vpsnet-mcp 2.3.16 → 2.7.0

package/build/index.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
-import { installToolInputSchemas } from "./tool-schema.js";
+import { installToolInputSchemas, unboundedInteger } from "./tool-schema.js";
+import { createDnsZoneDescription } from "./dns-zone-contract.js";
 import { registerOrderTools } from "./remote-orders.js";
 import { registerRemoteTools } from "./remote-tools.js";
 import { registerReadOnlyContext } from "./read-only-context.js";
@@ -8,10 +9,12 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { pathToFileURL } from "node:url";
 import { resolve } from "node:path";
+import { reinstallDescription } from "./service-reinstall-contract.js";
 import { installRemotePolicy, installToolTitles, remoteInstructions, orderInstructions } from "./remote-policy.js";
 import { createHash, randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { registerNetworkingTools } from "./networking-tools.js";
+import { registerServiceFileTools } from "./service-files.js";
 import { isIP } from "node:net";
 import { z } from "zod";
 import { apiRequest, formatJson, initializeStdioApi } from "./api.js";
@@ -47,9 +50,10 @@ export function createVpsnetServer(options = {}) {
         instructions: options.remoteScopes ? (options.remoteProfile === "orders" ? orderInstructions(options.remoteScopes) : remoteInstructions) : [
             "This MCP server controls VPSnet.com services, including VPS service management, DNS zones, domain registration, domain contacts, API keys, billing, and related paid actions.",
             "Use the tool descriptions and API-key scopes to choose the correct surface; do not assume this server is limited to VPS-only operations.",
-            "Auth: every request authenticates with the X-API-KEY header (your VPSNet API key). Requests are rate-limited — on HTTP 429, back off and retry after a short delay rather than hammering the endpoint.",
+            "Auth: every request authenticates with the X-API-KEY header (your VPSNet API key). Each API key may make 300 requests per 60 seconds by default, and some operations have lower limits; on HTTP 429 wait the retry_after seconds given in the result (the API also sends Retry-After) before retrying.",
             "This server needs a MANAGEMENT API key (scope full, or read for GET-only use). An AI-scoped key is issued only for VPSnet AI assistant inference and is refused on every account route, so no tool here can work with one. When a tool result carries auth_problem, read its reason and fix and relay them instead of reporting a bare 'Unauthorized'.",
-            "Service tools are scope-gated for API keys: service reads (lists, details, graphs, history, options, backup/snapshot/restore-point listings) require services:read; service mutations (start/stop/restart/console, suspend/resume, hostname, rDNS, root password, title, IPv6, extra settings, SSH key deploy, OS reinstall, plan change, renewal, auto-renew, backups, snapshots, firewall flush) require services:manage plus a full-access key; rescue requires services:rescue; paid whole-service restore additionally requires the services:restore paid scope. A key whose granular scope list was left empty keeps everything its access level (full/read) already allows, so scopes only ever narrow a key.",
+            "Service tools are scope-gated for API keys: service reads (lists, details, graphs, history, options, backup/snapshot/restore-point listings) require services:read; service mutations (start/stop/restart/console, suspend/resume, hostname, rDNS, root password, title, IPv6, extra settings, SSH key deploy, OS reinstall, plan change, renewal, auto-renew, backups, snapshots, firewall flush) require services:manage plus a full-access key; rescue requires services:rescue; paid whole-service restore additionally requires the services:restore paid scope. A key whose granular scope list was left empty keeps everything its access level (full/read) already allows, except the permissions that must be added to a key on purpose: networking:read/manage (private networks, the server firewall, port forwarding, public addresses, load balancers, VPN), files:read/manage and the App Cloud permissions. An older full key without a permission list therefore reaches no networking tool until networking:read or networking:manage is added.",
+            "Service file manager tools (get_service_file_capabilities, list/stat/read/search, download/upload, write, mkdir, move, delete, extract) need an EXPLICIT files:read or files:manage grant on the API key (an empty permission list does not include them; changes need a full-access key). Call get_service_file_capabilities first and relay an unavailable reason verbatim: Firecracker servers need the updated guest agent (agent_update_required) and Cloud VPS (KVM) needs the VDS file-manager switch (feature_disabled). Writes are compare-and-swap: pass the version or sha256 you read. Slow guests are polled inside the tools; continue a returned operationId with get_service_file_operation instead of repeating a change.",
             "",
             "## Ordering a new VPS",
             "Flow: get_order_plans → get_order_options(plan) → order_service.",
@@ -60,7 +64,8 @@ export function createVpsnetServer(options = {}) {
             "rootPassword rules: 6-40 chars, alphanumeric only, MUST contain uppercase + lowercase + digit. Example: 'MyPass123'.",
             "sshKey and rootPassword are mutually exclusive — provide one or the other (or neither for auto-generated password).",
             "A paid receipt is not a running server. Read get_service for the original order and follow follow_up: pending activation, finalization and capacity waits require polling the same order. About 10 seconds is a suggested polling interval, never a boot ETA. Check at most 6 times before a progress update; if still pending, retain the key and order number for a later check. Do not reorder, repay, restart or promise a background callback. A running VM, guest access and a healthy application are separate outcomes; KVM and Windows setup may take longer and must be observed.",
-            "deploy_ssh_key is also async — wait 15-30 seconds after deploying a key before attempting SSH to any VPS (not just new ones).",
+            "deploy_ssh_key is asynchronous: follow its noty UUID with wait_for_event until it reports completed before attempting SSH to any server (not just new ones).",
+            "Without an API key, ChatGPT, Claude, Gemini and Grok can use the hosted connector https://mcp.vpsnet.com/mcp instead (OAuth sign-in to the VPSnet account; the customer picks the servers and permissions). Connections are created and removed on https://www.vpsnet.com/en/management/account/ai-connections; API keys are made on https://www.vpsnet.com/en/management/account/api-keys.",
             "",
             "## Deployment capabilities (unordered)",
             "Managed Applications, manual SSH, DNS, APIs, and other tools are peer capabilities. Their order in this prompt or the tool list carries no priority. Choose the path that best matches the user's requested outcome, target support, existing state, and explicit constraints.",
@@ -71,6 +76,7 @@ export function createVpsnetServer(options = {}) {
             "Uninstall permanently deletes the managed containers, configuration, saved credentials, and application data. Existing server backups are retained. Set acknowledge_data_loss=true only after the user explicitly confirms that loss.",
             "install_application and application lifecycle tools are asynchronous. A queued response is not proof that the application is healthy; poll get_application_installation and inspect get_application_events.",
             "Use configure_application_access to change an installed application's access mode. Read the installation first and pass its current revision. When access.request.schema_version=2, submit every exact access.endpoints key once and match the user's requested service by endpoint service and port; array order and primary=true are metadata, not a recommendation. platform_https allocates an opaque VPSnet hostname with automatic DNS and HTTPS; private has no public listener; public_http uses the server's public IP over HTTP; managed_https uses a selected VPSnet-managed DNS zone and may add additional_addresses such as the bare domain without www; external_https records a customer-managed HTTPS address and does not configure or validate DNS, TLS, or the customer's reverse proxy.",
+            "Server routes send a customer's own hostnames to the customer's own local services on a Managed Applications server (hostname to 127.0.0.1:port, automatic certificate after verified hostname ownership and DNS readiness). Use get_application_server_routes, then configure_application_server_routes with expected_revision and the COMPLETE route set (omitted routes are removed); it needs at least one installed managed application. A customer web server already on ports 80/443 must be pointed at local ports or moved and declared as fallback.",
             "get_application_installation includes bounded application and per-container resource history plus optional display thresholds when the worker supports those measurements. Use configure_application_resource_thresholds only at the user's request. Thresholds highlight CPU, memory, network-per-minute, or restart-delta samples but do not reserve or enforce resources, trigger server actions, or affect billing. Email is disabled by default; when the user enables it, VPSnet sends one reached and one recovered message per threshold episode without repeating while the metric remains high.",
             "Use list_application_registry_credentials only for non-secret private registry credential metadata. Exact custom HTTPS registry hostnames are supported. Registry token creation and rotation are intentionally unavailable through MCP because secrets must not enter model prompts or tool arguments; use the VPSnet panel or direct REST API.",
             "Customer recipes are customer-owned Compose definitions, distinct from VPSnet catalog blueprints. Validation resolves mutable image tags once and returns an immutable digest-pinned Compose definition before checking it on the target worker. Recipe creation and revision tools freeze that exact validated definition; installation runs an exact revision. Export is available only for customer recipes and never for VPSnet catalog recipes.",
@@ -82,7 +88,7 @@ export function createVpsnetServer(options = {}) {
             "Installation list and detail responses carry a capabilities block for the service's platform: data_restore, console, compose_adoption, custom_projects, and log_service_filter. Treat it as the authority on what is possible for that installation. Do not offer selective data restore when data_restore is false, do not offer Compose adoption or customer recipes when their flags are false, and do not pass a per-service log filter when log_service_filter is false. A separate access.capabilities.can_configure flag governs whether the access mode may be changed.",
             "Never repeat application variable values in summaries or approval text. Refer only to variable names, especially for passwords, tokens, and secrets.",
             "Use manual SSH deployment when it best matches the requested result or the user explicitly requests a custom installation. Do not present a manual deployment as a VPSnet-managed catalog installation.",
-            "Service rescue is a separate recovery path for Firecracker VPS and Cloud VPS. Always call get_service_rescue first. Entering rescue restarts the service; call enter_service_rescue only after the user explicitly approves the restart and exact image returned by the capability response. Firecracker exposes the customer filesystem at /mnt/customer; Cloud VPS uses the operator recovery ISO and noVNC. Exit restores the exact original boot and running/stopped state. If exit returns needs_attention, retry exit_service_rescue with the same idempotency key. Never ask for or invent provider nodes, VM IDs, ISO paths, operation nonces, or rollback configuration.",
+            "Service rescue is a separate recovery path for Firecracker VPS and Cloud VPS, offered only while VPSnet has it switched on. Always call get_service_rescue first; capability.enabled false means it is not offered now. Entering rescue restarts the service; call enter_service_rescue only after the user explicitly approves the restart and exact image returned by the capability response. Firecracker exposes the customer filesystem at /mnt/customer; Cloud VPS uses the operator recovery ISO and noVNC. Exit restores the exact original boot and running/stopped state. If exit returns needs_attention, retry exit_service_rescue with the same idempotency key. Never ask for or invent provider nodes, VM IDs, ISO paths, operation nonces, or rollback configuration.",
             "",
             "### Manual or custom deployment inside a VPS",
             "Use only the access needed for the user's task. Keep local sandbox and approval controls enabled; request a specific missing capability instead of unrestricted agent access.",
@@ -169,6 +175,8 @@ export function createVpsnetServer(options = {}) {
     if (options.remoteScopes)
         installRemotePolicy(server, options.remoteScopes, options.remoteProfile);
     registerNetworkingTools(server);
+    // Local-path transfers and address-bound download URLs stay on stdio; the hosted connector gets the API-only file tools.
+    registerServiceFileTools(server, undefined, options.remoteScopes ? "remote" : "stdio");
     // Helper to build service settings path
     const svc = (orderNo, action) => `/account/services/${encodeURIComponent(serviceOrderNoSchema.parse(orderNo))}/${action}`;
     const idempotencyKeySchema = z
@@ -221,7 +229,7 @@ export function createVpsnetServer(options = {}) {
     const applicationOrderNoSchema = serviceOrderNoSchema;
     const applicationInstallationIdSchema = z
         .string()
-        .uuid()
+        .guid()
         .describe("Managed application installation UUID");
     const applicationSlugSchema = z
         .string()
@@ -429,7 +437,7 @@ export function createVpsnetServer(options = {}) {
         return { content: [{ type: "text", text: formatJson(data) }] };
     });
     server.registerTool("get_service_rescue", {
-        description: "Get operator rescue capability and the current durable rescue session for one owned Firecracker VPS or Cloud VPS. Requires services:read. Provider identifiers, ISO paths, nonces, and rollback state are never returned.",
+        description: "Get operator rescue capability and the current durable rescue session for one owned Firecracker VPS or Cloud VPS. Requires services:read. Provider identifiers, ISO paths, nonces, and rollback state are never returned. VPSnet can switch rescue off: capability.enabled false means it is not offered now; say so and do not call enter_service_rescue.",
         inputSchema: {
             orderNo: serviceOrderNoSchema,
         },
@@ -449,7 +457,7 @@ export function createVpsnetServer(options = {}) {
         };
     });
     server.registerTool("enter_service_rescue", {
-        description: "Restart one owned active Firecracker VPS or Cloud VPS into an operator-owned rescue system. Read get_service_rescue first and use an exact advertised image ID. This interrupts every running service. Call only after the user explicitly confirms the target service, rescue image, and reboot. Requires services:rescue, full API-key access, and a fresh idempotencyKey.",
+        description: "Restart one owned active Firecracker VPS or Cloud VPS into an operator-owned rescue system. Read get_service_rescue first and use an exact advertised image ID. This interrupts every running service. Call only after the user explicitly confirms the target service, rescue image, and reboot. Requires services:rescue, full API-key access, and a fresh idempotencyKey. Rescue may be switched off by VPSnet: while get_service_rescue reports capability.enabled false this tool sends nothing and answers serviceRescueImageNotAdvertised (the API itself answers 503 serviceRescueUnavailable).",
         inputSchema: {
             orderNo: serviceOrderNoSchema,
             image: serviceRescueImageIdSchema,
@@ -500,7 +508,7 @@ export function createVpsnetServer(options = {}) {
             orderNo: serviceOrderNoSchema,
             rescue_session_id: z
                 .string()
-                .uuid()
+                .guid()
                 .describe("Exact current session UUID from get_service_rescue"),
             acknowledge_restart: z
                 .literal(true)
@@ -804,7 +812,7 @@ export function createVpsnetServer(options = {}) {
         inputSchema: {
             orderNo: applicationOrderNoSchema,
             installation_id: applicationInstallationIdSchema,
-            inspection_id: z.string().uuid(),
+            inspection_id: z.string().guid(),
             kind: z.enum(["health", "logs"]),
         },
         annotations: { title: "Get application inspection", readOnlyHint: true, destructiveHint: false, idempotentHint: true },
@@ -818,7 +826,7 @@ export function createVpsnetServer(options = {}) {
     });
     server.registerTool("get_application_recipe_validation", {
         description: "Poll the exact persisted customer recipe validation returned by validate_application_recipe or a pending recipe creation/revision. This GET does not resolve tags or create another validation. Retain the initial resolved_compose_yaml; after this ID succeeds with valid=true, resume creation using that exact pinned document and validation_id. Requires applications:read.",
-        inputSchema: { orderNo: applicationOrderNoSchema, validation_id: z.string().uuid() },
+        inputSchema: { orderNo: applicationOrderNoSchema, validation_id: z.string().guid() },
         annotations: { title: "Get application recipe validation", readOnlyHint: true, destructiveHint: false, idempotentHint: true },
     }, async ({ orderNo, validation_id }) => {
         const { status, data } = await apiRequest("GET", applicationPath(orderNo, `custom-projects/validations/${encodeURIComponent(validation_id)}`));
@@ -829,7 +837,7 @@ export function createVpsnetServer(options = {}) {
     });
     server.registerTool("get_service_container_discovery", {
         description: "Poll the exact persisted service container discovery returned by discover_service_containers when it remains pending. This GET does not create another discovery and never returns environment values or mounts. Keep the service and discovery UUID until succeeded, failed or expired. Requires applications:read.",
-        inputSchema: { orderNo: applicationOrderNoSchema, discovery_id: z.string().uuid() },
+        inputSchema: { orderNo: applicationOrderNoSchema, discovery_id: z.string().guid() },
         annotations: { title: "Get service container discovery", readOnlyHint: true, destructiveHint: false, idempotentHint: true },
     }, async ({ orderNo, discovery_id }) => {
         const { status, data } = await apiRequest("GET", applicationPath(orderNo, `container-discoveries/${encodeURIComponent(discovery_id)}`));
@@ -1093,7 +1101,7 @@ export function createVpsnetServer(options = {}) {
             orderNo: applicationOrderNoSchema,
             name: customProjectNameSchema,
             compose_yaml: customProjectComposeSchema,
-            validation_id: z.string().uuid().optional().describe("Resume only the exact successful validation for this service and digest-pinned compose_yaml; retain the initial resolved document"),
+            validation_id: z.string().guid().optional().describe("Resume only the exact successful validation for this service and digest-pinned compose_yaml; retain the initial resolved document"),
             env: customProjectEnvironmentSchema,
             secret_names: customProjectSecretNamesSchema,
             registry_credential_ids: customProjectRegistryCredentialIdsSchema,
@@ -1152,7 +1160,7 @@ export function createVpsnetServer(options = {}) {
             orderNo: applicationOrderNoSchema,
             project_id: customProjectIdSchema,
             compose_yaml: customProjectComposeSchema,
-            validation_id: z.string().uuid().optional().describe("Resume only the exact successful validation for this service and digest-pinned compose_yaml; retain the initial resolved document"),
+            validation_id: z.string().guid().optional().describe("Resume only the exact successful validation for this service and digest-pinned compose_yaml; retain the initial resolved document"),
             env: customProjectEnvironmentSchema,
             secret_names: customProjectSecretNamesSchema,
             registry_credential_ids: customProjectRegistryCredentialIdsSchema,
@@ -1284,7 +1292,7 @@ export function createVpsnetServer(options = {}) {
         description: "Prepare and poll a short-lived, read-only takeover candidate for one exact unmanaged Compose project from a fresh discovery. The worker verifies container identity, immutable image identity, restart policy, Compose safety, and exclusive local named-volume ownership. Returns only a scrubbed Compose file, variable names, and bounded counts; never variable values, source paths, commands, or unrestricted labels. This tool does not stop or replace containers. Requires applications:manage.",
         inputSchema: {
             orderNo: applicationOrderNoSchema,
-            discovery_id: z.string().uuid().describe("Fresh discovery UUID returned by discover_service_containers"),
+            discovery_id: z.string().guid().describe("Fresh discovery UUID returned by discover_service_containers"),
             compose_project: composeProjectLabelSchema,
         },
         annotations: {
@@ -1439,6 +1447,90 @@ export function createVpsnetServer(options = {}) {
             ],
         };
     });
+    server.registerTool("get_application_server_routes", {
+        description: "Get the server routes of one owned Managed Applications server: customer-owned hostnames routed by the in-guest HTTPS front door to the customer's own local services (for example app.example.com to 127.0.0.1:3000) with an automatic certificate, the optional fallback (the customer's own web server on local ports), the current revision, applied revision, overall state, per-route state and DNS status (ok, missing, elsewhere, unknown, with the A/AAAA records to create), availability and limits. Read this before configure_application_server_routes and pass its revision as expected_revision. Requires applications:read.",
+        inputSchema: {
+            orderNo: applicationOrderNoSchema,
+        },
+        annotations: {
+            title: "Get application server routes",
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+        },
+    }, async ({ orderNo }) => {
+        const { data } = await apiRequest("GET", applicationPath(orderNo, "server-routes"));
+        return { content: [{ type: "text", text: formatJson(data) }] };
+    });
+    const serverRouteHostnameSchema = z
+        .string()
+        .min(1)
+        .max(253)
+        .describe("Customer-owned hostname, for example app.example.com");
+    const serverRoutePortSchema = z
+        .number()
+        .int()
+        .min(1024)
+        .max(65535)
+        .refine((port) => ![10080, 10443, 19090].includes(port), {
+        message: "Ports 10080, 10443 and 19090 are reserved",
+    });
+    server.registerTool("configure_application_server_routes", {
+        description: "Queue a change of the server routes of one owned Managed Applications server. This REPLACES the COMPLETE set: read get_application_server_routes first, then send the full list of wanted routes and the fallback; a route or fallback that is omitted is removed. Each route sends one customer hostname to 127.0.0.1:<port> on the same server over http or https (ports 1024-65535 except 10080, 10443 and 19090; no host field, upstream is always local; at most 64 routes). The hostname needs verified ownership evidence as well as DNS pointing at the server; pointing DNS alone does not prove ownership. get_application_server_routes reports DNS, per-route state/errors and records to create. Preserve backend refusals, including applicationServerRoutesDeliveredCertificates when delivered certificates prevent enabling routes. Removed hostname claims are not released until the change is applied. The server must have at least one installed managed application. Unknown hostnames are never sent to an application (HTTP 421 / TLS unrecognized_name). Coexistence: if the customer runs their own web server (Caddy, nginx, Traefik) on ports 80/443, either point it at local ports instead, or move it to local ports and declare it as fallback ({http_port?, https_port?}); the fallback receives every hostname the front door does not serve (HTTP proxied with its Host header, HTTPS passed through unterminated). Pass expected_revision from the read; a stale revision is refused with applicationServerRoutesRevisionConflict. Confirm the exact full set with the user first. A queued response (202, action type configure_routes) must be verified by polling get_application_server_routes until state is active. Requires applications:manage and is not a paid API-key operation.",
+        inputSchema: {
+            orderNo: applicationOrderNoSchema,
+            expected_revision: z
+                .number()
+                .int()
+                .min(0)
+                .max(Number.MAX_SAFE_INTEGER)
+                .describe("Current revision returned by get_application_server_routes"),
+            routes: z
+                .array(z.object({
+                hostname: serverRouteHostnameSchema,
+                upstream: z.object({
+                    scheme: z.enum(["http", "https"]),
+                    port: serverRoutePortSchema,
+                }),
+            }))
+                .max(64)
+                .describe("The COMPLETE wanted set of routes; omitting a route removes it. An empty array removes all routes."),
+            fallback: z
+                .object({
+                http_port: serverRoutePortSchema.optional(),
+                https_port: serverRoutePortSchema.optional(),
+            })
+                .nullable()
+                .optional()
+                .describe("The customer's own web server on local ports, receiving every hostname the front door does not serve. null or omitted removes the fallback."),
+            idempotencyKey: idempotencyKeySchema.describe("Client-global unique key. Reuse it only to replay this exact request; never reuse it for another service or request."),
+            confirmed: z
+                .literal(true)
+                .describe("True only after the user confirmed the complete route set"),
+        },
+        annotations: {
+            title: "Configure application server routes",
+            readOnlyHint: false,
+            destructiveHint: true,
+            idempotentHint: true,
+            openWorldHint: true,
+        },
+    }, async ({ orderNo, expected_revision, routes, fallback, idempotencyKey, confirmed, }) => {
+        const { status, data } = await apiRequest("PUT", applicationPath(orderNo, "server-routes"), {
+            expectedRevision: expected_revision,
+            routes,
+            fallback: fallback ?? null,
+            confirmed,
+        }, { "Idempotency-Key": idempotencyKey });
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: safeApplicationMutationResult(status, data, orderNo),
+                },
+            ],
+        };
+    });
     async function performApplicationLifecycleAction({ orderNo, installation_id, action, idempotencyKey, expected_blueprint_version, expected_upstream_version, acknowledge_data_loss, }) {
         if (action === "uninstall" && acknowledge_data_loss !== true) {
             return {
@@ -1760,7 +1852,7 @@ export function createVpsnetServer(options = {}) {
         return { content: [{ type: "text", text: formatJson(data) }] };
     });
     server.registerTool("flush_iptables", {
-        description: "Flush iptables rules on VPS (useful when locked out) Requires services:manage and a full-access API key.",
+        description: "Flush iptables rules on VPS (useful when locked out) Requires services:manage and a full-access API key. It clears the rules inside the server only; the public firewall that VPSnet applies to the server's public interface on its node is separate and is not changed by this.",
         inputSchema: {
             orderNo: serviceOrderNoSchema,
         },
@@ -1816,7 +1908,7 @@ export function createVpsnetServer(options = {}) {
         return { content: [{ type: "text", text: formatJson(data) }] };
     });
     server.registerTool("deploy_ssh_key", {
-        description: "Deploy an SSH key to VPS. Returns a noty UUID; follow it with wait_for_event. ASYNC — wait 15-30 seconds after deploying before attempting SSH. Use list_ssh_keys to get available key IDs. To add your own key first: read ~/.ssh/id_rsa.pub from local machine, then create_ssh_key, then deploy it here. Remote OAuth requires vm:exec; direct API-key use requires services:manage and a full-access key.",
+        description: "Deploy an SSH key to VPS. Returns a noty UUID; follow it with wait_for_event until it reports completed before attempting SSH. Use list_ssh_keys to get available key IDs. To add your own key first: read ~/.ssh/id_rsa.pub from local machine, then create_ssh_key, then deploy it here. Remote OAuth requires vm:exec; direct API-key use requires services:manage and a full-access key.",
         inputSchema: {
             orderNo: serviceOrderNoSchema,
             ssh_key: positiveIdSchema.describe("SSH key ID from list_ssh_keys"),
@@ -1825,6 +1917,38 @@ export function createVpsnetServer(options = {}) {
         const { data } = await apiRequest("POST", svc(orderNo, "change-ssh-key"), { ssh_key });
         return { content: [{ type: "text", text: formatJson(data) }] };
     });
+    server.registerTool("list_service_ssh_keys", {
+        description: "List which account SSH keys are in root's authorized_keys on one owned Cloud VPS or Firecracker VPS, as the server last reported: per key deployed (true, false, or null when the server was never read) and a removal running or ended in the last 15 minutes; inventory carries source, observedAt, refreshing (a Firecracker VPS answers asynchronously), readFailure, passwordLogin and the count of other keys. refresh=true asks the server again. Container VPS and dedicated servers answer supported false with unsupportedReason. Free. Requires services:read when called with an API key.",
+        inputSchema: {
+            orderNo: serviceOrderNoSchema,
+            refresh: z.boolean().optional().describe("Ask the server again even when the last read is fresh"),
+        },
+        annotations: {
+            title: "List SSH keys on a server",
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+        },
+    }, async ({ orderNo, refresh }) => {
+        const { data } = await apiRequest("GET", svc(orderNo, "ssh-keys") + (refresh === true ? "?refresh=1" : ""));
+        return { content: [{ type: "text", text: formatJson(data) }] };
+    });
+    server.registerTool("remove_service_ssh_key", {
+        description: "Remove one account SSH key (ssh_key from list_ssh_keys) from root's authorized_keys on one owned running Cloud VPS or Firecracker VPS; every line with that key goes, nothing else changes, and the key stays in the account. Free. Confirm with the user first. A key that is not on the server answers state absent. Refused with 409 sshKeyRemoveLastKey when it is the server's last permanent key and root cannot log in with a password: add another key first. Cloud VPS answers at once (removed or absent); Firecracker VPS answers 202 pending and list_service_ssh_keys shows the result in the key's removal. One removal at a time per server, at most 10 per minute; 423 while the server's two-factor lock is on. Requires services:manage and a full-access API key.",
+        inputSchema: {
+            orderNo: serviceOrderNoSchema,
+            ssh_key: positiveIdSchema.describe("SSH key ID from list_ssh_keys"),
+        },
+        annotations: {
+            title: "Remove an SSH key from a server",
+            readOnlyHint: false,
+            destructiveHint: true,
+            idempotentHint: true,
+        },
+    }, async ({ orderNo, ssh_key }) => {
+        const { data } = await apiRequest("DELETE", svc(orderNo, `ssh-keys/${ssh_key}`));
+        return { content: [{ type: "text", text: formatJson(data) }] };
+    });
     // --- OS Reinstall ---
     server.registerTool("get_os_options", {
         description: "Get available OS templates for reinstall Requires services:read when called with an API key.",
@@ -1836,18 +1960,18 @@ export function createVpsnetServer(options = {}) {
         return { content: [{ type: "text", text: formatJson(data) }] };
     });
     server.registerTool("reinstall_os", {
-        description: "Reinstall OS on a VPS or qualified dedicated server. WARNING: destroys existing data; confirm with the user before reinstalling. Cloud VPS and Firecracker VPS: reinstall also deletes existing snapshots, so they cannot provide rollback after reinstall. Read get_os_options.snapshotDeletion first; when snapshots exist, set confirmSnapshotDelete to true only after the user explicitly confirms their deletion. A pending snapshot action blocks reinstall until it finishes. Container VPS has no snapshots. Dedicated servers erase every disk and have no snapshot rollback; get_os_options reports dedicated=true and confirmRequired=true. Pass confirmReinstall=true only after the user explicitly approves reinstalling that exact dedicated server and losing all disk data. Dedicated reinstall supports an optional sshKey from list_ssh_keys (otherwise the prior install key is reused), never rootPassword, and returns a reinstall job ID. VPS reinstall returns a noty UUID for acceptance; follow get_service_history for completion. Password rules: 6-40 chars, alphanumeric, must contain uppercase + lowercase + digit. OAuth requires services:reinstall; API keys require full access.",
+        description: reinstallDescription(false),
         inputSchema: {
             orderNo: serviceOrderNoSchema,
             confirmReinstall: z.boolean().optional().describe("Dedicated only: true only after explicit user approval to reinstall this exact server and erase all its disks; never inferred or defaulted."),
-            sshKey: positiveIdSchema.optional().describe("Dedicated only: account SSH key ID from list_ssh_keys; omitted reuses the installed key."),
+            sshKey: positiveIdSchema.optional().describe("Account public SSH key ID from list_ssh_keys. Mutually exclusive with rootPassword. Dedicated: omitted reuses the installed key when one exists."),
             osVersion: z
                 .number()
                 .describe("OS version ID from get_os_options"),
             rootPassword: z
                 .string()
                 .optional()
-                .describe("New root password (auto-generated if omitted). 6-40 chars, alphanumeric, must contain uppercase + lowercase + digit"),
+                .describe("New root password for VPS or dedicated reinstall; mutually exclusive with sshKey. Omit to reuse a dedicated server's installed key when available, otherwise the backend generates a password. 6-40 chars, alphanumeric, uppercase + lowercase + digit."),
             confirmSnapshotDelete: z
                 .boolean()
                 .optional()
@@ -1859,6 +1983,8 @@ export function createVpsnetServer(options = {}) {
             idempotentHint: false,
         },
     }, async ({ orderNo, osVersion, rootPassword, confirmSnapshotDelete, confirmReinstall, sshKey }) => {
+        if (rootPassword !== undefined && sshKey !== undefined)
+            throw new Error("Choose an account sshKey or rootPassword, not both.");
         const options = await apiRequest("GET", svc(orderNo, "change-os"));
         const capability = options.data;
         if (options.status >= 400 || capability?.success !== true) {
@@ -1868,15 +1994,13 @@ export function createVpsnetServer(options = {}) {
         if (capability.dedicated === true) {
             if (confirmReinstall !== true)
                 throw new Error("Dedicated reinstall requires explicit user approval of all-disk data loss and confirmReinstall=true.");
-            if (rootPassword !== undefined)
-                throw new Error("Dedicated reinstall does not support rootPassword; use an account sshKey or reuse the installed key.");
             body.confirmReinstall = true;
-            if (sshKey !== undefined)
-                body.sshKey = sshKey;
         }
-        else if (confirmReinstall !== undefined || sshKey !== undefined) {
-            throw new Error("confirmReinstall and sshKey are dedicated-only reinstall fields; inspect get_os_options for this service.");
+        else if (confirmReinstall !== undefined) {
+            throw new Error("confirmReinstall is a dedicated-only reinstall field; inspect get_os_options for this service.");
         }
+        if (sshKey !== undefined)
+            body.sshKey = sshKey;
         if (rootPassword)
             body.rootPassword = rootPassword;
         if (confirmSnapshotDelete === true)
@@ -2269,7 +2393,7 @@ export function createVpsnetServer(options = {}) {
     });
     // --- API Keys ---
     server.registerTool("list_api_keys", {
-        description: "Show the API key this request authenticated with: scope (read/full/ai), granular scopes, paid_scopes, paid_operations_enabled, daily_spend_limit_eur, monthly_spend_limit_eur, allowed IPs, expiry and rate_limit (requests per minute), plus permission_options listing every scope the panel can grant. The backend scopes this endpoint to the calling key itself (apiKeyScopedToSelf), so other keys on the account are never listed here. By design an API key can never create, change or revoke API keys (403 apiKeyForbidden, reason api_keys_cannot_manage_api_keys): that is done in the VPSnet panel while signed in. Read-only.",
+        description: "Show the API key this request authenticated with: scope (read/full/ai), granular scopes, paid_scopes, paid_operations_enabled, daily_spend_limit_eur, monthly_spend_limit_eur, allowed IPs, expiry and rate_limit (a stored value the limiter does not read: every key may make 300 requests per 60 seconds by default, fewer on some operations), plus permission_options listing every scope the panel can grant. The backend scopes this endpoint to the calling key itself (apiKeyScopedToSelf), so other keys on the account are never listed here. By design an API key can never create, change or revoke API keys (403 apiKeyForbidden, reason api_keys_cannot_manage_api_keys): that is done in the VPSnet panel while signed in. Read-only.",
         inputSchema: {},
     }, async () => {
         const { data } = await apiRequest("GET", "/account/api-keys");
@@ -2285,7 +2409,7 @@ export function createVpsnetServer(options = {}) {
         return { content: [{ type: "text", text: formatJson(data) }] };
     });
     server.registerTool("get_api_key_activity", {
-        description: "Get the recorded request activity for this API key: recent matched route patterns and statuses, resolved and separately labelled caller-claimed source addresses, endpoint/source totals, and retained daily history. API-key callers can inspect only the same key that authenticated the MCP connection. Key values, headers, query strings, path values, and request bodies are never returned. To protect the control plane during abusive bursts, audit writes are capped per key per minute and retained detail has a separate per-key row ceiling; totals describe recorded rows and are not a billing ledger.",
+        description: "Get the recorded request activity for this API key: recent matched route patterns and statuses, resolved and separately labelled caller-claimed source addresses, endpoint/source totals, and retained daily history. API-key callers can inspect only the same key that authenticated the MCP connection, and this server needs a management key: a management key has no inference usage of its own and an inference key is refused on every account route, so read inference usage in the VPSnet panel. Key values, headers, query strings, path values, and request bodies are never returned. To protect the control plane during abusive bursts, audit writes are capped per key per minute and retained detail has a separate per-key row ceiling; totals describe recorded rows and are not a billing ledger.",
         inputSchema: {
             id: positiveIdSchema.describe("API key ID from list_api_keys (the calling key's own ID)"),
             limit: z.number().int().min(1).max(200).optional().describe("Recent request rows to return (default 50, maximum 200)"),
@@ -2296,7 +2420,7 @@ export function createVpsnetServer(options = {}) {
         return { content: [{ type: "text", text: formatJson(data) }] };
     });
     server.registerTool("get_api_key_inference_usage", {
-        description: "Get exact paid VPSnet AI usage for this inference API key: committed and currently reserved spend for the UTC day and month, request and token totals by public VPSnet model profile, configured spend limits, remaining spend, and notification preferences. API-key callers can inspect only the same key that authenticated the MCP connection. Internal provider model names are never returned. This is read-only and does not change limits, notifications, or billing.",
+        description: "Get exact paid VPSnet AI usage for this inference API key: committed and currently reserved spend for the UTC day and month, request and token totals by public VPSnet model profile, configured spend limits, remaining spend, and notification preferences. API-key callers can inspect only the same key that authenticated the MCP connection, and this server needs a management key: a management key has no inference usage of its own and an inference key is refused on every account route, so read inference usage in the VPSnet panel. Internal provider model names are never returned. This is read-only and does not change limits, notifications, or billing.",
         inputSchema: {
             id: positiveIdSchema.describe("Inference API key ID from list_api_keys (the calling key's own ID)"),
         },
@@ -2307,7 +2431,7 @@ export function createVpsnetServer(options = {}) {
     // --- TLS certificates ---
     const certificatePaymentSchema = z
         .object({
-        payment: z.number().int().positive().describe("Payment method ID; use 1 for account balance"),
+        payment: unboundedInteger().positive().describe("Payment method ID; use 1 for account balance"),
         successUrl: z.string().max(2048).describe("Approved VPSnet redirect URL, or an empty string"),
         cancelUrl: z.string().max(2048).describe("Approved VPSnet redirect URL, or an empty string"),
     })
@@ -3098,7 +3222,7 @@ export function createVpsnetServer(options = {}) {
         return { content: [{ type: "text", text: formatJson(data) }] };
     });
     server.registerTool("get_domain", {
-        description: "Get one owned domain with current nameservers and any pending domain action. Requires domains:read when using an API key.",
+        description: "Get one owned domain with current nameservers and any pending domain action. An automatic DNSSEC move may report dnssec_transition steps with waiting/retrying states; queued or waiting is not completed. Requires domains:read when using an API key.",
         inputSchema: {
             domain_id: positiveIdSchema.describe("Owned domain ID from list_domains"),
         },
@@ -3114,7 +3238,7 @@ export function createVpsnetServer(options = {}) {
         return { content: [{ type: "text", text: formatJson(data) }] };
     });
     server.registerTool("set_domain_nameservers", {
-        description: "Queue an asynchronous registrar nameserver change for an owned domain. When applied, the parent zone delegates the domain to the new public nameservers, replacing the prior delegation. Nameservers must be hostnames, not IP addresses; same-domain nameserver IP records are managed separately. This does not manage DNS records or PTR. Requires domains:manage when using an API key.",
+        description: "Queue an asynchronous registrar nameserver change for an owned domain. When applied, the parent zone delegates the domain to the new public nameservers, replacing the prior delegation. Nameservers must be hostnames, not IP addresses; same-domain nameserver IP records are managed separately. This does not manage DNS records or PTR. Follow returned dnssec_transition steps until done; preserve parentDsUnreadable or parentDsRemovalRequired refusals and do not bypass an active transition with manual DS edits. Requires domains:manage when using an API key.",
         inputSchema: {
             domain_id: positiveIdSchema.describe("Owned domain ID from list_domains"),
             nameservers: z.array(nameserverHostnameSchema).min(2).max(13).describe("2-13 nameserver hostnames, e.g. ns1.vpsnet.com, ns2.vpsnet.com. IP addresses are not accepted."),
@@ -4202,7 +4326,7 @@ export function createVpsnetServer(options = {}) {
         return { content: [{ type: "text", text: formatJson(data) }] };
     });
     server.registerTool("create_dns_zone", {
-        description: "Create a forward DNS zone in pending verification state. Native zones are managed here; secondary zones AXFR from public primary DNS servers and require TSIG. Returns the ownership TXT in verificationRecord (name _vpsnet-dns.<zone>). If the value is lost, read get_dns_zone.zone.verification.record.value first; use reissue_dns_zone_verification only when it is null/unrecoverable or the customer requests rotation. The API records the nameservers the parent zone delegates the name to, so the TXT can still be proven at that previous provider after the domain is pointed at VPSnet. warnings: delegatedToPlatform (the domain already points at VPSnet nameservers - keep them, do not point it back) or parentServedByPlatform (the TXT goes in the parent zone); zone.verification.next_step says what to do next. Add the TXT at that location, then call verify_dns_zone. Requires dns:write when using an API key.",
+        description: createDnsZoneDescription(),
         inputSchema: {
             zone: z.string().describe("Zone name, e.g. example.com"),
             kind: dnsZoneKindSchema
@@ -4227,7 +4351,7 @@ export function createVpsnetServer(options = {}) {
         },
         annotations: {
             readOnlyHint: false,
-            destructiveHint: false,
+            destructiveHint: true,
             openWorldHint: true,
         },
     }, async ({ zone, kind, secondary_masters, secondary_tsig_key_name, secondary_tsig_algorithm, secondary_tsig_secret }) => {
@@ -4312,7 +4436,7 @@ export function createVpsnetServer(options = {}) {
             template: dnsTemplateIdSchema
                 .describe("Template ID returned by list_dns_templates, e.g. web_service, null_mx, google_workspace, microsoft_365, mail_security, caa_letsencrypt"),
             parameters: z
-                .record(z.union([z.string(), z.number(), z.boolean()]))
+                .record(z.string(), z.union([z.string(), z.number(), z.boolean()]))
                 .optional()
                 .describe("Template parameters, e.g. { ipv4, ipv6, www, mx_target, ttl } depending on the template"),
             preview: z
@@ -4334,13 +4458,19 @@ export function createVpsnetServer(options = {}) {
         return { content: [{ type: "text", text: formatJson(data) }] };
     });
     server.registerTool("delete_dns_zone", {
-        description: "Delete a forward DNS zone. Published zones are queued for removal from the managed DNS platform. Requires dns:write when using an API key.",
+        description: "Delete a forward DNS zone. Published zones are queued for removal from the managed DNS platform; the zone's own records are kept on the deletion record, so re-creating the same name in the same account within 7 days publishes it again with those records. A published zone that the domain is delegated to VPSnet for (get_dns_zone: delegation.state=platform) answers for the whole internet: deleting it stops the domain resolving worldwide (websites, e-mail). The API refuses such a delete with HTTP 409 deleteRequiresConfirmation (reason zone_serves_domain, confirm_field confirm_outage, the delegated nameservers) and deletes nothing. Tell the user exactly that and call again with confirm_outage=true only after the user explicitly confirmed the outage; never set it by default or infer it. Requires dns:write when using an API key.",
         inputSchema: {
             zone_id: positiveIdSchema.describe("DNS zone ID"),
+            confirm_outage: z
+                .boolean()
+                .optional()
+                .default(false)
+                .describe("true only after the user explicitly confirmed that deleting this zone stops the domain resolving worldwide; required when the API answered deleteRequiresConfirmation. Default false."),
         },
         annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
-    }, async ({ zone_id }) => {
-        const { data } = await apiRequest("DELETE", `/account/dns/zones/${encodeURIComponent(String(zone_id))}`);
+    }, async ({ zone_id, confirm_outage }) => {
+        const query = confirm_outage === true ? "?confirm_outage=true" : "";
+        const { data } = await apiRequest("DELETE", `/account/dns/zones/${encodeURIComponent(String(zone_id))}${query}`);
         return { content: [{ type: "text", text: formatJson(data) }] };
     });
     server.registerTool("reapply_dns_zone", {