vpsnet-mcp 2.3.13 → 2.3.15

package/README.md

@@ -40,6 +40,8 @@ endpoint and task skills. The npm package supplies the local MCP server;
 installable plugin bundles also carry the AI application's manifest and skills.
 
 Build all client bundles with `python3 scripts/package-distribution.py`.
+The same build creates four [self-contained skill imports](docs/STANDALONE_SKILLS.md)
+for clients that import one skill folder or ZIP at a time.
 The output includes checksums and identifies each format. Public directory
 submission materials are in [the catalog kit](distribution/catalogs/README.md).
 
@@ -337,7 +339,10 @@ Choose your environment:
 - [VS Code with GitHub Copilot](#vs-code-with-github-copilot) — Copilot agent mode
 - [Cline](#cline) / [Cursor](#cursor) / [Windsurf](#windsurf) / [Roo Code](#roo-code) / [Codex](#codex) — Other clients
 
-The standard config works across most MCP clients:
+The following local stdio example uses the `mcpServers` configuration format
+supported by several MCP clients. Use your client's native schema; VS Code's
+`.vscode/mcp.json` uses `servers` instead. For customer OAuth and the hosted
+connector, use [AI client setup](docs/CLIENTS.md).
 
 ```json
 {
@@ -495,7 +500,8 @@ Go to **Cursor Settings** > **MCP** > **Add new MCP Server**. Use command type w
 <details>
 <summary>Roo Code</summary>
 
-Open Roo Code MCP settings and add to `roo_mcp_settings.json`:
+Open Roo Code MCP settings and choose **Edit Global MCP** (currently
+`mcp_settings.json`), or **Edit Project MCP** for `.roo/mcp.json`:
 
 ```json
 {
@@ -516,24 +522,74 @@ Open Roo Code MCP settings and add to `roo_mcp_settings.json`:
 </details>
 
 <details>
-<summary>VS Code with GitHub Copilot</summary>
+<summary id="vs-code-with-github-copilot">VS Code with GitHub Copilot</summary>
 
-Install using the VS Code CLI:
+For the hosted customer OAuth connection, run **MCP: Add Server** and enter
+`https://mcp.vpsnet.com/mcp`, or merge this native VS Code entry into
+`.vscode/mcp.json`, preserving other servers:
+
+```json
+{
+  "servers": {
+    "vpsnet": {
+      "type": "http",
+      "url": "https://mcp.vpsnet.com/mcp"
+    }
+  }
+}
+```
+
+Complete the browser sign-in and consent flow when requested. Copilot's portable
+workspace `.mcp.json` and user `~/.copilot/mcp-config.json` use a top-level
+`mcpServers` object instead. These formats are distinct from the Claude Code
+extension's configuration.
+
+For the separate local stdio package with your own VPSnet API key, install using
+the VS Code CLI:
 
 ```bash
 code --add-mcp '{"name":"vpsnet","command":"npx","args":["-y","vpsnet-mcp"],"env":{"VPSNET_API_KEY":"your_api_key_here"}}'
 ```
 
-Or add to your VS Code MCP config manually using the standard config above.
+For manual native VS Code configuration, place that local server's `command`,
+`args` and private `env` under `servers.vpsnet`, rather than copying the generic
+`mcpServers` wrapper. VS Code's **MCP: Reset Cached Tools** refreshes a stale
+tool catalog. See [official MCP configuration](https://code.visualstudio.com/docs/agents/reference/mcp-configuration).
 
 > This is for **GitHub Copilot** agent mode in VS Code. For the **Claude Code** extension, see the [Claude Code for VS Code Extension](#claude-code-for-vs-code-extension) section.
 
 </details>
 
 <details>
-<summary>Windsurf</summary>
+<summary id="windsurf">Windsurf / Devin Desktop</summary>
+
+Current official Windsurf documentation redirects to Devin Desktop. Choose the
+agent you are using: legacy Cascade and the current Devin Local agent have
+different MCP setup paths.
+
+For Devin Local, add and authenticate the hosted connector with the Devin CLI:
+
+```sh
+devin mcp add vpsnet https://mcp.vpsnet.com/mcp
+devin mcp login vpsnet --scopes services:read
+```
 
-Follow the [Windsurf MCP documentation](https://docs.windsurf.com/windsurf/mcp). Use the standard config above.
+This requests a read baseline. Request the documented scopes required for other
+tasks through a new authorization flow before approving them. If authorization
+is lost, use the Desktop **Authenticate** action, or `devin mcp logout vpsnet`
+followed by the login command. Current CLI versions use dedicated
+`.devin/mcp_config.json`, `.devin/mcp_config.local.json` or user
+`~/.config/devin/mcp_config.json` files.
+
+For legacy Cascade, open the panel's **Actions → Open MCP config file** and merge
+a server under `mcpServers` with `serverUrl: "https://mcp.vpsnet.com/mcp"`.
+Complete its OAuth flow. Cascade has a 100-tool total limit, so inspect the
+enabled tools. The local stdio example above is a separate API-key connection.
+
+Follow the official [Devin Local MCP guide](https://docs.devin.ai/cli/extensibility/mcp/configuration)
+or [legacy Cascade guide](https://docs.devin.ai/desktop/cascade/mcp) for your
+surface. Client authentication and VPSnet compatibility still need verification
+on the actual client version.
 
 </details>
 

package/build/http-server.js

@@ -3,6 +3,7 @@ import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/
 import { createVpsnetServer } from "./index.js";
 import { resolveApiBase } from "./api.js";
 import { requireRequestAuthorization, withAuthorization } from "./request-context.js";
+import { scopeDescriptions } from "./scope-catalog.js";
 import { supportedScopes, orderScopes } from "./remote-policy.js";
 function publicUrl(value) {
     const url = new URL(value);
@@ -70,7 +71,7 @@ export function createRemoteServer(options) {
             return;
         }
         if (req.method === 'GET' && ['/.well-known/oauth-protected-resource', '/.well-known/oauth-protected-resource/mcp'].includes(req.url ?? '')) {
-            return json(res, 200, { resource: resource.href, authorization_servers: [issuer], scopes_supported: allowedScopes, bearer_methods_supported: ['header'], resource_name: 'VPSnet' });
+            return json(res, 200, { resource: resource.href, authorization_servers: [issuer], scopes_supported: allowedScopes, scope_descriptions: scopeDescriptions(allowedScopes), bearer_methods_supported: ['header'], resource_name: 'VPSnet' });
         }
         if (req.url !== '/mcp')
             return json(res, 404, { error: 'not_found' });

package/build/remote-policy.js

@@ -8,6 +8,7 @@ export const remoteInstructions = [
     "Firecracker VPS supports general-purpose and resource-intensive Linux workloads with substantial server resources and low virtualization overhead. MicroVM describes the lightweight design, not a small server limit. Consider it when KVM-specific features are unnecessary; match current plans to resource and availability requirements.",
     "Cloud VPS (KVM) offers Linux and BSD support, automatic Windows Server provisioning, three-copy Ceph NVMe storage on enterprise drives with power-loss protection (PLP), HA restart on another host after host failure, and live migration to another node for planned host upgrades, with migration back when appropriate.",
     "Use the connected VPSnet account and only the services and permissions it granted. Never request a model API key.",
+    "On first VPSnet use in a conversation, call get_update_info once when available. Read an installed skill's bundled plugin-version reference if accessible; otherwise omit pluginVersion rather than infer it from clientInfo.version or repository HEAD. Keep checked/dismissed state only in conversation context. If an actually observed plugin/local version is older, give one concise native update advisory and continue the task. For unknown/current versions or unavailable release facts, stay quiet unless the user asks about updates. Never force an update, change grants or treat a published runtime as proof of deployment.",
     "Tool discovery describes supported capabilities, not granted authority. Compare the scopes and selected services from get_connected_account with each tool's required scope metadata. Explain missing permissions only when relevant to the user's task. Ask the customer to approve the required permission by re-authorizing this existing VPSnet connection through the AI app's OAuth flow; never work around a denial.",
     "Inspect current capabilities and state before a change. Honor the user's existing authorization; obtain consent when a change expands the task, destroys unrelated data or adds unapproved exposure.",
     "Keep operation IDs, reason codes and idempotency keys. Accepted means pending; read the final state before claiming success.",
@@ -118,7 +119,7 @@ const permissions = new Map([
     ["get_system_status", "authenticated"],
     ["get_faq", "authenticated"],
     ["get_pricing", "authenticated"],
-    ["get_connected_account", "authenticated"],
+    ["get_connected_account", "authenticated"], ["get_update_info", "authenticated"],
     ["open_vm_session", "vm:session"], ["run_vm_command", "vm:exec"], ["read_vm_file", "vm:files:read"],
     ["write_vm_file", "vm:files:write"], ["create_vm_file", "vm:files:write"], ["inspect_vm", "vm:diagnostics"], ["get_vm_operation", "vm:session"], ["cancel_vm_operation", "vm:session"],
 ]);
@@ -227,7 +228,14 @@ export function installRemotePolicy(server, scopes, profile = 'directory') {
             return setRequestHandler(schema, handler);
         return setRequestHandler(schema, async (...args) => {
             const response = await handler(...args);
-            return { ...response, tools: response.tools.filter((tool) => !legacyAggregateTools.has(tool.name)) };
+            return { ...response, tools: response.tools
+                    .filter((tool) => !legacyAggregateTools.has(tool.name))
+                    // SDK registerTool preserves _meta but drops unknown top-level config
+                    // fields. Add the canonical declaration to the emitted descriptor,
+                    // using exactly the same scopes as its compatibility mirror.
+                    .map((tool) => ({
+                    ...tool, securitySchemes: tool._meta?.securitySchemes,
+                })) };
         });
     });
     const original = server.registerTool.bind(server);

package/build/remote-tools.js

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import { randomBytes } from 'node:crypto';
 import { apiRequest, resolveApiBase } from './api.js';
+import { getUpdateInfo, updateInfoOutput } from './update-info.js';
 const resource = { orderNo: z.string().regex(/^[A-Za-z0-9-]{1,64}$/), sessionBinding: z.string().regex(/^[a-f0-9]{32}$/, 'sessionBinding must contain exactly 32 lowercase hexadecimal characters (0-9, a-f), without hyphens. For a new open_vm_session call, omit it so VPSnet creates it; otherwise reuse the returned sessionBinding.').describe('Exactly 32 lowercase hexadecimal characters (0-9, a-f), without hyphens. Copy sessionBinding from open_vm_session and reuse it for every operation and reconnect. Not a credential.') };
 const session = { ...resource, sessionId: z.string().uuid() };
 const idempotencyKey = z.string().regex(/^[A-Za-z0-9_-]{16,128}$/).describe('Stable key for this exact operation. Reuse after a lost response; never automatically replace.');
@@ -76,9 +77,23 @@ async function operationResult(orderNo, sessionBinding, operationId, cancel = fa
     return runtime(await lease(orderNo, sessionBinding, true), cancel ? 'POST' : 'GET', `/mcp/operations/${operationId}${cancel ? '/cancel' : ''}`, cancel ? {} : undefined);
 }
 export function registerRemoteTools(server) {
+    server.registerTool('get_update_info', {
+        description: 'Read public VPSnet releases and reviewed client update guidance without changing software, credentials or permissions. On first VPSnet use in a conversation, check once when available. Pass installed versions only if actually observed or user-reported; never infer them from host clientInfo.version or the gateway runtime. Unknown installed versions stay unknown. If an observed version is older, give one concise advisory and continue; otherwise stay quiet unless the user asks about updates. Remember checks and dismissals in conversation context, not customer tracking. VPSnet maintains the hosted gateway.',
+        inputSchema: {
+            client: z.string().max(64).optional().describe('Known client identifier such as codex, claude-code or gemini-cli; omit when unknown.'),
+            pluginVersion: z.string().max(63).optional().describe('Observed or user-reported installed VPSnet plugin version, not the host application version. Omit if unknown.'),
+            localMcpVersion: z.string().max(63).optional().describe('Observed or user-reported local vpsnet-mcp npm version. Omit for remote-only connections or when unknown.'),
+        }, outputSchema: updateInfoOutput,
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    }, async (args) => { const data = await getUpdateInfo(args); return { ...result(data), structuredContent: data }; });
+    const spendingLimit = z.union([z.number().finite().nonnegative(), z.string().regex(/^\d+(?:\.\d+)?$/)]).nullable().optional();
     server.registerTool('get_connected_account', {
-        description: 'Identify the connected VPSnet account and its granted permissions and services.', inputSchema: {},
-        annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, _meta: { 'openai/profile': true },
+        description: 'Identify the connected VPSnet account and its granted permissions, selected services and spending limits.', inputSchema: {},
+        outputSchema: z.object({
+            id: z.string().min(1), name: z.string(), scopes: z.array(z.string()), services: z.array(z.string()),
+            function_daily_limit_eur: spendingLimit, order_daily_limit_eur: spendingLimit, order_monthly_limit_eur: spendingLimit,
+        }).passthrough(),
+        annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },
     }, async () => { const { data } = await apiRequest('GET', '/account/mcp/profile'); return { ...result(data), structuredContent: data }; });
     server.registerTool('open_vm_session', {
         description: 'Open an authorized Linux session on a selected KVM or Firecracker service. The VPSnet guest channel works without a VM IP, SSH password or guest internet connection; choose connectionMethod="guest" for network/SSH troubleshooting or "ssh" for the independent SSH path. Auto prefers the guest channel. Requires explicit VM permission. Omit sessionBinding for a new session; VPSnet generates it and returns it with sessionId. Reuse both returned values for commands, files and reconnects. The OS user is root. Read /etc/os-release through the first operation to verify guest connectivity before choosing OS-specific commands or making changes. An empty managed-app list does not mean the server has no software.',

package/build/scope-catalog.js

@@ -0,0 +1,417 @@
+// Generated from backend app/Services/Mcp/scope-catalog.json.
+// Update with scripts/sync-scope-catalog.py; OAuth policy is enforced separately.
+export const scopeCatalog = {
+    "services:read": {
+        "label": {
+            "en": "View selected servers",
+            "lt": "Peržiūrėti pasirinktus serverius"
+        },
+        "description": {
+            "en": "View selected servers, status, graphs, history, backups and snapshots; browsing backup files may queue a saved browse operation.",
+            "lt": "Peržiūrėti pasirinktus serverius, būseną, grafikus, istoriją, atsargines ir momentines kopijas; kopijų failų naršymas gali sukurti išsaugomą užduotį."
+        },
+        "implies": [],
+        "billing": "none",
+        "legacy": false
+    },
+    "services:manage": {
+        "label": {
+            "en": "Manage selected servers",
+            "lt": "Valdyti pasirinktus serverius"
+        },
+        "description": {
+            "en": "Start, stop or restart selected servers and change their settings, including guest DNS and firewall reset. Includes viewing selected servers.",
+            "lt": "Paleisti, stabdyti ar perkrauti pasirinktus serverius ir keisti jų nustatymus, įskaitant DNS bei ugniasienės atkūrimą. Apima serverių peržiūrą."
+        },
+        "implies": [
+            "services:read"
+        ],
+        "billing": "none",
+        "legacy": false
+    },
+    "applications:read": {
+        "label": {
+            "en": "View selected server applications",
+            "lt": "Peržiūrėti pasirinktų serverių programas"
+        },
+        "description": {
+            "en": "View applications, recipes, health and logs on selected servers; diagnostics may start saved inspection jobs.",
+            "lt": "Peržiūrėti pasirinktų serverių programas, receptus, būseną ir žurnalus; diagnostika gali paleisti išsaugomas patikros užduotis."
+        },
+        "implies": [],
+        "billing": "none",
+        "legacy": false
+    },
+    "applications:manage": {
+        "label": {
+            "en": "Manage selected server applications",
+            "lt": "Valdyti pasirinktų serverių programas"
+        },
+        "description": {
+            "en": "Install, configure, update, stop, remove or roll back applications and recipes on selected servers. May replace or delete application data. Includes application viewing.",
+            "lt": "Diegti, konfigūruoti, atnaujinti, stabdyti, šalinti ar atkurti pasirinktų serverių programas ir receptus. Gali pakeisti ar ištrinti programų duomenis. Apima programų peržiūrą."
+        },
+        "implies": [
+            "applications:read"
+        ],
+        "billing": "none",
+        "legacy": false
+    },
+    "networking:read": {
+        "label": {
+            "en": "View account networks",
+            "lt": "Peržiūrėti paskyros tinklus"
+        },
+        "description": {
+            "en": "View existing networks, attachments, routes and network appliance status across your account.",
+            "lt": "Peržiūrėti esamus paskyros tinklus, jungtis, maršrutus ir tinklo įrenginių būseną."
+        },
+        "implies": [],
+        "billing": "none",
+        "legacy": false
+    },
+    "networking:manage": {
+        "label": {
+            "en": "Manage account networks",
+            "lt": "Valdyti paskyros tinklus"
+        },
+        "description": {
+            "en": "Create, change or remove existing-account networks, routes, attachments and appliances. May interrupt connectivity. Includes network viewing; excludes purchases and renewals.",
+            "lt": "Kurti, keisti ar šalinti paskyros tinklus, maršrutus, jungtis ir įrenginius. Gali sutrikdyti ryšį. Apima tinklų peržiūrą; pirkimai ir pratęsimai neįtraukti."
+        },
+        "implies": [
+            "networking:read"
+        ],
+        "billing": "none",
+        "legacy": false
+    },
+    "functions:read": {
+        "label": {
+            "en": "View Functions and run results",
+            "lt": "Peržiūrėti Functions ir vykdymo rezultatus"
+        },
+        "description": {
+            "en": "View account Functions, their configuration, history and invocation results.",
+            "lt": "Peržiūrėti paskyros Functions, jų konfigūraciją, istoriją ir vykdymo rezultatus."
+        },
+        "implies": [],
+        "billing": "none",
+        "legacy": false
+    },
+    "functions:manage": {
+        "label": {
+            "en": "Manage Functions",
+            "lt": "Valdyti Functions"
+        },
+        "description": {
+            "en": "Create, update or delete account Functions and their code. Includes viewing Functions; running them requires separate paid execution permission.",
+            "lt": "Kurti, atnaujinti ar trinti paskyros Functions ir jų kodą. Apima Functions peržiūrą; vykdymui reikia atskiro mokamo vykdymo leidimo."
+        },
+        "implies": [
+            "functions:read"
+        ],
+        "billing": "none",
+        "legacy": false
+    },
+    "functions:invoke": {
+        "label": {
+            "en": "Run Functions (usage charges)",
+            "lt": "Vykdyti Functions (mokama pagal naudojimą)"
+        },
+        "description": {
+            "en": "Run existing account Functions using your VPSnet balance. Usage charges apply; your AI subscription does not cover them. Includes viewing Functions and run results. The daily limit counts total account Functions spending, including pending runs.",
+            "lt": "Vykdyti paskyros Functions naudojant VPSnet balansą. Taikomi naudojimo mokesčiai; AI prenumerata jų nepadengia. Apima Functions ir rezultatų peržiūrą. Dienos riba apima visas paskyros Functions išlaidas, įskaitant laukiančius vykdymus."
+        },
+        "implies": [
+            "functions:read"
+        ],
+        "billing": "usage_balance",
+        "legacy": false
+    },
+    "vm:diagnostics": {
+        "label": {
+            "en": "Inspect selected servers",
+            "lt": "Tikrinti pasirinktus serverius"
+        },
+        "description": {
+            "en": "Run bounded diagnostics on selected servers and save operation results. Does not grant arbitrary commands or file access.",
+            "lt": "Vykdyti ribotą pasirinktų serverių diagnostiką ir išsaugoti rezultatus. Nesuteikia savavališkų komandų ar failų prieigos."
+        },
+        "implies": [],
+        "billing": "none",
+        "legacy": false
+    },
+    "vm:files:read": {
+        "label": {
+            "en": "Read selected server files as root",
+            "lt": "Skaityti pasirinktų serverių failus root teisėmis"
+        },
+        "description": {
+            "en": "Read files on selected servers with root privileges through saved guest operations. Files may contain secrets.",
+            "lt": "Skaityti pasirinktų serverių failus root teisėmis per išsaugomas užduotis. Failuose gali būti paslapčių."
+        },
+        "implies": [],
+        "billing": "none",
+        "legacy": false
+    },
+    "vm:files:write": {
+        "label": {
+            "en": "Read and change selected server files as root",
+            "lt": "Skaityti ir keisti pasirinktų serverių failus root teisėmis"
+        },
+        "description": {
+            "en": "Create or overwrite files on selected servers with root privileges. Includes reading files; changes can replace data or affect server operation.",
+            "lt": "Kurti ar perrašyti pasirinktų serverių failus root teisėmis. Apima failų skaitymą; pakeitimai gali pakeisti duomenis ar paveikti serverio veikimą."
+        },
+        "implies": [
+            "vm:files:read"
+        ],
+        "billing": "none",
+        "legacy": false
+    },
+    "vm:exec": {
+        "label": {
+            "en": "Run selected server commands as root",
+            "lt": "Vykdyti pasirinktų serverių komandas root teisėmis"
+        },
+        "description": {
+            "en": "Run arbitrary commands and install root SSH access on selected servers. Can read, change or delete data through commands. Includes bounded server diagnostics.",
+            "lt": "Vykdyti savavališkas komandas ir įdiegti root SSH prieigą pasirinktuose serveriuose. Komandos gali skaityti, keisti ar trinti duomenis. Apima ribotą serverių diagnostiką."
+        },
+        "implies": [
+            "vm:diagnostics"
+        ],
+        "billing": "none",
+        "legacy": false
+    },
+    "vm:files": {
+        "label": {
+            "en": "Read and change selected server files as root (legacy)",
+            "lt": "Skaityti ir keisti pasirinktų serverių failus root teisėmis (senasis leidimas)"
+        },
+        "description": {
+            "en": "Legacy combined file permission: includes vm:files:read and vm:files:write on selected servers. Can read secrets and overwrite data. Not advertised for new connections.",
+            "lt": "Senasis jungtinis failų leidimas: apima vm:files:read ir vm:files:write pasirinktuose serveriuose. Gali skaityti paslaptis ir perrašyti duomenis. Naujiems prisijungimams neskelbiamas."
+        },
+        "implies": [
+            "vm:files:read",
+            "vm:files:write"
+        ],
+        "billing": "none",
+        "legacy": true
+    },
+    "services:reinstall": {
+        "label": {
+            "en": "Reinstall selected server operating systems",
+            "lt": "Perdiegti pasirinktų serverių operacines sistemas"
+        },
+        "description": {
+            "en": "Reinstall operating systems on selected servers. This can erase existing server data.",
+            "lt": "Perdiegti pasirinktų serverių operacines sistemas. Tai gali ištrinti esamus serverio duomenis."
+        },
+        "implies": [],
+        "billing": "none",
+        "legacy": false
+    },
+    "services:restore": {
+        "label": {
+            "en": "Restore or delete selected server snapshots",
+            "lt": "Atkurti arba trinti pasirinktų serverių momentines kopijas"
+        },
+        "description": {
+            "en": "Restore selected servers from snapshots or delete snapshots. Restoring replaces current data; deleting removes a recovery point.",
+            "lt": "Atkurti pasirinktus serverius iš momentinių kopijų arba trinti kopijas. Atkūrimas pakeičia esamus duomenis; ištrynus kopiją prarandamas atkūrimo taškas."
+        },
+        "implies": [],
+        "billing": "none",
+        "legacy": false
+    },
+    "services:rescue": {
+        "label": {
+            "en": "Start or exit selected server rescue mode",
+            "lt": "Įjungti ar išjungti pasirinktų serverių atkūrimo režimą"
+        },
+        "description": {
+            "en": "Start or exit rescue mode on selected servers. May restart a server or interrupt its workload. Includes viewing selected servers.",
+            "lt": "Įjungti ar išjungti pasirinktų serverių atkūrimo režimą. Gali perkrauti serverį ar nutraukti jo darbą. Apima serverių peržiūrą."
+        },
+        "implies": [
+            "services:read"
+        ],
+        "billing": "none",
+        "legacy": false
+    },
+    "dns:read": {
+        "label": {
+            "en": "View account DNS",
+            "lt": "Peržiūrėti paskyros DNS"
+        },
+        "description": {
+            "en": "View account DNS zones, records, diagnostics, DNSSEC state and zone history.",
+            "lt": "Peržiūrėti paskyros DNS zonas, įrašus, diagnostiką, DNSSEC būseną ir zonų istoriją."
+        },
+        "implies": [],
+        "billing": "none",
+        "legacy": false
+    },
+    "dns:write": {
+        "label": {
+            "en": "Manage account DNS",
+            "lt": "Valdyti paskyros DNS"
+        },
+        "description": {
+            "en": "Create, change, import or delete account DNS zones and records. Can redirect traffic or interrupt domains. Includes DNS viewing.",
+            "lt": "Kurti, keisti, importuoti ar trinti paskyros DNS zonas ir įrašus. Gali nukreipti srautą ar sutrikdyti domenų veikimą. Apima DNS peržiūrą."
+        },
+        "implies": [
+            "dns:read"
+        ],
+        "billing": "none",
+        "legacy": false
+    },
+    "dnssec:manage": {
+        "label": {
+            "en": "Manage account DNSSEC",
+            "lt": "Valdyti paskyros DNSSEC"
+        },
+        "description": {
+            "en": "Change DNSSEC signing for account DNS zones. Incorrect changes can interrupt DNS resolution. Includes DNS viewing.",
+            "lt": "Keisti paskyros DNS zonų DNSSEC pasirašymą. Klaidingi pakeitimai gali sutrikdyti DNS veikimą. Apima DNS peržiūrą."
+        },
+        "implies": [
+            "dns:read"
+        ],
+        "billing": "none",
+        "legacy": false
+    },
+    "domains:read": {
+        "label": {
+            "en": "View account domains",
+            "lt": "Peržiūrėti paskyros domenus"
+        },
+        "description": {
+            "en": "View account domains, nameservers, glue records, parent DS records and contacts.",
+            "lt": "Peržiūrėti paskyros domenus, vardų serverius, glue ir tėvinės zonos DS įrašus bei kontaktus."
+        },
+        "implies": [],
+        "billing": "none",
+        "legacy": false
+    },
+    "domains:manage": {
+        "label": {
+            "en": "Manage account domains",
+            "lt": "Valdyti paskyros domenus"
+        },
+        "description": {
+            "en": "Change account domain nameservers, glue records, parent DS records and contacts. Can interrupt domain resolution. Includes domain viewing; registration requires separate purchase permission.",
+            "lt": "Keisti paskyros domenų vardų serverius, glue ir tėvinės zonos DS įrašus bei kontaktus. Gali sutrikdyti domenų veikimą. Apima peržiūrą; registravimui reikia atskiro pirkimo leidimo."
+        },
+        "implies": [
+            "domains:read"
+        ],
+        "billing": "none",
+        "legacy": false
+    },
+    "certificates:read": {
+        "label": {
+            "en": "View account TLS certificates",
+            "lt": "Peržiūrėti paskyros TLS sertifikatus"
+        },
+        "description": {
+            "en": "View account TLS certificates, validation and actions, and download available certificate material.",
+            "lt": "Peržiūrėti paskyros TLS sertifikatus, patvirtinimą, veiksmus ir atsisiųsti prieinamą sertifikatų medžiagą."
+        },
+        "implies": [],
+        "billing": "none",
+        "legacy": false
+    },
+    "certificates:manage": {
+        "label": {
+            "en": "Manage account TLS certificates",
+            "lt": "Valdyti paskyros TLS sertifikatus"
+        },
+        "description": {
+            "en": "Create or renew free certificates and manage existing certificates and automatic SSL subscriptions, including cancellation or revocation. Includes certificate viewing; excludes purchases.",
+            "lt": "Kurti ar pratęsti nemokamus sertifikatus ir valdyti esamus sertifikatus bei automatinio SSL prenumeratas, įskaitant atšaukimą. Apima sertifikatų peržiūrą; pirkimai neįtraukti."
+        },
+        "implies": [
+            "certificates:read"
+        ],
+        "billing": "none",
+        "legacy": false
+    },
+    "ssh_keys:read": {
+        "label": {
+            "en": "View account public SSH keys",
+            "lt": "Peržiūrėti paskyros viešuosius SSH raktus"
+        },
+        "description": {
+            "en": "View public SSH keys saved in your account. Does not expose private keys.",
+            "lt": "Peržiūrėti paskyroje išsaugotus viešuosius SSH raktus. Privatūs raktai neatskleidžiami."
+        },
+        "implies": [],
+        "billing": "none",
+        "legacy": false
+    },
+    "ssh_keys:manage": {
+        "label": {
+            "en": "Manage account public SSH keys",
+            "lt": "Valdyti paskyros viešuosius SSH raktus"
+        },
+        "description": {
+            "en": "Add or delete account public SSH keys. Includes key viewing; installing a key on a server requires vm:exec permission.",
+            "lt": "Pridėti ar trinti paskyros viešuosius SSH raktus. Apima raktų peržiūrą; diegimui serveryje reikia vm:exec leidimo."
+        },
+        "implies": [
+            "ssh_keys:read"
+        ],
+        "billing": "none",
+        "legacy": false
+    },
+    "orders:read": {
+        "label": {
+            "en": "View server plans and server or domain purchase results",
+            "lt": "Peržiūrėti serverių planus ir serverių ar domenų pirkimo rezultatus"
+        },
+        "description": {
+            "en": "View server plans, order options and existing server or domain purchase results. Does not submit a purchase. Available only through the separate orders profile.",
+            "lt": "Peržiūrėti serverių planus, užsakymo parinktis ir esamų serverių ar domenų pirkimų rezultatus. Pirkimo neatlieka. Prieinama tik atskirame užsakymų profilyje."
+        },
+        "implies": [],
+        "billing": "none",
+        "legacy": false
+    },
+    "orders:servers": {
+        "label": {
+            "en": "Purchase VPS servers from your balance",
+            "lt": "Pirkti VPS serverius iš balanso"
+        },
+        "description": {
+            "en": "Quote and purchase VPS servers using your VPSnet balance after approval of the final gross EUR amount and period, within this connection’s daily and monthly limits. Includes viewing order plans and purchase results. Available only through the separate orders profile.",
+            "lt": "Gauti VPS serverių pasiūlymus ir pirkti iš VPSnet balanso, patvirtinus galutinę EUR sumą su mokesčiais bei laikotarpį, neviršijant jungties dienos ir mėnesio ribų. Apima planų ir pirkimų rezultatų peržiūrą. Prieinama tik atskirame užsakymų profilyje."
+        },
+        "implies": [
+            "orders:read"
+        ],
+        "billing": "purchase_balance",
+        "legacy": false
+    },
+    "orders:domains": {
+        "label": {
+            "en": "Register domains from your balance",
+            "lt": "Registruoti domenus iš balanso"
+        },
+        "description": {
+            "en": "Quote and register domains using your VPSnet balance after approval of the final gross EUR amount and period, within this connection’s daily and monthly limits. Registration may be non-refundable. Includes viewing order plans and purchase results. Available only through the separate orders profile.",
+            "lt": "Gauti domenų pasiūlymus ir registruoti iš VPSnet balanso, patvirtinus galutinę EUR sumą su mokesčiais bei laikotarpį, neviršijant jungties dienos ir mėnesio ribų. Registravimo mokestis gali būti negrąžinamas. Apima planų ir pirkimų rezultatų peržiūrą. Prieinama tik atskirame užsakymų profilyje."
+        },
+        "implies": [
+            "orders:read"
+        ],
+        "billing": "purchase_balance",
+        "legacy": false
+    }
+};
+export function scopeDescriptions(scopes) {
+    return Object.fromEntries(scopes.map(scope => [scope, scopeCatalog[scope].description.en]));
+}

package/build/update-info.js

@@ -0,0 +1,135 @@
+import { readFileSync } from 'node:fs';
+import { z } from 'zod';
+export const RELEASE_FEED_URL = 'https://raw.githubusercontent.com/bacarrdy/vpsnet-mcp/main/distribution/releases/published.json';
+export const MAX_FEED_BYTES = 65536;
+const stable = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
+const entry = z.object({
+    version: z.string().max(63).regex(stable), source_commit: z.string().regex(/^[0-9a-f]{40}$/),
+    verified_at: z.string().max(40).datetime({ offset: true }), url: z.string().max(256),
+    sha256: z.string().regex(/^[0-9a-f]{64}$/), ci_run: z.number().int().positive().safe(),
+    ci_conclusion: z.literal('success'),
+}).strict();
+const feedSchema = z.object({ schema_version: z.literal(1), plugin: entry, mcp: entry }).strict();
+const instructions = JSON.parse(readFileSync(new URL('../scripts/update-clients.json', import.meta.url), 'utf8'));
+const runtimeVersion = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version;
+export function validatePublishedFeed(value) {
+    const feed = feedSchema.parse(value);
+    if (feed.plugin.url !== `https://github.com/bacarrdy/vpsnet-mcp/releases/download/plugin-${feed.plugin.version}/vpsnet-plugin-${feed.plugin.version}.zip`
+        || feed.mcp.url !== `https://registry.npmjs.org/vpsnet-mcp/-/vpsnet-mcp-${feed.mcp.version}.tgz`) {
+        throw new Error('Unexpected release artifact URL');
+    }
+    return feed;
+}
+/** Reject duplicate keys (including escaped aliases) before normal JSON parsing. */
+export function parsePublishedFeed(text) {
+    const token = /\s*("(?:[^"\\\u0000-\u001f]|\\(?:["\\/bfnrt]|u[0-9a-fA-F]{4}))*"|true|false|null|-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?|[{}\[\],:])/gy;
+    const stack = [];
+    let position = 0;
+    while (position < text.length && text.slice(position).trim()) {
+        token.lastIndex = position;
+        const match = token.exec(text);
+        if (!match)
+            throw new Error('Invalid release JSON');
+        const value = match[1], frame = stack.at(-1);
+        if (value === '{' || value === '[')
+            stack.push({ object: value === '{', key: value === '{', keys: new Set() });
+        else if (value === '}' || value === ']')
+            stack.pop();
+        else if (value === ',' && frame?.object)
+            frame.key = true;
+        else if (value.startsWith('"') && frame?.object && frame.key) {
+            const name = JSON.parse(value);
+            if (frame.keys.has(name))
+                throw new Error('Duplicate release key');
+            frame.keys.add(name);
+            frame.key = false;
+        }
+        position = token.lastIndex;
+    }
+    return validatePublishedFeed(JSON.parse(text));
+}
+export async function fetchPublishedFeed(fetcher = fetch) {
+    const response = await fetcher(RELEASE_FEED_URL, {
+        redirect: 'error', signal: AbortSignal.timeout(5000), headers: { Accept: 'application/json' },
+    });
+    if (response.status !== 200 || !response.body)
+        throw new Error('Release feed unavailable');
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > MAX_FEED_BYTES)
+                throw new Error('Release feed too large');
+            chunks.push(value);
+        }
+    }
+    finally {
+        await reader.cancel().catch(() => { });
+    }
+    return parsePublishedFeed(new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks)));
+}
+let cache;
+async function cachedFeed() {
+    if (!cache || cache.expires <= Date.now()) {
+        // Public facts only: never cache account data, tokens or installed versions.
+        cache = { expires: Date.now() + 300_000, value: fetchPublishedFeed() };
+    }
+    return cache.value;
+}
+const observedSchema = z.object({ version: z.string().nullable(), source: z.enum(['caller_reported', 'runtime', 'unknown']) });
+export const updateInfoOutput = {
+    schema_version: z.literal(1), checked_at: z.string(), client: z.string(),
+    published: z.object({ plugin: entry, mcp: entry }).nullable(),
+    observed: z.object({ plugin: observedSchema, local_mcp: observedSchema, server: observedSchema }),
+    update_available: z.object({ plugin: z.boolean().nullable(), local_mcp: z.boolean().nullable(), server: z.boolean().nullable() }),
+    compatibility: z.object({ status: z.literal('unknown'), reason: z.string() }),
+    distribution_status: z.object({ source_release_published: z.boolean().nullable(), npm_package_published: z.boolean().nullable(),
+        remote_deployment_status: z.literal('unknown'), official_registry: z.object({ status: z.literal('unknown'), version: z.null(), checked_at: z.null() }),
+        downstream_catalogs: z.record(z.unknown()),
+    }),
+    instructions: z.object({ reviewed_at: z.string(), source_urls: z.array(z.string()), steps: z.array(z.string()) }).nullable(),
+    server_update: z.string(), advisory: z.literal(true), reason: z.string().nullable(),
+};
+function observed(value, runtime = false) {
+    return value && value.length < 64 && stable.test(value)
+        ? { version: value, source: runtime ? 'runtime' : 'caller_reported' }
+        : { version: null, source: 'unknown' };
+}
+function older(current, latest) {
+    if (current === null)
+        return null;
+    const a = current.split('.').map(BigInt), b = latest.split('.').map(BigInt);
+    for (let i = 0; i < 3; i++)
+        if (a[i] !== b[i])
+            return a[i] < b[i];
+    return false;
+}
+export async function getUpdateInfo(args, lookup = cachedFeed) {
+    let published = null;
+    try {
+        published = validatePublishedFeed(await lookup());
+    }
+    catch { /* Do not echo untrusted errors. */ }
+    const client = args.client ?? 'generic';
+    const observations = { plugin: observed(args.pluginVersion), local_mcp: observed(args.localMcpVersion), server: observed(runtimeVersion, true) };
+    return z.object(updateInfoOutput).parse({
+        schema_version: 1, checked_at: new Date().toISOString(), client,
+        published: published ? { plugin: published.plugin, mcp: published.mcp } : null,
+        observed: observations,
+        update_available: { plugin: published ? older(observations.plugin.version, published.plugin.version) : null,
+            local_mcp: published ? older(observations.local_mcp.version, published.mcp.version) : null,
+            server: published ? older(observations.server.version, published.mcp.version) : null },
+        compatibility: { status: 'unknown', reason: 'No version-specific client acceptance evidence is supplied by this check.' },
+        distribution_status: { source_release_published: published ? true : null, npm_package_published: published ? true : null,
+            remote_deployment_status: 'unknown', official_registry: { status: 'unknown', version: null, checked_at: null }, downstream_catalogs: {} },
+        instructions: Object.hasOwn(instructions, client) ? instructions[client] : null,
+        server_update: 'The hosted gateway is maintained by VPSnet. Updating a local npm package does not update it.',
+        advisory: true,
+        reason: published ? null : 'Published release information is unavailable or invalid; installed software is unchanged.',
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vpsnet-mcp",
-  "version": "2.3.13",
+  "version": "2.3.15",
   "type": "module",
   "description": "MCP server for managing VPSnet.com services, applications, DNS, domains, billing, and server lifecycle operations",
   "bin": {
@@ -35,8 +35,11 @@
     "build/http-server.js",
     "build/request-context.js",
     "build/remote-policy.js",
+    "build/scope-catalog.js",
     "build/remote-auth-error.js",
     "build/remote-tools.js",
+    "build/update-info.js",
+    "scripts/update-clients.json",
     "build/remote-orders.js"
   ],
   "repository": "github:bacarrdy/vpsnet-mcp",

package/scripts/update-clients.json

@@ -0,0 +1,204 @@
+{
+  "claude-code": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://code.claude.com/docs/en/plugins/cli-reference",
+      "https://code.claude.com/docs/en/discover-plugins"
+    ],
+    "steps": [
+      "Use claude plugin list --json to check the installed VPSnet plugin and its source.",
+      "For the VPSnet marketplace installation, run claude plugin update vpsnet@vpsnet in your own terminal.",
+      "Use /reload-plugins in the running session or start a new session. For another install source, use its native update control."
+    ]
+  },
+  "claude": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://claude.com/docs/plugins/overview"
+    ],
+    "steps": [
+      "Open Customize > Plugins. For an added marketplace, use Check for updates where available.",
+      "Uploaded or organization-managed plugins follow their owner's upload, sync and review process. A GitHub release alone does not prove the account's plugin updated."
+    ]
+  },
+  "cowork": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://claude.com/docs/plugins/overview",
+      "https://support.claude.com/en/articles/13837433-manage-plugins-for-your-organization"
+    ],
+    "steps": [
+      "Manage the account plugin in Customize > Plugins using the source's native update controls.",
+      "For an organization marketplace, ask its owner to upload or re-sync and complete any required review. The served version can remain pinned or await approval."
+    ]
+  },
+  "grok": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://docs.x.ai/grok/connectors"
+    ],
+    "steps": [
+      "Manage the custom remote connection at grok.com/connectors.",
+      "The official connector guide does not establish plugin ZIP updates or a tool-cache refresh command. A remote gateway deployment does not establish whether this conversation refreshed its tools."
+    ]
+  },
+  "codex": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://learn.chatgpt.com/docs/cli/reference",
+      "https://learn.chatgpt.com/docs/plugins"
+    ],
+    "steps": [
+      "Use codex plugin list --json to inspect installed and available plugin versions and the configured marketplace name.",
+      "For that configured marketplace, use codex plugin marketplace upgrade <marketplace-name> --json, then start a new session. Do not assume the active thread reloads plugins."
+    ]
+  },
+  "chatgpt": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://developers.openai.com/plugins/deploy/connect-chatgpt",
+      "https://developers.openai.com/plugins/deploy/submission"
+    ],
+    "steps": [
+      "For a custom MCP connection, open its plugin settings, use Refresh and start a new conversation.",
+      "Published package updates and server rescans are publisher actions, with their own review and publication state. A local ZIP or GitHub release does not prove a directory update."
+    ]
+  },
+  "gemini-cli": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://geminicli.com/docs/extensions/reference/",
+      "https://geminicli.com/docs/reference/commands/"
+    ],
+    "steps": [
+      "For a named installed extension, run gemini extensions update vpsnet in your terminal and restart the CLI.",
+      "/mcp reload re-discovers tools and /skills reload refreshes skills on host versions that support them; these do not install a new extension."
+    ]
+  },
+  "gemini-browser": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://support.google.com/gemini/answer/17209137"
+    ],
+    "steps": [
+      "Manage the custom Connected App in Gemini settings. This remote connection is not a Gemini CLI extension.",
+      "The reviewed guide does not establish a package-upgrade or tool-cache refresh command."
+    ]
+  },
+  "cursor": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://cursor.com/docs/reference/plugins",
+      "https://cursor.com/docs/plugins"
+    ],
+    "steps": [
+      "For a local plugin copy, replace it with the complete reviewed new package and reload the window or restart.",
+      "Public marketplace updates require provider review; team marketplace sync and local updates are separate. No universal public-store update command is established here."
+    ]
+  },
+  "kimi-code": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://www.kimi.com/code/docs/en/kimi-code-cli/customization/plugins.html"
+    ],
+    "steps": [
+      "For a copied local installation, reinstall the reviewed complete source with /plugins install ./vpsnet, then /reload or start a new session.",
+      "Use the plugin manager update action where available. Do not assume custom VPSnet plugins auto-update."
+    ]
+  },
+  "kimi-work": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://www.kimi.com/en/help/plugins-and-skills/create",
+      "https://www.kimi.com/en/help/plugins-and-skills/publish"
+    ],
+    "steps": [
+      "Use Plugin Builder in Kimi Work to convert the reviewed source update and inspect the resulting package.",
+      "Personal installation and public marketplace review are separate; no automatic source-update contract was established."
+    ]
+  },
+  "kiro": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://kiro.dev/docs/powers/installation/",
+      "https://kiro.dev/docs/mcp/configuration/"
+    ],
+    "steps": [
+      "For a repository-backed Power, use its Check for updates and Install updates controls.",
+      "Standalone MCP configuration is separate. Power OAuth scope compatibility needs client verification; installing a package does not grant additional scopes."
+    ]
+  },
+  "vscode": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://code.visualstudio.com/docs/agent-customization/agent-plugins",
+      "https://code.visualstudio.com/docs/agents/reference/mcp-configuration"
+    ],
+    "steps": [
+      "MCP: Reset Cached Tools refreshes discovery, not installed plugin files.",
+      "Use Extensions: Check for Extension Updates for the extension inventory. AgentHost /plugin update applies to its own plugin inventory; inspect which host and install source you use first."
+    ]
+  },
+  "devin": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://docs.devin.ai/cli/extensibility/plugins/overview",
+      "https://docs.devin.ai/cli/extensibility/mcp/configuration"
+    ],
+    "steps": [
+      "For a Devin CLI plugin installation, use devin plugins update vpsnet. A linked local source reloads on a new session.",
+      "Legacy Cascade and Devin Local are different hosts; do not assume a Devin CLI action updates a legacy Cascade configuration."
+    ]
+  },
+  "qwen": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://qwenlm.github.io/qwen-code-docs/en/users/extension/introduction/"
+    ],
+    "steps": [
+      "Use qwen extensions update <installed-name> for a native installed extension, then restart after terminal changes.",
+      "Pinned exact npm versions remain pinned. Marketplace source refresh is separate from updating installed extensions."
+    ]
+  },
+  "cline": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://docs.cline.bot/customization/plugins",
+      "https://docs.cline.bot/mcp/mcp-overview"
+    ],
+    "steps": [
+      "Inspect the actual Cline host and installed source; plugin support differs between CLI/SDK and IDE extensions.",
+      "No custom-plugin automatic upgrade or remote tool-refresh guarantee was established. Use the host-native manager and current official instructions."
+    ]
+  },
+  "mistral-work": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://docs.mistral.ai/vibe/work/connectors/mcp-connectors"
+    ],
+    "steps": [
+      "After tools change, open the existing Vibe Work connector and use Functions > Refresh tools. This host does not support dynamic tool discovery.",
+      "Do not substitute Vibe Code CLI: direct OAuth MCP is not supported there by the reviewed documentation."
+    ]
+  },
+  "mistral-code": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://docs.mistral.ai/vibe/code/cli/mcp-servers"
+    ],
+    "steps": [
+      "The reviewed Vibe Code CLI documentation explicitly excludes OAuth MCP servers. A plugin update does not fix that limitation.",
+      "Use a supported OAuth client; never substitute customer passwords or manually supplied tokens."
+    ]
+  },
+  "perplexity": {
+    "reviewed_at": "2026-10-14",
+    "source_urls": [
+      "https://www.perplexity.ai/help-center/en/articles/13915507-adding-custom-remote-connectors"
+    ],
+    "steps": [
+      "Manage the existing custom remote connector in account settings. Native skill ZIP replacement is a separate operation.",
+      "The reviewed connector guide does not establish automatic tool-list refresh, custom plugin upgrades or release notifications."
+    ]
+  }
+}