirinktų serverių failus root teisėmis. Apima failų skaitymą; pakeitimai gali pakeisti duomenis ar paveikti serverio veikimą."
+        },
+        "implies": [
+            "vm:files:read"
+        ],
+        "billing": "none",
+        "legacy": false
+    },
+    "vm:exec": {
+        "label": {
+            "en": "Run selected server commands as root",
+            "lt": "Vykdyti pasirinktų serverių komandas root teisėmis"
+        },
+        "description": {
+            "en": "Run arbitrary commands and install root SSH access on selected servers. Can read, change or delete data through commands. Includes bounded server diagnostics.",
+            "lt": "Vykdyti savavališkas komandas ir įdiegti root SSH prieigą pasirinktuose serveriuose. Komandos gali skaityti, keisti ar trinti duomenis. Apima ribotą serverių diagnostiką."
+        },
+        "implies": [
+            "vm:diagnostics"
+        ],
+        "billing": "none",
+        "legacy": false
+    },
+    "vm:files": {
+        "label": {
+            "en": "Read and change selected server files as root (legacy)",
+            "lt": "Skaityti ir keisti pasirinktų serverių failus root teisėmis (senasis leidimas)"
+        },
+        "description": {
+            "en": "Legacy combined file permission: includes vm:files:read and vm:files:write on selected servers. Can read secrets and overwrite data. Not advertised for new connections.",
+            "lt": "Senasis jungtinis failų leidimas: apima vm:files:read ir vm:files:write pasirinktuose serveriuose. Gali skaityti paslaptis ir perrašyti duomenis. Naujiems prisijungimams neskelbiamas."
+        },
+        "implies": [
+            "vm:files:read",
+            "vm:files:write"
+        ],
+        "billing": "none",
+        "legacy": true
+    },
+    "services:reinstall": {
+        "label": {
+            "en": "Reinstall selected server operating systems",
+            "lt": "Perdiegti pasirinktų serverių operacines sistemas"
+        },
+        "description": {
+            "en": "Reinstall operating systems on selected servers. This can erase existing server data.",
+            "lt": "Perdiegti pasirinktų serverių operacines sistemas. Tai gali ištrinti esamus serverio duomenis."
+        },
+        "implies": [],
+        "billing": "none",
+        "legacy": false
+    },
+    "services:restore": {
+        "label": {
+            "en": "Restore or delete selected server snapshots",
+            "lt": "Atkurti arba trinti pasirinktų serverių momentines kopijas"
+        },
+        "description": {
+            "en": "Restore selected servers from snapshots or delete snapshots. Restoring replaces current data; deleting removes a recovery point.",
+            "lt": "Atkurti pasirinktus serverius iš momentinių kopijų arba trinti kopijas. Atkūrimas pakeičia esamus duomenis; ištrynus kopiją prarandamas atkūrimo taškas."
+        },
+        "implies": [],
+        "billing": "none",
+        "legacy": false
+    },
+    "services:rescue": {
+        "label": {
+            "en": "Start or exit selected server rescue mode",
+            "lt": "Įjungti ar išjungti pasirinktų serverių atkūrimo režimą"
+        },
+        "description": {
+            "en": "Start or exit rescue mode on selected servers. May restart a server or interrupt its workload. Includes viewing selected servers.",
+            "lt": "Įjungti ar išjungti pasirinktų serverių atkūrimo režimą. Gali perkrauti serverį ar nutraukti jo darbą. Apima serverių peržiūrą."
+        },
+        "implies": [
+            "services:read"
+        ],
+        "billing": "none",
+        "legacy": false
+    },
+    "dns:read": {
+        "label": {
+            "en": "View account DNS",
+            "lt": "Peržiūrėti paskyros DNS"
+        },
+        "description": {
+            "en": "View account DNS zones, records, diagnostics, DNSSEC state and zone history.",
+            "lt": "Peržiūrėti paskyros DNS zonas, įrašus, diagnostiką, DNSSEC būseną ir zonų istoriją."
+        },
+        "implies": [],
+        "billing": "none",
+        "legacy": false
+    },
+    "dns:write": {
+        "label": {
+            "en": "Manage account DNS",
+            "lt": "Valdyti paskyros DNS"
+        },
+        "description": {
+            "en": "Create, change, import or delete account DNS zones and records. Can redirect traffic or interrupt domains. Includes DNS viewing.",
+            "lt": "Kurti, keisti, importuoti ar trinti paskyros DNS zonas ir įrašus. Gali nukreipti srautą ar sutrikdyti domenų veikimą. Apima DNS peržiūrą."
+        },
+        "implies": [
+            "dns:read"
+        ],
+        "billing": "none",
+        "legacy": false
+    },
+    "dnssec:manage": {
+        "label": {
+            "en": "Manage account DNSSEC",
+            "lt": "Valdyti paskyros DNSSEC"
+        },
+        "description": {
+            "en": "Change DNSSEC signing for account DNS zones. Incorrect changes can interrupt DNS resolution. Includes DNS viewing.",
+            "lt": "Keisti paskyros DNS zonų DNSSEC pasirašymą. Klaidingi pakeitimai gali sutrikdyti DNS veikimą. Apima DNS peržiūrą."
+        },
+        "implies": [
+            "dns:read"
+        ],
+        "billing": "none",
+        "legacy": false
+    },
+    "domains:read": {
+        "label": {
+            "en": "View account domains",
+            "lt": "Peržiūrėti paskyros domenus"
+        },
+        "description": {
+            "en": "View account domains, nameservers, glue records, parent DS records and contacts.",
+            "lt": "Peržiūrėti paskyros domenus, vardų serverius, glue ir tėvinės zonos DS įrašus bei kontaktus."
+        },
+        "implies": [],
+        "billing": "none",
+        "legacy": false
+    },
+    "domains:manage": {
+        "label": {
+            "en": "Manage account domains",
+            "lt": "Valdyti paskyros domenus"
+        },
+        "description": {
+            "en": "Change account domain nameservers, glue records, parent DS records and contacts. Can interrupt domain resolution. Includes domain viewing; registration requires separate purchase permission.",
+            "lt": "Keisti paskyros domenų vardų serverius, glue ir tėvinės zonos DS įrašus bei kontaktus. Gali sutrikdyti domenų veikimą. Apima peržiūrą; registravimui reikia atskiro pirkimo leidimo."
+        },
+        "implies": [
+            "domains:read"
+        ],
+        "billing": "none",
+        "legacy": false
+    },
+    "certificates:read": {
+        "label": {
+            "en": "View account TLS certificates",
+            "lt": "Peržiūrėti paskyros TLS sertifikatus"
+        },
+        "description": {
+            "en": "View account TLS certificates, validation and actions, and download available certificate material.",
+            "lt": "Peržiūrėti paskyros TLS sertifikatus, patvirtinimą, veiksmus ir atsisiųsti prieinamą sertifikatų medžiagą."
+        },
+        "implies": [],
+        "billing": "none",
+        "legacy": false
+    },
+    "certificates:manage": {
+        "label": {
+            "en": "Manage account TLS certificates",
+            "lt": "Valdyti paskyros TLS sertifikatus"
+        },
+        "description": {
+            "en": "Create or renew free certificates and manage existing certificates and automatic SSL subscriptions, including cancellation or revocation. Includes certificate viewing; excludes purchases.",
+            "lt": "Kurti ar pratęsti nemokamus sertifikatus ir valdyti esamus sertifikatus bei automatinio SSL prenumeratas, įskaitant atšaukimą. Apima sertifikatų peržiūrą; pirkimai neįtraukti."
+        },
+        "implies": [
+            "certificates:read"
+        ],
+        "billing": "none",
+        "legacy": false
+    },
+    "ssh_keys:read": {
+        "label": {
+            "en": "View account public SSH keys",
+            "lt": "Peržiūrėti paskyros viešuosius SSH raktus"
+        },
+        "description": {
+            "en": "View public SSH keys saved in your account. Does not expose private keys.",
+            "lt": "Peržiūrėti paskyroje išsaugotus viešuosius SSH raktus. Privatūs raktai neatskleidžiami."
+        },
+        "implies": [],
+        "billing": "none",
+        "legacy": false
+    },
+    "ssh_keys:manage": {
+        "label": {
+            "en": "Manage account public SSH keys",
+            "lt": "Valdyti paskyros viešuosius SSH raktus"
+        },
+        "description": {
+            "en": "Add or delete account public SSH keys. Includes key viewing; installing a key on a server requires vm:exec permission.",
+            "lt": "Pridėti ar trinti paskyros viešuosius SSH raktus. Apima raktų peržiūrą; diegimui serveryje reikia vm:exec leidimo."
+        },
+        "implies": [
+            "ssh_keys:read"
+        ],
+        "billing": "none",
+        "legacy": false
+    },
+    "orders:read": {
+        "label": {
+            "en": "View server plans and server or domain purchase results",
+            "lt": "Peržiūrėti serverių planus ir serverių ar domenų pirkimo rezultatus"
+        },
+        "description": {
+            "en": "View server plans, order options and existing server or domain purchase results. Does not submit a purchase. Available only through the separate orders profile.",
+            "lt": "Peržiūrėti serverių planus, užsakymo parinktis ir esamų serverių ar domenų pirkimų rezultatus. Pirkimo neatlieka. Prieinama tik atskirame užsakymų profilyje."
+        },
+        "implies": [],
+        "billing": "none",
+        "legacy": false
+    },
+    "orders:servers": {
+        "label": {
+            "en": "Purchase VPS servers from your balance",
+            "lt": "Pirkti VPS serverius iš balanso"
+        },
+        "description": {
+            "en": "Quote and purchase VPS servers using your VPSnet balance after approval of the final gross EUR amount and period, within this connection’s daily and monthly limits. Includes viewing order plans and purchase results. Available only through the separate orders profile.",
+            "lt": "Gauti VPS serverių pasiūlymus ir pirkti iš VPSnet balanso, patvirtinus galutinę EUR sumą su mokesčiais bei laikotarpį, neviršijant jungties dienos ir mėnesio ribų. Apima planų ir pirkimų rezultatų peržiūrą. Prieinama tik atskirame užsakymų profilyje."
+        },
+        "implies": [
+            "orders:read"
+        ],
+        "billing": "purchase_balance",
+        "legacy": false
+    },
+    "orders:domains": {
+        "label": {
+            "en": "Register domains from your balance",
+            "lt": "Registruoti domenus iš balanso"
+        },
+        "description": {
+            "en": "Quote and register domains using your VPSnet balance after approval of the final gross EUR amount and period, within this connection’s daily and monthly limits. Registration may be non-refundable. Includes viewing order plans and purchase results. Available only through the separate orders profile.",
+            "lt": "Gauti domenų pasiūlymus ir registruoti iš VPSnet balanso, patvirtinus galutinę EUR sumą su mokesčiais bei laikotarpį, neviršijant jungties dienos ir mėnesio ribų. Registravimo mokestis gali būti negrąžinamas. Apima planų ir pirkimų rezultatų peržiūrą. Prieinama tik atskirame užsakymų profilyje."
+        },
+        "implies": [
+            "orders:read"
+        ],
+        "billing": "purchase_balance",
+        "legacy": false
+    }
+};
+export function scopeDescriptions(scopes) {
+    return Object.fromEntries(scopes.map(scope => [scope, scopeCatalog[scope].description.en]));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vpsnet-mcp",
-  "version": "2.3.12",
+  "version": "2.3.14",
   "type": "module",
   "description": "MCP server for managing VPSnet.com services, applications, DNS, domains, billing, and server lifecycle operations",
   "bin": {
@@ -35,6 +35,7 @@
     "build/http-server.js",
     "build/request-context.js",
     "build/remote-policy.js",
+    "build/scope-catalog.js",
     "build/remote-auth-error.js",
     "build/remote-tools.js",
     "build/remote-orders.js"