python-rac 0.2.0__py3-none-any.whl

pyrac/mcp_server.py

@@ -0,0 +1,3845 @@
+"""Local MCP stdio interface; read-only unless mutations are explicitly enabled."""
+import argparse
+import asyncio
+from functools import partial
+from uuid import UUID
+from pydantic import StrictBool, StrictInt, StrictStr
+from .client import RacClient, RacError
+from .read_service import CLUSTER_LISTS, SERVER_LISTS, PROFILE_ACL_LISTS, ReadService
+from .web.workspace import startup_endpoints
+
+READ_TIMEOUT = 30.0
+
+
+def create_server(service, *, allow_process_turn_off=False, allow_cluster_insert=False,
+                  allow_agent_admin_register=False, allow_agent_admin_remove=False,
+                  allow_cluster_admin_register=False, allow_cluster_admin_remove=False,
+                  allow_rule_insert=False, allow_rule_remove=False, allow_rule_apply=False,
+                  allow_service_settings_apply=False, allow_service_setting_remove=False,
+                  allow_service_setting_update=False, allow_service_setting_insert=False,
+                  allow_profile_remove=False, allow_profile_description_update=False,
+                  allow_profile_config_update=False, allow_profile_access_flags_update=False,
+                  allow_profile_role_fields_update=False, allow_profile_directory_remove=False,
+                  allow_profile_directory_update=False, allow_profile_com_remove=False,
+                  allow_profile_com_update=False, allow_profile_addin_remove=False,
+                  allow_profile_addin_update=False, allow_profile_module_remove=False,
+                  allow_profile_module_update=False, allow_profile_app_remove=False,
+                  allow_profile_app_update=False, allow_profile_inet_remove=False,
+                  allow_profile_inet_update=False,
+                  allow_rule_priority_update=False, allow_rule_fields_update=False,
+                  allow_rule_position_update=False,
+                  allow_infobase_security_profile_update=False,
+                  allow_infobase_safe_mode_security_profile_update=False,
+                  allow_infobase_maximum_scheduled_jobs_shift_update=False,
+                  allow_infobase_minimum_scheduled_jobs_period_update=False,
+                  allow_infobase_configuration_unload_delay_update=False,
+                  allow_infobase_local_speech_update=False,
+                  allow_infobase_external_session_manager_update=False,
+                  allow_infobase_reserve_working_processes_update=False,
+                  allow_infobase_denied_message_update=False,
+                  allow_infobase_license_distribution_update=False,
+                  allow_infobase_sessions_deny_update=False,
+                  allow_infobase_scheduled_jobs_deny_update=False,
+                  allow_infobase_description_update=False,
+                  allow_infobase_summary_description_update=False,
+                  allow_infobase_registration_drop=False,
+                  allow_infobase_existing_registration=False,
+                  allow_infobase_database_create=False,
+                  allow_limit_remove=False,
+                  allow_limit_update=False, allow_counter_remove=False,
+                  allow_counter_description_update=False,
+                  allow_counter_collection_time_update=False,
+                  allow_counter_duration_update=False, allow_counter_group_update=False,
+                  allow_counter_filter_type_update=False, allow_counter_filter_update=False,
+                  allow_counter_analysis_flags_update=False, allow_counter_clear=False,
+                  allow_cluster_remove=False,
+                  allow_cluster_name_update=False,
+                  allow_cluster_expiration_timeout_update=False,
+                  allow_cluster_security_level_update=False,
+                  allow_cluster_session_fault_tolerance_level_update=False,
+                  allow_cluster_load_balancing_mode_update=False,
+                  allow_cluster_kill_problem_processes_update=False,
+                  allow_cluster_kill_by_memory_with_dump_update=False,
+                  allow_cluster_audit_update=False,
+                  allow_cluster_ping_update=False,
+                  allow_cluster_restart_schedule_update=False,
+                  allow_server_restart_schedule_update=False,
+                  allow_server_infobases_limit_update=False,
+                  allow_server_connections_limit_update=False,
+                  allow_server_safe_call_memory_limit_update=False,
+                  allow_server_critical_total_memory_update=False,
+                  allow_server_temporary_total_memory_update=False,
+                  allow_server_temporary_memory_time_limit_update=False,
+                  allow_server_spn_update=False,
+                  allow_server_dedicate_managers_update=False,
+                  allow_server_port_ranges_update=False, workspace_endpoints=None):
+    from mcp.server.mcpserver import MCPServer
+
+    server = MCPServer('pyrac', description=('1C RAC views' if
+                       (allow_process_turn_off or allow_cluster_insert or allow_cluster_remove or
+                        allow_agent_admin_register or allow_agent_admin_remove or
+                        allow_cluster_admin_register or allow_cluster_admin_remove or
+                        allow_rule_insert or allow_rule_remove or allow_rule_priority_update or
+                        allow_rule_fields_update or allow_rule_position_update or
+                        allow_infobase_security_profile_update or
+                        allow_infobase_safe_mode_security_profile_update or
+                        allow_infobase_maximum_scheduled_jobs_shift_update or
+                        allow_infobase_minimum_scheduled_jobs_period_update or
+                        allow_infobase_configuration_unload_delay_update or
+                        allow_infobase_local_speech_update or
+                        allow_infobase_external_session_manager_update or
+                        allow_infobase_reserve_working_processes_update or
+                        allow_infobase_denied_message_update or
+                        allow_infobase_license_distribution_update or
+                        allow_infobase_sessions_deny_update or
+                        allow_infobase_scheduled_jobs_deny_update or
+                        allow_infobase_description_update or
+                        allow_infobase_summary_description_update or
+                        allow_infobase_registration_drop or
+                        allow_infobase_existing_registration or
+                        allow_infobase_database_create or
+                        allow_rule_apply or allow_service_settings_apply or
+                        allow_service_setting_remove or allow_service_setting_update or
+                        allow_service_setting_insert or allow_profile_remove or
+                        allow_profile_description_update or allow_profile_config_update or
+                        allow_profile_access_flags_update or allow_profile_role_fields_update or
+                        allow_profile_directory_remove or allow_profile_directory_update or
+                        allow_profile_com_remove or allow_profile_com_update or
+                        allow_profile_addin_remove or allow_profile_addin_update or
+                        allow_profile_module_remove or allow_profile_module_update or
+                        allow_profile_app_remove or allow_profile_app_update or
+                        allow_profile_inet_remove or allow_profile_inet_update or
+                        allow_limit_remove or allow_limit_update or allow_counter_remove or
+                        allow_counter_description_update or allow_counter_collection_time_update or
+                        allow_counter_duration_update or allow_counter_group_update or
+                        allow_counter_filter_type_update or allow_counter_filter_update or
+                        allow_counter_analysis_flags_update or allow_counter_clear or
+                        allow_cluster_name_update or
+                        allow_cluster_expiration_timeout_update or
+                        allow_cluster_security_level_update or
+                        allow_cluster_session_fault_tolerance_level_update or
+                        allow_cluster_load_balancing_mode_update or
+                        allow_cluster_kill_problem_processes_update or
+                        allow_cluster_kill_by_memory_with_dump_update or
+                        allow_cluster_audit_update or
+                        allow_cluster_ping_update or
+                        allow_cluster_restart_schedule_update or
+                        allow_server_restart_schedule_update or
+                        allow_server_infobases_limit_update or
+                        allow_server_connections_limit_update or
+                        allow_server_safe_call_memory_limit_update or
+                        allow_server_critical_total_memory_update or
+                        allow_server_temporary_total_memory_update or
+                        allow_server_temporary_memory_time_limit_update or
+                        allow_server_spn_update or
+                        allow_server_dedicate_managers_update or
+                        allow_server_port_ranges_update) else 'Read-only 1C RAC views'))
+
+    async def safe_read(operation, *args):
+        try:
+            async with asyncio.timeout(READ_TIMEOUT):
+                return ReadService.public_data(await operation(*args))
+        except Exception as exc:
+            # Do not let SDK logging include credentials or raw server frames,
+            # including errors raised by an unexpected decoder or backend.
+            raise ValueError('RAC read failed (' + type(exc).__name__ + ')') from None
+
+    if workspace_endpoints is not None:
+        @server.tool(description='List cluster navigation entries on every configured RAS '
+                     'without requiring a search term; failed endpoints are isolated')
+        async def rac_workspace_list_clusters() -> list[dict]:
+            semaphore = asyncio.Semaphore(4)
+            deadline = asyncio.get_running_loop().time() + READ_TIMEOUT
+
+            async def list_one(index, endpoint):
+                host, port, protocol = endpoint
+                try:
+                    async with asyncio.timeout_at(deadline), semaphore:
+                        rows = await ReadService(partial(RacClient, host, port, protocol)).clusters()
+                        result = []
+                        for row in rows:
+                            if not isinstance(row, dict):
+                                continue
+                            try:
+                                cluster = str(UUID(str(row['cluster'])))
+                            except (KeyError, TypeError, ValueError):
+                                continue
+                            name = row.get('name')
+                            object_host = row.get('host')
+                            valid_host = (isinstance(object_host, str) and object_host.strip()
+                                          and ReadService._valid_search_text(object_host))
+                            valid_name = (isinstance(name, str) and name.strip()
+                                          and ReadService._valid_search_text(name))
+                            entry = {'ras': index, 'host': host, 'port': port,
+                                     'protocol': protocol, 'cluster': cluster,
+                                     'name': name if valid_name else
+                                     object_host if valid_host else 'Unnamed cluster'}
+                            if valid_host:
+                                entry['object_host'] = object_host
+                            result.append(entry)
+                        return result
+                except Exception:
+                    return []
+
+            batches = await asyncio.gather(*(list_one(index, endpoint)
+                                             for index, endpoint in enumerate(workspace_endpoints)))
+            return [row for batch in batches for row in batch]
+
+        @server.tool(description='List infobase navigation entries across all startup RAS '
+                     'without requiring a search term; isolate failed clusters')
+        async def rac_workspace_list_infobases() -> list[dict]:
+            semaphore = asyncio.Semaphore(4)
+            deadline = asyncio.get_running_loop().time() + READ_TIMEOUT
+
+            async def list_one(index, endpoint):
+                host, port, protocol = endpoint
+                result = []
+                try:
+                    async with asyncio.timeout_at(deadline), semaphore:
+                        async with RacClient(host, port, protocol) as client:
+                            for cluster_row in await client.list_clusters():
+                                if not isinstance(cluster_row, dict):
+                                    continue
+                                try:
+                                    cluster = str(UUID(str(cluster_row['cluster'])))
+                                except (KeyError, TypeError, ValueError):
+                                    continue
+                                try:
+                                    bases = await client.list_infobases(UUID(cluster))
+                                    for row in bases:
+                                        if not isinstance(row, dict):
+                                            continue
+                                        try:
+                                            infobase = str(UUID(str(row['infobase'])))
+                                        except (KeyError, TypeError, ValueError):
+                                            continue
+                                        name = row.get('name')
+                                        valid_name = (isinstance(name, str) and name.strip()
+                                                      and ReadService._valid_search_text(name))
+                                        result.append({'ras': index, 'host': host, 'port': port,
+                                                       'protocol': protocol, 'cluster': cluster,
+                                                       'infobase': infobase,
+                                                       'name': name if valid_name else 'Unnamed infobase'})
+                                except Exception:
+                                    continue
+                        return result
+                except Exception:
+                    return result
+
+            batches = await asyncio.gather(*(list_one(index, endpoint)
+                                             for index, endpoint in enumerate(workspace_endpoints)))
+            return [row for batch in batches for row in batch]
+
+        @server.tool(description='List working-server navigation entries across all startup RAS '
+                     'without a search term; isolate failed clusters')
+        async def rac_workspace_list_servers() -> list[dict]:
+            semaphore = asyncio.Semaphore(4)
+            deadline = asyncio.get_running_loop().time() + READ_TIMEOUT
+
+            async def list_one(index, endpoint):
+                host, port, protocol = endpoint
+                result = []
+                try:
+                    async with asyncio.timeout_at(deadline), semaphore:
+                        async with RacClient(host, port, protocol) as client:
+                            for cluster_row in await client.list_clusters():
+                                if not isinstance(cluster_row, dict):
+                                    continue
+                                try:
+                                    cluster = str(UUID(str(cluster_row['cluster'])))
+                                except (KeyError, TypeError, ValueError):
+                                    continue
+                                try:
+                                    for row in await client.list_servers(UUID(cluster)):
+                                        if not isinstance(row, dict):
+                                            continue
+                                        try:
+                                            server_id = str(UUID(str(row['server'])))
+                                        except (KeyError, TypeError, ValueError):
+                                            continue
+                                        name, object_host = row.get('name'), row.get('host_name')
+                                        valid_name = (isinstance(name, str) and name.strip()
+                                                      and ReadService._valid_search_text(name))
+                                        valid_host = (isinstance(object_host, str) and object_host.strip()
+                                                      and ReadService._valid_search_text(object_host))
+                                        entry = {'ras': index, 'host': host, 'port': port,
+                                                 'protocol': protocol, 'cluster': cluster,
+                                                 'server': server_id, 'name': name if valid_name else
+                                                 object_host if valid_host else 'Unnamed server'}
+                                        if valid_host:
+                                            entry['object_host'] = object_host
+                                        result.append(entry)
+                                except Exception:
+                                    continue
+                except Exception:
+                    pass  # Keep completed clusters; never return server exception text.
+                return result
+
+            batches = await asyncio.gather(*(list_one(index, endpoint)
+                                             for index, endpoint in enumerate(workspace_endpoints)))
+            return [row for batch in batches for row in batch]
+
+        @server.tool(description='List working-process navigation entries across all startup RAS '
+                     'without a search term; isolate failed clusters')
+        async def rac_workspace_list_processes() -> list[dict]:
+            semaphore = asyncio.Semaphore(4)
+            deadline = asyncio.get_running_loop().time() + READ_TIMEOUT
+
+            async def list_one(index, endpoint):
+                host, port, protocol = endpoint
+                result = []
+                try:
+                    async with asyncio.timeout_at(deadline), semaphore:
+                        async with RacClient(host, port, protocol) as client:
+                            for cluster_row in await client.list_clusters():
+                                if not isinstance(cluster_row, dict):
+                                    continue
+                                try:
+                                    cluster = str(UUID(str(cluster_row['cluster'])))
+                                except (KeyError, TypeError, ValueError):
+                                    continue
+                                try:
+                                    for row in await client.list_processes(UUID(cluster)):
+                                        if not isinstance(row, dict):
+                                            continue
+                                        try:
+                                            process = str(UUID(str(row['process'])))
+                                        except (KeyError, TypeError, ValueError):
+                                            continue
+                                        pid, object_host = row.get('pid'), row.get('host')
+                                        valid_pid = (type(pid) is str and pid.isascii()
+                                                     and pid.isdecimal() and len(pid) <= 20)
+                                        valid_host = (isinstance(object_host, str) and object_host.strip()
+                                                      and ReadService._valid_search_text(object_host))
+                                        entry = {'ras': index, 'host': host, 'port': port,
+                                                 'protocol': protocol, 'cluster': cluster,
+                                                 'process': process,
+                                                 'name': f'PID {pid}' if valid_pid else 'Working process'}
+                                        if valid_pid:
+                                            entry['pid'] = pid
+                                        if valid_host:
+                                            entry['object_host'] = object_host
+                                        result.append(entry)
+                                except Exception:
+                                    continue
+                except Exception:
+                    pass  # Keep completed clusters; never return server exception text.
+                return result
+
+            batches = await asyncio.gather(*(list_one(index, endpoint)
+                                             for index, endpoint in enumerate(workspace_endpoints)))
+            return [row for batch in batches for row in batch]
+
+        @server.tool(description='List session navigation entries across all startup RAS '
+                     'without a search term; isolate failed clusters')
+        async def rac_workspace_list_sessions() -> list[dict]:
+            semaphore = asyncio.Semaphore(4)
+            deadline = asyncio.get_running_loop().time() + READ_TIMEOUT
+
+            async def list_one(index, endpoint):
+                host, port, protocol = endpoint
+                result = []
+                try:
+                    async with asyncio.timeout_at(deadline), semaphore:
+                        async with RacClient(host, port, protocol) as client:
+                            for cluster_row in await client.list_clusters():
+                                if not isinstance(cluster_row, dict):
+                                    continue
+                                try:
+                                    cluster = str(UUID(str(cluster_row['cluster'])))
+                                except (KeyError, TypeError, ValueError):
+                                    continue
+                                try:
+                                    for row in await client.list_sessions(UUID(cluster)):
+                                        if not isinstance(row, dict):
+                                            continue
+                                        try:
+                                            session = str(UUID(str(row['session_id'])))
+                                        except (KeyError, TypeError, ValueError):
+                                            continue
+                                        name = row.get('user_name')
+                                        if (not isinstance(name, str) or not name.strip()
+                                                or not ReadService._valid_search_text(name)):
+                                            name = 'Unnamed session'
+                                        result.append({'ras': index, 'host': host, 'port': port,
+                                                       'protocol': protocol, 'cluster': cluster,
+                                                       'session': session, 'name': name})
+                                except Exception:
+                                    continue
+                except Exception:
+                    pass  # Keep completed clusters; never return server exception text.
+                return result
+
+            batches = await asyncio.gather(*(list_one(index, endpoint)
+                                             for index, endpoint in enumerate(workspace_endpoints)))
+            return [row for batch in batches for row in batch]
+
+        @server.tool(description='List connection navigation entries across all startup RAS '
+                     'without a search term; isolate failed clusters')
+        async def rac_workspace_list_connections() -> list[dict]:
+            semaphore = asyncio.Semaphore(4)
+            deadline = asyncio.get_running_loop().time() + READ_TIMEOUT
+
+            async def list_one(index, endpoint):
+                host, port, protocol = endpoint
+                result = []
+                try:
+                    async with asyncio.timeout_at(deadline), semaphore:
+                        async with RacClient(host, port, protocol) as client:
+                            for cluster_row in await client.list_clusters():
+                                if not isinstance(cluster_row, dict):
+                                    continue
+                                try:
+                                    cluster = str(UUID(str(cluster_row['cluster'])))
+                                except (KeyError, TypeError, ValueError):
+                                    continue
+                                try:
+                                    for row in await client.list_connections(UUID(cluster)):
+                                        if not isinstance(row, dict):
+                                            continue
+                                        try:
+                                            connection = str(UUID(str(row['connection'])))
+                                        except (KeyError, TypeError, ValueError):
+                                            continue
+                                        object_host = row.get('host')
+                                        valid_host = (isinstance(object_host, str) and object_host.strip()
+                                                      and ReadService._valid_search_text(object_host))
+                                        entry = {'ras': index, 'host': host, 'port': port,
+                                                 'protocol': protocol, 'cluster': cluster,
+                                                 'connection': connection,
+                                                 'name': object_host if valid_host else 'Unnamed connection'}
+                                        if valid_host:
+                                            entry['object_host'] = object_host
+                                        result.append(entry)
+                                except Exception:
+                                    continue
+                except Exception:
+                    pass  # Keep completed clusters; never return server exception text.
+                return result
+
+            batches = await asyncio.gather(*(list_one(index, endpoint)
+                                             for index, endpoint in enumerate(workspace_endpoints)))
+            return [row for batch in batches for row in batch]
+
+        @server.tool(description='List safe lock navigation entries across startup RAS '
+                     'without a search term; isolate failed clusters')
+        async def rac_workspace_list_locks() -> list[dict]:
+            semaphore = asyncio.Semaphore(4)
+            deadline = asyncio.get_running_loop().time() + READ_TIMEOUT
+
+            async def list_one(index, endpoint):
+                host, port, protocol = endpoint
+                result = []
+                try:
+                    async with asyncio.timeout_at(deadline), semaphore:
+                        async with RacClient(host, port, protocol) as client:
+                            for cluster_row in await client.list_clusters():
+                                if not isinstance(cluster_row, dict):
+                                    continue
+                                try:
+                                    cluster = str(UUID(str(cluster_row['cluster'])))
+                                except (KeyError, TypeError, ValueError):
+                                    continue
+                                try:
+                                    for row in await client.list_locks(UUID(cluster)):
+                                        if not isinstance(row, dict):
+                                            continue
+                                        try:
+                                            connection = str(UUID(str(row['connection'])))
+                                            obj = str(UUID(str(row['object'])))
+                                        except (KeyError, TypeError, ValueError):
+                                            continue
+                                        label = row.get('lock-descr')
+                                        name = (label if isinstance(label, str) and label.strip()
+                                                and ReadService._valid_search_text(label)
+                                                else 'Lock')
+                                        result.append({'ras': index, 'host': host, 'port': port,
+                                                       'protocol': protocol, 'cluster': cluster,
+                                                       'connection': connection, 'object': obj,
+                                                       'name': name})
+                                except Exception:
+                                    continue
+                except Exception:
+                    pass  # Keep completed clusters without private exception text.
+                return result
+
+            batches = await asyncio.gather(*(list_one(index, endpoint)
+                                             for index, endpoint in enumerate(workspace_endpoints)))
+            return [row for batch in batches for row in batch]
+
+        @server.tool(description='List cluster-service navigation entries across all startup RAS '
+                     'without a search term; isolate failed clusters')
+        async def rac_workspace_list_services() -> list[dict]:
+            semaphore = asyncio.Semaphore(4)
+            deadline = asyncio.get_running_loop().time() + READ_TIMEOUT
+
+            async def list_one(index, endpoint):
+                host, port, protocol = endpoint
+                result = []
+                try:
+                    async with asyncio.timeout_at(deadline), semaphore:
+                        async with RacClient(host, port, protocol) as client:
+                            for cluster_row in await client.list_clusters():
+                                if not isinstance(cluster_row, dict):
+                                    continue
+                                try:
+                                    cluster = str(UUID(str(cluster_row['cluster'])))
+                                except (KeyError, TypeError, ValueError):
+                                    continue
+                                try:
+                                    for row in await client.list_services(UUID(cluster)):
+                                        if not isinstance(row, dict):
+                                            continue
+                                        name = row.get('name')
+                                        if (not isinstance(name, str) or not name.strip()
+                                                or not ReadService._valid_search_text(name)):
+                                            continue
+                                        result.append({'ras': index, 'host': host, 'port': port,
+                                                       'protocol': protocol, 'cluster': cluster,
+                                                       'name': name})
+                                except Exception:
+                                    continue
+                except Exception:
+                    pass  # Keep completed clusters; never return server exception text.
+                return result
+
+            batches = await asyncio.gather(*(list_one(index, endpoint)
+                                             for index, endpoint in enumerate(workspace_endpoints)))
+            return [row for batch in batches for row in batch]
+
+        @server.tool(description='List security-profile navigation entries across all startup RAS '
+                     'without a search term; isolate failed clusters')
+        async def rac_workspace_list_profiles() -> list[dict]:
+            semaphore = asyncio.Semaphore(4)
+            deadline = asyncio.get_running_loop().time() + READ_TIMEOUT
+
+            async def list_one(index, endpoint):
+                host, port, protocol = endpoint
+                result = []
+                try:
+                    async with asyncio.timeout_at(deadline), semaphore:
+                        async with RacClient(host, port, protocol) as client:
+                            for cluster_row in await client.list_clusters():
+                                if not isinstance(cluster_row, dict):
+                                    continue
+                                try:
+                                    cluster = str(UUID(str(cluster_row['cluster'])))
+                                except (KeyError, TypeError, ValueError):
+                                    continue
+                                try:
+                                    for row in await client.list_profiles(UUID(cluster)):
+                                        if not isinstance(row, dict):
+                                            continue
+                                        name = row.get('name')
+                                        if (not isinstance(name, str) or not name.strip()
+                                                or not ReadService._valid_search_text(name)):
+                                            continue
+                                        result.append({'ras': index, 'host': host, 'port': port,
+                                                       'protocol': protocol, 'cluster': cluster,
+                                                       'name': name})
+                                except Exception:
+                                    continue
+                except Exception:
+                    pass  # Keep completed clusters; never return server exception text.
+                return result
+
+            batches = await asyncio.gather(*(list_one(index, endpoint)
+                                             for index, endpoint in enumerate(workspace_endpoints)))
+            return [row for batch in batches for row in batch]
+
+        @server.tool(description='List managers, counters or limits across startup RAS without '
+                     'a search term; return navigation fields only')
+        async def rac_workspace_list_cluster_inventory(kind: StrictStr) -> list[dict]:
+            options = {'managers': ('list_managers', 'manager', 'manager'),
+                       'counters': ('list_counters', 'counter', 'name'),
+                       'limits': ('list_limits', 'limit', 'name')}
+            if kind not in options:
+                raise ValueError('Unsupported cluster inventory')
+            method, row_kind, selector_key = options[kind]
+            semaphore = asyncio.Semaphore(4)
+            deadline = asyncio.get_running_loop().time() + READ_TIMEOUT
+
+            async def list_one(index, endpoint):
+                host, port, protocol = endpoint
+                result = []
+                try:
+                    async with asyncio.timeout_at(deadline), semaphore:
+                        async with RacClient(host, port, protocol) as client:
+                            for cluster_row in await client.list_clusters():
+                                if not isinstance(cluster_row, dict):
+                                    continue
+                                try:
+                                    cluster = str(UUID(str(cluster_row['cluster'])))
+                                except (KeyError, TypeError, ValueError):
+                                    continue
+                                try:
+                                    for row in await getattr(client, method)(UUID(cluster)):
+                                        if not isinstance(row, dict):
+                                            continue
+                                        if row_kind == 'manager':
+                                            try:
+                                                selector = str(UUID(str(row[selector_key])))
+                                            except (KeyError, TypeError, ValueError):
+                                                continue
+                                            label = row.get('host')
+                                            name = (label if isinstance(label, str) and label.strip()
+                                                    and ReadService._valid_search_text(label)
+                                                    else 'Cluster manager')
+                                        else:
+                                            selector = row.get(selector_key)
+                                            if (not isinstance(selector, str) or not selector.strip()
+                                                    or not ReadService._valid_search_text(selector)):
+                                                continue
+                                            name = selector
+                                        result.append({'ras': index, 'host': host, 'port': port,
+                                                       'protocol': protocol, 'cluster': cluster,
+                                                       'kind': row_kind, 'selector': selector,
+                                                       'name': name})
+                                except Exception:
+                                    continue
+                except Exception:
+                    pass  # Keep completed clusters; never return server exception text.
+                return result
+
+            batches = await asyncio.gather(*(list_one(index, endpoint)
+                                             for index, endpoint in enumerate(workspace_endpoints)))
+            return [row for batch in batches for row in batch]
+
+        @server.tool(description='List rule, service-setting or transfer-directory navigation '
+                     'across startup RAS without a search term; return safe fields only')
+        async def rac_workspace_list_server_inventory(kind: StrictStr) -> list[dict]:
+            options = {'rules': ('list_rules', 'rule', 'object-type', 'Assignment rule'),
+                       'service-settings': ('list_service_settings', 'setting',
+                                            'service-name', 'Service setting'),
+                       'transfer-directories': ('list_service_data_dirs_for_transfer',
+                                                'service-name', 'service-name', '')}
+            if kind not in options:
+                raise ValueError('Unsupported server inventory')
+            method, selector_key, label_key, fallback = options[kind]
+            semaphore = asyncio.Semaphore(4)
+            deadline = asyncio.get_running_loop().time() + READ_TIMEOUT
+
+            async def list_one(index, endpoint):
+                host, port, protocol = endpoint
+                result = []
+                try:
+                    async with asyncio.timeout_at(deadline), semaphore:
+                        async with RacClient(host, port, protocol) as client:
+                            for cluster_row in await client.list_clusters():
+                                if not isinstance(cluster_row, dict):
+                                    continue
+                                try:
+                                    cluster = str(UUID(str(cluster_row['cluster'])))
+                                except (KeyError, TypeError, ValueError):
+                                    continue
+                                try:
+                                    servers = await client.list_servers(UUID(cluster))
+                                except Exception:
+                                    continue
+                                for server_row in servers:
+                                    if not isinstance(server_row, dict):
+                                        continue
+                                    try:
+                                        server_id = str(UUID(str(server_row['server'])))
+                                    except (KeyError, TypeError, ValueError):
+                                        continue
+                                    try:
+                                        for row in await getattr(client, method)(
+                                                UUID(cluster), UUID(server_id)):
+                                            if not isinstance(row, dict):
+                                                continue
+                                            entry = {'ras': index, 'host': host, 'port': port,
+                                                     'protocol': protocol, 'cluster': cluster,
+                                                     'server': server_id, 'kind': kind}
+                                            if kind == 'transfer-directories':
+                                                service_name = row.get(selector_key)
+                                                if (not isinstance(service_name, str)
+                                                        or not service_name.strip()
+                                                        or not ReadService._valid_search_text(service_name)):
+                                                    continue
+                                                entry.update({'service-name': service_name,
+                                                              'name': service_name})
+                                                infobase = row.get('infobase-name')
+                                                if (isinstance(infobase, str)
+                                                        and ReadService._valid_search_text(infobase)):
+                                                    entry['infobase-name'] = infobase
+                                            else:
+                                                try:
+                                                    selector = str(UUID(str(row[selector_key])))
+                                                except (KeyError, TypeError, ValueError):
+                                                    continue
+                                                label = row.get(label_key)
+                                                name = (label if isinstance(label, str) and label.strip()
+                                                        and ReadService._valid_search_text(label)
+                                                        else fallback)
+                                                entry.update({selector_key: selector, 'name': name})
+                                            result.append(entry)
+                                    except Exception:
+                                        continue
+                except Exception:
+                    pass  # Keep completed servers without exposing connection errors.
+                return result
+
+            batches = await asyncio.gather(*(list_one(index, endpoint)
+                                             for index, endpoint in enumerate(workspace_endpoints)))
+            return [row for batch in batches for row in batch]
+
+        @server.tool(description='List safe agent or cluster administrator names across '
+                     'startup RAS without a search term')
+        async def rac_workspace_list_administrators(kind: StrictStr) -> list[dict]:
+            if kind not in ('agent-admins', 'cluster-admins'):
+                raise ValueError('Unsupported administrator inventory')
+            semaphore = asyncio.Semaphore(4)
+            deadline = asyncio.get_running_loop().time() + READ_TIMEOUT
+
+            async def list_one(index, endpoint):
+                host, port, protocol = endpoint
+                result = []
+                try:
+                    async with asyncio.timeout_at(deadline), semaphore:
+                        async with RacClient(host, port, protocol) as client:
+                            if kind == 'agent-admins':
+                                for row in await client.list_agent_admins():
+                                    if not isinstance(row, dict):
+                                        continue
+                                    name = row.get('name')
+                                    if (isinstance(name, str) and name.strip()
+                                            and ReadService._valid_search_text(name)):
+                                        result.append({'ras': index, 'host': host, 'port': port,
+                                                       'protocol': protocol, 'kind': kind, 'name': name})
+                            else:
+                                for cluster_row in await client.list_clusters():
+                                    if not isinstance(cluster_row, dict):
+                                        continue
+                                    try:
+                                        cluster = str(UUID(str(cluster_row['cluster'])))
+                                    except (KeyError, TypeError, ValueError):
+                                        continue
+                                    try:
+                                        for row in await client.list_cluster_admins(UUID(cluster)):
+                                            if not isinstance(row, dict):
+                                                continue
+                                            name = row.get('name')
+                                            if (isinstance(name, str) and name.strip()
+                                                    and ReadService._valid_search_text(name)):
+                                                result.append({'ras': index, 'host': host,
+                                                               'port': port, 'protocol': protocol,
+                                                               'kind': kind, 'cluster': cluster,
+                                                               'name': name})
+                                    except Exception:
+                                        continue
+                except Exception:
+                    pass  # Keep completed clusters, not server exception text.
+                return result
+
+            batches = await asyncio.gather(*(list_one(index, endpoint)
+                                             for index, endpoint in enumerate(workspace_endpoints)))
+            return [row for batch in batches for row in batch]
+
+        @server.tool(description='Read-only cross-RAS search of verified inventories; '
+                     'returns endpoint and object navigation fields only')
+        async def rac_workspace_search(query: StrictStr, scope: StrictStr) -> list[dict]:
+            methods = {'clusters': 'search_clusters', 'infobases': 'search_infobases',
+                       'profiles': 'search_profiles', 'servers': 'search_working_servers',
+                       'processes': 'search_working_processes', 'sessions': 'search_sessions',
+                       'connections': 'search_connections', 'managers': 'search_managers',
+                       'counters': 'search_counters', 'limits': 'search_limits',
+                       'services': 'search_services', 'locks': 'search_locks',
+                       'agent-admins': 'search_agent_admins',
+                       'cluster-admins': 'search_cluster_admins',
+                       'rules': 'search_rules',
+                       'service-settings': 'search_service_settings',
+                       'transfer-directories': 'search_transfer_directories',
+                       **{f'profile-{kind if kind != "directory" else "directories"}':
+                          kind for kind in PROFILE_ACL_LISTS}}
+            if scope not in methods:
+                raise ValueError('Invalid workspace search scope')
+            needle = ReadService._search_needle(query)
+            semaphore = asyncio.Semaphore(4)
+            deadline = asyncio.get_running_loop().time() + READ_TIMEOUT
+
+            async def search_one(index, endpoint):
+                host, port, protocol = endpoint
+                try:
+                    async with asyncio.timeout_at(deadline), semaphore:
+                        reader = ReadService(partial(RacClient, host, port, protocol))
+                        if scope.startswith('profile-'):
+                            rows = await reader.search_profile_acl_all(methods[scope], needle)
+                        else:
+                            rows = await getattr(reader, methods[scope])(needle)
+                        results = []
+                        for row in rows:
+                            address = ReadService.public_data(row)
+                            if 'host' in address:
+                                address['object_host'] = address.pop('host')
+                            results.append({**address, 'ras': index, 'host': host,
+                                            'port': port, 'protocol': protocol})
+                        return results
+                except Exception:
+                    # A failed RAS must not hide the healthy endpoints or leak its error.
+                    return []
+
+            batches = await asyncio.gather(*(search_one(i, endpoint)
+                                             for i, endpoint in enumerate(workspace_endpoints)))
+            return [row for batch in batches for row in batch]
+
+        @server.tool(description='Read-only cluster overview from one configured RAS; '
+                     'ras is the index returned by rac_workspace_search')
+        async def rac_workspace_cluster_overview(ras: StrictInt, cluster_id: StrictStr) -> dict:
+            if type(ras) is not int or not 0 <= ras < len(workspace_endpoints):
+                raise ValueError('Invalid RAS index')
+            cluster = str(UUID(cluster_id))
+            host, port, protocol = workspace_endpoints[ras]
+            try:
+                async with asyncio.timeout(READ_TIMEOUT):
+                    reader = ReadService(partial(RacClient, host, port, protocol))
+                    record = ReadService.public_data(await reader.cluster(cluster))
+                    return {'ras': ras, 'host': host, 'port': port,
+                            'protocol': protocol, **record}
+            except Exception as exc:
+                raise ValueError('RAC read failed (' + type(exc).__name__ + ')') from None
+
+        @server.tool(description='List a verified cluster inventory from a selected startup RAS')
+        async def rac_workspace_list_cluster_group(ras: StrictInt, cluster_id: StrictStr,
+                                                    group: StrictStr) -> dict:
+            if type(ras) is not int or not 0 <= ras < len(workspace_endpoints):
+                raise ValueError('Invalid RAS index')
+            if group not in CLUSTER_LISTS:
+                raise ValueError('Invalid cluster group')
+            cluster = str(UUID(cluster_id))
+            host, port, protocol = workspace_endpoints[ras]
+            try:
+                async with asyncio.timeout(READ_TIMEOUT):
+                    reader = ReadService(partial(RacClient, host, port, protocol))
+                    rows = ReadService.public_data(await reader.list_group(cluster, group))
+                    for row in rows:
+                        if 'host' in row:
+                            row['object_host'] = row.pop('host')
+                    return {'ras': ras, 'host': host, 'port': port, 'protocol': protocol,
+                            'cluster': cluster, 'group': group, 'rows': rows}
+            except Exception as exc:
+                raise ValueError('RAC read failed (' + type(exc).__name__ + ')') from None
+
+        @server.tool(description='Read one server, process, session, infobase or connection '
+                     'from a selected startup RAS')
+        async def rac_workspace_object_detail(ras: StrictInt, cluster_id: StrictStr,
+                                              kind: StrictStr, object_id: StrictStr) -> dict:
+            methods = {'server': 'server', 'process': 'process', 'session': 'session',
+                       'infobase': 'infobase_info', 'connection': 'connection'}
+            if type(ras) is not int or not 0 <= ras < len(workspace_endpoints):
+                raise ValueError('Invalid RAS index')
+            if kind not in methods:
+                raise ValueError('Invalid object kind')
+            cluster, object_id = str(UUID(cluster_id)), str(UUID(object_id))
+            host, port, protocol = workspace_endpoints[ras]
+            try:
+                async with asyncio.timeout(READ_TIMEOUT):
+                    reader = ReadService(partial(RacClient, host, port, protocol))
+                    record = ReadService.public_data(
+                        await getattr(reader, methods[kind])(cluster, object_id))
+                    if 'host' in record:
+                        record['object_host'] = record.pop('host')
+                    return {'ras': ras, 'host': host, 'port': port, 'protocol': protocol,
+                            'cluster': cluster, 'kind': kind, 'object': record}
+            except Exception as exc:
+                raise ValueError('RAC read failed (' + type(exc).__name__ + ')') from None
+
+        @server.tool(description='List rules, service settings or transfer directories '
+                     'of a working server on the selected startup RAS')
+        async def rac_workspace_list_server_group(ras: StrictInt, cluster_id: StrictStr,
+                                                  server_id: StrictStr, group: StrictStr) -> dict:
+            if type(ras) is not int or not 0 <= ras < len(workspace_endpoints):
+                raise ValueError('Invalid RAS index')
+            if group not in SERVER_LISTS:
+                raise ValueError('Invalid server group')
+            cluster, server_id = str(UUID(cluster_id)), str(UUID(server_id))
+            host, port, protocol = workspace_endpoints[ras]
+            try:
+                async with asyncio.timeout(READ_TIMEOUT):
+                    reader = ReadService(partial(RacClient, host, port, protocol))
+                    rows = ReadService.public_data(
+                        await reader.list_server_group(cluster, server_id, group))
+                    for row in rows:
+                        if 'host' in row:
+                            row['object_host'] = row.pop('host')
+                    return {'ras': ras, 'host': host, 'port': port, 'protocol': protocol,
+                            'cluster': cluster, 'server': server_id, 'group': group,
+                            'rows': rows}
+            except Exception as exc:
+                raise ValueError('RAC read failed (' + type(exc).__name__ + ')') from None
+
+        @server.tool(description='List one verified security-profile ACL subtype on '
+                     'the selected startup RAS')
+        async def rac_workspace_list_profile_acl(ras: StrictInt, cluster_id: StrictStr,
+                                                 profile_name: StrictStr,
+                                                 acl_type: StrictStr) -> dict:
+            if type(ras) is not int or not 0 <= ras < len(workspace_endpoints):
+                raise ValueError('Invalid RAS index')
+            if acl_type not in PROFILE_ACL_LISTS:
+                raise ValueError('Invalid profile ACL type')
+            cluster = str(UUID(cluster_id))
+            ReadService._validated_profile_name(profile_name)
+            host, port, protocol = workspace_endpoints[ras]
+            try:
+                async with asyncio.timeout(READ_TIMEOUT):
+                    reader = ReadService(partial(RacClient, host, port, protocol))
+                    rows = ReadService.public_data(
+                        await reader.list_profile_acl(cluster, profile_name, acl_type))
+                    for row in rows:
+                        if 'host' in row:
+                            row['object_host'] = row.pop('host')
+                    return {'ras': ras, 'host': host, 'port': port, 'protocol': protocol,
+                            'cluster': cluster, 'profile': profile_name,
+                            'acl_type': acl_type, 'rows': rows}
+            except Exception as exc:
+                raise ValueError('RAC read failed (' + type(exc).__name__ + ')') from None
+
+        @server.tool(description='List sessions, connections or binary storages of an '
+                     'infobase on the selected startup RAS')
+        async def rac_workspace_list_infobase_group(ras: StrictInt, cluster_id: StrictStr,
+                                                    infobase_id: StrictStr,
+                                                    group: StrictStr) -> dict:
+            methods = {'sessions': 'sessions_in_infobase',
+                       'connections': 'connections_in_infobase',
+                       'binary-storages': 'binary_storages'}
+            if type(ras) is not int or not 0 <= ras < len(workspace_endpoints):
+                raise ValueError('Invalid RAS index')
+            if group not in methods:
+                raise ValueError('Invalid infobase group')
+            cluster, infobase = str(UUID(cluster_id)), str(UUID(infobase_id))
+            host, port, protocol = workspace_endpoints[ras]
+            try:
+                async with asyncio.timeout(READ_TIMEOUT):
+                    reader = ReadService(partial(RacClient, host, port, protocol))
+                    rows = ReadService.public_data(
+                        await getattr(reader, methods[group])(cluster, infobase))
+                    for row in rows:
+                        if 'host' in row:
+                            row['object_host'] = row.pop('host')
+                    return {'ras': ras, 'host': host, 'port': port, 'protocol': protocol,
+                            'cluster': cluster, 'infobase': infobase, 'group': group,
+                            'rows': rows}
+            except Exception as exc:
+                raise ValueError('RAC read failed (' + type(exc).__name__ + ')') from None
+
+        @server.tool(description='Read a manager, rule, service setting, counter or limit '
+                     'from the selected startup RAS')
+        async def rac_workspace_record_detail(ras: StrictInt, cluster_id: StrictStr,
+                                              kind: StrictStr, selector: StrictStr,
+                                              server_id: StrictStr = '') -> dict:
+            methods = {'manager': 'manager', 'rule': 'rule',
+                       'service-setting': 'service_setting',
+                       'counter': 'counter', 'limit': 'limit'}
+            if type(ras) is not int or not 0 <= ras < len(workspace_endpoints):
+                raise ValueError('Invalid RAS index')
+            if kind not in methods:
+                raise ValueError('Invalid record kind')
+            cluster = str(UUID(cluster_id))
+            if kind in ('rule', 'service-setting'):
+                server_id = str(UUID(server_id))
+            elif server_id:
+                raise ValueError('Unexpected working server')
+            if kind in ('counter', 'limit'):
+                if (not selector or '\x00' in selector
+                        or len(selector.encode('utf-8')) > 1024):
+                    raise ValueError('Invalid record name')
+            else:
+                selector = str(UUID(selector))
+            host, port, protocol = workspace_endpoints[ras]
+            try:
+                async with asyncio.timeout(READ_TIMEOUT):
+                    reader = ReadService(partial(RacClient, host, port, protocol))
+                    arguments = ((cluster, server_id, selector) if kind in ('rule', 'service-setting')
+                                 else (cluster, selector))
+                    record = ReadService.public_data(
+                        await getattr(reader, methods[kind])(*arguments))
+                    if 'host' in record:
+                        record['object_host'] = record.pop('host')
+                    return {'ras': ras, 'host': host, 'port': port, 'protocol': protocol,
+                            'cluster': cluster, 'server': server_id, 'kind': kind,
+                            'selector': selector, 'object': record}
+            except Exception as exc:
+                raise ValueError('RAC read failed (' + type(exc).__name__ + ')') from None
+
+        @server.tool(description='Read related processes, connections or locks for a '
+                     'selected server, process, infobase or connection on a startup RAS')
+        async def rac_workspace_related_inventory(ras: StrictInt, cluster_id: StrictStr,
+                                                  scope: StrictStr, record_id: StrictStr) -> dict:
+            methods = {'server-processes': 'processes_on_server',
+                       'process-connections': 'connections_in_process',
+                       'infobase-locks': 'filtered_locks',
+                       'connection-locks': 'filtered_locks'}
+            if type(ras) is not int or not 0 <= ras < len(workspace_endpoints):
+                raise ValueError('Invalid RAS index')
+            if scope not in methods:
+                raise ValueError('Invalid related inventory scope')
+            cluster, record = str(UUID(cluster_id)), str(UUID(record_id))
+            host, port, protocol = workspace_endpoints[ras]
+            try:
+                async with asyncio.timeout(READ_TIMEOUT):
+                    reader = ReadService(partial(RacClient, host, port, protocol))
+                    if scope.endswith('-locks'):
+                        rows = await reader.filtered_locks(cluster, scope.split('-')[0], record)
+                    else:
+                        rows = await getattr(reader, methods[scope])(cluster, record)
+                    rows = ReadService.public_data(rows)
+                    for row in rows:
+                        if 'host' in row:
+                            row['object_host'] = row.pop('host')
+                    return {'ras': ras, 'host': host, 'port': port, 'protocol': protocol,
+                            'cluster': cluster, 'scope': scope, 'record': record,
+                            'rows': rows}
+            except Exception as exc:
+                raise ValueError('RAC read failed (' + type(exc).__name__ + ')') from None
+
+        @server.tool(description='Read regular or accumulated values of a named counter '
+                     'on the selected startup RAS')
+        async def rac_workspace_counter_values(ras: StrictInt, cluster_id: StrictStr,
+                                               name: StrictStr, object_filter: StrictStr = '',
+                                               accumulated: StrictBool = False) -> dict:
+            if type(ras) is not int or not 0 <= ras < len(workspace_endpoints):
+                raise ValueError('Invalid RAS index')
+            if (not name.strip() or '\x00' in name or len(name.encode('utf-8')) > 1024
+                    or '\x00' in object_filter
+                    or len(object_filter.encode('utf-8')) > 4096):
+                raise ValueError('Invalid counter selector')
+            cluster = str(UUID(cluster_id))
+            host, port, protocol = workspace_endpoints[ras]
+            try:
+                async with asyncio.timeout(READ_TIMEOUT):
+                    reader = ReadService(partial(RacClient, host, port, protocol))
+                    rows = ReadService.public_data(await reader.counter_values(
+                        cluster, name, object_filter, accumulated=accumulated))
+                    for row in rows:
+                        if 'host' in row:
+                            row['object_host'] = row.pop('host')
+                    return {'ras': ras, 'host': host, 'port': port, 'protocol': protocol,
+                            'cluster': cluster, 'name': name, 'object_filter': object_filter,
+                            'accumulated': accumulated, 'rows': rows}
+            except Exception as exc:
+                raise ValueError('RAC read failed (' + type(exc).__name__ + ')') from None
+
+        @server.tool(description='Read an infobase summary or a security-profile overview '
+                     'with its verified ACL lists from the selected startup RAS')
+        async def rac_workspace_named_overview(ras: StrictInt, cluster_id: StrictStr,
+                                               kind: StrictStr, selector: StrictStr) -> dict:
+            if type(ras) is not int or not 0 <= ras < len(workspace_endpoints):
+                raise ValueError('Invalid RAS index')
+            if kind not in ('infobase-summary', 'profile-overview'):
+                raise ValueError('Invalid overview kind')
+            cluster = str(UUID(cluster_id))
+            if kind == 'infobase-summary':
+                selector = str(UUID(selector))
+            else:
+                ReadService._validated_profile_name(selector)
+            host, port, protocol = workspace_endpoints[ras]
+            try:
+                async with asyncio.timeout(READ_TIMEOUT):
+                    reader = ReadService(partial(RacClient, host, port, protocol))
+                    if kind == 'infobase-summary':
+                        record = await reader.infobase_summary(cluster, selector)
+                    else:
+                        record = await reader.profile_overview(cluster, selector)
+                    record = ReadService.public_data(record)
+                    if 'host' in record:
+                        record['object_host'] = record.pop('host')
+                    return {'ras': ras, 'host': host, 'port': port, 'protocol': protocol,
+                            'cluster': cluster, 'kind': kind, 'selector': selector,
+                            'object': record}
+            except Exception as exc:
+                raise ValueError('RAC read failed (' + type(exc).__name__ + ')') from None
+
+        @server.tool(description='Read an infobase info or summary by name on the '
+                     'selected startup RAS, without requiring an infobase UUID')
+        async def rac_workspace_infobase_by_name(ras: StrictInt, cluster_id: StrictStr,
+                                                 kind: StrictStr, name: StrictStr) -> dict:
+            if type(ras) is not int or not 0 <= ras < len(workspace_endpoints):
+                raise ValueError('Invalid RAS index')
+            if kind not in ('info', 'summary'):
+                raise ValueError('Invalid infobase view')
+            cluster = str(UUID(cluster_id))
+            ReadService._validated_infobase_name(name)
+            host, port, protocol = workspace_endpoints[ras]
+            if protocol == '10.0':
+                raise ValueError('Infobase info and summary by name require protocol 16.0')
+            try:
+                async with asyncio.timeout(READ_TIMEOUT):
+                    reader = ReadService(partial(RacClient, host, port, protocol))
+                    method = (reader.infobase_info_by_name if kind == 'info'
+                              else reader.infobase_summary_by_name)
+                    record = ReadService.public_data(await method(cluster, name))
+                    if 'host' in record:
+                        record['object_host'] = record.pop('host')
+                    return {'ras': ras, 'host': host, 'port': port, 'protocol': protocol,
+                            'cluster': cluster, 'kind': kind, 'name': name, 'object': record}
+            except Exception as exc:
+                raise ValueError('RAC read failed (' + type(exc).__name__ + ')') from None
+
+        @server.tool(description='Read agent version, agent administrators or cluster '
+                     'administrators from the selected startup RAS')
+        async def rac_workspace_agent_view(ras: StrictInt, scope: StrictStr,
+                                           cluster_id: StrictStr = '') -> dict:
+            methods = {'agent-version': 'agent_version', 'agent-admins': 'agent_admins',
+                       'cluster-admins': 'cluster_admins'}
+            if type(ras) is not int or not 0 <= ras < len(workspace_endpoints):
+                raise ValueError('Invalid RAS index')
+            if scope not in methods:
+                raise ValueError('Invalid agent view')
+            if scope == 'cluster-admins':
+                cluster_id = str(UUID(cluster_id))
+            elif cluster_id:
+                raise ValueError('Unexpected cluster')
+            host, port, protocol = workspace_endpoints[ras]
+            try:
+                async with asyncio.timeout(READ_TIMEOUT):
+                    reader = ReadService(partial(RacClient, host, port, protocol))
+                    args = (cluster_id,) if cluster_id else ()
+                    data = ReadService.public_data(await getattr(reader, methods[scope])(*args))
+                    return {'ras': ras, 'host': host, 'port': port, 'protocol': protocol,
+                            'scope': scope, 'cluster': cluster_id, 'data': data}
+            except Exception as exc:
+                raise ValueError('RAC read failed (' + type(exc).__name__ + ')') from None
+
+    @server.tool(description='List clusters accessible on the configured RAS')
+    async def rac_list_clusters() -> list[dict]:
+        return await safe_read(service.clusters)
+
+    @server.tool(description='Search clusters by name or UUID on the configured RAS; '
+                 'returns only cluster UUID and name')
+    async def rac_search_clusters(query: StrictStr) -> list[dict]:
+        return await safe_read(service.search_clusters, query)
+
+    @server.tool(description='Search infobases by name or UUID across clusters on the configured RAS; '
+                 'returns only cluster UUID, infobase UUID and name')
+    async def rac_search_infobases(query: StrictStr) -> list[dict]:
+        return await safe_read(service.search_infobases, query)
+
+    @server.tool(description='Search security profiles by name across clusters on the configured RAS; '
+                 'returns only cluster UUID and profile name')
+    async def rac_search_profiles(query: StrictStr) -> list[dict]:
+        return await safe_read(service.search_profiles, query)
+
+    @server.tool(description='Search working servers by name or UUID across clusters on the '
+                 'configured RAS; returns only cluster UUID, server UUID and name')
+    async def rac_search_working_servers(query: StrictStr) -> list[dict]:
+        return await safe_read(service.search_working_servers, query)
+
+    @server.tool(description='Search working processes by PID, host or UUID across clusters '
+                 'on the configured RAS; returns only navigation fields')
+    async def rac_search_working_processes(query: StrictStr) -> list[dict]:
+        return await safe_read(service.search_working_processes, query)
+
+    @server.tool(description='Search sessions by user, host, application, UUID or numeric ID '
+                 'on the configured RAS; returns only cluster, session UUID and user')
+    async def rac_search_sessions(query: StrictStr) -> list[dict]:
+        return await safe_read(service.search_sessions, query)
+
+    @server.tool(description='Search connections by host, application, UUID or numeric ID '
+                 'on the configured RAS; returns only cluster, connection UUID and host')
+    async def rac_search_connections(query: StrictStr) -> list[dict]:
+        return await safe_read(service.search_connections, query)
+
+    @server.tool(description='Search agent administrators on the configured RAS by name or '
+                 'OS user; returns only administrator names')
+    async def rac_search_agent_admins(query: StrictStr) -> list[dict]:
+        return await safe_read(service.search_agent_admins, query)
+
+    @server.tool(description='Search cluster administrators on the configured RAS by name or '
+                 'OS user; returns only cluster UUID and administrator name')
+    async def rac_search_cluster_admins(query: StrictStr) -> list[dict]:
+        return await safe_read(service.search_cluster_admins, query)
+
+    @server.tool(description='Search cluster managers by UUID, host, description or PID '
+                 'on the configured RAS; returns only cluster UUID, manager UUID and host')
+    async def rac_search_managers(query: StrictStr) -> list[dict]:
+        return await safe_read(service.search_managers, query)
+
+    @server.tool(description='Search cluster services by name, description or manager UUID '
+                 'on the configured RAS; returns only cluster UUID and service name')
+    async def rac_search_services(query: StrictStr) -> list[dict]:
+        return await safe_read(service.search_services, query)
+
+    @server.tool(description='Search counters by name or description across clusters on '
+                 'the configured RAS; returns only navigation fields')
+    async def rac_search_counters(query: StrictStr) -> list[dict]:
+        return await safe_read(service.search_counters, query)
+
+    @server.tool(description='Search limits by name or description across clusters on '
+                 'the configured RAS; returns only navigation fields')
+    async def rac_search_limits(query: StrictStr) -> list[dict]:
+        return await safe_read(service.search_limits, query)
+
+    @server.tool(description='Search locks by description, connection UUID or object UUID '
+                 'across clusters on the configured RAS; returns only navigation fields')
+    async def rac_search_locks(query: StrictStr) -> list[dict]:
+        return await safe_read(service.search_locks, query)
+
+    @server.tool(description='Search assignment rules across working servers on the '
+                 'configured RAS; returns exact cluster, server and rule UUIDs')
+    async def rac_search_rules(query: StrictStr) -> list[dict]:
+        return await safe_read(service.search_rules, query)
+
+    @server.tool(description='Search service settings across working servers on the '
+                 'configured RAS; returns exact cluster, server and setting UUIDs')
+    async def rac_search_service_settings(query: StrictStr) -> list[dict]:
+        return await safe_read(service.search_service_settings, query)
+
+    @server.tool(description='Search transfer directories by service or infobase name '
+                 'on the configured RAS; excludes filesystem paths')
+    async def rac_search_transfer_directories(query: StrictStr) -> list[dict]:
+        return await safe_read(service.search_transfer_directories, query)
+
+    @server.tool(description='Get the RAS agent version (protocol 16.0)')
+    async def rac_agent_version() -> str:
+        return await safe_read(service.agent_version)
+
+    @server.tool(description='List RAS agent administrators')
+    async def rac_list_agent_admins() -> list[dict]:
+        return await safe_read(service.agent_admins)
+
+    @server.tool(description='List cluster administrators by cluster UUID')
+    async def rac_list_cluster_admins(cluster_id: StrictStr) -> list[dict]:
+        return await safe_read(service.cluster_admins, cluster_id)
+
+    @server.tool(description='Get a cluster record by UUID')
+    async def rac_get_cluster(cluster_id: StrictStr) -> dict:
+        return await safe_read(service.one, cluster_id, 'get_cluster')
+
+    @server.tool(description='Read cluster info, working servers, processes and infobase summaries')
+    async def rac_cluster_overview(cluster_id: StrictStr) -> dict:
+        return await safe_read(service.cluster, cluster_id)
+
+    @server.tool(description='List working servers of a cluster')
+    async def rac_list_working_servers(cluster_id: StrictStr) -> list[dict]:
+        return await safe_read(service.one, cluster_id, 'list_servers')
+
+    @server.tool(description='List working processes of a cluster')
+    async def rac_list_working_processes(cluster_id: StrictStr) -> list[dict]:
+        return await safe_read(service.one, cluster_id, 'list_processes')
+
+    @server.tool(description='List working processes filtered by working server UUID')
+    async def rac_list_processes_on_server(cluster_id: StrictStr, server_id: StrictStr) -> list[dict]:
+        return await safe_read(service.processes_on_server, cluster_id, server_id)
+
+    @server.tool(description='List infobase summaries of a cluster')
+    async def rac_list_infobase_summaries(cluster_id: StrictStr) -> list[dict]:
+        return await safe_read(service.one, cluster_id, 'list_infobases')
+
+    @server.tool(description='List sessions filtered by infobase UUID (populated 16.0 decoder unverified)')
+    async def rac_list_sessions_in_infobase(cluster_id: StrictStr, infobase_id: StrictStr) -> list[dict]:
+        return await safe_read(service.sessions_in_infobase, cluster_id, infobase_id)
+
+    @server.tool(description='List connections filtered by infobase UUID')
+    async def rac_list_connections_in_infobase(cluster_id: StrictStr, infobase_id: StrictStr) -> list[dict]:
+        return await safe_read(service.connections_in_infobase, cluster_id, infobase_id)
+
+    @server.tool(description='List connections filtered locally by process UUID after decoding the cluster list')
+    async def rac_list_connections_in_process(cluster_id: StrictStr, process_id: StrictStr) -> list[dict]:
+        return await safe_read(service.connections_in_process, cluster_id, process_id)
+
+    @server.tool(description='List locks filtered by infobase or connection UUID (not session)')
+    async def rac_list_filtered_locks(cluster_id: StrictStr, scope: StrictStr, record_id: StrictStr) -> list[dict]:
+        return await safe_read(service.filtered_locks, cluster_id, scope, record_id)
+
+    @server.tool(description='List a verified read-only cluster group: ' + ', '.join(CLUSTER_LISTS))
+    async def rac_list_cluster_group(cluster_id: StrictStr, group: StrictStr) -> list[dict]:
+        return await safe_read(service.list_group, cluster_id, group)
+
+    @server.tool(description='Get a working server record by cluster and server UUID')
+    async def rac_get_server(cluster_id: StrictStr, server_id: StrictStr) -> dict:
+        return await safe_read(service.server, cluster_id, server_id)
+
+    @server.tool(description='Get a working process record by cluster and process UUID')
+    async def rac_get_process(cluster_id: StrictStr, process_id: StrictStr) -> dict:
+        return await safe_read(service.process, cluster_id, process_id)
+
+    @server.tool(description='Get a session record by cluster and session UUID')
+    async def rac_get_session(cluster_id: StrictStr, session_id: StrictStr) -> dict:
+        return await safe_read(service.session, cluster_id, session_id)
+
+    @server.tool(description='Get an infobase summary by cluster and infobase UUID')
+    async def rac_get_infobase_summary(cluster_id: StrictStr, infobase_id: StrictStr) -> dict:
+        return await safe_read(service.infobase_summary, cluster_id, infobase_id)
+
+    @server.tool(description='Get an infobase summary by its unique name within a cluster')
+    async def rac_get_infobase_summary_by_name(cluster_id: StrictStr, name: StrictStr) -> dict:
+        return await safe_read(service.infobase_summary_by_name, cluster_id, name)
+
+    @server.tool(description='Get infobase full info by cluster and infobase UUID (protocol 16.0)')
+    async def rac_get_infobase_info(cluster_id: StrictStr, infobase_id: StrictStr) -> dict:
+        return await safe_read(service.infobase_info, cluster_id, infobase_id)
+
+    @server.tool(description='Get filtered infobase full info by its unique name (protocol 16.0)')
+    async def rac_get_infobase_info_by_name(cluster_id: StrictStr, name: StrictStr) -> dict:
+        return await safe_read(service.infobase_info_by_name, cluster_id, name)
+
+    @server.tool(description='List binary data storages of an infobase (populated results unverified)')
+    async def rac_list_binary_storages(cluster_id: StrictStr, infobase_id: StrictStr) -> list[dict]:
+        return await safe_read(service.binary_storages, cluster_id, infobase_id)
+
+    @server.tool(description='Get a connection record by cluster and connection UUID')
+    async def rac_get_connection(cluster_id: StrictStr, connection_id: StrictStr) -> dict:
+        return await safe_read(service.connection, cluster_id, connection_id)
+
+    @server.tool(description='Get a service setting by cluster, server and setting UUID')
+    async def rac_get_service_setting(cluster_id: StrictStr, server_id: StrictStr, setting_id: StrictStr) -> dict:
+        return await safe_read(service.service_setting, cluster_id, server_id, setting_id)
+
+    @server.tool(description='Get an assignment rule by cluster, server and rule UUID')
+    async def rac_get_rule(cluster_id: StrictStr, server_id: StrictStr, rule_id: StrictStr) -> dict:
+        return await safe_read(service.rule, cluster_id, server_id, rule_id)
+
+    @server.tool(description='Get a cluster manager by cluster and manager UUID')
+    async def rac_get_manager(cluster_id: StrictStr, manager_id: StrictStr) -> dict:
+        return await safe_read(service.manager, cluster_id, manager_id)
+
+    @server.tool(description='Get a cluster limit by cluster UUID and limit name')
+    async def rac_get_limit(cluster_id: StrictStr, name: StrictStr) -> dict:
+        return await safe_read(service.limit, cluster_id, name)
+
+    @server.tool(description='Get a cluster counter by cluster UUID and counter name')
+    async def rac_get_counter(cluster_id: StrictStr, name: StrictStr) -> dict:
+        return await safe_read(service.counter, cluster_id, name)
+
+    @server.tool(description='List counter readings (populated 16.0 decoder not live-verified)')
+    async def rac_list_counter_values(cluster_id: StrictStr, name: StrictStr, object_filter: StrictStr = '') -> list[dict]:
+        return await safe_read(service.counter_values, cluster_id, name, object_filter)
+
+    @server.tool(description='List accumulated counter readings (populated 16.0 decoder not live-verified)')
+    async def rac_list_accumulated_counter_values(cluster_id: StrictStr, name: StrictStr,
+                                                  object_filter: StrictStr = '') -> list[dict]:
+        return await safe_read(partial(service.counter_values, accumulated=True),
+                               cluster_id, name, object_filter)
+
+    @server.tool(description='List a verified read-only server group: ' + ', '.join(SERVER_LISTS))
+    async def rac_list_server_group(cluster_id: StrictStr, server_id: StrictStr, group: StrictStr) -> list[dict]:
+        return await safe_read(service.list_server_group, cluster_id, server_id, group)
+
+    @server.tool(description='List service transfer directories filtered by service name on a working server')
+    async def rac_list_transfer_directories(cluster_id: StrictStr, server_id: StrictStr,
+                                            service_name: StrictStr = '') -> list[dict]:
+        return await safe_read(service.transfer_directories, cluster_id, server_id, service_name)
+
+    @server.tool(description='Get a security profile by its unique name within a cluster')
+    async def rac_get_profile_by_name(cluster_id: StrictStr, name: StrictStr) -> dict:
+        return await safe_read(service.profile_by_name, cluster_id, name)
+
+    @server.tool(description='Read a security profile and all six verified ACL lists by exact name')
+    async def rac_profile_overview(cluster_id: StrictStr, name: StrictStr) -> dict:
+        return await safe_read(service.profile_overview, cluster_id, name)
+
+    @server.tool(description='List profile ACL entries: ' + ', '.join(PROFILE_ACL_LISTS) +
+                 '; optionally filter by exact alias (directory) or name (other ACLs)')
+    async def rac_list_profile_acl(cluster_id: StrictStr, profile_name: StrictStr,
+                                   acl_type: StrictStr, name: StrictStr = '') -> list[dict]:
+        return await safe_read(service.list_profile_acl, cluster_id, profile_name, acl_type, name)
+
+    @server.tool(description='Search one of six verified profile ACL categories by alias or name '
+                 'on the configured RAS; returns only navigation fields')
+    async def rac_search_profile_acl(cluster_id: StrictStr, acl_type: StrictStr,
+                                     query: StrictStr) -> list[dict]:
+        return await safe_read(service.search_profile_acl, cluster_id, acl_type, query)
+
+    if allow_agent_admin_register:
+        @server.tool(description='MUTATION: register a password-free OS-capable agent administrator. '
+                             'Confirm the exact name:os_user; guarded client verifies the complete admin list.')
+        async def rac_register_agent_admin(name: StrictStr, os_user: StrictStr, descr: StrictStr,
+                                           confirm_name_os_user: StrictStr) -> dict:
+            if (type(name) is not str or not name or '\x00' in name
+                    or len(name.encode('utf-8')) > 1024
+                    or type(os_user) is not str or not os_user or '\x00' in os_user
+                    or len(os_user.encode('utf-8')) > 1024
+                    or type(descr) is not str or '\x00' in descr
+                    or len(descr.encode('utf-8')) > 1024):
+                raise ValueError('Invalid agent administrator parameters')
+            if confirm_name_os_user != f'{name}:{os_user}':
+                raise ValueError('Confirmation must match name:os_user exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.register_agent_admin(name, os_user, descr=descr)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC agent admin register failed (' + type(exc).__name__ + ')') from None
+
+    if allow_agent_admin_remove:
+        @server.tool(description='DESTRUCTIVE: remove an agent administrator; requires an authenticated '
+                             'agent-user and exact name confirmation. Guarded client verifies full list.')
+        async def rac_remove_agent_admin(name: StrictStr, confirm_name: StrictStr) -> list[dict]:
+            if (type(name) is not str or not name or '\x00' in name
+                    or len(name.encode('utf-8')) > 1024):
+                raise ValueError('Invalid agent administrator name')
+            if confirm_name != name:
+                raise ValueError('Confirmation must match agent administrator name exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.remove_agent_admin(name)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC agent admin remove failed (' + type(exc).__name__ + ')') from None
+
+    if allow_cluster_admin_register:
+        @server.tool(description='MUTATION: register a password-free OS-capable cluster administrator. '
+                             'Confirm exact cluster UUID:name:os_user; guarded client checks full admin list.')
+        async def rac_register_cluster_admin(cluster_id: StrictStr, name: StrictStr,
+                                             os_user: StrictStr, descr: StrictStr,
+                                             confirm_cluster_name_os_user: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            if (str(cluster) != cluster_id or type(name) is not str or not name
+                    or '\x00' in name or len(name.encode('utf-8')) > 1024
+                    or type(os_user) is not str or not os_user or '\x00' in os_user
+                    or len(os_user.encode('utf-8')) > 1024
+                    or type(descr) is not str or '\x00' in descr
+                    or len(descr.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator parameters')
+            if confirm_cluster_name_os_user != f'{cluster}:{name}:{os_user}':
+                raise ValueError('Confirmation must match cluster UUID:name:os_user exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.register_cluster_admin(cluster, name, os_user, descr=descr)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC cluster admin register failed (' + type(exc).__name__ + ')') from None
+
+    if allow_cluster_admin_remove:
+        @server.tool(description='DESTRUCTIVE: remove a cluster administrator. Requires an authenticated '
+                             'cluster-user and exact cluster UUID:name confirmation; guarded client checks '
+                             'the complete administrator list after removal.')
+        async def rac_remove_cluster_admin(cluster_id: StrictStr, name: StrictStr,
+                                           confirm_cluster_name: StrictStr) -> list[dict]:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            if (str(cluster) != cluster_id or type(name) is not str or not name
+                    or '\x00' in name or len(name.encode('utf-8')) > 1024):
+                raise ValueError('Invalid cluster administrator parameters')
+            if confirm_cluster_name != f'{cluster}:{name}':
+                raise ValueError('Confirmation must match cluster UUID:name exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.remove_cluster_admin(cluster, name)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC cluster admin remove failed (' + type(exc).__name__ + ')') from None
+
+    if allow_infobase_database_create:
+        @server.tool(description='DESTRUCTIVE: create and register a new PostgreSQL database. '
+                             'Confirm cluster UUID:name:database name exactly; guarded client '
+                             'requires full list and info read-back. No password input.')
+        async def rac_create_infobase_database(
+                cluster_id: StrictStr, name: StrictStr, db_name: StrictStr, db_server: StrictStr,
+                db_user: StrictStr, locale: StrictStr, confirm_cluster_name_db: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            if str(cluster) != cluster_id:
+                raise ValueError('Invalid cluster UUID')
+            for field in (name, db_name, db_server, db_user, locale):
+                if (type(field) is not str or not field or '\x00' in field
+                        or len(field.encode('utf-8')) > 255):
+                    raise ValueError('Invalid infobase creation parameters')
+            if confirm_cluster_name_db != f'{cluster}:{name}:{db_name}':
+                raise ValueError('Confirmation must match cluster UUID:name:database name exactly')
+            try:
+                async with service.factory() as client:
+                    return ReadService._public_infobase_info(await client.create_infobase(
+                        cluster, name=name, db_name=db_name, db_server=db_server,
+                        db_user=db_user, locale=locale, create_database=True))
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC infobase database creation failed ('
+                                 + type(exc).__name__ + ')') from None
+
+    if allow_infobase_existing_registration:
+        @server.tool(description='MUTATION: register an already existing PostgreSQL infobase; '
+                             'never create the database. Confirm cluster UUID:name:database name '
+                             'exactly; guarded client verifies full list and info read-back.')
+        async def rac_register_existing_infobase(
+                cluster_id: StrictStr, name: StrictStr, db_name: StrictStr, db_server: StrictStr,
+                db_user: StrictStr, locale: StrictStr, confirm_cluster_name_db: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            if str(cluster) != cluster_id:
+                raise ValueError('Invalid cluster UUID')
+            for field in (name, db_name, db_server, db_user, locale):
+                if (type(field) is not str or not field or '\x00' in field
+                        or len(field.encode('utf-8')) > 255):
+                    raise ValueError('Invalid infobase registration parameters')
+            if confirm_cluster_name_db != f'{cluster}:{name}:{db_name}':
+                raise ValueError('Confirmation must match cluster UUID:name:database name exactly')
+            try:
+                async with service.factory() as client:
+                    return ReadService._public_infobase_info(await client.create_infobase(
+                        cluster, name=name, db_name=db_name, db_server=db_server,
+                        db_user=db_user, locale=locale, create_database=False))
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC existing infobase registration failed ('
+                                 + type(exc).__name__ + ')') from None
+
+    if allow_infobase_registration_drop:
+        @server.tool(description='DESTRUCTIVE: remove an infobase registration only; never drop or '
+                             'clear the underlying database. Confirm cluster UUID:infobase UUID '
+                             'exactly; guarded client verifies the complete registration list.')
+        async def rac_drop_infobase_registration(
+                cluster_id: StrictStr, infobase_id: StrictStr,
+                confirm_cluster_infobase: StrictStr) -> list[dict]:
+            try:
+                cluster, infobase = UUID(cluster_id), UUID(infobase_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster or infobase UUID') from None
+            if str(cluster) != cluster_id or str(infobase) != infobase_id:
+                raise ValueError('Invalid cluster or infobase UUID')
+            if confirm_cluster_infobase != f'{cluster}:{infobase}':
+                raise ValueError('Confirmation must match cluster UUID:infobase UUID exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.drop_infobase(cluster, infobase, drop_database=False,
+                                                      clear_database=False)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC infobase registration drop failed ('
+                                 + type(exc).__name__ + ')') from None
+
+    if allow_infobase_summary_description_update:
+        @server.tool(description='MUTATION: set infobase summary description (empty string '
+                             'clears). Confirm cluster UUID:infobase UUID exactly; guarded '
+                             'client checks the complete infobase list.')
+        async def rac_update_infobase_summary_description(
+                cluster_id: StrictStr, infobase_id: StrictStr, description: StrictStr,
+                confirm_cluster_infobase: StrictStr) -> dict:
+            try:
+                cluster, infobase = UUID(cluster_id), UUID(infobase_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster or infobase UUID') from None
+            if (str(cluster) != cluster_id or str(infobase) != infobase_id
+                    or type(description) is not str or '\x00' in description
+                    or len(description.encode('utf-8')) > 1024):
+                raise ValueError('Invalid infobase summary description')
+            if confirm_cluster_infobase != f'{cluster}:{infobase}':
+                raise ValueError('Confirmation must match cluster UUID:infobase UUID exactly')
+            try:
+                async with service.factory() as client:
+                    return ReadService._public_infobase_info(
+                        await client.update_infobase_summary_description(cluster, infobase, description))
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC infobase summary description update failed ('
+                                 + type(exc).__name__ + ')') from None
+
+    if allow_infobase_description_update:
+        @server.tool(description='MUTATION: set infobase description (empty string clears). '
+                             'Confirm cluster UUID:infobase UUID exactly; guarded client '
+                             'checks complete info and infobase list.')
+        async def rac_update_infobase_description(
+                cluster_id: StrictStr, infobase_id: StrictStr, description: StrictStr,
+                confirm_cluster_infobase: StrictStr) -> dict:
+            try:
+                cluster, infobase = UUID(cluster_id), UUID(infobase_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster or infobase UUID') from None
+            if (str(cluster) != cluster_id or str(infobase) != infobase_id
+                    or type(description) is not str or '\x00' in description
+                    or len(description.encode('utf-8')) > 1024):
+                raise ValueError('Invalid infobase description')
+            if confirm_cluster_infobase != f'{cluster}:{infobase}':
+                raise ValueError('Confirmation must match cluster UUID:infobase UUID exactly')
+            try:
+                async with service.factory() as client:
+                    return ReadService._public_infobase_info(
+                        await client.update_infobase_description(cluster, infobase, description))
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC infobase description update failed ('
+                                 + type(exc).__name__ + ')') from None
+
+    if allow_infobase_scheduled_jobs_deny_update:
+        @server.tool(description='MUTATION: deny or allow scheduled jobs for an infobase. '
+                             'Confirm cluster UUID:infobase UUID exactly; guarded client '
+                             'checks complete info and registration list.')
+        async def rac_update_infobase_scheduled_jobs_deny(
+                cluster_id: StrictStr, infobase_id: StrictStr, denied: StrictBool,
+                confirm_cluster_infobase: StrictStr) -> dict:
+            try:
+                cluster, infobase = UUID(cluster_id), UUID(infobase_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster or infobase UUID') from None
+            if (str(cluster) != cluster_id or str(infobase) != infobase_id
+                    or type(denied) is not bool):
+                raise ValueError('Invalid infobase scheduled jobs deny flag')
+            if confirm_cluster_infobase != f'{cluster}:{infobase}':
+                raise ValueError('Confirmation must match cluster UUID:infobase UUID exactly')
+            try:
+                async with service.factory() as client:
+                    return ReadService._public_infobase_info(
+                        await client.update_infobase_scheduled_jobs_deny(cluster, infobase, denied))
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC infobase scheduled jobs deny update failed ('
+                                 + type(exc).__name__ + ')') from None
+
+    if allow_infobase_sessions_deny_update:
+        @server.tool(description='MUTATION: deny or allow sessions for an infobase. '
+                             'Confirm cluster UUID:infobase UUID exactly; guarded client '
+                             'checks complete info and registration list.')
+        async def rac_update_infobase_sessions_deny(
+                cluster_id: StrictStr, infobase_id: StrictStr, denied: StrictBool,
+                confirm_cluster_infobase: StrictStr) -> dict:
+            try:
+                cluster, infobase = UUID(cluster_id), UUID(infobase_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster or infobase UUID') from None
+            if (str(cluster) != cluster_id or str(infobase) != infobase_id
+                    or type(denied) is not bool):
+                raise ValueError('Invalid infobase sessions deny flag')
+            if confirm_cluster_infobase != f'{cluster}:{infobase}':
+                raise ValueError('Confirmation must match cluster UUID:infobase UUID exactly')
+            try:
+                async with service.factory() as client:
+                    return ReadService._public_infobase_info(
+                        await client.update_infobase_sessions_deny(cluster, infobase, denied))
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC infobase sessions deny update failed ('
+                                 + type(exc).__name__ + ')') from None
+
+    if allow_infobase_license_distribution_update:
+        @server.tool(description='MUTATION: allow or deny infobase license distribution. '
+                             'Confirm cluster UUID:infobase UUID exactly; guarded client '
+                             'checks complete info and registration list.')
+        async def rac_update_infobase_license_distribution(
+                cluster_id: StrictStr, infobase_id: StrictStr, distribution: StrictStr,
+                confirm_cluster_infobase: StrictStr) -> dict:
+            try:
+                cluster, infobase = UUID(cluster_id), UUID(infobase_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster or infobase UUID') from None
+            if (str(cluster) != cluster_id or str(infobase) != infobase_id
+                    or type(distribution) is not str or distribution not in ('allow', 'deny')):
+                raise ValueError('Invalid infobase license distribution')
+            if confirm_cluster_infobase != f'{cluster}:{infobase}':
+                raise ValueError('Confirmation must match cluster UUID:infobase UUID exactly')
+            try:
+                async with service.factory() as client:
+                    return ReadService._public_infobase_info(
+                        await client.update_infobase_license_distribution(cluster, infobase, distribution))
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC infobase license distribution update failed ('
+                                 + type(exc).__name__ + ')') from None
+
+    if allow_infobase_denied_message_update:
+        @server.tool(description='MUTATION: set infobase denied message (empty string clears). '
+                             'Confirm cluster UUID:infobase UUID exactly; guarded client '
+                             'checks complete info and registration list.')
+        async def rac_update_infobase_denied_message(
+                cluster_id: StrictStr, infobase_id: StrictStr, message: StrictStr,
+                confirm_cluster_infobase: StrictStr) -> dict:
+            try:
+                cluster, infobase = UUID(cluster_id), UUID(infobase_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster or infobase UUID') from None
+            if (str(cluster) != cluster_id or str(infobase) != infobase_id
+                    or type(message) is not str or '\x00' in message):
+                raise ValueError('Invalid infobase denied message')
+            if confirm_cluster_infobase != f'{cluster}:{infobase}':
+                raise ValueError('Confirmation must match cluster UUID:infobase UUID exactly')
+            try:
+                async with service.factory() as client:
+                    return ReadService._public_infobase_info(
+                        await client.update_infobase_denied_message(cluster, infobase, message))
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC infobase denied message update failed ('
+                                 + type(exc).__name__ + ')') from None
+
+    if allow_infobase_reserve_working_processes_update:
+        @server.tool(description='MUTATION: toggle infobase reserve working processes. '
+                             'Confirm cluster UUID:infobase UUID exactly; guarded client '
+                             'checks complete info and registration list.')
+        async def rac_update_infobase_reserve_working_processes(
+                cluster_id: StrictStr, infobase_id: StrictStr, reserve: StrictBool,
+                confirm_cluster_infobase: StrictStr) -> dict:
+            try:
+                cluster, infobase = UUID(cluster_id), UUID(infobase_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster or infobase UUID') from None
+            if (str(cluster) != cluster_id or str(infobase) != infobase_id
+                    or type(reserve) is not bool):
+                raise ValueError('Invalid infobase reserve working processes flag')
+            if confirm_cluster_infobase != f'{cluster}:{infobase}':
+                raise ValueError('Confirmation must match cluster UUID:infobase UUID exactly')
+            try:
+                async with service.factory() as client:
+                    return ReadService._public_infobase_info(
+                        await client.update_infobase_reserve_working_processes(cluster, infobase, reserve))
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC infobase reserve working processes update failed ('
+                                 + type(exc).__name__ + ')') from None
+
+    if allow_infobase_external_session_manager_update:
+        @server.tool(description='MUTATION: require or release an external session manager '
+                             'for an infobase. Confirm cluster UUID:infobase UUID exactly; '
+                             'guarded client checks complete info and registration list.')
+        async def rac_update_infobase_external_session_manager_required(
+                cluster_id: StrictStr, infobase_id: StrictStr, required: StrictBool,
+                confirm_cluster_infobase: StrictStr) -> dict:
+            try:
+                cluster, infobase = UUID(cluster_id), UUID(infobase_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster or infobase UUID') from None
+            if (str(cluster) != cluster_id or str(infobase) != infobase_id
+                    or type(required) is not bool):
+                raise ValueError('Invalid infobase external session manager flag')
+            if confirm_cluster_infobase != f'{cluster}:{infobase}':
+                raise ValueError('Confirmation must match cluster UUID:infobase UUID exactly')
+            try:
+                async with service.factory() as client:
+                    return ReadService._public_infobase_info(
+                        await client.update_infobase_external_session_manager_required(cluster, infobase, required))
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC infobase external session manager update failed ('
+                                 + type(exc).__name__ + ')') from None
+
+    if allow_infobase_local_speech_update:
+        @server.tool(description='MUTATION: disable or enable local speech-to-text for an '
+                             'infobase. Confirm cluster UUID:infobase UUID exactly; guarded '
+                             'client checks complete info and registration list.')
+        async def rac_update_infobase_disable_local_speech_to_text(
+                cluster_id: StrictStr, infobase_id: StrictStr, disabled: StrictBool,
+                confirm_cluster_infobase: StrictStr) -> dict:
+            try:
+                cluster, infobase = UUID(cluster_id), UUID(infobase_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster or infobase UUID') from None
+            if (str(cluster) != cluster_id or str(infobase) != infobase_id
+                    or type(disabled) is not bool):
+                raise ValueError('Invalid infobase local speech-to-text flag')
+            if confirm_cluster_infobase != f'{cluster}:{infobase}':
+                raise ValueError('Confirmation must match cluster UUID:infobase UUID exactly')
+            try:
+                async with service.factory() as client:
+                    return ReadService._public_infobase_info(
+                        await client.update_infobase_disable_local_speech_to_text(cluster, infobase, disabled))
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC infobase local speech-to-text update failed ('
+                                 + type(exc).__name__ + ')') from None
+
+    if allow_infobase_configuration_unload_delay_update:
+        @server.tool(description='MUTATION: set configuration unload delay by a working '
+                             'process without active users. Confirm cluster UUID:infobase UUID '
+                             'exactly; guarded client checks complete info and registration list.')
+        async def rac_update_infobase_configuration_unload_delay(
+                cluster_id: StrictStr, infobase_id: StrictStr, delay: StrictInt,
+                confirm_cluster_infobase: StrictStr) -> dict:
+            try:
+                cluster, infobase = UUID(cluster_id), UUID(infobase_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster or infobase UUID') from None
+            if (str(cluster) != cluster_id or str(infobase) != infobase_id
+                    or type(delay) is not int or not 0 <= delay <= 0xffffffff):
+                raise ValueError('Invalid infobase configuration unload delay')
+            if confirm_cluster_infobase != f'{cluster}:{infobase}':
+                raise ValueError('Confirmation must match cluster UUID:infobase UUID exactly')
+            try:
+                async with service.factory() as client:
+                    return ReadService._public_infobase_info(
+                        await client.update_infobase_configuration_unload_delay(cluster, infobase, delay))
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC infobase configuration unload delay update failed ('
+                                 + type(exc).__name__ + ')') from None
+
+    if allow_infobase_minimum_scheduled_jobs_period_update:
+        @server.tool(description='MUTATION: set minimum scheduled-jobs start period without '
+                             'active users. Confirm cluster UUID:infobase UUID exactly; '
+                             'guarded client checks complete info and registration list.')
+        async def rac_update_infobase_minimum_scheduled_jobs_start_period(
+                cluster_id: StrictStr, infobase_id: StrictStr, period: StrictInt,
+                confirm_cluster_infobase: StrictStr) -> dict:
+            try:
+                cluster, infobase = UUID(cluster_id), UUID(infobase_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster or infobase UUID') from None
+            if (str(cluster) != cluster_id or str(infobase) != infobase_id
+                    or type(period) is not int or not 0 <= period <= 0xffffffff):
+                raise ValueError('Invalid infobase minimum scheduled jobs period')
+            if confirm_cluster_infobase != f'{cluster}:{infobase}':
+                raise ValueError('Confirmation must match cluster UUID:infobase UUID exactly')
+            try:
+                async with service.factory() as client:
+                    return ReadService._public_infobase_info(
+                        await client.update_infobase_minimum_scheduled_jobs_start_period(cluster, infobase, period))
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC infobase minimum scheduled jobs period update failed ('
+                                 + type(exc).__name__ + ')') from None
+
+    if allow_infobase_maximum_scheduled_jobs_shift_update:
+        @server.tool(description='MUTATION: set maximum scheduled-jobs start shift without '
+                             'active users. Confirm cluster UUID:infobase UUID exactly; '
+                             'guarded client checks complete info and registration list.')
+        async def rac_update_infobase_maximum_scheduled_jobs_start_shift(
+                cluster_id: StrictStr, infobase_id: StrictStr, shift: StrictInt,
+                confirm_cluster_infobase: StrictStr) -> dict:
+            try:
+                cluster, infobase = UUID(cluster_id), UUID(infobase_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster or infobase UUID') from None
+            if (str(cluster) != cluster_id or str(infobase) != infobase_id
+                    or type(shift) is not int or not 0 <= shift <= 255):
+                raise ValueError('Invalid infobase maximum scheduled jobs shift')
+            if confirm_cluster_infobase != f'{cluster}:{infobase}':
+                raise ValueError('Confirmation must match cluster UUID:infobase UUID exactly')
+            try:
+                async with service.factory() as client:
+                    return ReadService._public_infobase_info(
+                        await client.update_infobase_maximum_scheduled_jobs_start_shift(cluster, infobase, shift))
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC infobase maximum scheduled jobs shift update failed ('
+                                 + type(exc).__name__ + ')') from None
+
+    if allow_infobase_safe_mode_security_profile_update:
+        @server.tool(description='MUTATION: assign or clear an infobase safe-mode security '
+                             'profile. Confirm cluster UUID:infobase UUID exactly; guarded '
+                             'client checks complete infobase info and unchanged registration list.')
+        async def rac_update_infobase_safe_mode_security_profile(
+                cluster_id: StrictStr, infobase_id: StrictStr, name: StrictStr,
+                confirm_cluster_infobase: StrictStr) -> dict:
+            try:
+                cluster, infobase = UUID(cluster_id), UUID(infobase_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster or infobase UUID') from None
+            if (str(cluster) != cluster_id or str(infobase) != infobase_id
+                    or type(name) is not str or '\x00' in name
+                    or len(name.encode('utf-8')) > 1024):
+                raise ValueError('Invalid infobase safe mode security profile parameters')
+            if confirm_cluster_infobase != f'{cluster}:{infobase}':
+                raise ValueError('Confirmation must match cluster UUID:infobase UUID exactly')
+            try:
+                async with service.factory() as client:
+                    return ReadService._public_infobase_info(
+                        await client.update_infobase_safe_mode_security_profile(cluster, infobase, name))
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC infobase safe mode security profile update failed ('
+                                 + type(exc).__name__ + ')') from None
+
+    if allow_infobase_security_profile_update:
+        @server.tool(description='MUTATION: assign or clear an infobase security profile. '
+                             'Confirm cluster UUID:infobase UUID exactly; guarded client '
+                             'checks complete infobase info and unchanged registration list.')
+        async def rac_update_infobase_security_profile(cluster_id: StrictStr,
+                                                       infobase_id: StrictStr, name: StrictStr,
+                                                       confirm_cluster_infobase: StrictStr) -> dict:
+            try:
+                cluster, infobase = UUID(cluster_id), UUID(infobase_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster or infobase UUID') from None
+            if (str(cluster) != cluster_id or str(infobase) != infobase_id
+                    or type(name) is not str or '\x00' in name
+                    or len(name.encode('utf-8')) > 1024):
+                raise ValueError('Invalid infobase security profile parameters')
+            if confirm_cluster_infobase != f'{cluster}:{infobase}':
+                raise ValueError('Confirmation must match cluster UUID:infobase UUID exactly')
+            try:
+                async with service.factory() as client:
+                    return ReadService._public_infobase_info(
+                        await client.update_infobase_security_profile(cluster, infobase, name))
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC infobase security profile update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_profile_inet_update:
+        @server.tool(description='MUTATION: update or insert a profile internet-resource ACL. '
+                             'Confirm cluster UUID:profile name:resource name; guarded client '
+                             'checks full internet-resource list after update.')
+        async def rac_update_profile_inet(cluster_id: StrictStr, profile_name: StrictStr,
+                                          inet_name: StrictStr,
+                                          fields: dict[str, StrictStr | StrictInt],
+                                          confirm_cluster_profile_inet: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            if (str(cluster) != cluster_id or any(
+                    type(value) is not str or not value.strip() or '\x00' in value
+                    or len(value.encode('utf-8')) > 1024 for value in (profile_name, inet_name))
+                    or type(fields) is not dict or not fields
+                    or set(fields) - {'url', 'port', 'protocol', 'descr'}
+                    or any(type(value) is not int or not 0 <= value <= 65535
+                           if key == 'port' else type(value) is not str or '\x00' in value
+                           or len(value.encode('utf-8')) > 1024
+                           for key, value in fields.items())):
+                raise ValueError('Invalid profile inet update parameters')
+            if confirm_cluster_profile_inet != f'{cluster}:{profile_name}:{inet_name}':
+                raise ValueError('Confirmation must match cluster:profile:inet exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.update_profile_inet(cluster, profile_name, inet_name,
+                                                            **fields)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC profile inet update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_profile_inet_remove:
+        @server.tool(description='DESTRUCTIVE: remove a security profile internet-resource ACL. '
+                             'Confirm cluster UUID:profile name:resource name exactly; '
+                             'guarded client checks full inet ACL list after removal.')
+        async def rac_remove_profile_inet(cluster_id: StrictStr, profile_name: StrictStr,
+                                          inet_name: StrictStr,
+                                          confirm_cluster_profile_inet: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            if (str(cluster) != cluster_id or any(
+                    type(value) is not str or not value.strip() or '\x00' in value
+                    or len(value.encode('utf-8')) > 1024 for value in
+                    (profile_name, inet_name))):
+                raise ValueError('Invalid profile inet removal parameters')
+            if confirm_cluster_profile_inet != f'{cluster}:{profile_name}:{inet_name}':
+                raise ValueError('Confirmation must match cluster:profile:inet exactly')
+            try:
+                async with service.factory() as client:
+                    await client.remove_profile_inet(cluster, profile_name, inet_name)
+                    return {'removed_profile_inet': inet_name}
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC profile inet remove failed (' + type(exc).__name__ + ')') from None
+
+    if allow_profile_app_update:
+        @server.tool(description='MUTATION: update or insert a profile application ACL. '
+                             'Confirm cluster UUID:profile name:application name; guarded client '
+                             'checks full application list after update.')
+        async def rac_update_profile_app(cluster_id: StrictStr, profile_name: StrictStr,
+                                         app_name: StrictStr, fields: dict[str, StrictStr],
+                                         confirm_cluster_profile_app: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            if (str(cluster) != cluster_id or any(
+                    type(value) is not str or not value.strip() or '\x00' in value
+                    or len(value.encode('utf-8')) > 1024 for value in (profile_name, app_name))
+                    or type(fields) is not dict or not fields
+                    or set(fields) - {'wild', 'descr'}
+                    or any(type(value) is not str or '\x00' in value
+                           or len(value.encode('utf-8')) > 1024 for value in fields.values())):
+                raise ValueError('Invalid profile app update parameters')
+            if confirm_cluster_profile_app != f'{cluster}:{profile_name}:{app_name}':
+                raise ValueError('Confirmation must match cluster:profile:app exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.update_profile_app(cluster, profile_name, app_name,
+                                                           **fields)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC profile app update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_profile_app_remove:
+        @server.tool(description='DESTRUCTIVE: remove a security profile application ACL. '
+                             'Confirm cluster UUID:profile name:application name exactly; '
+                             'guarded client checks full application ACL list after removal.')
+        async def rac_remove_profile_app(cluster_id: StrictStr, profile_name: StrictStr,
+                                         app_name: StrictStr,
+                                         confirm_cluster_profile_app: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            if (str(cluster) != cluster_id or any(
+                    type(value) is not str or not value.strip() or '\x00' in value
+                    or len(value.encode('utf-8')) > 1024 for value in
+                    (profile_name, app_name))):
+                raise ValueError('Invalid profile application removal parameters')
+            if confirm_cluster_profile_app != f'{cluster}:{profile_name}:{app_name}':
+                raise ValueError('Confirmation must match cluster:profile:app exactly')
+            try:
+                async with service.factory() as client:
+                    await client.remove_profile_app(cluster, profile_name, app_name)
+                    return {'removed_profile_app': app_name}
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC profile app remove failed (' + type(exc).__name__ + ')') from None
+
+    if allow_profile_module_update:
+        @server.tool(description='MUTATION: update or insert a profile module ACL. '
+                             'Confirm cluster UUID:profile name:module name; guarded client '
+                             'checks full module list after update.')
+        async def rac_update_profile_module(cluster_id: StrictStr, profile_name: StrictStr,
+                                            module_name: StrictStr, fields: dict[str, StrictStr],
+                                            confirm_cluster_profile_module: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            if (str(cluster) != cluster_id or any(
+                    type(value) is not str or not value.strip() or '\x00' in value
+                    or len(value.encode('utf-8')) > 1024 for value in (profile_name, module_name))
+                    or type(fields) is not dict or not fields
+                    or set(fields) - {'hash_value', 'descr'}
+                    or any(type(value) is not str or '\x00' in value
+                           or len(value.encode('utf-8')) > 1024 for value in fields.values())):
+                raise ValueError('Invalid profile module update parameters')
+            if confirm_cluster_profile_module != f'{cluster}:{profile_name}:{module_name}':
+                raise ValueError('Confirmation must match cluster:profile:module exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.update_profile_module(cluster, profile_name, module_name,
+                                                              **fields)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC profile module update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_profile_module_remove:
+        @server.tool(description='DESTRUCTIVE: remove a security profile module ACL. '
+                             'Confirm cluster UUID:profile name:module name exactly; '
+                             'guarded client checks full module ACL list after removal.')
+        async def rac_remove_profile_module(cluster_id: StrictStr, profile_name: StrictStr,
+                                            module_name: StrictStr,
+                                            confirm_cluster_profile_module: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            if (str(cluster) != cluster_id or any(
+                    type(value) is not str or not value.strip() or '\x00' in value
+                    or len(value.encode('utf-8')) > 1024 for value in
+                    (profile_name, module_name))):
+                raise ValueError('Invalid profile module removal parameters')
+            if confirm_cluster_profile_module != f'{cluster}:{profile_name}:{module_name}':
+                raise ValueError('Confirmation must match cluster:profile:module exactly')
+            try:
+                async with service.factory() as client:
+                    await client.remove_profile_module(cluster, profile_name, module_name)
+                    return {'removed_profile_module': module_name}
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC profile module remove failed (' + type(exc).__name__ + ')') from None
+
+    if allow_profile_addin_update:
+        @server.tool(description='MUTATION: update or insert a profile add-in ACL. '
+                             'Confirm cluster UUID:profile name:add-in name; guarded client '
+                             'checks full add-in list after update.')
+        async def rac_update_profile_addin(cluster_id: StrictStr, profile_name: StrictStr,
+                                           addin_name: StrictStr, fields: dict[str, StrictStr],
+                                           confirm_cluster_profile_addin: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            if (str(cluster) != cluster_id or any(
+                    type(value) is not str or not value.strip() or '\x00' in value
+                    or len(value.encode('utf-8')) > 1024 for value in (profile_name, addin_name))
+                    or type(fields) is not dict or not fields
+                    or set(fields) - {'hash_value', 'descr'}
+                    or any(type(value) is not str or '\x00' in value
+                           or len(value.encode('utf-8')) > 1024 for value in fields.values())):
+                raise ValueError('Invalid profile addin update parameters')
+            if confirm_cluster_profile_addin != f'{cluster}:{profile_name}:{addin_name}':
+                raise ValueError('Confirmation must match cluster:profile:addin exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.update_profile_addin(cluster, profile_name, addin_name,
+                                                             **fields)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC profile addin update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_profile_addin_remove:
+        @server.tool(description='DESTRUCTIVE: remove a security profile add-in ACL. '
+                             'Confirm cluster UUID:profile name:add-in name exactly; '
+                             'guarded client checks full add-in ACL list after removal.')
+        async def rac_remove_profile_addin(cluster_id: StrictStr, profile_name: StrictStr,
+                                           addin_name: StrictStr,
+                                           confirm_cluster_profile_addin: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            if (str(cluster) != cluster_id or any(
+                    type(value) is not str or not value.strip() or '\x00' in value
+                    or len(value.encode('utf-8')) > 1024 for value in
+                    (profile_name, addin_name))):
+                raise ValueError('Invalid profile addin removal parameters')
+            if confirm_cluster_profile_addin != f'{cluster}:{profile_name}:{addin_name}':
+                raise ValueError('Confirmation must match cluster:profile:addin exactly')
+            try:
+                async with service.factory() as client:
+                    await client.remove_profile_addin(cluster, profile_name, addin_name)
+                    return {'removed_profile_addin': addin_name}
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC profile addin remove failed (' + type(exc).__name__ + ')') from None
+
+    if allow_profile_com_update:
+        @server.tool(description='MUTATION: update or insert a profile COM-class ACL. '
+                             'Confirm cluster UUID:profile name:class name; guarded client '
+                             'checks complete COM ACL list after update.')
+        async def rac_update_profile_com_class(cluster_id: StrictStr, profile_name: StrictStr,
+                                               class_name: StrictStr, fields: dict[str, StrictStr],
+                                               confirm_cluster_profile_class: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            allowed = {'file_name', 'class_id', 'host', 'descr'}
+            if (str(cluster) != cluster_id or any(
+                    type(value) is not str or not value.strip() or '\x00' in value
+                    or len(value.encode('utf-8')) > 1024 for value in (profile_name, class_name))
+                    or type(fields) is not dict or not fields or set(fields) - allowed
+                    or any(type(value) is not str or '\x00' in value
+                           or len(value.encode('utf-8')) > 1024 for value in fields.values())):
+                raise ValueError('Invalid profile COM update parameters')
+            if confirm_cluster_profile_class != f'{cluster}:{profile_name}:{class_name}':
+                raise ValueError('Confirmation must match cluster:profile:class exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.update_profile_com_class(cluster, profile_name, class_name,
+                                                                 **fields)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC profile COM update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_profile_com_remove:
+        @server.tool(description='DESTRUCTIVE: remove a security profile COM-class ACL. '
+                             'Confirm cluster UUID:profile name:class name exactly; guarded '
+                             'client checks full COM-class ACL list after removal.')
+        async def rac_remove_profile_com_class(cluster_id: StrictStr, profile_name: StrictStr,
+                                               class_name: StrictStr,
+                                               confirm_cluster_profile_class: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            if (str(cluster) != cluster_id or any(
+                    type(value) is not str or not value.strip() or '\x00' in value
+                    or len(value.encode('utf-8')) > 1024 for value in
+                    (profile_name, class_name))):
+                raise ValueError('Invalid profile COM removal parameters')
+            if confirm_cluster_profile_class != f'{cluster}:{profile_name}:{class_name}':
+                raise ValueError('Confirmation must match cluster:profile:class exactly')
+            try:
+                async with service.factory() as client:
+                    await client.remove_profile_com_class(cluster, profile_name, class_name)
+                    return {'removed_profile_com_class': class_name}
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC profile COM remove failed (' + type(exc).__name__ + ')') from None
+
+    if allow_profile_directory_update:
+        @server.tool(description='MUTATION: update or insert a profile directory ACL. '
+                             'Confirm cluster UUID:profile name:alias exactly; guarded client '
+                             'checks the full directory ACL list after update.')
+        async def rac_update_profile_directory(cluster_id: StrictStr, profile_name: StrictStr,
+                                               alias: StrictStr,
+                                               fields: dict[str, StrictBool | StrictStr],
+                                               confirm_cluster_profile_alias: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            text_fields = {'physical_path', 'descr'}
+            bool_fields = {'allowed_read', 'allowed_write'}
+            if (str(cluster) != cluster_id or any(
+                    type(value) is not str or not value.strip() or '\x00' in value
+                    or len(value.encode('utf-8')) > 1024 for value in (profile_name, alias))
+                    or type(fields) is not dict or not fields
+                    or set(fields) - (text_fields | bool_fields)
+                    or any(type(value) is not str or '\x00' in value
+                           or len(value.encode('utf-8')) > 1024
+                           for key, value in fields.items() if key in text_fields)
+                    or any(type(value) is not bool for key, value in fields.items()
+                           if key in bool_fields)):
+                raise ValueError('Invalid profile directory update parameters')
+            if confirm_cluster_profile_alias != f'{cluster}:{profile_name}:{alias}':
+                raise ValueError('Confirmation must match cluster:profile:alias exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.update_profile_directory(cluster, profile_name, alias,
+                                                                 **fields)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC profile directory update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_profile_directory_remove:
+        @server.tool(description='DESTRUCTIVE: remove a security profile directory ACL. '
+                             'Confirm cluster UUID:profile name:directory alias exactly; '
+                             'guarded client checks full directory ACL list after removal.')
+        async def rac_remove_profile_directory(cluster_id: StrictStr, profile_name: StrictStr,
+                                               alias: StrictStr,
+                                               confirm_cluster_profile_alias: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            if (str(cluster) != cluster_id or any(
+                    type(value) is not str or not value.strip() or '\x00' in value
+                    or len(value.encode('utf-8')) > 1024 for value in (profile_name, alias))):
+                raise ValueError('Invalid profile directory removal parameters')
+            if confirm_cluster_profile_alias != f'{cluster}:{profile_name}:{alias}':
+                raise ValueError('Confirmation must match cluster:profile:alias exactly')
+            try:
+                async with service.factory() as client:
+                    await client.remove_profile_directory(cluster, profile_name, alias)
+                    return {'removed_profile_directory': alias}
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC profile directory remove failed (' + type(exc).__name__ + ')') from None
+
+    if allow_profile_role_fields_update:
+        @server.tool(description='MUTATION: update selected profile role/module fields. '
+                             'Confirm cluster UUID:profile name; guarded client checks the '
+                             'full list. Underlying update creates a profile if absent.')
+        async def rac_update_profile_role_fields(cluster_id: StrictStr, profile_name: StrictStr,
+                                                 fields: dict[str, StrictStr],
+                                                 confirm_cluster_name: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            allowed = {'right_extension_definition_roles', 'privileged_mode_roles',
+                       'modules_available_for_extension', 'modules_not_available_for_extension'}
+            if (str(cluster) != cluster_id or type(profile_name) is not str
+                    or not profile_name.strip() or '\x00' in profile_name
+                    or len(profile_name.encode('utf-8')) > 1024 or type(fields) is not dict
+                    or not fields or set(fields) - allowed
+                    or any(type(value) is not str or '\x00' in value
+                           or len(value.encode('utf-8')) > 1024 for value in fields.values())):
+                raise ValueError('Invalid profile role fields update parameters')
+            if confirm_cluster_name != f'{cluster}:{profile_name}':
+                raise ValueError('Confirmation must match cluster UUID:profile name exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.update_profile(cluster, profile_name, **fields)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC profile role fields update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_profile_access_flags_update:
+        @server.tool(description='MUTATION: update selected security profile access flags. '
+                             'Confirm cluster UUID:profile name; guarded client checks full '
+                             'profile list. Underlying update creates a profile if absent.')
+        async def rac_update_profile_access_flags(cluster_id: StrictStr, profile_name: StrictStr,
+                                                  flags: dict[str, StrictBool],
+                                                  confirm_cluster_name: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            allowed = {'priv', 'full_privileged_mode', 'crypto', 'directory_access', 'com_access', 'addin_access',
+                       'module_access', 'app_access', 'inet_access', 'right_extension',
+                       'all_modules_extension'}
+            if (str(cluster) != cluster_id or type(profile_name) is not str
+                    or not profile_name.strip() or '\x00' in profile_name
+                    or len(profile_name.encode('utf-8')) > 1024 or type(flags) is not dict
+                    or not flags or set(flags) - allowed
+                    or 'priv' in flags and 'full_privileged_mode' in flags
+                    or any(type(value) is not bool for value in flags.values())):
+                raise ValueError('Invalid profile access flags update parameters')
+            if confirm_cluster_name != f'{cluster}:{profile_name}':
+                raise ValueError('Confirmation must match cluster UUID:profile name exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.update_profile(cluster, profile_name, **flags)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC profile access flags update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_profile_config_update:
+        @server.tool(description='MUTATION: change security profile configuration access flag. '
+                             'Confirm cluster UUID:profile name; guarded client verifies the '
+                             'full profile list. Underlying update creates a profile if absent.')
+        async def rac_update_profile_config(cluster_id: StrictStr, profile_name: StrictStr,
+                                            enabled: StrictBool, confirm_cluster_name: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            if (str(cluster) != cluster_id or type(profile_name) is not str
+                    or not profile_name.strip() or '\x00' in profile_name
+                    or len(profile_name.encode('utf-8')) > 1024 or type(enabled) is not bool):
+                raise ValueError('Invalid profile config update parameters')
+            if confirm_cluster_name != f'{cluster}:{profile_name}':
+                raise ValueError('Confirmation must match cluster UUID:profile name exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.update_profile(cluster, profile_name, config=enabled)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC profile config update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_profile_description_update:
+        @server.tool(description='MUTATION: update or clear security profile description. '
+                             'Confirm cluster UUID:profile name; guarded client verifies '
+                             'the entire profile list after update. Creates if absent.')
+        async def rac_update_profile_description(cluster_id: StrictStr, profile_name: StrictStr,
+                                                 descr: StrictStr, confirm_cluster_name: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            if (str(cluster) != cluster_id or type(profile_name) is not str
+                    or not profile_name.strip() or '\x00' in profile_name
+                    or len(profile_name.encode('utf-8')) > 1024 or type(descr) is not str
+                    or '\x00' in descr or len(descr.encode('utf-8')) > 1024):
+                raise ValueError('Invalid profile description update parameters')
+            if confirm_cluster_name != f'{cluster}:{profile_name}':
+                raise ValueError('Confirmation must match cluster UUID:profile name exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.update_profile(cluster, profile_name, descr=descr)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC profile description update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_profile_remove:
+        @server.tool(description='DESTRUCTIVE: remove one security profile. Confirm exact '
+                             'cluster UUID:profile name; guarded client verifies its absence '
+                             'and all other profiles unchanged via complete list read-back.')
+        async def rac_remove_profile(cluster_id: StrictStr, profile_name: StrictStr,
+                                     confirm_cluster_name: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            if (str(cluster) != cluster_id or type(profile_name) is not str
+                    or not profile_name.strip() or '\x00' in profile_name
+                    or len(profile_name.encode('utf-8')) > 1024):
+                raise ValueError('Invalid profile removal parameters')
+            if confirm_cluster_name != f'{cluster}:{profile_name}':
+                raise ValueError('Confirmation must match cluster UUID:profile name exactly')
+            try:
+                async with service.factory() as client:
+                    await client.remove_profile(cluster, profile_name)
+                    return {'removed_profile': profile_name}
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC profile remove failed (' + type(exc).__name__ + ')') from None
+
+    if allow_service_setting_insert:
+        @server.tool(description='MUTATION: insert a service setting. Confirm exact '
+                             'cluster UUID:working server UUID:service name:infobase name; '
+                             'guarded client checks the complete settings list after insert.')
+        async def rac_insert_service_setting(cluster_id: StrictStr, server_id: StrictStr,
+                                             service_name: StrictStr, infobase_name: StrictStr,
+                                             service_data_dir: StrictStr,
+                                             confirm_cluster_server_service_infobase: StrictStr) -> dict:
+            try:
+                cluster, working_server = UUID(cluster_id), UUID(server_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster or working server UUID') from None
+            if str(cluster) != cluster_id or str(working_server) != server_id:
+                raise ValueError('UUIDs must use canonical form')
+            for key, value in (('service name', service_name), ('infobase name', infobase_name),
+                               ('service data dir', service_data_dir)):
+                if (type(value) is not str or '\x00' in value or len(value.encode('utf-8')) > 1024
+                        or key == 'service name' and not value.strip()):
+                    raise ValueError('Invalid ' + key)
+            if confirm_cluster_server_service_infobase != (
+                    f'{cluster}:{working_server}:{service_name}:{infobase_name}'):
+                raise ValueError('Confirmation must match cluster:server:service:infobase exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.insert_service_setting(
+                        cluster, working_server, service_name,
+                        infobase_name=infobase_name, service_data_dir=service_data_dir)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC service setting insert failed (' + type(exc).__name__ + ')') from None
+
+    if allow_service_setting_update:
+        @server.tool(description='MUTATION: update a service setting data directory. '
+                             'Confirm cluster UUID:working server UUID:setting UUID exactly; '
+                             'guarded client checks the full settings list after update.')
+        async def rac_update_service_setting(cluster_id: StrictStr, server_id: StrictStr,
+                                             setting_id: StrictStr, service_data_dir: StrictStr,
+                                             confirm_cluster_server_setting: StrictStr) -> dict:
+            try:
+                cluster, working_server, setting = (UUID(value) for value in
+                                                    (cluster_id, server_id, setting_id))
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster, working server, or setting UUID') from None
+            if (str(cluster) != cluster_id or str(working_server) != server_id
+                    or str(setting) != setting_id or type(service_data_dir) is not str
+                    or '\x00' in service_data_dir
+                    or len(service_data_dir.encode('utf-8')) > 1024):
+                raise ValueError('Invalid service setting update parameters')
+            if confirm_cluster_server_setting != f'{cluster}:{working_server}:{setting}':
+                raise ValueError('Confirmation must match cluster:server:setting UUIDs exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.update_service_setting(cluster, working_server, setting,
+                                                               service_data_dir)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC service setting update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_service_setting_remove:
+        @server.tool(description='DESTRUCTIVE: remove one service setting. Confirm exact '
+                             'cluster UUID:working server UUID:setting UUID; guarded client '
+                             'checks the full settings list after removal.')
+        async def rac_remove_service_setting(cluster_id: StrictStr, server_id: StrictStr,
+                                             setting_id: StrictStr,
+                                             confirm_cluster_server_setting: StrictStr) -> None:
+            try:
+                cluster, working_server, setting = (UUID(value) for value in
+                                                    (cluster_id, server_id, setting_id))
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster, working server, or setting UUID') from None
+            if (str(cluster) != cluster_id or str(working_server) != server_id
+                    or str(setting) != setting_id):
+                raise ValueError('UUIDs must use canonical form')
+            if confirm_cluster_server_setting != f'{cluster}:{working_server}:{setting}':
+                raise ValueError('Confirmation must match cluster:server:setting UUIDs exactly')
+            try:
+                async with service.factory() as client:
+                    await client.remove_service_setting(cluster, working_server, setting)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC service setting remove failed (' + type(exc).__name__ + ')') from None
+
+    if allow_service_settings_apply:
+        @server.tool(description='MUTATION: apply pending service settings. Confirm the exact '
+                             'cluster UUID:working server UUID; guarded client checks all '
+                             'settings have become active.')
+        async def rac_apply_service_settings(cluster_id: StrictStr, server_id: StrictStr,
+                                             confirm_cluster_server: StrictStr) -> list[dict]:
+            try:
+                cluster, working_server = UUID(cluster_id), UUID(server_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster or working server UUID') from None
+            if str(cluster) != cluster_id or str(working_server) != server_id:
+                raise ValueError('UUIDs must use canonical form')
+            if confirm_cluster_server != f'{cluster}:{working_server}':
+                raise ValueError('Confirmation must match cluster UUID:working server UUID exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.apply_service_settings(cluster, working_server)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC service settings apply failed (' + type(exc).__name__ + ')') from None
+
+    if allow_rule_apply:
+        @server.tool(description='MUTATION: apply cluster assignment rules in full or partial mode. '
+                             'Confirm the exact cluster UUID; guarded client checks all rule lists '
+                             'unchanged, but effective process allocation is not observable.')
+        async def rac_apply_rules(cluster_id: StrictStr, full: StrictBool,
+                                  confirm_cluster_id: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            if str(cluster) != cluster_id or type(full) is not bool:
+                raise ValueError('Invalid assignment rule apply parameters')
+            if confirm_cluster_id != cluster_id:
+                raise ValueError('Confirmation must match cluster UUID exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.apply_rules(cluster, full=full)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC rule apply failed (' + type(exc).__name__ + ')') from None
+
+    if allow_rule_insert:
+        @server.tool(description='MUTATION: insert a cluster assignment rule at a position. Confirm '
+                             'cluster UUID:server UUID:position exactly; guarded client checks full rule list.')
+        async def rac_insert_rule(cluster_id: StrictStr, server_id: StrictStr, position: StrictInt,
+                                  rule_type: StrictStr, priority: StrictInt,
+                                  confirm_cluster_server_position: StrictStr) -> dict:
+            try:
+                cluster, working_server = UUID(cluster_id), UUID(server_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster or server UUID') from None
+            if (str(cluster) != cluster_id or str(working_server) != server_id
+                    or type(position) is not int or not 0 <= position < 2**31
+                    or type(priority) is not int or not -(2**31) <= priority < 2**31
+                    or rule_type not in ('never', 'auto', 'always')):
+                raise ValueError('Invalid assignment rule parameters')
+            if confirm_cluster_server_position != f'{cluster}:{working_server}:{position}':
+                raise ValueError('Confirmation must match cluster UUID:server UUID:position exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.insert_rule(cluster, working_server, position,
+                                                    rule_type=rule_type, priority=priority)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC rule insert failed (' + type(exc).__name__ + ')') from None
+
+    if allow_rule_remove:
+        @server.tool(description='DESTRUCTIVE: remove an assignment rule by exact cluster, working-server '
+                             'and rule UUIDs. Guarded client checks the entire rule list after removal.')
+        async def rac_remove_rule(cluster_id: StrictStr, server_id: StrictStr, rule_id: StrictStr,
+                                  confirm_cluster_server_rule: StrictStr) -> dict:
+            try:
+                cluster, working_server, rule = UUID(cluster_id), UUID(server_id), UUID(rule_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster, server or rule UUID') from None
+            if (str(cluster) != cluster_id or str(working_server) != server_id
+                    or str(rule) != rule_id):
+                raise ValueError('Non-canonical cluster, server or rule UUID')
+            if confirm_cluster_server_rule != f'{cluster}:{working_server}:{rule}':
+                raise ValueError('Confirmation must match cluster UUID:server UUID:rule UUID exactly')
+            try:
+                async with service.factory() as client:
+                    await client.remove_rule(cluster, working_server, rule)
+                return {'removed_rule': str(rule)}
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC rule remove failed (' + type(exc).__name__ + ')') from None
+
+    if allow_rule_position_update:
+        @server.tool(description='MUTATION: move an existing assignment rule without changing fields. '
+                             'Confirm cluster UUID:server UUID:rule UUID; guarded client checks full rule list.')
+        async def rac_move_rule(cluster_id: StrictStr, server_id: StrictStr, rule_id: StrictStr,
+                                position: StrictInt, confirm_cluster_server_rule: StrictStr) -> dict:
+            try:
+                cluster, working_server, rule = UUID(cluster_id), UUID(server_id), UUID(rule_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster, server or rule UUID') from None
+            if (str(cluster) != cluster_id or str(working_server) != server_id
+                    or str(rule) != rule_id or type(position) is not int
+                    or not 0 <= position < 2**31):
+                raise ValueError('Invalid assignment rule position')
+            if confirm_cluster_server_rule != f'{cluster}:{working_server}:{rule}':
+                raise ValueError('Confirmation must match cluster UUID:server UUID:rule UUID exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.update_rule(cluster, working_server, rule, position)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC rule position update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_rule_fields_update:
+        @server.tool(description='MUTATION: update selected assignment-rule fields. Confirm '
+                             'cluster UUID:server UUID:rule UUID; guarded client checks full rule list.')
+        async def rac_update_rule_fields(cluster_id: StrictStr, server_id: StrictStr,
+                                         rule_id: StrictStr, position: StrictInt,
+                                         fields: dict[str, StrictStr | StrictInt],
+                                         confirm_cluster_server_rule: StrictStr) -> dict:
+            try:
+                cluster, working_server, rule = UUID(cluster_id), UUID(server_id), UUID(rule_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster, server or rule UUID') from None
+            if (str(cluster) != cluster_id or str(working_server) != server_id
+                    or str(rule) != rule_id or type(position) is not int
+                    or not 0 <= position < 2**31 or type(fields) is not dict or not fields
+                    or set(fields) - {'object_type', 'infobase_name', 'rule_type',
+                                      'application_ext', 'priority'}
+                    or any((type(value) is not int or not -(2**31) <= value < 2**31)
+                           if key == 'priority' else
+                           (type(value) is not str or '\x00' in value
+                            or len(value.encode('utf-8')) > 1024
+                            or key == 'rule_type' and value not in ('never', 'auto', 'always'))
+                           for key, value in fields.items())):
+                raise ValueError('Invalid assignment rule fields')
+            if confirm_cluster_server_rule != f'{cluster}:{working_server}:{rule}':
+                raise ValueError('Confirmation must match cluster UUID:server UUID:rule UUID exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.update_rule(cluster, working_server, rule, position, **fields)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC rule fields update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_rule_priority_update:
+        @server.tool(description='MUTATION: update priority of a selected assignment rule without changing '
+                             'other rule fields. Confirm cluster UUID:server UUID:rule UUID exactly; '
+                             'guarded client verifies the entire rule list.')
+        async def rac_update_rule_priority(cluster_id: StrictStr, server_id: StrictStr,
+                                           rule_id: StrictStr, position: StrictInt,
+                                           priority: StrictInt,
+                                           confirm_cluster_server_rule: StrictStr) -> dict:
+            try:
+                cluster, working_server, rule = UUID(cluster_id), UUID(server_id), UUID(rule_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster, server or rule UUID') from None
+            if (str(cluster) != cluster_id or str(working_server) != server_id or str(rule) != rule_id
+                    or type(position) is not int or not 0 <= position < 2**31
+                    or type(priority) is not int or not -(2**31) <= priority < 2**31):
+                raise ValueError('Invalid assignment rule parameters')
+            if confirm_cluster_server_rule != f'{cluster}:{working_server}:{rule}':
+                raise ValueError('Confirmation must match cluster UUID:server UUID:rule UUID exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.update_rule(cluster, working_server, rule, position,
+                                                    priority=priority)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC rule priority update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_counter_clear:
+        @server.tool(description='DESTRUCTIVE: request clear of named counter readings. '
+                             'Confirm cluster UUID:name exactly; guarded client checks configuration '
+                             'unchanged, but populated reading deletion is not live-verified.')
+        async def rac_clear_counter(cluster_id: StrictStr, name: StrictStr,
+                                    object_filter: StrictStr,
+                                    confirm_cluster_name: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            if (str(cluster) != cluster_id or type(name) is not str or not name.strip()
+                    or '\x00' in name or len(name.encode('utf-8')) > 1024
+                    or type(object_filter) is not str or '\x00' in object_filter
+                    or len(object_filter.encode('utf-8')) > 4096):
+                raise ValueError('Invalid counter clear parameters')
+            if confirm_cluster_name != f'{cluster}:{name}':
+                raise ValueError('Confirmation must match cluster UUID:counter name exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.clear_counter(cluster, name, object_filter)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC counter clear failed (' + type(exc).__name__ + ')') from None
+
+    if allow_counter_analysis_flags_update:
+        @server.tool(description='MUTATION: update selected named-counter analysis flags. '
+                             'Confirm cluster UUID:name exactly; guarded client checks full list.')
+        async def rac_update_counter_analysis_flags(cluster_id: StrictStr, name: StrictStr,
+                                                     flags: dict[str, StrictBool],
+                                                     confirm_cluster_name: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            allowed = {'duration', 'cpu_time', 'memory', 'read', 'write', 'duration_dbms',
+                       'dbms_bytes', 'service', 'call', 'number_of_active_sessions',
+                       'number_of_sessions'}
+            if (str(cluster) != cluster_id or type(name) is not str or not name.strip()
+                    or '\x00' in name or len(name.encode('utf-8')) > 1024
+                    or type(flags) is not dict or not flags or any(
+                        key not in allowed or type(value) is not bool
+                        for key, value in flags.items())):
+                raise ValueError('Invalid counter analysis flags parameters')
+            if confirm_cluster_name != f'{cluster}:{name}':
+                raise ValueError('Confirmation must match cluster UUID:counter name exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.update_counter(cluster, name, **flags)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC counter analysis flags update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_counter_filter_update:
+        @server.tool(description='MUTATION: update or clear a named counter object filter. '
+                             'Confirm cluster UUID:name exactly; guarded client checks full list.')
+        async def rac_update_counter_filter(cluster_id: StrictStr, name: StrictStr,
+                                            object_filter: StrictStr,
+                                            confirm_cluster_name: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            if (str(cluster) != cluster_id or type(name) is not str or not name.strip()
+                    or '\x00' in name or len(name.encode('utf-8')) > 1024
+                    or type(object_filter) is not str or '\x00' in object_filter
+                    or len(object_filter.encode('utf-8')) > 1024):
+                raise ValueError('Invalid counter filter parameters')
+            if confirm_cluster_name != f'{cluster}:{name}':
+                raise ValueError('Confirmation must match cluster UUID:counter name exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.update_counter(cluster, name, filter=object_filter)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC counter filter update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_counter_filter_type_update:
+        @server.tool(description='MUTATION: update a named counter filter type. Confirm cluster '
+                             'UUID:name exactly; guarded client verifies full counter list.')
+        async def rac_update_counter_filter_type(cluster_id: StrictStr, name: StrictStr,
+                                                 mode: StrictStr,
+                                                 confirm_cluster_name: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            if (str(cluster) != cluster_id or type(name) is not str or not name.strip()
+                    or '\x00' in name or len(name.encode('utf-8')) > 1024
+                    or mode not in ('all', 'all-selected', 'all-but-selected')):
+                raise ValueError('Invalid counter filter type parameters')
+            if confirm_cluster_name != f'{cluster}:{name}':
+                raise ValueError('Confirmation must match cluster UUID:counter name exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.update_counter(cluster, name, filter_type=mode)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC counter filter type update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_counter_group_update:
+        @server.tool(description='MUTATION: update a named counter group. Confirm cluster '
+                             'UUID:name exactly; guarded client verifies full counter list.')
+        async def rac_update_counter_group(cluster_id: StrictStr, name: StrictStr, group: StrictStr,
+                                           confirm_cluster_name: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            if (str(cluster) != cluster_id or type(name) is not str or not name.strip()
+                    or '\x00' in name or len(name.encode('utf-8')) > 1024
+                    or group not in ('users', 'data-separation')):
+                raise ValueError('Invalid counter group parameters')
+            if confirm_cluster_name != f'{cluster}:{name}':
+                raise ValueError('Confirmation must match cluster UUID:counter name exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.update_counter(cluster, name, group=group)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC counter group update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_counter_duration_update:
+        @server.tool(description='MUTATION: toggle duration analysis for a named counter. '
+                             'Confirm cluster UUID:name exactly; guarded client checks full list.')
+        async def rac_update_counter_duration(cluster_id: StrictStr, name: StrictStr, enabled: StrictBool,
+                                              confirm_cluster_name: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            if (str(cluster) != cluster_id or type(name) is not str or not name.strip()
+                    or '\x00' in name or len(name.encode('utf-8')) > 1024
+                    or type(enabled) is not bool):
+                raise ValueError('Invalid counter duration parameters')
+            if confirm_cluster_name != f'{cluster}:{name}':
+                raise ValueError('Confirmation must match cluster UUID:counter name exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.update_counter(cluster, name, duration=enabled)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC counter duration update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_counter_collection_time_update:
+        @server.tool(description='MUTATION: update a named counter collection time. Confirm '
+                             'cluster UUID:name exactly; guarded client checks the full list.')
+        async def rac_update_counter_collection_time(cluster_id: StrictStr, name: StrictStr, seconds: StrictInt,
+                                                     confirm_cluster_name: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            if (str(cluster) != cluster_id or type(name) is not str or not name.strip()
+                    or '\x00' in name or len(name.encode('utf-8')) > 1024
+                    or type(seconds) is not int or not 0 <= seconds < 2**63):
+                raise ValueError('Invalid counter collection time parameters')
+            if confirm_cluster_name != f'{cluster}:{name}':
+                raise ValueError('Confirmation must match cluster UUID:counter name exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.update_counter(cluster, name, collection_time=seconds)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC counter collection time update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_counter_description_update:
+        @server.tool(description='MUTATION: update the description of a named cluster counter. '
+                             'Confirm cluster UUID:name exactly; guarded client verifies full list.')
+        async def rac_update_counter_description(cluster_id: StrictStr, name: StrictStr, descr: StrictStr,
+                                                 confirm_cluster_name: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            if (str(cluster) != cluster_id or type(name) is not str or not name.strip()
+                    or '\x00' in name or len(name.encode('utf-8')) > 1024
+                    or type(descr) is not str or '\x00' in descr
+                    or len(descr.encode('utf-8')) > 1024):
+                raise ValueError('Invalid counter description parameters')
+            if confirm_cluster_name != f'{cluster}:{name}':
+                raise ValueError('Confirmation must match cluster UUID:counter name exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.update_counter(cluster, name, descr=descr)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC counter description update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_counter_remove:
+        @server.tool(description='DESTRUCTIVE: remove a named cluster counter. Confirm cluster '
+                             'UUID:name exactly; guarded client checks the complete counter list.')
+        async def rac_remove_counter(cluster_id: StrictStr, name: StrictStr,
+                                     confirm_cluster_name: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            if (str(cluster) != cluster_id or type(name) is not str or not name.strip()
+                    or '\x00' in name or len(name.encode('utf-8')) > 1024):
+                raise ValueError('Invalid counter parameters')
+            if confirm_cluster_name != f'{cluster}:{name}':
+                raise ValueError('Confirmation must match cluster UUID:counter name exactly')
+            try:
+                async with service.factory() as client:
+                    await client.remove_counter(cluster, name)
+                return {'removed_counter': name}
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC counter remove failed (' + type(exc).__name__ + ')') from None
+
+    if allow_limit_update:
+        @server.tool(description='MUTATION: create or update a named cluster limit with action, '
+                             'counter and duration threshold. Confirm cluster UUID:name exactly; '
+                             'guarded client verifies the complete limit list.')
+        async def rac_update_limit(cluster_id: StrictStr, name: StrictStr, action: StrictStr,
+                                   counter: StrictStr, duration: StrictInt,
+                                   confirm_cluster_name: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            if (str(cluster) != cluster_id or type(name) is not str or not name.strip()
+                    or '\x00' in name or len(name.encode('utf-8')) > 1024
+                    or action not in ('none', 'set-low-priority-thread', 'interrupt-current-call',
+                                      'interrupt-session') or type(counter) is not str
+                    or '\x00' in counter or len(counter.encode('utf-8')) > 1024
+                    or type(duration) is not int or not 0 <= duration < 2**63):
+                raise ValueError('Invalid limit parameters')
+            if confirm_cluster_name != f'{cluster}:{name}':
+                raise ValueError('Confirmation must match cluster UUID:limit name exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.update_limit(cluster, name, action=action,
+                                                     counter=counter, duration=duration)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC limit update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_limit_remove:
+        @server.tool(description='DESTRUCTIVE: remove a named cluster limit. Confirm the exact cluster '
+                             'UUID:name; guarded client checks the complete limit list after removal.')
+        async def rac_remove_limit(cluster_id: StrictStr, name: StrictStr,
+                                   confirm_cluster_name: StrictStr) -> dict:
+            try:
+                cluster = UUID(cluster_id)
+            except (TypeError, ValueError, AttributeError):
+                raise ValueError('Invalid cluster UUID') from None
+            if (str(cluster) != cluster_id or type(name) is not str or not name.strip()
+                    or '\x00' in name or len(name.encode('utf-8')) > 1024):
+                raise ValueError('Invalid limit parameters')
+            if confirm_cluster_name != f'{cluster}:{name}':
+                raise ValueError('Confirmation must match cluster UUID:limit name exactly')
+            try:
+                async with service.factory() as client:
+                    await client.remove_limit(cluster, name)
+                return {'removed_limit': name}
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC limit remove failed (' + type(exc).__name__ + ')') from None
+
+    if allow_cluster_insert:
+        @server.tool(description='MUTATION: insert a new cluster on the configured RAS. '
+                             'Confirm the exact host:port; the client requires a full list/info read-back. '
+                             'Only independently verified 16.0 options are exposed.')
+        async def rac_insert_cluster(host: StrictStr, port: StrictInt, name: StrictStr, audit: StrictBool,
+                                     confirm_host_port: StrictStr, expiration_timeout: StrictInt = 60,
+                                     security_level: StrictInt = 0,
+                                     session_fault_tolerance_level: StrictInt = 0,
+                                     load_balancing_mode: StrictStr = 'performance',
+                                     kill_problem_processes: StrictBool = True,
+                                     kill_by_memory_with_dump: StrictBool = False,
+                                     restart_schedule: StrictStr = '', ping_period: StrictInt = 0,
+                                     ping_timeout: StrictInt = 0) -> dict:
+            if (type(host) is not str or not host or '\x00' in host
+                    or len(host.encode('utf-8')) > 255 or type(port) is not int
+                    or not 1 <= port <= 65535 or type(name) is not str or '\x00' in name
+                    or len(name.encode('utf-8')) > 256 or type(audit) is not bool):
+                raise ValueError('Invalid cluster insert parameters')
+            if confirm_host_port != f'{host}:{port}':
+                raise ValueError('Confirmation must match the cluster host:port exactly')
+            if (type(ping_period) is not int or type(ping_timeout) is not int
+                    or not ((ping_period == ping_timeout == 0)
+                            or 0 < ping_period < ping_timeout < 2**31)):
+                raise ValueError('Invalid cluster ping period/timeout pair')
+            for value in (expiration_timeout, security_level, session_fault_tolerance_level):
+                if type(value) is not int or not 0 <= value < 2**31:
+                    raise ValueError('Invalid cluster insert numeric setting')
+            if (type(load_balancing_mode) is not str
+                    or load_balancing_mode not in ('performance', 'memory')
+                    or type(kill_problem_processes) is not bool
+                    or type(kill_by_memory_with_dump) is not bool
+                    or type(restart_schedule) is not str or '\x00' in restart_schedule
+                    or (restart_schedule and (len(restart_schedule.encode('utf-8')) > 256
+                        or len(restart_schedule.split()) != 6
+                        or any(not part.isascii() or not part.isdecimal()
+                               for part in restart_schedule.split())))):
+                raise ValueError('Invalid cluster insert option')
+            defaults = {'expiration_timeout': 60, 'security_level': 0,
+                        'session_fault_tolerance_level': 0, 'load_balancing_mode': 'performance',
+                        'kill_problem_processes': True, 'kill_by_memory_with_dump': False,
+                        'restart_schedule': '', 'ping_period': 0, 'ping_timeout': 0}
+            requested = {'expiration_timeout': expiration_timeout, 'security_level': security_level,
+                         'session_fault_tolerance_level': session_fault_tolerance_level,
+                         'load_balancing_mode': load_balancing_mode,
+                         'kill_problem_processes': kill_problem_processes,
+                         'kill_by_memory_with_dump': kill_by_memory_with_dump,
+                         'restart_schedule': restart_schedule, 'ping_period': ping_period,
+                         'ping_timeout': ping_timeout}
+            options = {key: value for key, value in requested.items() if value != defaults[key]}
+            try:
+                async with service.factory() as client:
+                    return await client.insert_cluster(host, port, name, audit=audit, **options)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC cluster insert failed (' + type(exc).__name__ + ')') from None
+
+    if allow_cluster_remove:
+        @server.tool(description='DESTRUCTIVE: remove a cluster from the configured RAS; '
+                             'confirm its exact UUID. The client checks the full cluster list before and after.')
+        async def rac_remove_cluster(cluster_id: StrictStr, confirm_cluster_id: StrictStr) -> list[dict]:
+            cluster = UUID(cluster_id)
+            if confirm_cluster_id != str(cluster):
+                raise ValueError('Confirmation must match the cluster UUID exactly')
+            try:
+                async with service.factory() as client:
+                    return await client.remove_cluster(cluster)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC cluster remove failed (' + type(exc).__name__ + ')') from None
+
+    if allow_process_turn_off:
+        @server.tool(description='DESTRUCTIVE: turn off an existing process; confirm with its exact UUID. The client verifies disappearance.')
+        async def rac_turn_off_process(cluster_id: StrictStr, process_id: StrictStr,
+                                       confirm_process_id: StrictStr) -> list[dict]:
+            cluster, process = UUID(cluster_id), UUID(process_id)
+            if confirm_process_id != str(process):
+                raise ValueError('Confirmation must match the process UUID exactly')
+            async with service.factory() as client:
+                try:
+                    return await client.turn_off_process(cluster, process)
+                except (RacError, ValueError, OSError, TimeoutError) as exc:
+                    raise ValueError('RAC process turn-off failed (' + type(exc).__name__ + ')') from None
+
+    if allow_cluster_name_update:
+        @server.tool(description='MUTATION: change an existing cluster name; confirm with its exact UUID. The client verifies full read-back.')
+        async def rac_update_cluster_name(cluster_id: StrictStr, name: StrictStr,
+                                          confirm_cluster_id: StrictStr) -> dict:
+            cluster = UUID(cluster_id)
+            if confirm_cluster_id != str(cluster):
+                raise ValueError('Confirmation must match the cluster UUID exactly')
+            async with service.factory() as client:
+                try:
+                    return await client.update_cluster_name(cluster, name)
+                except (RacError, ValueError, OSError, TimeoutError) as exc:
+                    raise ValueError('RAC cluster name update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_cluster_expiration_timeout_update:
+        @server.tool(description='MUTATION: change cluster expiration timeout in seconds; confirm its exact UUID. Full read-back is verified.')
+        async def rac_update_cluster_expiration_timeout(cluster_id: StrictStr, seconds: StrictInt,
+                                                        confirm_cluster_id: StrictStr) -> dict:
+            cluster = UUID(cluster_id)
+            if confirm_cluster_id != str(cluster):
+                raise ValueError('Confirmation must match the cluster UUID exactly')
+            if type(seconds) is not int or not 0 <= seconds <= 2_147_483_647:
+                raise ValueError('Invalid cluster expiration timeout')
+            try:
+                async with service.factory() as client:
+                    return await client.update_cluster_expiration_timeout(cluster, seconds)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC cluster timeout update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_cluster_security_level_update:
+        @server.tool(description='MUTATION: change cluster security level; confirm its exact UUID. Full read-back is verified.')
+        async def rac_update_cluster_security_level(cluster_id: StrictStr, level: StrictInt,
+                                                    confirm_cluster_id: StrictStr) -> dict:
+            cluster = UUID(cluster_id)
+            if confirm_cluster_id != str(cluster):
+                raise ValueError('Confirmation must match the cluster UUID exactly')
+            if type(level) is not int or not 0 <= level <= 2_147_483_647:
+                raise ValueError('Invalid cluster security level')
+            try:
+                async with service.factory() as client:
+                    return await client.update_cluster_security_level(cluster, level)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC cluster security level update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_cluster_session_fault_tolerance_level_update:
+        @server.tool(description='MUTATION: change cluster session fault tolerance level; confirm its exact UUID. Full read-back is verified.')
+        async def rac_update_cluster_session_fault_tolerance_level(cluster_id: StrictStr, level: StrictInt,
+                                                                  confirm_cluster_id: StrictStr) -> dict:
+            cluster = UUID(cluster_id)
+            if confirm_cluster_id != str(cluster):
+                raise ValueError('Confirmation must match the cluster UUID exactly')
+            if type(level) is not int or not 0 <= level <= 2_147_483_647:
+                raise ValueError('Invalid cluster session fault tolerance level')
+            try:
+                async with service.factory() as client:
+                    return await client.update_cluster_session_fault_tolerance_level(cluster, level)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC cluster session fault tolerance update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_cluster_load_balancing_mode_update:
+        @server.tool(description='MUTATION: set cluster load balancing to performance or memory; exact UUID confirmation and full read-back required.')
+        async def rac_update_cluster_load_balancing_mode(cluster_id: StrictStr, mode: StrictStr,
+                                                         confirm_cluster_id: StrictStr) -> dict:
+            cluster = UUID(cluster_id)
+            if confirm_cluster_id != str(cluster):
+                raise ValueError('Confirmation must match the cluster UUID exactly')
+            if type(mode) is not str or mode not in ('performance', 'memory'):
+                raise ValueError('Invalid cluster load balancing mode')
+            try:
+                async with service.factory() as client:
+                    return await client.update_cluster_load_balancing_mode(cluster, mode)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC cluster load balancing update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_cluster_kill_problem_processes_update:
+        @server.tool(description='MUTATION: change cluster automatic problem-process termination; confirm exact UUID. Full read-back required.')
+        async def rac_update_cluster_kill_problem_processes(cluster_id: StrictStr, enabled: StrictBool,
+                                                            confirm_cluster_id: StrictStr) -> dict:
+            cluster = UUID(cluster_id)
+            if confirm_cluster_id != str(cluster):
+                raise ValueError('Confirmation must match the cluster UUID exactly')
+            if type(enabled) is not bool:
+                raise ValueError('Invalid kill problem processes flag')
+            try:
+                async with service.factory() as client:
+                    return await client.update_cluster_kill_problem_processes(cluster, enabled)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC cluster problem-process policy update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_cluster_kill_by_memory_with_dump_update:
+        @server.tool(description='MUTATION: change cluster kill-by-memory dump policy; confirm exact UUID. Full read-back required.')
+        async def rac_update_cluster_kill_by_memory_with_dump(cluster_id: StrictStr, enabled: StrictBool,
+                                                              confirm_cluster_id: StrictStr) -> dict:
+            cluster = UUID(cluster_id)
+            if confirm_cluster_id != str(cluster):
+                raise ValueError('Confirmation must match the cluster UUID exactly')
+            if type(enabled) is not bool:
+                raise ValueError('Invalid kill by memory dump flag')
+            try:
+                async with service.factory() as client:
+                    return await client.update_cluster_kill_by_memory_with_dump(cluster, enabled)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC cluster kill-by-memory dump update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_cluster_audit_update:
+        @server.tool(description='MUTATION: change cluster access-right audit recording; confirm exact UUID. Full read-back required.')
+        async def rac_update_cluster_audit(cluster_id: StrictStr, enabled: StrictBool,
+                                           confirm_cluster_id: StrictStr) -> dict:
+            cluster = UUID(cluster_id)
+            if confirm_cluster_id != str(cluster):
+                raise ValueError('Confirmation must match the cluster UUID exactly')
+            if type(enabled) is not bool:
+                raise ValueError('Invalid cluster audit flag')
+            try:
+                async with service.factory() as client:
+                    return await client.update_cluster_audit(cluster, enabled)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC cluster audit update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_cluster_ping_update:
+        @server.tool(description='MUTATION: update cluster ping period and timeout together; confirm exact UUID. Full read-back required.')
+        async def rac_update_cluster_ping(cluster_id: StrictStr, period: StrictInt, timeout: StrictInt,
+                                          confirm_cluster_id: StrictStr) -> dict:
+            cluster = UUID(cluster_id)
+            if confirm_cluster_id != str(cluster):
+                raise ValueError('Confirmation must match the cluster UUID exactly')
+            if (type(period) is not int or type(timeout) is not int or
+                    not ((period == 0 and timeout == 0) or (0 < period < timeout <= 2_147_483_647))):
+                raise ValueError('Invalid cluster ping period/timeout pair')
+            try:
+                async with service.factory() as client:
+                    return await client.update_cluster_ping(cluster, period, timeout)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC cluster ping update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_cluster_restart_schedule_update:
+        @server.tool(description='MUTATION: update cluster restart schedule; confirm exact UUID. Full read-back required.')
+        async def rac_update_cluster_restart_schedule(cluster_id: StrictStr, schedule: StrictStr,
+                                                      confirm_cluster_id: StrictStr) -> dict:
+            cluster = UUID(cluster_id)
+            if confirm_cluster_id != str(cluster):
+                raise ValueError('Confirmation must match the cluster UUID exactly')
+            RacClient._validate_schedule(schedule)
+            try:
+                async with service.factory() as client:
+                    return await client.update_restart_schedule(cluster, schedule)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC cluster restart schedule update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_server_restart_schedule_update:
+        @server.tool(description='MUTATION: update working-server restart schedule; confirm exact server UUID. Full read-back required.')
+        async def rac_update_server_restart_schedule(cluster_id: StrictStr, server_id: StrictStr,
+                                                     schedule: StrictStr, confirm_server_id: StrictStr) -> dict:
+            cluster, working_server = UUID(cluster_id), UUID(server_id)
+            if confirm_server_id != str(working_server):
+                raise ValueError('Confirmation must match the working server UUID exactly')
+            RacClient._validate_schedule(schedule)
+            try:
+                async with service.factory() as client:
+                    return await client.update_server_restart_schedule(cluster, working_server, schedule)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC server restart schedule update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_server_infobases_limit_update:
+        @server.tool(description='MUTATION: update working-server infobases-per-process limit; confirm exact server UUID. Full read-back required.')
+        async def rac_update_server_infobases_limit(cluster_id: StrictStr, server_id: StrictStr,
+                                                    limit: StrictInt, confirm_server_id: StrictStr) -> dict:
+            cluster, working_server = UUID(cluster_id), UUID(server_id)
+            if confirm_server_id != str(working_server):
+                raise ValueError('Confirmation must match the working server UUID exactly')
+            if type(limit) is not int or not 0 <= limit <= 2_147_483_647:
+                raise ValueError('Invalid working-server infobases limit')
+            try:
+                async with service.factory() as client:
+                    return await client.update_server_infobases_limit(cluster, working_server, limit)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC server infobases limit update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_server_connections_limit_update:
+        @server.tool(description='MUTATION: update working-server connections-per-process limit; confirm exact server UUID. Full read-back required.')
+        async def rac_update_server_connections_limit(cluster_id: StrictStr, server_id: StrictStr,
+                                                      limit: StrictInt, confirm_server_id: StrictStr) -> dict:
+            cluster, working_server = UUID(cluster_id), UUID(server_id)
+            if confirm_server_id != str(working_server):
+                raise ValueError('Confirmation must match the working server UUID exactly')
+            if type(limit) is not int or not 0 <= limit <= 2_147_483_647:
+                raise ValueError('Invalid working-server connections limit')
+            try:
+                async with service.factory() as client:
+                    return await client.update_server_connections_limit(cluster, working_server, limit)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC server connections limit update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_server_safe_call_memory_limit_update:
+        @server.tool(description='MUTATION: update working-server safe-call memory limit; confirm exact server UUID. Full read-back required.')
+        async def rac_update_server_safe_call_memory_limit(cluster_id: StrictStr, server_id: StrictStr,
+                                                           limit: StrictInt, confirm_server_id: StrictStr) -> dict:
+            cluster, working_server = UUID(cluster_id), UUID(server_id)
+            if confirm_server_id != str(working_server):
+                raise ValueError('Confirmation must match the working server UUID exactly')
+            if type(limit) is not int or not 0 <= limit < 2**63:
+                raise ValueError('Invalid working-server safe-call memory limit')
+            try:
+                async with service.factory() as client:
+                    return await client.update_server_safe_call_memory_limit(cluster, working_server, limit)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC server safe-call memory limit update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_server_critical_total_memory_update:
+        @server.tool(description='MUTATION: update working-server critical total memory; confirm exact server UUID. Full read-back required.')
+        async def rac_update_server_critical_total_memory(cluster_id: StrictStr, server_id: StrictStr,
+                                                          limit: StrictInt, confirm_server_id: StrictStr) -> dict:
+            cluster, working_server = UUID(cluster_id), UUID(server_id)
+            if confirm_server_id != str(working_server):
+                raise ValueError('Confirmation must match the working server UUID exactly')
+            if type(limit) is not int or not 0 <= limit < 2**63:
+                raise ValueError('Invalid working-server critical total memory')
+            try:
+                async with service.factory() as client:
+                    return await client.update_server_critical_total_memory(cluster, working_server, limit)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC server critical total memory update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_server_temporary_total_memory_update:
+        @server.tool(description='MUTATION: update working-server temporary allowed total memory; confirm exact server UUID. Full read-back required.')
+        async def rac_update_server_temporary_allowed_total_memory(cluster_id: StrictStr, server_id: StrictStr,
+                                                                   limit: StrictInt, confirm_server_id: StrictStr) -> dict:
+            cluster, working_server = UUID(cluster_id), UUID(server_id)
+            if confirm_server_id != str(working_server):
+                raise ValueError('Confirmation must match the working server UUID exactly')
+            if type(limit) is not int or not 0 <= limit < 2**63:
+                raise ValueError('Invalid working-server temporary allowed total memory')
+            try:
+                async with service.factory() as client:
+                    return await client.update_server_temporary_allowed_total_memory(cluster, working_server, limit)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC server temporary allowed total memory update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_server_temporary_memory_time_limit_update:
+        @server.tool(description='MUTATION: update working-server temporary allowed total memory time limit; confirm exact server UUID. Full read-back required.')
+        async def rac_update_server_temporary_allowed_total_memory_time_limit(cluster_id: StrictStr, server_id: StrictStr,
+                                                                              limit: StrictInt, confirm_server_id: StrictStr) -> dict:
+            cluster, working_server = UUID(cluster_id), UUID(server_id)
+            if confirm_server_id != str(working_server):
+                raise ValueError('Confirmation must match the working server UUID exactly')
+            if type(limit) is not int or not 0 <= limit < 2**63:
+                raise ValueError('Invalid working-server temporary memory time limit')
+            try:
+                async with service.factory() as client:
+                    return await client.update_server_temporary_allowed_total_memory_time_limit(cluster, working_server, limit)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC server temporary memory time limit update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_server_spn_update:
+        @server.tool(description='MUTATION: update or clear working-server service principal name; confirm exact server UUID. Full read-back required.')
+        async def rac_update_server_service_principal_name(cluster_id: StrictStr, server_id: StrictStr,
+                                                           name: StrictStr, confirm_server_id: StrictStr) -> dict:
+            cluster, working_server = UUID(cluster_id), UUID(server_id)
+            if confirm_server_id != str(working_server):
+                raise ValueError('Confirmation must match the working server UUID exactly')
+            if not isinstance(name, str) or '\x00' in name or len(name.encode('utf-8')) > 256:
+                raise ValueError('Invalid working-server service principal name')
+            try:
+                async with service.factory() as client:
+                    return await client.update_server_service_principal_name(cluster, working_server, name)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC server service principal name update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_server_dedicate_managers_update:
+        @server.tool(description='MUTATION: set working-server dedicated managers to all or none; confirm exact server UUID. Full read-back required.')
+        async def rac_update_server_dedicate_managers(cluster_id: StrictStr, server_id: StrictStr,
+                                                      choice: StrictStr, confirm_server_id: StrictStr) -> dict:
+            cluster, working_server = UUID(cluster_id), UUID(server_id)
+            if confirm_server_id != str(working_server):
+                raise ValueError('Confirmation must match the working server UUID exactly')
+            if type(choice) is not str or choice not in ('all', 'none'):
+                raise ValueError('Invalid working-server dedicated managers choice')
+            try:
+                async with service.factory() as client:
+                    return await client.update_server_dedicate_managers(cluster, working_server, choice)
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC server dedicated managers update failed (' + type(exc).__name__ + ')') from None
+
+    if allow_server_port_ranges_update:
+        @server.tool(description='MUTATION: update working-server port ranges; confirm exact server UUID. Full read-back required.')
+        async def rac_update_server_port_ranges(cluster_id: StrictStr, server_id: StrictStr,
+                                                ranges: list[list[StrictInt]],
+                                                confirm_server_id: StrictStr) -> dict:
+            cluster, working_server = UUID(cluster_id), UUID(server_id)
+            if confirm_server_id != str(working_server):
+                raise ValueError('Confirmation must match the working server UUID exactly')
+            if (type(ranges) is not list or not 1 <= len(ranges) <= 64 or
+                    any(type(pair) is not list or len(pair) != 2 or
+                        any(type(port) is not int or not 1 <= port <= 65535 for port in pair) or
+                        pair[0] > pair[1] for pair in ranges)):
+                raise ValueError('Invalid working-server port ranges')
+            ordered = sorted(ranges)
+            if any(left[1] >= right[0] for left, right in zip(ordered, ordered[1:])):
+                raise ValueError('Overlapping working-server port ranges')
+            try:
+                async with service.factory() as client:
+                    return await client.update_server_port_ranges(cluster, working_server,
+                                                                  [tuple(pair) for pair in ranges])
+            except (RacError, ValueError, OSError, TimeoutError, RuntimeError) as exc:
+                raise ValueError('RAC server port ranges update failed (' + type(exc).__name__ + ')') from None
+
+    return server
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser(description='RAC MCP server (read-only by default)')
+    parser.add_argument('--ras-host', default='127.0.0.1')
+    parser.add_argument('--ras-port', type=int, default=1545)
+    parser.add_argument('--ras-server', action='append', default=[], metavar='HOST:PORT/PROTOCOL',
+                        help='Additional read-only RAS for cross-server search (repeatable)')
+    parser.add_argument('--protocol', choices=['10.0', '16.0', 'auto'], default='16.0')
+    parser.add_argument('--agent-user', help='OS-authenticated agent administrator name')
+    parser.add_argument('--cluster-user', help='OS-authenticated cluster administrator name')
+    parser.add_argument('--allow-process-turn-off', action='store_true',
+                        help='Enable destructive process turn-off MCP tool (disabled by default)')
+    parser.add_argument('--allow-cluster-insert', action='store_true',
+                        help='Enable guarded cluster insertion MCP tool (disabled by default)')
+    parser.add_argument('--allow-cluster-remove', action='store_true',
+                        help='Enable destructive cluster removal MCP tool (disabled by default)')
+    parser.add_argument('--allow-agent-admin-register', action='store_true',
+                        help='Enable guarded password-free agent administrator registration (disabled by default)')
+    parser.add_argument('--allow-agent-admin-remove', action='store_true',
+                        help='Enable destructive agent administrator removal (disabled by default)')
+    parser.add_argument('--allow-cluster-admin-register', action='store_true',
+                        help='Enable guarded password-free cluster administrator registration (disabled by default)')
+    parser.add_argument('--allow-cluster-admin-remove', action='store_true',
+                        help='Enable destructive cluster administrator removal (disabled by default)')
+    parser.add_argument('--allow-rule-insert', action='store_true',
+                        help='Enable guarded assignment rule insertion (disabled by default)')
+    parser.add_argument('--allow-rule-apply', action='store_true',
+                        help='Enable guarded assignment rule apply (disabled by default)')
+    parser.add_argument('--allow-service-settings-apply', action='store_true',
+                        help='Enable guarded pending service settings apply (disabled by default)')
+    parser.add_argument('--allow-service-setting-remove', action='store_true',
+                        help='Enable destructive service setting removal (disabled by default)')
+    parser.add_argument('--allow-service-setting-update', action='store_true',
+                        help='Enable guarded service setting directory update (disabled by default)')
+    parser.add_argument('--allow-service-setting-insert', action='store_true',
+                        help='Enable guarded service setting insertion (disabled by default)')
+    parser.add_argument('--allow-profile-remove', action='store_true',
+                        help='Enable destructive security profile removal (disabled by default)')
+    parser.add_argument('--allow-profile-description-update', action='store_true',
+                        help='Enable guarded profile description update (disabled by default)')
+    parser.add_argument('--allow-profile-config-update', action='store_true',
+                        help='Enable guarded profile configuration access update (disabled by default)')
+    parser.add_argument('--allow-profile-access-flags-update', action='store_true',
+                        help='Enable guarded profile access flags update (disabled by default)')
+    parser.add_argument('--allow-profile-role-fields-update', action='store_true',
+                        help='Enable guarded profile role/module fields update (disabled by default)')
+    parser.add_argument('--allow-profile-directory-remove', action='store_true',
+                        help='Enable destructive profile directory ACL removal (disabled by default)')
+    parser.add_argument('--allow-profile-directory-update', action='store_true',
+                        help='Enable guarded profile directory ACL update (disabled by default)')
+    parser.add_argument('--allow-profile-com-remove', action='store_true',
+                        help='Enable destructive profile COM-class ACL removal (disabled by default)')
+    parser.add_argument('--allow-profile-com-update', action='store_true',
+                        help='Enable guarded profile COM-class ACL update (disabled by default)')
+    parser.add_argument('--allow-profile-addin-remove', action='store_true',
+                        help='Enable destructive profile add-in ACL removal (disabled by default)')
+    parser.add_argument('--allow-profile-addin-update', action='store_true',
+                        help='Enable guarded profile add-in ACL update (disabled by default)')
+    parser.add_argument('--allow-profile-module-remove', action='store_true',
+                        help='Enable destructive profile module ACL removal (disabled by default)')
+    parser.add_argument('--allow-profile-module-update', action='store_true',
+                        help='Enable guarded profile module ACL update (disabled by default)')
+    parser.add_argument('--allow-profile-app-remove', action='store_true',
+                        help='Enable destructive profile application ACL removal (disabled by default)')
+    parser.add_argument('--allow-profile-app-update', action='store_true',
+                        help='Enable guarded profile application ACL update (disabled by default)')
+    parser.add_argument('--allow-profile-inet-remove', action='store_true',
+                        help='Enable destructive profile inet ACL removal (disabled by default)')
+    parser.add_argument('--allow-profile-inet-update', action='store_true',
+                        help='Enable guarded profile inet ACL update (disabled by default)')
+    parser.add_argument('--allow-infobase-security-profile-update', action='store_true',
+                        help='Enable guarded infobase security profile update (disabled by default)')
+    parser.add_argument('--allow-infobase-safe-mode-security-profile-update', action='store_true',
+                        help='Enable guarded infobase safe-mode security profile update (disabled by default)')
+    parser.add_argument('--allow-infobase-maximum-scheduled-jobs-shift-update', action='store_true',
+                        help='Enable guarded infobase scheduled-jobs shift update (disabled by default)')
+    parser.add_argument('--allow-infobase-minimum-scheduled-jobs-period-update', action='store_true',
+                        help='Enable guarded infobase scheduled-jobs period update (disabled by default)')
+    parser.add_argument('--allow-infobase-configuration-unload-delay-update', action='store_true',
+                        help='Enable guarded infobase configuration unload delay update (disabled by default)')
+    parser.add_argument('--allow-infobase-local-speech-update', action='store_true',
+                        help='Enable guarded infobase local speech-to-text update (disabled by default)')
+    parser.add_argument('--allow-infobase-external-session-manager-update', action='store_true',
+                        help='Enable guarded infobase external session manager update (disabled by default)')
+    parser.add_argument('--allow-infobase-reserve-working-processes-update', action='store_true',
+                        help='Enable guarded infobase reserve working processes update (disabled by default)')
+    parser.add_argument('--allow-infobase-denied-message-update', action='store_true',
+                        help='Enable guarded infobase denied message update (disabled by default)')
+    parser.add_argument('--allow-infobase-license-distribution-update', action='store_true',
+                        help='Enable guarded infobase license distribution update (disabled by default)')
+    parser.add_argument('--allow-infobase-sessions-deny-update', action='store_true',
+                        help='Enable guarded infobase sessions deny update (disabled by default)')
+    parser.add_argument('--allow-infobase-scheduled-jobs-deny-update', action='store_true',
+                        help='Enable guarded infobase scheduled jobs deny update (disabled by default)')
+    parser.add_argument('--allow-infobase-description-update', action='store_true',
+                        help='Enable guarded infobase description update (disabled by default)')
+    parser.add_argument('--allow-infobase-summary-description-update', action='store_true',
+                        help='Enable guarded infobase summary description update (disabled by default)')
+    parser.add_argument('--allow-infobase-registration-drop', action='store_true',
+                        help='Enable destructive infobase registration removal without database deletion (disabled by default)')
+    parser.add_argument('--allow-infobase-existing-registration', action='store_true',
+                        help='Enable guarded registration of an existing PostgreSQL infobase (disabled by default)')
+    parser.add_argument('--allow-infobase-database-create', action='store_true',
+                        help='Enable database creation and infobase registration (disabled by default)')
+    parser.add_argument('--allow-rule-remove', action='store_true',
+                        help='Enable destructive assignment rule removal (disabled by default)')
+    parser.add_argument('--allow-rule-priority-update', action='store_true',
+                        help='Enable guarded assignment rule priority update (disabled by default)')
+    parser.add_argument('--allow-rule-fields-update', action='store_true',
+                        help='Enable guarded assignment rule fields update (disabled by default)')
+    parser.add_argument('--allow-rule-position-update', action='store_true',
+                        help='Enable guarded assignment rule reorder (disabled by default)')
+    parser.add_argument('--allow-limit-remove', action='store_true',
+                        help='Enable destructive named-limit removal (disabled by default)')
+    parser.add_argument('--allow-limit-update', action='store_true',
+                        help='Enable guarded named-limit update (disabled by default)')
+    parser.add_argument('--allow-counter-remove', action='store_true',
+                        help='Enable destructive named-counter removal (disabled by default)')
+    parser.add_argument('--allow-counter-description-update', action='store_true',
+                        help='Enable guarded named-counter description update (disabled by default)')
+    parser.add_argument('--allow-counter-collection-time-update', action='store_true',
+                        help='Enable guarded named-counter collection time update (disabled by default)')
+    parser.add_argument('--allow-counter-duration-update', action='store_true',
+                        help='Enable guarded named-counter duration analysis update (disabled by default)')
+    parser.add_argument('--allow-counter-group-update', action='store_true',
+                        help='Enable guarded named-counter group update (disabled by default)')
+    parser.add_argument('--allow-counter-filter-type-update', action='store_true',
+                        help='Enable guarded named-counter filter type update (disabled by default)')
+    parser.add_argument('--allow-counter-filter-update', action='store_true',
+                        help='Enable guarded named-counter object filter update (disabled by default)')
+    parser.add_argument('--allow-counter-analysis-flags-update', action='store_true',
+                        help='Enable guarded named-counter analysis flags update (disabled by default)')
+    parser.add_argument('--allow-counter-clear', action='store_true',
+                        help='Enable counter reading clear request (disabled by default; effect unverified)')
+    parser.add_argument('--allow-cluster-name-update', action='store_true',
+                        help='Enable verified cluster name update MCP tool (disabled by default)')
+    parser.add_argument('--allow-cluster-expiration-timeout-update', action='store_true',
+                        help='Enable guarded cluster expiration timeout update (disabled by default)')
+    parser.add_argument('--allow-cluster-security-level-update', action='store_true',
+                        help='Enable guarded cluster security level update (disabled by default)')
+    parser.add_argument('--allow-cluster-session-fault-tolerance-level-update', action='store_true',
+                        help='Enable guarded cluster session fault tolerance update (disabled by default)')
+    parser.add_argument('--allow-cluster-load-balancing-mode-update', action='store_true',
+                        help='Enable guarded cluster load balancing mode update (disabled by default)')
+    parser.add_argument('--allow-cluster-kill-problem-processes-update', action='store_true',
+                        help='Enable guarded cluster problem-process policy update (disabled by default)')
+    parser.add_argument('--allow-cluster-kill-by-memory-with-dump-update', action='store_true',
+                        help='Enable guarded cluster kill-by-memory dump update (disabled by default)')
+    parser.add_argument('--allow-cluster-audit-update', action='store_true',
+                        help='Enable guarded cluster access-right audit recording update (disabled by default)')
+    parser.add_argument('--allow-cluster-ping-update', action='store_true',
+                        help='Enable guarded cluster ping pair update (disabled by default)')
+    parser.add_argument('--allow-cluster-restart-schedule-update', action='store_true',
+                        help='Enable guarded cluster restart schedule update (disabled by default)')
+    parser.add_argument('--allow-server-restart-schedule-update', action='store_true',
+                        help='Enable guarded working-server restart schedule update (disabled by default)')
+    parser.add_argument('--allow-server-infobases-limit-update', action='store_true',
+                        help='Enable guarded working-server infobases limit update (disabled by default)')
+    parser.add_argument('--allow-server-connections-limit-update', action='store_true',
+                        help='Enable guarded working-server connections limit update (disabled by default)')
+    parser.add_argument('--allow-server-safe-call-memory-limit-update', action='store_true',
+                        help='Enable guarded working-server safe-call memory limit update (disabled by default)')
+    parser.add_argument('--allow-server-critical-total-memory-update', action='store_true',
+                        help='Enable guarded working-server critical total memory update (disabled by default)')
+    parser.add_argument('--allow-server-temporary-total-memory-update', action='store_true',
+                        help='Enable guarded working-server temporary allowed total memory update (disabled by default)')
+    parser.add_argument('--allow-server-temporary-memory-time-limit-update', action='store_true',
+                        help='Enable guarded working-server temporary memory time limit update (disabled by default)')
+    parser.add_argument('--allow-server-spn-update', action='store_true',
+                        help='Enable guarded working-server service principal name update (disabled by default)')
+    parser.add_argument('--allow-server-dedicate-managers-update', action='store_true',
+                        help='Enable guarded working-server dedicated managers update (disabled by default)')
+    parser.add_argument('--allow-server-port-ranges-update', action='store_true',
+                        help='Enable guarded working-server port ranges update (disabled by default)')
+    args = parser.parse_args(argv)
+    endpoints = startup_endpoints(args.ras_host, args.ras_port, args.protocol, args.ras_server)
+    if args.ras_server and (args.agent_user is not None or args.cluster_user is not None or
+                            any(value for name, value in vars(args).items() if name.startswith('allow_'))):
+        raise ValueError('Additional RAS endpoints require read-only unauthenticated mode')
+    if args.allow_agent_admin_register and args.protocol != '16.0':
+        raise ValueError('Agent admin register MCP tool requires protocol 16.0')
+    if args.allow_agent_admin_remove and args.protocol != '16.0':
+        raise ValueError('Agent admin remove MCP tool requires protocol 16.0')
+    if args.allow_agent_admin_remove and args.agent_user is None:
+        raise ValueError('Agent admin remove MCP tool requires an authenticated agent-user')
+    if args.allow_cluster_admin_register and args.protocol != '16.0':
+        raise ValueError('Cluster admin register MCP tool requires protocol 16.0')
+    if args.allow_cluster_admin_remove and args.protocol != '16.0':
+        raise ValueError('Cluster admin remove MCP tool requires protocol 16.0')
+    if args.allow_cluster_admin_remove and args.cluster_user is None:
+        raise ValueError('Cluster admin remove MCP tool requires an authenticated cluster-user')
+    if args.allow_rule_insert and args.protocol != '16.0':
+        raise ValueError('Rule insert MCP tool requires protocol 16.0')
+    if args.allow_rule_apply and args.protocol != '16.0':
+        raise ValueError('Rule apply MCP tool requires protocol 16.0')
+    if args.allow_rule_apply and args.cluster_user is not None:
+        raise ValueError('OS-authenticated rule apply MCP tool is not enabled')
+    if args.allow_service_settings_apply and args.protocol != '16.0':
+        raise ValueError('Service settings apply MCP tool requires protocol 16.0')
+    if args.allow_service_settings_apply and args.cluster_user is not None:
+        raise ValueError('OS-authenticated service settings apply MCP tool is not enabled')
+    if args.allow_service_setting_remove and args.protocol != '16.0':
+        raise ValueError('Service setting remove MCP tool requires protocol 16.0')
+    if args.allow_service_setting_remove and args.cluster_user is not None:
+        raise ValueError('OS-authenticated service setting remove MCP tool is not enabled')
+    if args.allow_service_setting_update and args.protocol != '16.0':
+        raise ValueError('Service setting update MCP tool requires protocol 16.0')
+    if args.allow_service_setting_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated service setting update MCP tool is not enabled')
+    if args.allow_service_setting_insert and args.protocol != '16.0':
+        raise ValueError('Service setting insert MCP tool requires protocol 16.0')
+    if args.allow_service_setting_insert and args.cluster_user is not None:
+        raise ValueError('OS-authenticated service setting insert MCP tool is not enabled')
+    if args.allow_profile_remove and args.protocol != '16.0':
+        raise ValueError('Profile remove MCP tool requires protocol 16.0')
+    if args.allow_profile_remove and args.cluster_user is not None:
+        raise ValueError('OS-authenticated profile remove MCP tool is not enabled')
+    if args.allow_profile_description_update and args.protocol != '16.0':
+        raise ValueError('Profile description update MCP tool requires protocol 16.0')
+    if args.allow_profile_description_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated profile description update MCP tool is not enabled')
+    if args.allow_profile_config_update and args.protocol != '16.0':
+        raise ValueError('Profile config update MCP tool requires protocol 16.0')
+    if args.allow_profile_config_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated profile config update MCP tool is not enabled')
+    if args.allow_profile_access_flags_update and args.protocol != '16.0':
+        raise ValueError('Profile access flags update MCP tool requires protocol 16.0')
+    if args.allow_profile_access_flags_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated profile access flags update MCP tool is not enabled')
+    if args.allow_profile_role_fields_update and args.protocol != '16.0':
+        raise ValueError('Profile role fields update MCP tool requires protocol 16.0')
+    if args.allow_profile_role_fields_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated profile role fields update MCP tool is not enabled')
+    if args.allow_profile_directory_remove and args.protocol != '16.0':
+        raise ValueError('Profile directory remove MCP tool requires protocol 16.0')
+    if args.allow_profile_directory_remove and args.cluster_user is not None:
+        raise ValueError('OS-authenticated profile directory remove MCP tool is not enabled')
+    if args.allow_profile_directory_update and args.protocol != '16.0':
+        raise ValueError('Profile directory update MCP tool requires protocol 16.0')
+    if args.allow_profile_directory_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated profile directory update MCP tool is not enabled')
+    if args.allow_profile_com_remove and args.protocol != '16.0':
+        raise ValueError('Profile COM remove MCP tool requires protocol 16.0')
+    if args.allow_profile_com_remove and args.cluster_user is not None:
+        raise ValueError('OS-authenticated profile COM remove MCP tool is not enabled')
+    if args.allow_profile_com_update and args.protocol != '16.0':
+        raise ValueError('Profile COM update MCP tool requires protocol 16.0')
+    if args.allow_profile_com_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated profile COM update MCP tool is not enabled')
+    if args.allow_profile_addin_remove and args.protocol != '16.0':
+        raise ValueError('Profile addin remove MCP tool requires protocol 16.0')
+    if args.allow_profile_addin_remove and args.cluster_user is not None:
+        raise ValueError('OS-authenticated profile addin remove MCP tool is not enabled')
+    if args.allow_profile_addin_update and args.protocol != '16.0':
+        raise ValueError('Profile addin update MCP tool requires protocol 16.0')
+    if args.allow_profile_addin_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated profile addin update MCP tool is not enabled')
+    if args.allow_profile_module_remove and args.protocol != '16.0':
+        raise ValueError('Profile module remove MCP tool requires protocol 16.0')
+    if args.allow_profile_module_remove and args.cluster_user is not None:
+        raise ValueError('OS-authenticated profile module remove MCP tool is not enabled')
+    if args.allow_profile_module_update and args.protocol != '16.0':
+        raise ValueError('Profile module update MCP tool requires protocol 16.0')
+    if args.allow_profile_module_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated profile module update MCP tool is not enabled')
+    if args.allow_profile_app_remove and args.protocol != '16.0':
+        raise ValueError('Profile app remove MCP tool requires protocol 16.0')
+    if args.allow_profile_app_remove and args.cluster_user is not None:
+        raise ValueError('OS-authenticated profile app remove MCP tool is not enabled')
+    if args.allow_profile_app_update and args.protocol != '16.0':
+        raise ValueError('Profile app update MCP tool requires protocol 16.0')
+    if args.allow_profile_app_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated profile app update MCP tool is not enabled')
+    if args.allow_profile_inet_remove and args.protocol != '16.0':
+        raise ValueError('Profile inet remove MCP tool requires protocol 16.0')
+    if args.allow_profile_inet_remove and args.cluster_user is not None:
+        raise ValueError('OS-authenticated profile inet remove MCP tool is not enabled')
+    if args.allow_profile_inet_update and args.protocol != '16.0':
+        raise ValueError('Profile inet update MCP tool requires protocol 16.0')
+    if args.allow_profile_inet_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated profile inet update MCP tool is not enabled')
+    if args.allow_infobase_security_profile_update and args.protocol != '16.0':
+        raise ValueError('Infobase security profile update MCP tool requires protocol 16.0')
+    if args.allow_infobase_security_profile_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated infobase security profile update MCP tool is not enabled')
+    if args.allow_infobase_safe_mode_security_profile_update and args.protocol != '16.0':
+        raise ValueError('Infobase safe mode security profile update MCP tool requires protocol 16.0')
+    if args.allow_infobase_safe_mode_security_profile_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated infobase safe mode security profile update MCP tool is not enabled')
+    if args.allow_infobase_maximum_scheduled_jobs_shift_update and args.protocol != '16.0':
+        raise ValueError('Infobase maximum scheduled jobs shift update MCP tool requires protocol 16.0')
+    if args.allow_infobase_maximum_scheduled_jobs_shift_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated infobase maximum scheduled jobs shift update MCP tool is not enabled')
+    if args.allow_infobase_minimum_scheduled_jobs_period_update and args.protocol != '16.0':
+        raise ValueError('Infobase minimum scheduled jobs period update MCP tool requires protocol 16.0')
+    if args.allow_infobase_minimum_scheduled_jobs_period_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated infobase minimum scheduled jobs period update MCP tool is not enabled')
+    if args.allow_infobase_configuration_unload_delay_update and args.protocol != '16.0':
+        raise ValueError('Infobase configuration unload delay update MCP tool requires protocol 16.0')
+    if args.allow_infobase_configuration_unload_delay_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated infobase configuration unload delay update MCP tool is not enabled')
+    if args.allow_infobase_local_speech_update and args.protocol != '16.0':
+        raise ValueError('Infobase local speech-to-text update MCP tool requires protocol 16.0')
+    if args.allow_infobase_local_speech_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated infobase local speech-to-text update MCP tool is not enabled')
+    if args.allow_infobase_external_session_manager_update and args.protocol != '16.0':
+        raise ValueError('Infobase external session manager update MCP tool requires protocol 16.0')
+    if args.allow_infobase_external_session_manager_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated infobase external session manager update MCP tool is not enabled')
+    if args.allow_infobase_reserve_working_processes_update and args.protocol != '16.0':
+        raise ValueError('Infobase reserve working processes update MCP tool requires protocol 16.0')
+    if args.allow_infobase_reserve_working_processes_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated infobase reserve working processes update MCP tool is not enabled')
+    if args.allow_infobase_denied_message_update and args.protocol != '16.0':
+        raise ValueError('Infobase denied message update MCP tool requires protocol 16.0')
+    if args.allow_infobase_denied_message_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated infobase denied message update MCP tool is not enabled')
+    if args.allow_infobase_license_distribution_update and args.protocol != '16.0':
+        raise ValueError('Infobase license distribution update MCP tool requires protocol 16.0')
+    if args.allow_infobase_license_distribution_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated infobase license distribution update MCP tool is not enabled')
+    if args.allow_infobase_sessions_deny_update and args.protocol != '16.0':
+        raise ValueError('Infobase sessions deny update MCP tool requires protocol 16.0')
+    if args.allow_infobase_sessions_deny_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated infobase sessions deny update MCP tool is not enabled')
+    if args.allow_infobase_scheduled_jobs_deny_update and args.protocol != '16.0':
+        raise ValueError('Infobase scheduled jobs deny update MCP tool requires protocol 16.0')
+    if args.allow_infobase_scheduled_jobs_deny_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated infobase scheduled jobs deny update MCP tool is not enabled')
+    if args.allow_infobase_description_update and args.protocol != '16.0':
+        raise ValueError('Infobase description update MCP tool requires protocol 16.0')
+    if args.allow_infobase_description_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated infobase description update MCP tool is not enabled')
+    if args.allow_infobase_summary_description_update and args.protocol != '16.0':
+        raise ValueError('Infobase summary description update MCP tool requires protocol 16.0')
+    if args.allow_infobase_summary_description_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated infobase summary description update MCP tool is not enabled')
+    if args.allow_infobase_registration_drop and args.protocol != '16.0':
+        raise ValueError('Infobase registration drop MCP tool requires protocol 16.0')
+    if args.allow_infobase_registration_drop and args.cluster_user is not None:
+        raise ValueError('OS-authenticated infobase registration drop MCP tool is not enabled')
+    if args.allow_infobase_existing_registration and args.protocol != '16.0':
+        raise ValueError('Existing infobase registration MCP tool requires protocol 16.0')
+    if args.allow_infobase_existing_registration and args.cluster_user is not None:
+        raise ValueError('OS-authenticated existing infobase registration MCP tool is not enabled')
+    if args.allow_infobase_database_create and args.protocol != '16.0':
+        raise ValueError('Infobase database creation MCP tool requires protocol 16.0')
+    if args.allow_infobase_database_create and args.cluster_user is not None:
+        raise ValueError('OS-authenticated infobase database creation MCP tool is not enabled')
+    if args.allow_rule_remove and args.protocol != '16.0':
+        raise ValueError('Rule remove MCP tool requires protocol 16.0')
+    if args.allow_rule_priority_update and args.protocol != '16.0':
+        raise ValueError('Rule priority update MCP tool requires protocol 16.0')
+    if args.allow_rule_fields_update and args.protocol != '16.0':
+        raise ValueError('Rule fields update MCP tool requires protocol 16.0')
+    if args.allow_rule_fields_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated rule fields update MCP tool is not enabled')
+    if args.allow_rule_position_update and args.protocol != '16.0':
+        raise ValueError('Rule position update MCP tool requires protocol 16.0')
+    if args.allow_rule_position_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated rule position update MCP tool is not enabled')
+    if args.allow_limit_remove and args.protocol != '16.0':
+        raise ValueError('Limit remove MCP tool requires protocol 16.0')
+    if args.allow_limit_update and args.protocol != '16.0':
+        raise ValueError('Limit update MCP tool requires protocol 16.0')
+    if args.allow_limit_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated limit update MCP tool is not enabled')
+    if args.allow_counter_remove and args.protocol != '16.0':
+        raise ValueError('Counter remove MCP tool requires protocol 16.0')
+    if args.allow_counter_remove and args.cluster_user is not None:
+        raise ValueError('OS-authenticated counter remove MCP tool is not enabled')
+    if args.allow_counter_description_update and args.protocol != '16.0':
+        raise ValueError('Counter description update MCP tool requires protocol 16.0')
+    if args.allow_counter_description_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated counter description update MCP tool is not enabled')
+    if args.allow_counter_collection_time_update and args.protocol != '16.0':
+        raise ValueError('Counter collection time update MCP tool requires protocol 16.0')
+    if args.allow_counter_collection_time_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated counter collection time update MCP tool is not enabled')
+    if args.allow_counter_duration_update and args.protocol != '16.0':
+        raise ValueError('Counter duration update MCP tool requires protocol 16.0')
+    if args.allow_counter_duration_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated counter duration update MCP tool is not enabled')
+    if args.allow_counter_group_update and args.protocol != '16.0':
+        raise ValueError('Counter group update MCP tool requires protocol 16.0')
+    if args.allow_counter_group_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated counter group update MCP tool is not enabled')
+    if args.allow_counter_filter_type_update and args.protocol != '16.0':
+        raise ValueError('Counter filter type update MCP tool requires protocol 16.0')
+    if args.allow_counter_filter_type_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated counter filter type update MCP tool is not enabled')
+    if args.allow_counter_filter_update and args.protocol != '16.0':
+        raise ValueError('Counter filter update MCP tool requires protocol 16.0')
+    if args.allow_counter_filter_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated counter filter update MCP tool is not enabled')
+    if args.allow_counter_analysis_flags_update and args.protocol != '16.0':
+        raise ValueError('Counter analysis flags update MCP tool requires protocol 16.0')
+    if args.allow_counter_analysis_flags_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated counter analysis flags update MCP tool is not enabled')
+    if args.allow_counter_clear and args.protocol != '16.0':
+        raise ValueError('Counter clear MCP tool requires protocol 16.0')
+    if args.allow_counter_clear and args.cluster_user is not None:
+        raise ValueError('OS-authenticated counter clear MCP tool is not enabled')
+    if args.allow_process_turn_off and args.protocol != '16.0':
+        raise ValueError('Process turn-off MCP tool requires protocol 16.0')
+    if args.allow_process_turn_off and args.cluster_user is not None:
+        raise ValueError('OS-authenticated process turn-off is not verified')
+    if args.allow_cluster_insert and args.protocol != '16.0':
+        raise ValueError('Cluster insert MCP tool requires protocol 16.0')
+    if args.allow_cluster_insert and args.agent_user is not None:
+        raise ValueError('OS-authenticated cluster insert MCP tool is not enabled')
+    if args.allow_cluster_remove and args.protocol != '16.0':
+        raise ValueError('Cluster remove MCP tool requires protocol 16.0')
+    if args.allow_cluster_remove and args.cluster_user is not None:
+        raise ValueError('OS-authenticated cluster remove MCP tool is not enabled')
+    if args.allow_cluster_name_update and args.protocol != '16.0':
+        raise ValueError('Cluster name update MCP tool requires protocol 16.0')
+    if args.allow_cluster_name_update and args.agent_user is not None:
+        raise ValueError('OS-authenticated cluster name update MCP tool is not enabled')
+    if args.allow_cluster_expiration_timeout_update and args.protocol != '16.0':
+        raise ValueError('Cluster timeout update MCP tool requires protocol 16.0')
+    if args.allow_cluster_expiration_timeout_update and args.agent_user is not None:
+        raise ValueError('OS-authenticated cluster timeout update MCP tool is not enabled')
+    if args.allow_cluster_security_level_update and args.protocol != '16.0':
+        raise ValueError('Cluster security level update MCP tool requires protocol 16.0')
+    if args.allow_cluster_security_level_update and args.agent_user is not None:
+        raise ValueError('OS-authenticated cluster security level update MCP tool is not enabled')
+    if args.allow_cluster_session_fault_tolerance_level_update and args.protocol != '16.0':
+        raise ValueError('Cluster session fault tolerance update MCP tool requires protocol 16.0')
+    if args.allow_cluster_session_fault_tolerance_level_update and args.agent_user is not None:
+        raise ValueError('OS-authenticated cluster session fault tolerance update MCP tool is not enabled')
+    if args.allow_cluster_load_balancing_mode_update and args.protocol != '16.0':
+        raise ValueError('Cluster load balancing update MCP tool requires protocol 16.0')
+    if args.allow_cluster_load_balancing_mode_update and args.agent_user is not None:
+        raise ValueError('OS-authenticated cluster load balancing update MCP tool is not enabled')
+    if args.allow_cluster_kill_problem_processes_update and args.protocol != '16.0':
+        raise ValueError('Cluster problem-process policy update MCP tool requires protocol 16.0')
+    if args.allow_cluster_kill_problem_processes_update and args.agent_user is not None:
+        raise ValueError('OS-authenticated cluster problem-process policy update MCP tool is not enabled')
+    if args.allow_cluster_kill_by_memory_with_dump_update and args.protocol != '16.0':
+        raise ValueError('Cluster kill-by-memory dump update MCP tool requires protocol 16.0')
+    if args.allow_cluster_kill_by_memory_with_dump_update and args.agent_user is not None:
+        raise ValueError('OS-authenticated cluster kill-by-memory dump update MCP tool is not enabled')
+    if args.allow_cluster_audit_update and args.protocol != '16.0':
+        raise ValueError('Cluster audit update MCP tool requires protocol 16.0')
+    if args.allow_cluster_audit_update and args.agent_user is not None:
+        raise ValueError('OS-authenticated cluster audit update MCP tool is not enabled')
+    if args.allow_cluster_ping_update and args.protocol != '16.0':
+        raise ValueError('Cluster ping update MCP tool requires protocol 16.0')
+    if args.allow_cluster_ping_update and args.agent_user is not None:
+        raise ValueError('OS-authenticated cluster ping update MCP tool is not enabled')
+    if args.allow_cluster_restart_schedule_update and args.protocol != '16.0':
+        raise ValueError('Cluster restart schedule update MCP tool requires protocol 16.0')
+    if args.allow_cluster_restart_schedule_update and args.agent_user is not None:
+        raise ValueError('OS-authenticated cluster restart schedule update MCP tool is not enabled')
+    if args.allow_server_restart_schedule_update and args.protocol != '16.0':
+        raise ValueError('Server restart schedule update MCP tool requires protocol 16.0')
+    if args.allow_server_restart_schedule_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated server restart schedule update MCP tool is not enabled')
+    if args.allow_server_infobases_limit_update and args.protocol != '16.0':
+        raise ValueError('Server infobases limit update MCP tool requires protocol 16.0')
+    if args.allow_server_infobases_limit_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated server infobases limit update MCP tool is not enabled')
+    if args.allow_server_connections_limit_update and args.protocol != '16.0':
+        raise ValueError('Server connections limit update MCP tool requires protocol 16.0')
+    if args.allow_server_connections_limit_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated server connections limit update MCP tool is not enabled')
+    if args.allow_server_safe_call_memory_limit_update and args.protocol != '16.0':
+        raise ValueError('Server safe-call memory limit update MCP tool requires protocol 16.0')
+    if args.allow_server_safe_call_memory_limit_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated server safe-call memory limit update MCP tool is not enabled')
+    if args.allow_server_critical_total_memory_update and args.protocol != '16.0':
+        raise ValueError('Server critical total memory update MCP tool requires protocol 16.0')
+    if args.allow_server_critical_total_memory_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated server critical total memory update MCP tool is not enabled')
+    if args.allow_server_temporary_total_memory_update and args.protocol != '16.0':
+        raise ValueError('Server temporary allowed total memory update MCP tool requires protocol 16.0')
+    if args.allow_server_temporary_total_memory_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated server temporary allowed total memory update MCP tool is not enabled')
+    if args.allow_server_temporary_memory_time_limit_update and args.protocol != '16.0':
+        raise ValueError('Server temporary memory time limit update MCP tool requires protocol 16.0')
+    if args.allow_server_temporary_memory_time_limit_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated server temporary memory time limit update MCP tool is not enabled')
+    if args.allow_server_spn_update and args.protocol != '16.0':
+        raise ValueError('Server SPN update MCP tool requires protocol 16.0')
+    if args.allow_server_spn_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated server SPN update MCP tool is not enabled')
+    if args.allow_server_dedicate_managers_update and args.protocol != '16.0':
+        raise ValueError('Server dedicated managers update MCP tool requires protocol 16.0')
+    if args.allow_server_dedicate_managers_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated server dedicated managers update MCP tool is not enabled')
+    if args.allow_server_port_ranges_update and args.protocol != '16.0':
+        raise ValueError('Server port ranges update MCP tool requires protocol 16.0')
+    if args.allow_server_port_ranges_update and args.cluster_user is not None:
+        raise ValueError('OS-authenticated server port ranges update MCP tool is not enabled')
+    for name in (args.agent_user, args.cluster_user):
+        if name is not None and (not name or '\x00' in name or len(name.encode('utf-8')) > 1024):
+            raise ValueError('Invalid administrator name')
+    factory = partial(RacClient, args.ras_host, args.ras_port, args.protocol,
+                      agent_user=args.agent_user, cluster_user=args.cluster_user)
+    service = ReadService(factory)
+    options = {}
+    if args.ras_server:
+        options['workspace_endpoints'] = endpoints
+    if args.allow_agent_admin_register:
+        options['allow_agent_admin_register'] = True
+    if args.allow_agent_admin_remove:
+        options['allow_agent_admin_remove'] = True
+    if args.allow_cluster_admin_register:
+        options['allow_cluster_admin_register'] = True
+    if args.allow_cluster_admin_remove:
+        options['allow_cluster_admin_remove'] = True
+    if args.allow_rule_insert:
+        options['allow_rule_insert'] = True
+    if args.allow_rule_apply:
+        options['allow_rule_apply'] = True
+    if args.allow_service_settings_apply:
+        options['allow_service_settings_apply'] = True
+    if args.allow_service_setting_remove:
+        options['allow_service_setting_remove'] = True
+    if args.allow_service_setting_update:
+        options['allow_service_setting_update'] = True
+    if args.allow_service_setting_insert:
+        options['allow_service_setting_insert'] = True
+    if args.allow_profile_remove:
+        options['allow_profile_remove'] = True
+    if args.allow_profile_description_update:
+        options['allow_profile_description_update'] = True
+    if args.allow_profile_config_update:
+        options['allow_profile_config_update'] = True
+    if args.allow_profile_access_flags_update:
+        options['allow_profile_access_flags_update'] = True
+    if args.allow_profile_role_fields_update:
+        options['allow_profile_role_fields_update'] = True
+    if args.allow_profile_directory_remove:
+        options['allow_profile_directory_remove'] = True
+    if args.allow_profile_directory_update:
+        options['allow_profile_directory_update'] = True
+    if args.allow_profile_com_remove:
+        options['allow_profile_com_remove'] = True
+    if args.allow_profile_com_update:
+        options['allow_profile_com_update'] = True
+    if args.allow_profile_addin_remove:
+        options['allow_profile_addin_remove'] = True
+    if args.allow_profile_addin_update:
+        options['allow_profile_addin_update'] = True
+    if args.allow_profile_module_remove:
+        options['allow_profile_module_remove'] = True
+    if args.allow_profile_module_update:
+        options['allow_profile_module_update'] = True
+    if args.allow_profile_app_remove:
+        options['allow_profile_app_remove'] = True
+    if args.allow_profile_app_update:
+        options['allow_profile_app_update'] = True
+    if args.allow_profile_inet_remove:
+        options['allow_profile_inet_remove'] = True
+    if args.allow_profile_inet_update:
+        options['allow_profile_inet_update'] = True
+    if args.allow_infobase_security_profile_update:
+        options['allow_infobase_security_profile_update'] = True
+    if args.allow_infobase_safe_mode_security_profile_update:
+        options['allow_infobase_safe_mode_security_profile_update'] = True
+    if args.allow_infobase_maximum_scheduled_jobs_shift_update:
+        options['allow_infobase_maximum_scheduled_jobs_shift_update'] = True
+    if args.allow_infobase_minimum_scheduled_jobs_period_update:
+        options['allow_infobase_minimum_scheduled_jobs_period_update'] = True
+    if args.allow_infobase_configuration_unload_delay_update:
+        options['allow_infobase_configuration_unload_delay_update'] = True
+    if args.allow_infobase_local_speech_update:
+        options['allow_infobase_local_speech_update'] = True
+    if args.allow_infobase_external_session_manager_update:
+        options['allow_infobase_external_session_manager_update'] = True
+    if args.allow_infobase_reserve_working_processes_update:
+        options['allow_infobase_reserve_working_processes_update'] = True
+    if args.allow_infobase_denied_message_update:
+        options['allow_infobase_denied_message_update'] = True
+    if args.allow_infobase_license_distribution_update:
+        options['allow_infobase_license_distribution_update'] = True
+    if args.allow_infobase_sessions_deny_update:
+        options['allow_infobase_sessions_deny_update'] = True
+    if args.allow_infobase_scheduled_jobs_deny_update:
+        options['allow_infobase_scheduled_jobs_deny_update'] = True
+    if args.allow_infobase_description_update:
+        options['allow_infobase_description_update'] = True
+    if args.allow_infobase_summary_description_update:
+        options['allow_infobase_summary_description_update'] = True
+    if args.allow_infobase_registration_drop:
+        options['allow_infobase_registration_drop'] = True
+    if args.allow_infobase_existing_registration:
+        options['allow_infobase_existing_registration'] = True
+    if args.allow_infobase_database_create:
+        options['allow_infobase_database_create'] = True
+    if args.allow_rule_remove:
+        options['allow_rule_remove'] = True
+    if args.allow_rule_priority_update:
+        options['allow_rule_priority_update'] = True
+    if args.allow_rule_fields_update:
+        options['allow_rule_fields_update'] = True
+    if args.allow_rule_position_update:
+        options['allow_rule_position_update'] = True
+    if args.allow_limit_remove:
+        options['allow_limit_remove'] = True
+    if args.allow_limit_update:
+        options['allow_limit_update'] = True
+    if args.allow_counter_remove:
+        options['allow_counter_remove'] = True
+    if args.allow_counter_description_update:
+        options['allow_counter_description_update'] = True
+    if args.allow_counter_collection_time_update:
+        options['allow_counter_collection_time_update'] = True
+    if args.allow_counter_duration_update:
+        options['allow_counter_duration_update'] = True
+    if args.allow_counter_group_update:
+        options['allow_counter_group_update'] = True
+    if args.allow_counter_filter_type_update:
+        options['allow_counter_filter_type_update'] = True
+    if args.allow_counter_filter_update:
+        options['allow_counter_filter_update'] = True
+    if args.allow_counter_analysis_flags_update:
+        options['allow_counter_analysis_flags_update'] = True
+    if args.allow_counter_clear:
+        options['allow_counter_clear'] = True
+    if args.allow_process_turn_off:
+        options['allow_process_turn_off'] = True
+    if args.allow_cluster_insert:
+        options['allow_cluster_insert'] = True
+    if args.allow_cluster_remove:
+        options['allow_cluster_remove'] = True
+    if args.allow_cluster_name_update:
+        options['allow_cluster_name_update'] = True
+    if args.allow_cluster_expiration_timeout_update:
+        options['allow_cluster_expiration_timeout_update'] = True
+    if args.allow_cluster_security_level_update:
+        options['allow_cluster_security_level_update'] = True
+    if args.allow_cluster_session_fault_tolerance_level_update:
+        options['allow_cluster_session_fault_tolerance_level_update'] = True
+    if args.allow_cluster_load_balancing_mode_update:
+        options['allow_cluster_load_balancing_mode_update'] = True
+    if args.allow_cluster_kill_problem_processes_update:
+        options['allow_cluster_kill_problem_processes_update'] = True
+    if args.allow_cluster_kill_by_memory_with_dump_update:
+        options['allow_cluster_kill_by_memory_with_dump_update'] = True
+    if args.allow_cluster_audit_update:
+        options['allow_cluster_audit_update'] = True
+    if args.allow_cluster_ping_update:
+        options['allow_cluster_ping_update'] = True
+    if args.allow_cluster_restart_schedule_update:
+        options['allow_cluster_restart_schedule_update'] = True
+    if args.allow_server_restart_schedule_update:
+        options['allow_server_restart_schedule_update'] = True
+    if args.allow_server_infobases_limit_update:
+        options['allow_server_infobases_limit_update'] = True
+    if args.allow_server_connections_limit_update:
+        options['allow_server_connections_limit_update'] = True
+    if args.allow_server_safe_call_memory_limit_update:
+        options['allow_server_safe_call_memory_limit_update'] = True
+    if args.allow_server_critical_total_memory_update:
+        options['allow_server_critical_total_memory_update'] = True
+    if args.allow_server_temporary_total_memory_update:
+        options['allow_server_temporary_total_memory_update'] = True
+    if args.allow_server_temporary_memory_time_limit_update:
+        options['allow_server_temporary_memory_time_limit_update'] = True
+    if args.allow_server_spn_update:
+        options['allow_server_spn_update'] = True
+    if args.allow_server_dedicate_managers_update:
+        options['allow_server_dedicate_managers_update'] = True
+    if args.allow_server_port_ranges_update:
+        options['allow_server_port_ranges_update'] = True
+    server = create_server(service, **options)
+    asyncio.run(server.run_stdio_async())
+
+
+if __name__ == '__main__':
+    main()