vpsnet-mcp 2.3.6 → 2.3.7

package/build/index.js

@@ -622,6 +622,7 @@ export function createVpsnetServer(options = {}) {
             readOnlyHint: false,
             destructiveHint: true,
             idempotentHint: true,
+            openWorldHint: true,
         },
     }, async ({ orderNo, installation_id, cpu_percent, email_enabled, memory_mib, network_mib_per_minute, restart_delta, }) => {
         const { data } = await apiRequest("PUT", applicationPath(orderNo, `installations/${encodeURIComponent(installation_id)}/resource-thresholds`), applicationResourceThresholdRequestBody({
@@ -1244,6 +1245,7 @@ export function createVpsnetServer(options = {}) {
             readOnlyHint: false,
             destructiveHint: true,
             idempotentHint: true,
+            openWorldHint: true,
         },
     }, async ({ orderNo, adoption_id, name, env, secrets, registry_credential_ids, acknowledge_runtime_restart, idempotencyKey, }) => {
         const { status, data } = await apiRequest("POST", applicationPath(orderNo, `compose-adoptions/${encodeURIComponent(adoption_id)}/confirm`), {
@@ -1325,6 +1327,7 @@ export function createVpsnetServer(options = {}) {
             readOnlyHint: false,
             destructiveHint: true,
             idempotentHint: true,
+            openWorldHint: true,
         },
     }, async ({ orderNo, installation_id, access, expected_revision, idempotencyKey, }) => {
         const { status, data } = await apiRequest("POST", applicationPath(orderNo, `installations/${encodeURIComponent(installation_id)}/configure-access`), applicationAccessConfigurationRequestBody(access, expected_revision), { "Idempotency-Key": idempotencyKey });
@@ -1617,22 +1620,24 @@ export function createVpsnetServer(options = {}) {
         return { content: [{ type: "text", text: formatJson(data) }] };
     });
     server.registerTool("change_rdns", {
-        description: "Set a customer PTR override for an address returned by get_rdns. Canonical length is 3-253 characters; labels are 1-63 ASCII alphanumeric/hyphen characters without leading/trailing hyphens. A trailing dot is removed and reserved VPSnet names are blocked. Requires services:manage and a full-access API key; this route is not idempotency-keyed.",
+        description: "Set a customer PTR override for an address returned by get_rdns. The new reverse DNS value replaces the previous public PTR answer after propagation. Canonical length is 3-253 characters; labels are 1-63 ASCII alphanumeric/hyphen characters without leading/trailing hyphens. A trailing dot is removed and reserved VPSnet names are blocked. OAuth requires services:manage; API keys require full access. This route is not idempotency-keyed.",
         inputSchema: {
             orderNo: serviceOrderNoSchema,
             ip: serviceIpSchema,
             value: servicePtrSchema,
         },
+        annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
     }, async ({ orderNo, ip, value }) => {
         const { data } = await apiRequest("POST", svc(orderNo, "change-rdns"), { ip, value });
         return { content: [{ type: "text", text: formatJson(data) }] };
     });
     server.registerTool("clear_rdns", {
-        description: "Clear a customer PTR override for an address returned by get_rdns. The automatic VPSnet PTR is restored, or PTR is removed when no automatic hostname exists. Requires services:manage and a full-access API key; this route is not idempotency-keyed.",
+        description: "Clear a customer PTR override for an address returned by get_rdns. The automatic VPSnet PTR is restored, or PTR is removed when no automatic hostname exists. OAuth requires services:manage; API keys require full access. This route is not idempotency-keyed.",
         inputSchema: {
             orderNo: serviceOrderNoSchema,
             ip: serviceIpSchema,
         },
+        annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
     }, async ({ orderNo, ip }) => {
         const { data } = await apiRequest("POST", svc(orderNo, "change-rdns/clear"), { ip });
         return { content: [{ type: "text", text: formatJson(data) }] };
@@ -2871,12 +2876,13 @@ export function createVpsnetServer(options = {}) {
         return { content: [{ type: "text", text: formatJson(data) }] };
     });
     server.registerTool("set_domain_nameservers", {
-        description: "Queue an asynchronous nameserver change for an owned domain. Nameservers must be hostnames, not IP addresses; same-domain nameserver IP records are managed separately. This does not manage DNS records or PTR. Requires domains:manage when using an API key.",
+        description: "Queue an asynchronous registrar nameserver change for an owned domain. When applied, the parent zone delegates the domain to the new public nameservers, replacing the prior delegation. Nameservers must be hostnames, not IP addresses; same-domain nameserver IP records are managed separately. This does not manage DNS records or PTR. Requires domains:manage when using an API key.",
         inputSchema: {
             domain_id: positiveIdSchema.describe("Owned domain ID from list_domains"),
             nameservers: z.array(nameserverHostnameSchema).min(2).max(13).describe("2-13 nameserver hostnames, e.g. ns1.vpsnet.com, ns2.vpsnet.com. IP addresses are not accepted."),
             idempotencyKey: idempotencyKeySchema.optional().describe("Optional idempotency key for the queued domain action"),
         },
+        annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
     }, async ({ domain_id, nameservers, idempotencyKey }) => {
         const headers = idempotencyKey ? { "Idempotency-Key": idempotencyKey } : undefined;
         const { data } = await apiRequest("POST", `/account/domains/${encodeURIComponent(String(domain_id))}/nameservers`, {
@@ -2895,13 +2901,14 @@ export function createVpsnetServer(options = {}) {
         return { content: [{ type: "text", text: formatJson(data) }] };
     });
     server.registerTool("create_domain_glue_record", {
-        description: "Queue creating or updating a same-domain nameserver IP record for an owned domain. Hostname must be below the domain, addresses must be public IPs, and this does not create DNS A/AAAA records or PTR. Requires domains:manage when using an API key.",
+        description: "Queue creating or updating a same-domain nameserver IP record at the registrar for an owned domain. The public parent-zone glue can direct resolvers to new nameserver addresses; updating an existing hostname replaces its previous addresses. Hostname must be below the domain, addresses must be public IPs, and this does not create DNS A/AAAA records or PTR. Requires domains:manage when using an API key.",
         inputSchema: {
             domain_id: positiveIdSchema.describe("Owned domain ID from list_domains"),
             hostname: glueHostnameSchema,
             addresses: z.array(gluePublicIpSchema).min(1).max(13).describe("Public IPv4/IPv6 addresses for this nameserver host"),
             idempotencyKey: idempotencyKeySchema.describe("Unique key for this queued domain action; sent as Idempotency-Key"),
         },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
     }, async ({ domain_id, hostname, addresses, idempotencyKey }) => {
         const { data } = await apiRequest("POST", `/account/domains/${encodeURIComponent(String(domain_id))}/glue`, { hostname, addresses, idempotencyKey }, { "Idempotency-Key": idempotencyKey });
         return { content: [{ type: "text", text: formatJson(data) }] };
@@ -2913,6 +2920,7 @@ export function createVpsnetServer(options = {}) {
             record_id: positiveIdSchema.describe("Record ID from list_domain_glue_records"),
             idempotencyKey: idempotencyKeySchema.describe("Unique key for this queued domain action; sent as Idempotency-Key"),
         },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
     }, async ({ domain_id, record_id, idempotencyKey }) => {
         const { data } = await apiRequest("DELETE", `/account/domains/${encodeURIComponent(String(domain_id))}/glue/${encodeURIComponent(String(record_id))}`, { idempotencyKey }, { "Idempotency-Key": idempotencyKey });
         return { content: [{ type: "text", text: formatJson(data) }] };
@@ -2927,7 +2935,7 @@ export function createVpsnetServer(options = {}) {
         return { content: [{ type: "text", text: formatJson(data) }] };
     });
     server.registerTool("add_domain_parent_ds", {
-        description: "Queue adding DNSSEC DS records at the parent zone for an owned domain. Requires domains:manage when using an API key.",
+        description: "Queue adding public DNSSEC DS records at the parent zone for an owned domain. Confirm the records match the child zone's DNSKEY; mismatched DS records can prevent validating resolvers from resolving the domain. Requires domains:manage when using an API key.",
         inputSchema: {
             domain_id: positiveIdSchema.describe("Owned domain ID from list_domains"),
             ds: z
@@ -2936,6 +2944,7 @@ export function createVpsnetServer(options = {}) {
                 .describe("One or more DS records, one per line. Accepted forms include '12345 13 2 ABCDEF...' or full BIND-style DS lines."),
             idempotencyKey: idempotencyKeySchema.describe("Unique key for this queued domain action; sent as Idempotency-Key"),
         },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
     }, async ({ domain_id, ds, idempotencyKey }) => {
         const { data } = await apiRequest("POST", `/account/domains/${encodeURIComponent(String(domain_id))}/dnssec-ds`, 
         // The API's preferred key is ds_records; bare `ds` is only a
@@ -2953,6 +2962,7 @@ export function createVpsnetServer(options = {}) {
                 .describe("One or more DS records to remove, one per line. Accepted forms include '12345 13 2 ABCDEF...' or full BIND-style DS lines."),
             idempotencyKey: idempotencyKeySchema.describe("Unique key for this queued domain action; sent as Idempotency-Key"),
         },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
     }, async ({ domain_id, ds, idempotencyKey }) => {
         const { data } = await apiRequest("DELETE", `/account/domains/${encodeURIComponent(String(domain_id))}/dnssec-ds`, 
         // The API's preferred key is ds_records; bare `ds` is only a
@@ -3091,6 +3101,7 @@ export function createVpsnetServer(options = {}) {
             quoteToken: z.string().min(32).describe("quoteToken returned by quote_domain_register"),
             payment: domainPaymentSchema,
         },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
     }, async ({ idempotencyKey, quoteToken, ...input }) => {
         const body = { ...input, idempotencyKey, quoteToken };
         const { data } = await apiRequest("POST", options.remoteProfile === "orders" ? "/account/mcp/orders/domains/confirm" : "/account/domains/register/confirm", body, { "Idempotency-Key": idempotencyKey, "X-Quote-Token": quoteToken });
@@ -3111,6 +3122,7 @@ export function createVpsnetServer(options = {}) {
             quoteToken: z.string().min(32).describe("quoteToken returned by quote_domain_transfer"),
             payment: domainPaymentSchema,
         },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
     }, async ({ idempotencyKey, quoteToken, authCode, ...input }) => {
         const body = { ...input, auth_code: authCode, idempotencyKey, quoteToken };
         const { data } = await apiRequest("POST", "/account/domains/transfer/confirm", body, { "Idempotency-Key": idempotencyKey, "X-Quote-Token": quoteToken });
@@ -3139,6 +3151,7 @@ export function createVpsnetServer(options = {}) {
             quoteToken: z.string().min(32).describe("quoteToken returned by quote_domain_renew"),
             payment: domainPaymentSchema,
         },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
     }, async ({ idempotencyKey, quoteToken, ...input }) => {
         const body = { ...input, idempotencyKey, quoteToken };
         const { data } = await apiRequest("POST", "/account/domains/renew/confirm", body, { "Idempotency-Key": idempotencyKey, "X-Quote-Token": quoteToken });
@@ -3165,6 +3178,7 @@ export function createVpsnetServer(options = {}) {
             quoteToken: z.string().min(32).describe("quoteToken returned by quote_domain_restore"),
             payment: domainPaymentSchema,
         },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
     }, async ({ idempotencyKey, quoteToken, ...input }) => {
         const body = { ...input, idempotencyKey, quoteToken };
         const { data } = await apiRequest("POST", "/account/domains/restore/confirm", body, { "Idempotency-Key": idempotencyKey, "X-Quote-Token": quoteToken });
@@ -3221,6 +3235,7 @@ export function createVpsnetServer(options = {}) {
                 .describe("CNAME target hostname (required when type=CNAME)"),
             ttl: z.number().optional().describe("TTL in seconds (default 120)"),
         },
+        annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
     }, async ({ orderNo, zone_id, name, type, ip, target, ttl }) => {
         const body = { zone_id, name, type };
         if (ip !== undefined)
@@ -3686,10 +3701,11 @@ export function createVpsnetServer(options = {}) {
         return { content: [{ type: "text", text: formatJson(data) }] };
     });
     server.registerTool("delete_function", {
-        description: "Delete a Firecracker Function.",
+        description: "Delete a Firecracker Function, including its public webhook endpoint when enabled.",
         inputSchema: {
             function_id: positiveIdSchema.describe("Function ID from list_functions"),
         },
+        annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
     }, async ({ function_id }) => {
         const { data } = await apiRequest("DELETE", `/account/firecracker/functions/${encodeURIComponent(String(function_id))}`);
         return { content: [{ type: "text", text: formatJson(data) }] };
@@ -4005,7 +4021,7 @@ export function createVpsnetServer(options = {}) {
         return { content: [{ type: "text", text: formatJson(data) }] };
     });
     server.registerTool("import_dns_zone", {
-        description: "Import BIND-style forward DNS records into a native zone. Set replace=true to replace non-system desired-state records; false upserts imported records. PTR/reverse DNS, SOA, DNSSEC wire records, apex NS, and LUA are skipped or rejected by the API. Requires dns:write when using an API key.",
+        description: "Import BIND-style forward DNS records into a native zone. These records can change public DNS answers after publication. Set replace=true to replace non-system desired-state records; false upserts imported records. PTR/reverse DNS, SOA, DNSSEC wire records, apex NS, and LUA are skipped or rejected by the API. Requires dns:write when using an API key.",
         inputSchema: {
             zone_id: positiveIdSchema.describe("DNS zone ID"),
             zonefile: z
@@ -4018,6 +4034,7 @@ export function createVpsnetServer(options = {}) {
                 .optional()
                 .describe("If true, delete existing non-system desired-state records before importing. Defaults to false."),
         },
+        annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
     }, async ({ zone_id, zonefile, replace }) => {
         const { data } = await apiRequest("POST", `/account/dns/zones/${encodeURIComponent(String(zone_id))}/import`, {
             zonefile,
@@ -4035,7 +4052,7 @@ export function createVpsnetServer(options = {}) {
         return { content: [{ type: "text", text: formatJson(data) }] };
     });
     server.registerTool("apply_dns_template", {
-        description: "Apply a backend-defined DNS template to a native forward zone. Records still pass the same API validation, quotas and conflict rules as manual record writes. Prefer preview=true first to show the user exactly which records a template would write before changing the zone. Requires dns:write when using an API key.",
+        description: "Apply a backend-defined DNS template to a native forward zone. The written records can change public DNS answers; overwrite=true replaces conflicting records. Records still pass the same API validation, quotas and conflict rules as manual record writes. Prefer preview=true first to show the user exactly which records a template would write before changing the zone. Requires dns:write when using an API key.",
         inputSchema: {
             zone_id: positiveIdSchema.describe("DNS zone ID"),
             template: dnsTemplateIdSchema
@@ -4053,6 +4070,7 @@ export function createVpsnetServer(options = {}) {
                 .optional()
                 .describe("true to replace existing records that conflict with the template. Destructive: confirm the exact conflicts with the user first, ideally from a preview run."),
         },
+        annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
     }, async ({ zone_id, template, parameters, preview, overwrite }) => {
         const { data } = await apiRequest("POST", `/account/dns/zones/${encodeURIComponent(String(zone_id))}/templates/${encodeURIComponent(template)}`, {
             ...(parameters !== undefined ? { parameters } : {}),
@@ -4066,6 +4084,7 @@ export function createVpsnetServer(options = {}) {
         inputSchema: {
             zone_id: positiveIdSchema.describe("DNS zone ID"),
         },
+        annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
     }, async ({ zone_id }) => {
         const { data } = await apiRequest("DELETE", `/account/dns/zones/${encodeURIComponent(String(zone_id))}`);
         return { content: [{ type: "text", text: formatJson(data) }] };
@@ -4075,6 +4094,7 @@ export function createVpsnetServer(options = {}) {
         inputSchema: {
             zone_id: positiveIdSchema.describe("DNS zone ID"),
         },
+        annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
     }, async ({ zone_id }) => {
         const { data } = await apiRequest("POST", `/account/dns/zones/${encodeURIComponent(String(zone_id))}/verify`);
         return { content: [{ type: "text", text: formatJson(data) }] };
@@ -4098,7 +4118,7 @@ export function createVpsnetServer(options = {}) {
         return { content: [{ type: "text", text: formatJson(data) }] };
     });
     server.registerTool("set_dnssec", {
-        description: "Enable or disable DNSSEC signing for a native DNS zone. If parent DS records still exist outside VPSNet, remove them first and set parent_ds_removed=true before disabling signing. Secondary-zone DNSSEC is controlled on the primary server. Requires dnssec:manage when using an API key.",
+        description: "Enable or disable public DNSSEC signing for a native DNS zone. This changes the zone's DNSSEC chain and can affect validating resolvers. If parent DS records still exist outside VPSNet, remove them first and set parent_ds_removed=true before disabling signing. Secondary-zone DNSSEC is controlled on the primary server. Requires dnssec:manage when using an API key.",
         inputSchema: {
             zone_id: positiveIdSchema.describe("DNS zone ID"),
             enabled: z.boolean().describe("true to enable/sign the zone, false to disable/remove signing"),
@@ -4107,6 +4127,7 @@ export function createVpsnetServer(options = {}) {
                 .optional()
                 .describe("When disabling DNSSEC for a zone whose parent DS is managed outside VPSNet, set true only after removing the parent DS records."),
         },
+        annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
     }, async ({ zone_id, enabled, parent_ds_removed }) => {
         const { data } = await apiRequest("POST", `/account/dns/zones/${encodeURIComponent(String(zone_id))}/dnssec`, {
             enabled,
@@ -4115,7 +4136,7 @@ export function createVpsnetServer(options = {}) {
         return { content: [{ type: "text", text: formatJson(data) }] };
     });
     server.registerTool("upsert_dns_record", {
-        description: "Create or replace a forward DNS record in desired state for a native zone. PTR and *.arpa are rejected; use change_rdns for reverse DNS. Requires dns:write when using an API key.",
+        description: "Create or replace a forward DNS record in desired state for a native zone. Replacing an existing record changes the public answer after publication. PTR and *.arpa are rejected; use change_rdns for reverse DNS. Requires dns:write when using an API key.",
         inputSchema: {
             zone_id: positiveIdSchema.describe("DNS zone ID"),
             name: z
@@ -4133,6 +4154,7 @@ export function createVpsnetServer(options = {}) {
                 .optional()
                 .describe("Optional note about this record, max 255 chars."),
         },
+        annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
     }, async ({ zone_id, name, type, content, ttl, comment }) => {
         const body = { name, type, content };
         if (ttl !== undefined)
@@ -4143,7 +4165,7 @@ export function createVpsnetServer(options = {}) {
         return { content: [{ type: "text", text: formatJson(data) }] };
     });
     server.registerTool("update_dns_record", {
-        description: "Edit an existing forward DNS record by its ID (PUT) — change value, TTL, or comment without replacing it. System-managed records cannot be edited. Requires dns:write when using an API key.",
+        description: "Update an existing forward DNS record by its ID (PUT), replacing its desired value, TTL or comment. A changed value can replace the public DNS answer after publication. System-managed records cannot be edited. Requires dns:write when using an API key.",
         inputSchema: {
             zone_id: positiveIdSchema.describe("DNS zone ID"),
             record_id: positiveIdSchema.describe("DNS record ID to update"),
@@ -4162,6 +4184,7 @@ export function createVpsnetServer(options = {}) {
                 .optional()
                 .describe("Optional note about this record, max 255 chars."),
         },
+        annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
     }, async ({ zone_id, record_id, name, type, content, ttl, comment }) => {
         const body = { name, type, content };
         if (ttl !== undefined)
@@ -4177,6 +4200,7 @@ export function createVpsnetServer(options = {}) {
             zone_id: positiveIdSchema.describe("DNS zone ID"),
             record_id: positiveIdSchema.describe("DNS record ID"),
         },
+        annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
     }, async ({ zone_id, record_id }) => {
         const { data } = await apiRequest("DELETE", `/account/dns/zones/${encodeURIComponent(String(zone_id))}/records/${encodeURIComponent(String(record_id))}`);
         return { content: [{ type: "text", text: formatJson(data) }] };

package/build/remote-policy.js

@@ -158,11 +158,18 @@ const additiveTools = new Set([
 ]);
 const externalTools = new Set([
     'run_vm_command', 'invoke_function', 'install_application', 'install_application_recipe',
-    'create_function', 'update_function', 'create_dns_zone',
+    'configure_application_access', 'configure_application_resource_thresholds',
+    'confirm_application_compose_adoption',
+    'create_function', 'update_function', 'delete_function', 'create_dns_zone',
     'validate_application_recipe', 'create_application_recipe', 'create_application_recipe_revision',
     'read_vm_file', 'write_vm_file', 'manage_application', 'get_application_health', 'get_application_logs',
     'reconcile_application', 'repair_application', 'restart_application', 'start_application',
     'stop_application', 'uninstall_application', 'update_application',
+    'change_rdns', 'clear_rdns', 'set_domain_nameservers',
+    'create_domain_glue_record', 'delete_domain_glue_record',
+    'add_domain_parent_ds', 'delete_domain_parent_ds', 'confirm_domain_register',
+    'attach_service_dns_record', 'import_dns_zone', 'apply_dns_template', 'delete_dns_zone',
+    'set_dnssec', 'upsert_dns_record', 'update_dns_record', 'delete_dns_record',
     'verify_dns_zone', 'reissue_dns_zone_verification', 'get_dns_zone_diagnostics',
     'create_free_certificate', 'manage_free_certificate', 'refresh_automatic_ssl_subscription',
     'manage_automatic_ssl_subscription', 'refresh_certificate', 'manage_certificate',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vpsnet-mcp",
-  "version": "2.3.6",
+  "version": "2.3.7",
   "type": "module",
   "description": "MCP server for managing VPSnet.com services, applications, DNS, domains, billing, and server lifecycle operations",
   "bin": {