Available MCP tools

Your client sees only the tools allowed by its OAuth grant or MCP key. Tool-mode keys see their explicit allowlist; scope-mode keys and OAuth grants are checked again when a tool runs.

Read Only (quave:read)

list-accounts
Lists all accounts that the authenticated user has access to
Example: "Show me all my accounts"

get-current-account
Gets the current account set for the authenticated user
Example: "Which account am I using?"

list-account-events
Lists Quave ONE platform audit/access events for an account. This is platform activity, not application HTTP or ingress access logs.
Example: "Show account audit events for the last week"

list-apps
Lists all apps for the authenticated user
Example: "List all my apps"

list-app-envs
Lists all app environments for the authenticated user
Example: "Show me all environments for my web app"

get-app-env
Gets the full configuration for an app environment including resources, scaling, deployment settings, security, hosts, and pending changes
May also require additional scopes: Read Secrets
Example: "Show me the full configuration for production"

get-app-env-status
Gets the current runtime status and health for an app environment
Example: "Is production running?"

get-app-env-metrics
Gets real-time resource metrics (CPU, memory, container count)
Example: "What's the CPU usage of staging?"

get-app-env-history
Gets the deployment history and activity timeline
Example: "Show me the last 10 deployments"

get-app-env-pods
Gets pod-level details for an app environment
Example: "How many pods are running?"

get-app-env-metrics-series
Gets historical time-series metrics (CPU, memory) over a time range from Prometheus. Supports time navigation with from/to parameters and configurable resolution.
Example: "Show me CPU usage for production over the last 24 hours"

get-app-env-metrics-baseline-summary
Compares a recent window against a longer baseline window for one or more metrics and returns per-metric stats (mean, p50/p95/p99, max, stddev) plus deviation (absolute, percent, z-score) in a single call. Built for anomaly detection — use instead of pulling raw series and computing by hand.
Example: "Is production CPU or memory anomalous vs its 7-day baseline?"

get-app-env-log-error-summary
Aggregates error log lines into stable signatures with counts, first/last seen, and a delta vs a prior baseline window — surfacing NEW error patterns that were not present before. Use instead of scrolling raw logs to detect new/regressed errors.
Example: "Are there new error patterns on prod compared to last week?"

list-app-env-variables
Lists environment variables for an app environment. Set showSecrets=true to view secret values (requires quave:read:secrets scope and admin permission).
May also require additional scopes: Read Secrets
Example: "List all environment variables for staging"

list-branch-previews
Lists temporary branch preview environments for an app.
Example: "List branch previews for my app"

check-app-env-cname
Checks if CNAME records are properly configured for region change. All custom hosts must have CNAME records pointing to the ingress URL before changing regions. Not supported for database environments. Use the database-specific tools for supported operations.
Example: "Check if production CNAME records are valid for region change"

list-app-env-job-runs
Lists recent JobRun history for a Job app environment
Example: "Show the latest job runs for staging"

get-app-env-job-run
Gets one JobRun by ID within an app environment
Example: "Check this job run status"

get-app-env-job-run-logs
Retrieves logs for one JobRun with filtering and pagination
Example: "Show me the logs for this job run"

get-logs
Retrieves logs from an app environment with filtering and search
Example: "Show me error logs from production in the last hour"

list-app-env-backups
Lists database backup files for an app environment. Returns backup metadata only; no secrets are decrypted.
Example: "List database backups for production"

list-app-env-volume-backups
Lists customer-safe volume backup recovery points for an app environment. Returns timestamps, snapshot types and sizes, but never storage credentials, object keys or PVC names.
Example: "List volume backup recovery points for production"

get-app-env-backup-overview
Gets a customer-language backup protection summary, retention policy, storage mode and latest validation without exposing schedules, paths or credentials.
Example: "Is my production environment protected by backups?"

list-app-env-backup-validations
Lists customer-safe backup validation history for an app environment.
Example: "Show the latest backup validation results for production"

preview-app-env-backup-cleanup
Shows the customer-safe retention cleanup outcome without changing backup storage. The newest recovery point is always protected.
Example: "Preview expired backup data that could be cleaned up"

get-account-backup-overview
Lists customer-safe backup protection, retention, storage mode and aggregate backup usage for every environment in one account.
Example: "Show backup protection and usage across this account"

preview-account-backup-cleanup
Previews expired backup data eligible for cleanup across one account. Requires account admin permission; no data is deleted.
Example: "Preview expired backups that can be cleaned up across this account"

get-app-env-backup-storage-usage
Gets aggregate database and volume backup storage usage, retention limits and storage mode without exposing bucket names, paths, keys or credentials.
Example: "How much storage do backups use for this environment?"

list-nodes
Lists infrastructure nodes. Internal Operator users can inspect every configured region; customers only see private regions enabled for their BYOP/Connect account. Returns node name, region, IPs, capacity, and allocatable resources.
Example: "Show me all nodes in my private region"

get-node-metrics-series
Retrieves time-series infrastructure metrics for a specific node from Prometheus. Internal Operator users can query any configured region; customers can query nodes in private regions enabled for their BYOP/Connect account. Supports CPU, memory, disk, network, filesystem, and load metrics.
Example: "Show me CPU usage for node-1 over the last 24 hours"

get-account-ingress-metrics-series
Retrieves account-wide nginx ingress time-series metrics from Prometheus, aggregated across every app environment of the account in the chosen region. Supports request rate, success/error rates, status code breakdown, request/response sizes, and P50/P90/P99 latency.
Example: "Show me total ingress request rate for my account in eu-3 over the last hour"

get-app-env-ingress-metrics-series
Retrieves nginx ingress time-series metrics from Prometheus for a single app environment (filtered to its k8s service). Supports request rate, success/error rates, status code breakdown, request/response sizes, and P50/P90/P99 latency.
Example: "What's production's P95 latency over the last 6 hours?"

get-account-ingress-access-log-summary
Returns aggregated nginx ingress access log buckets for an entire account (namespace), grouped by service/host/path/method/status with count and average/min/max response time. Sourced from the ingress-* Elasticsearch index. For raw individual access log hits use get-logs with type=ACCESS_LOG.
Example: "What are the top 50 hosts and paths receiving 5xx responses across my account in eu-3 over the last day?"

get-account-observability-summary
Rollup across every app environment in an account: each env's status plus recent-vs-baseline metric deltas (z-score) in a single call. Use this first for a fast account-wide anomaly sweep, then drill into a specific env with get-app-env-metrics-baseline-summary or get-app-env-log-error-summary. Env count is capped; deep dives should use the per-env tools.
Example: "Sweep my whole account for environments behaving abnormally."

get-app-env-ingress-access-log-summary
Returns aggregated HTTP request buckets for a single app environment, grouped by host/path/method/status with count and average/min/max response time. Use this for the same aggregated request data shown in the Requests tab for a Function environment; group Functions by path, method, and status to match that view. Regular apps are sourced from nginx ingress access logs; Functions are sourced from Knative request logs enriched with AppEnvId.
Example: "Show me the Function Requests summary for production over the last hour, grouped by path, method, and status"

list-regions
Lists all available deployment regions with their availability status. Shows which regions are enabled for the account and available for the user based on account tier (Hobby accounts are limited to the Hobby region; Professional accounts unlock all regions). Call this before create-app-env or update-app-env-region to know which regions are available.
Example: "Which regions can I deploy to?"

list-database-presets
Lists regular-user database presets that can be created automatically via the public API (MongoDB, PostgreSQL, MySQL, Redis, CouchDB, RabbitMQ, ClickHouse). Returns each preset with its name, label, protocol (e.g. mongodb://), isPersistenceOptional flag, available versions (with the default), and per-preset limits (min/max disk MB and max replicas). Call this before create-app or create-app-env on a database to pick the right `dockerPreset`, `dockerPresetVersion`, and to know whether `withPersistence` applies. For database create-app calls, include the standard engine port even though the managed database is provisioned later by create-app-env: MongoDB 27017, PostgreSQL 5432, MySQL 3306, Redis 6379, CouchDB 5984, RabbitMQ 5672, ClickHouse 8123. create-app-env does not take a port. Internal-Operator-only/manual database engines (Elasticsearch, Opensearch, Kafka, etc.) are not returned.
Example: "Which databases can I create?"

list-app-presets
Lists non-database Docker presets that the public API can create (Next.js, Remix, Vite, Vue.js, Express, Node.js variants, Angular, Meteor.js, Custom, Function). Returns each preset with its name, label, hasVersions flag, available versions (with the default), and capability flags (isCustom requires a Dockerfile, isFunction is the serverless preset). Call this before create-app to pick a sensible `dockerPreset` / `dockerPresetVersion`. For database presets use list-database-presets instead.
Example: "Which app frameworks can I deploy?"

list-solutions
Lists curated Quave ONE solutions available to create. The response contains only safe catalog metadata and never private deployment values.
Example: "Which solutions can I create?"

list-members
Lists account members and pending invitations with roles, MFA coverage, and environment-access summary for access review evidence.
Example: "List members and MFA coverage for this account"

get-member-env-access
Gets the environment access configuration for a specific member. Shows which environments the member can access, or if they have full access.
Example: "Show me which environments this member can access"

list-credentials
Lists all account-level credentials (container registries including AWS ECR, basic auth, TLS certificates, ACME wildcards). Returns credential metadata and sync/refresh status without sensitive values.
Example: "Show me all credentials for this account"

get-credential
Gets details of a specific account-level credential including its type, name, sync status, and non-sensitive metadata. Sensitive fields (passwords, private keys, provider configs) are never returned through the API.
Example: "Show me the details of my Docker registry credential"

list-credential-references
Lists all apps, environments, and hosts that reference a specific credential. Useful before deleting a credential to see what would break.
Example: "Show me what uses my Docker registry credential"

list-agent-automation-options
Lists safe metadata needed to create or edit agent automations: enabled MCP keys, accessible LLM provider keys, contact points, delivery modes, statuses, and common schedules. Does not return secrets.
Example: "Show me the options for creating an automation"

list-agent-automations
Lists agent automations owned by the authenticated user for an account, including schedule, enabled state, next run, and last run summary.
Example: "List my automations for this account"

get-agent-automation
Gets the full editable configuration for one agent automation owned by the authenticated user.
Example: "Show me this automation configuration"

list-agent-automation-runs
Lists automation run history with status, timing, usage, and telemetry summary.
Example: "Show me the last automation runs"

get-agent-automation-run
Gets detailed automation run output including transcript, telemetry, deliveries, and optionally tool step details.
May also require additional scopes: Read Secrets
Example: "Show me the full details for this automation run"

list-llm-provider-keys
Lists personal or account-scoped LLM provider keys without returning API key plaintext.
Example: "List my LLM provider keys"

get-llm-provider-key
Gets one LLM provider key metadata record without returning API key plaintext.
Example: "Show me this provider key"

search-docs
Searches Quave ONE documentation and blog posts using fuzzy matching. Returns relevant pages with excerpts. Use this to find information about deployment, CLI, billing, troubleshooting, and more.
Example: "How do I configure health checks?"

read-doc
Reads the full content of a specific documentation page or blog post. Use the path from search-docs results or known documentation paths.
Example: "Read the CLI documentation"

list-contact-points
Lists all contact points for an account. Contact points are notification destinations (Slack, PagerDuty, Webhook, Email) used by alerts.
Example: "Show me all contact points for this account"

get-contact-point
Gets details of a specific contact point including its configuration. Sensitive config fields (like webhook URLs) require admin permission.
May also require additional scopes: Read Secrets
Example: "Show me the details of my Slack contact point"

list-alerts
Lists all alerts for an app environment. Shows alert name, metric, threshold, state, and enabled status.
Example: "Show me all alerts for production"

get-alert
Gets detailed information about a specific alert including its condition, contact point, and current state.
Example: "Show me the details of the high CPU alert"

refresh-alert-state
Refreshes the alert state from Grafana. Returns the current state (Normal, Pending, Firing, NoData, Error).
Example: "Check the current state of my CPU alert"

Read Secrets (quave:read:secrets)

get-app-env-backup-download
Returns a time-limited backup download URL and backup decryption material. This is a sensitive operation that requires the quave:read:secrets scope and account admin permission.
Example: "Get the download and decryption data for this backup"

get-user-token
Retrieves the currently authenticated user profile token (decoded). This is a sensitive operation that requires the quave:read:secrets scope.
Example: "Show me my CLI token"

get-app-env-token
Retrieves the CLI token for a specific app environment (decoded). Requires admin permission on the account that owns the environment.
Example: "Show me the CLI token for production"

reveal-llm-provider-key
Reveals LLM provider API key plaintext. Requires secret-read scope and emits a secret decrypt audit event.
Example: "Reveal this provider API key"

Write Configurations (quave:write:config)

set-current-account
Sets the current account for the authenticated user
Example: "Switch to my work account"

create-account
Creates a new account for the authenticated user. Account names beginning with agent-test create internal test accounts with a 100 zCloud limit, production access to us-5, and staging access to all st-* regions. To add container registry credentials, use the create-credential tool after account creation.
Example: "Create a new account called "My Company""

update-account
Updates account settings including name. Requires admin permission on the account.
Example: "Update my account name to "New Company Name""

set-account-require-mfa
Enable or disable the account-wide two-factor authentication requirement.
Example: "Require two-factor authentication for everyone in my account"

create-app
Creates a new app within an account. Supports CLI deployments, image deployments, GitHub deployments, and managed database app shells. AI agents should send isCliDeployment: true by default unless the user explicitly provided GitHub repo details; GitHub deployments require gitNamespace, gitRepo, and gitInstallationId. For dockerPreset CUSTOM source builds, dockerfilePath defaults to "Dockerfile" when omitted. Call list-app-presets first to discover non-database presets (Next.js, Meteor.js, Custom, Function, ...) and their versions. For databases, call list-database-presets first, pass isCliDeployment: true plus the standard engine port on create-app, then use create-app-env to provision the cluster. Database creation rules: - Database creation is a two-tool flow: first call create-app with the database dockerPreset, isCliDeployment: true, and the standard engine port; then call create-app-env to provision the managed database cluster in a region. - Do not omit isCliDeployment for database apps. Without isCliDeployment: true, create-app is interpreted as a GitHub deployment and the API will complain about missing gitNamespace/gitRepo/gitInstallationId instead of provisioning a database. - For database create-app calls, include the standard engine port even though the managed database is provisioned later by create-app-env: MongoDB 27017, PostgreSQL 5432, MySQL 3306, Redis 6379, CouchDB 5984, RabbitMQ 5672, ClickHouse 8123. create-app-env does not take a port. - Call list-database-presets first to get the eligible regular-user presets (currently MongoDB, PostgreSQL, MySQL, Redis, CouchDB, RabbitMQ, ClickHouse), their versions and defaults, and the per-preset limits (minDiskMb, maxDiskMb, maxReplicas). Internal-Operator-only/manual database engines (Elasticsearch, Opensearch, Kafka, ...) are intentionally not returned. - The chosen region must support automatic DevOps deploy (use list-regions to confirm). - "containers" is the replica count: a positive integer up to maxReplicas. Use containers > 1 only for HA setups. CouchDB currently supports exactly 1 container. - "disk" is the per-replica volume size in MB, and must be between minDiskMb and maxDiskMb. For Redis with withPersistence=false, set disk=0 (warn the user that data is lost on restart). For all other DB presets, disk is mandatory. - "withPersistence" only applies when the preset has isPersistenceOptional=true (currently Redis). Pass true (with disk > 0) or false (cache-only, disk=0). - "dockerPresetVersion" should be set; if omitted, the latest default version is used. - "databaseSettings.redis" (Redis only) supports tlsEnabled, configExtra (key/value, with denylist), and HA components (sentinel must be odd, >= 3 replicas; haproxy >= 1). Only applies when containers > 1. - "databaseSettings.mysql.parameters" (MySQL only) supports max_connections. - "databaseSettings.postgresql.parameters" (PostgreSQL only) supports work_mem, hash_mem_multiplier, max_parallel_workers_per_gather, and effective_cache_size.
Example: "Create a new Node.js app called "my-api" on port 3000"

update-app
Updates app-level configuration including deployment source (build from source vs pre-built image), Docker settings, port, build configuration, and health checks. Changes affect all environments of the app. For persistent storage, use update-app-env-volume on a specific environment. To change the framework, use list-app-presets to discover valid `dockerPreset` and `dockerPresetVersion` values (database presets cannot be set via update-app).
Example: "Switch my-api to build from source using Dockerfile at ./docker/Dockerfile"

create-app-env
Creates a new environment within an app. Configure region, resources, and environment variables. Use list-regions first to see available regions for the account. For database apps, this is the step that provisions the managed cluster; pass zClouds (1, 2, 4, or 8), containers, disk, withPersistence (Redis only), dockerPresetVersion, and optional databaseSettings. Do not pass port or isCliDeployment here; those belong to create-app. Database creation rules: - Database creation is a two-tool flow: first call create-app with the database dockerPreset, isCliDeployment: true, and the standard engine port; then call create-app-env to provision the managed database cluster in a region. - Do not omit isCliDeployment for database apps. Without isCliDeployment: true, create-app is interpreted as a GitHub deployment and the API will complain about missing gitNamespace/gitRepo/gitInstallationId instead of provisioning a database. - For database create-app calls, include the standard engine port even though the managed database is provisioned later by create-app-env: MongoDB 27017, PostgreSQL 5432, MySQL 3306, Redis 6379, CouchDB 5984, RabbitMQ 5672, ClickHouse 8123. create-app-env does not take a port. - Call list-database-presets first to get the eligible regular-user presets (currently MongoDB, PostgreSQL, MySQL, Redis, CouchDB, RabbitMQ, ClickHouse), their versions and defaults, and the per-preset limits (minDiskMb, maxDiskMb, maxReplicas). Internal-Operator-only/manual database engines (Elasticsearch, Opensearch, Kafka, ...) are intentionally not returned. - The chosen region must support automatic DevOps deploy (use list-regions to confirm). - "containers" is the replica count: a positive integer up to maxReplicas. Use containers > 1 only for HA setups. CouchDB currently supports exactly 1 container. - "disk" is the per-replica volume size in MB, and must be between minDiskMb and maxDiskMb. For Redis with withPersistence=false, set disk=0 (warn the user that data is lost on restart). For all other DB presets, disk is mandatory. - "withPersistence" only applies when the preset has isPersistenceOptional=true (currently Redis). Pass true (with disk > 0) or false (cache-only, disk=0). - "dockerPresetVersion" should be set; if omitted, the latest default version is used. - "databaseSettings.redis" (Redis only) supports tlsEnabled, configExtra (key/value, with denylist), and HA components (sentinel must be odd, >= 3 replicas; haproxy >= 1). Only applies when containers > 1. - "databaseSettings.mysql.parameters" (MySQL only) supports max_connections. - "databaseSettings.postgresql.parameters" (PostgreSQL only) supports work_mem, hash_mem_multiplier, max_parallel_workers_per_gather, and effective_cache_size.
Example: "Create a staging environment in us-5 region with 2 zClouds"

update-app-env-resources
Updates resource allocation for an app environment (zClouds or custom CPU/memory/disk). zClouds accepts only 1, 2, 4, or 8; use custom resources instead when a BYOP account needs another size. For DevOps databases, "disk" is the per-replica volume size in MB and must stay within the per-preset limits (use list-database-presets to read the current minDiskMb and maxDiskMb). For databases, this is available for automatically provisioned database presets (MongoDB, PostgreSQL, MySQL, Redis, CouchDB, RabbitMQ, or ClickHouse) deployed in a region with DevOps support.
Example: "Increase staging to 4 zClouds"

update-app-env-autoscaling
Updates autoscaling configuration for an app environment. Not supported for database environments. Use the database-specific tools for supported operations.
Example: "Enable autoscaling for production with min 2 and max 5 replicas"

update-function-config
Updates the scaling and timeout configuration for a function app environment. Configure concurrency, timeouts, and min/max scale. Only available for function apps. Not supported for database environments. Use the database-specific tools for supported operations.
Example: "Set max scale to 10 and idle timeout to 600 seconds"

update-app-env-job-config
Updates the command, arguments, timeout, retry, TTL, and concurrency overrides for a Job app environment.
Example: "Set the staging Job command to bundle exec rails db:migrate"

update-app-env-variable
Adds, updates, or removes environment variables (partial update). Use "variables" to add/update and "variablesToRemove" to delete.
Example: "Set DEBUG=true on staging"

patch-json-env-var
Patches a specific field within a JSON-formatted environment variable without sending the entire JSON. Useful for updating large JSON configs like METEOR_SETTINGS.
Also requires: Read Secrets
Example: "Set public.regions.DEMOUS1.isAvailableForUnverifiedUsers to true in METEOR_SETTINGS"

update-app-env-branch
Updates the git branch for an app environment. Changing the branch creates pending build changes. Not supported for database environments. Use the database-specific tools for supported operations.
Example: "Switch production to the main branch"

update-app-env-healthcheck
Updates the HTTP health check configuration for an app. Health check settings are shared across all environments of the app. Not supported for database environments. Use the database-specific tools for supported operations.
Example: "Set health check path to /api/health for production"

update-app-env-security
Updates security settings for an app environment including ModSecurity WAF, rate limiting, and security context (fsGroup, runAsUser, runAsGroup). Not supported for database environments. Use the database-specific tools for supported operations.
Example: "Enable WAF and set rate limit to 100 requests per second"

update-app-env-allowlist
Manages the IP address allowlist and network control for an app environment. Toggle networkControlEnabled to enable or disable IP restriction enforcement. Add, update, or remove IP addresses/CIDR ranges. When network control is enabled and an allowlist is active, only connections from listed IPs are allowed. Changes trigger an immediate deploy. For databases, this is available for automatically provisioned database presets (MongoDB, PostgreSQL, MySQL, Redis, CouchDB, RabbitMQ, or ClickHouse) deployed in a region with DevOps support.
Example: "Enable network control and add my office IP 203.0.113.50 to the allowlist for production"

update-app-env-volume
Configures persistent storage for an app environment. Enable/disable volumes, set the mount path, and toggle NFS shared volumes. When useVolume is enabled without NFS, blue-green deploy is automatically disabled on the app and scaling is limited to 1 container. The environment's region must support volumes. Not supported for database environments. Use the database-specific tools for supported operations.
Example: "Enable persistent volume on staging with mount path /data"

update-app-env-name
Updates the name of an app environment. This is a display name change that may affect CLI deploy targets. For databases, this is available for automatically provisioned database presets (MongoDB, PostgreSQL, MySQL, Redis, CouchDB, RabbitMQ, or ClickHouse) deployed in a region with DevOps support.
Example: "Rename staging environment to staging-v2"

add-app-env-host
Adds a custom hostname to an app environment. The hostname must be a valid domain and not already in use in the same region. Hosts are deployed immediately. Not supported for database environments. Use the database-specific tools for supported operations.
Example: "Add api.example.com as a host for production"

extend-branch-preview
Extends a branch preview environment by adding a positive TTL to its expiration time.
Example: "Extend a branch preview by 4 hours"

update-app-env-region
Changes the region of an app environment. Requires valid CNAME records for all custom hosts (use check-app-env-cname first). This is a disruptive operation - the environment will be unreachable for ~2 minutes. Use list-regions to see available target regions. Not supported for database environments. Use the database-specific tools for supported operations.
Example: "Move production to us-5 region"

update-app-env-backup-retention
Updates the customer-safe backup retention days and storage-size cap for an environment.
Example: "Keep backups for 14 days and cap backup storage at 50 GB"

configure-app-env-backup-storage
Attaches or detaches an existing customer object-storage credential for backups without returning credentials. Cleanup on customer storage requires a separate explicit acknowledgement.
Example: "Use this existing object-storage credential for environment backups"

create-solution
Creates a curated solution in an account. Each component is created as a normal Quave ONE app environment through the standard creation flow. Requires internal Operator access.
Example: "Create the Headscale Stack solution in my account"

create-credential
Creates a new account-level credential, including static Docker registries or AWS ECR registry credentials. Requires the Manage Credentials role. Credentials are encrypted at rest and automatically synced to every region the account uses.
Example: "Create a Docker Hub registry credential for my production images"

update-credential
Updates an existing account-level credential. The type cannot be changed after creation. Sensitive fields left empty on update retain their stored values. Requires the Manage Credentials role.
Example: "Update the password for my Docker registry credential"

set-default-credential
Promotes a Container Registry credential to the account-wide default. Apps without an explicit registry selection use the default. Only Container Registry credentials support this operation. Requires the Manage Credentials role.
Example: "Set my Docker Hub credential as the default registry"

sync-credential
Re-pushes a credential to every active region the account uses. For AWS ECR, also generates a fresh short-lived Docker auth token and updates refresh status. Useful when a previous sync failed (shown as Error status) or after editing a credential. Requires the Manage Credentials role.
Example: "Re-sync my TLS certificate to all regions"

create-agent-automation
Creates an agent automation using the same backend validation as the dashboard UI. The selected MCP key controls what the automation can do.
Example: "Create an hourly automation that checks production health"

update-agent-automation
Updates an agent automation using the same backend validation as the dashboard UI.
Example: "Change this automation to run every 15 minutes"

toggle-agent-automation
Enables or disables an agent automation without deleting it.
Example: "Pause this automation"

create-llm-provider-key
Creates a personal or account-scoped LLM provider key. Account keys require the Manage Credentials role.
Example: "Create an OpenAI provider key for this account"

update-llm-provider-key
Updates a personal or account-scoped LLM provider key. Account keys require the Manage Credentials role.
Example: "Update the default model on this provider key"

set-default-llm-provider-key
Sets a personal or account-scoped LLM provider key as the default for that scope.
Example: "Set this provider key as the account default"

test-llm-provider-key
Runs the same one-token LLM provider connectivity probe used by the dashboard UI.
Example: "Test whether this provider key works"

create-contact-point
Creates a new contact point for alert notifications. Supported types: slack (requires webhookUrl), pagerduty (requires integrationKey), webhook (requires url), email (requires addresses array).
Example: "Create a Slack contact point for #alerts channel"

update-contact-point
Updates a contact point name or configuration. Changes are propagated to all deployed Grafana instances.
Example: "Update my Slack contact point to use a different channel"

create-alert
Creates a new alert for an app environment. Supports built-in metrics (cpu_percent, memory_percent, cpu_usage, memory_usage and per-pod variants). Requires a contact point for notifications.
Example: "Create an alert that fires when CPU is above 80% for 5 minutes"

update-alert
Updates an alert configuration. Can change name, description, metric, threshold, duration, or contact point.
Example: "Change the CPU alert threshold to 90%"

toggle-alert
Enables or disables an alert. Disabled alerts do not send notifications.
Example: "Disable the CPU alert for staging"

Write Deployments (quave:write:deploy)

apply-app-env-changes
Applies pending configuration changes to an app environment (like terraform apply). For databases, this is available for automatically provisioned database presets (MongoDB, PostgreSQL, MySQL, Redis, CouchDB, RabbitMQ, or ClickHouse) deployed in a region with DevOps support.
Example: "Apply pending changes to production"

scale-app-env-containers
Manually scales the number of containers for an app environment. For DevOps databases, "containers" is the replica count capped at the per-preset limit (use list-database-presets to read the current maxReplicas). Use containers > 1 only for HA setups (Redis HA settings only apply when containers > 1; CouchDB currently requires exactly 1). For databases, this is available for automatically provisioned database presets (MongoDB, PostgreSQL, MySQL, Redis, CouchDB, RabbitMQ, or ClickHouse) deployed in a region with DevOps support.
Example: "Scale production to 3 containers"

trigger-app-env-build
Triggers a new build for an app environment. This starts the build process to create a new deployment artifact. Not supported for database environments. Use the database-specific tools for supported operations.
May also require additional scopes: Write Configurations
Example: "Build and deploy production from main branch"

redeploy-app-env
Redeploys an app environment using the current or a specified deployment version. Useful for restarting containers or applying pending configuration changes (e.g. after rotating database credentials in env vars). For databases, this is available for automatically provisioned database presets (MongoDB, PostgreSQL, MySQL, Redis, CouchDB, RabbitMQ, or ClickHouse) deployed in a region with DevOps support.
Example: "Redeploy production to restart the containers"

start-app-env
Starts a stopped app environment by redeploying its current version. Not supported for database environments. Use the database-specific tools for supported operations.
Example: "Start the staging environment"

create-branch-preview
Creates a temporary branch preview environment cloned from an existing environment.
Also requires: Write Configurations
Example: "Create a preview of pull-request-123 from staging"

run-app-env-job
Runs a finite Job app workload, optionally merging environment variables before creating the JobRun
May also require additional scopes: Write Configurations
Example: "Run my Rails migration job in staging"

cancel-app-env-job-run
Cancels a running JobRun and deletes its Kubernetes Job if it has started
Example: "Cancel this migration job run"

rerun-app-env-job-run
Creates a new JobRun from a previous run snapshot, with optional content or command overrides
Example: "Rerun this failed migration job with a longer timeout"

validate-app-env-volume-backup
Starts a non-destructive restore validation for a volume backup recovery point. Requires account admin permission and the quave:write:deploy scope.
Example: "Validate this production recovery point before a restore drill"

create-app-env-from-volume-backup
Creates a separate environment restored from a volume backup recovery point. Requires account admin permission plus deploy and configuration scopes.
May also require additional scopes: Write Configurations
Example: "Create a restored test environment from this recovery point"

request-deploy-storage-key
Requests a pre-signed URL for uploading code to deploy. Returns an uploadUrl and storageKey. Step 1 of the code deployment process.
Example: "Get an upload URL to deploy my code"

notify-code-upload
Notifies that code has been uploaded and triggers the build process. Step 3 of the code deployment process (step 2 is uploading via curl).
May also require additional scopes: Write Configurations
Example: "I uploaded my code, now trigger the build"

deploy-app-env-image
Deploys a Docker image to an app environment. The app must have useImage=true. The image is deployed directly without a build step. Not supported for database environments. Use the database-specific tools for supported operations.
May also require additional scopes: Write Configurations
Example: "Deploy image myregistry/myapp:v1.2.3 to production"

run-agent-automation-once
Dispatches one manual run for an agent automation. Optionally waits for the resulting run to finish.
May also require additional scopes: Read Only
Example: "Run this automation now and wait for the result"

Write Dangerous (quave:write:dangerous)

rollback-app-env
Rolls back an app environment to a previous version. If no targetContentId is specified, rolls back to the immediately previous deployment. Not supported for database environments. Use the database-specific tools for supported operations.
Example: "Rollback production to the previous version"

stop-app-env
Stops an app environment, scaling its containers to zero. The environment can be started again later. Not supported for database environments. Use the database-specific tools for supported operations.
Example: "Stop the staging environment"

remove-app-env-host
Removes a hostname from an app environment. You can specify the host by hostId or hostname. Changes are deployed immediately. Not supported for database environments. Use the database-specific tools for supported operations.
Example: "Remove api.example.com from production"

delete-app
Permanently deletes an app and all its environments, deployments, metrics, and associated data. This action cannot be undone. Environments are destroyed automatically; managed database volumes are retained for the separate PVC cleanup/detach flow.
Example: "Delete the old test app"

delete-app-env
Permanently deletes an app environment and all its associated data (deployments, metrics, updates). This action cannot be undone. For databases, this is available for automatically provisioned database presets (MongoDB, PostgreSQL, MySQL, Redis, CouchDB, RabbitMQ, or ClickHouse) deployed in a region with DevOps support. Persistent database volumes are retained for the separate PVC cleanup/detach flow.
Example: "Delete the old-staging environment"

delete-branch-preview
Deletes a branch preview environment only when preview metadata is present.
Example: "Delete a branch preview by CLI env name"

run-app-env-backup-cleanup
Permanently removes expired backup data after an explicit, unexpired cleanup preview confirmation. The newest recovery point is always protected.
Example: "Delete the expired backups shown in this cleanup preview"

run-account-backup-cleanup
Permanently removes expired backup data across one account after an explicit unexpired preview confirmation. Requires account admin permission.
Example: "Delete expired backups across this account using this preview"

delete-credential
Permanently deletes an account-level credential. Cannot delete credentials that are still referenced by apps, hosts, or environments. Requires the Manage Credentials role.
Example: "Delete the old staging registry credential"

delete-agent-automation
Deletes an agent automation owned by the authenticated user.
Example: "Delete the old automation"

delete-llm-provider-key
Deletes a personal or account-scoped LLM provider key. Account keys require the Manage Credentials role.
Example: "Delete this provider key"

delete-mcp-key
Deletes an MCP key with the same or less effective tool access than the current MCP key. Requires MCP-key management plus dangerous-operation protection.
Also requires: Manage MCP Keys
Example: "Delete this automation MCP key"

delete-contact-point
Deletes a contact point. Cannot delete if alerts are using this contact point.
Example: "Delete the old PagerDuty contact point"

delete-alert
Permanently deletes an alert. Removes from both MongoDB and Grafana.
Example: "Delete the high memory alert"

Manage MCP Keys (quave:manage:mcp-keys)

list-mcp-keys
Lists MCP keys manageable by the current MCP key and only returns keys with the same or less effective tool access.
Example: "List MCP keys I can manage"

get-mcp-key
Gets MCP key metadata for a key with the same or less effective tool access than the current MCP key.
Example: "Show this MCP key configuration"

create-mcp-key
Creates a scope-mode or explicit tool-mode MCP key with the same or less effective tool access than the current MCP key.
May also require additional scopes: Read Secrets
Example: "Create a read-only MCP key for an automation"

update-mcp-key
Updates an MCP key only when its requested effective tool access is the same or less than the current MCP key.
Example: "Reduce this MCP key to read-only"

toggle-mcp-key
Enables or disables an MCP key with the same or less effective tool access than the current MCP key.
Example: "Disable this MCP key"

regenerate-mcp-key
Rotates the secret for an MCP key with the same or less effective tool access than the current MCP key.
May also require additional scopes: Read Secrets
Example: "Regenerate this MCP key"

reveal-mcp-key
Reveals raw MCP key plaintext for a key with the same or less effective tool access than the current MCP key. Secret-read protection remains required.
Also requires: Read Secrets
Example: "Reveal this MCP key"

Control Destroy Protection (quave:admin:destroy-protection)

set-app-env-prevent-destroy
Enables or disables the protected-environment guard that blocks direct environment deletion and parent app/account deletion until disabled again.
Example: "Protect production from accidental deletion"

Admin (quave:admin)

update-member-env-access
Updates which environments a member can access. Pass an empty array or omit allowedAppEnvIds to grant full access. Requires MANAGE_MEMBERS permission.
Example: "Restrict this member to only production and staging environments"

Common workflows

• Observe: inspect account resources, deployment history, logs, metrics, backup status, and JobRuns.
• Deploy safely: make configuration changes, apply pending changes when needed, deploy, then check the resulting deployment or JobRun status.
• Backups: review recovery points and validation results. Cleanup uses a preview first and requires the short-lived preview ID for the destructive operation.
• Credentials: create static Container Registry credentials or AWS ECR registry credentials with create-credential. For AWS ECR, provide the AWS source credential fields once; Quave ONE refreshes the generated Docker auth token every 6 hours and returns safe refreshStatus metadata from list-credentials / get-credential.
• Jobs: update saved Job configuration or supply a per-run override, then wait for the JobRun to become terminal before relying on its result.
• Databases & Services: use list-database-presets before creating a managed service so the client uses supported preset and capacity values. MySQL environments accept databaseSettings.mysql.parameters.max_connections; PostgreSQL environments accept databaseSettings.postgresql.parameters; Redis environments accept databaseSettings.redis for TLS, config overrides, and HA components.
• Solutions: use list-solutions, then create-solution with the returned slug. If a multi-component installation fails partway through, retry with the returned installation ID.
• Branch previews: create-branch-preview clones a source environment and deploys a Git branch with an absolute TTL. Use list-branch-previews to review it, extend-branch-preview to extend its TTL, and delete-branch-preview to remove it. A protected preview must first have its destroy guard disabled; server-side cleanup also respects idle-TTL rules.
• Destroy protection: set-app-env-prevent-destroy enables or disables the protected-environment guard. It requires account admin permission and the dedicated quave:admin:destroy-protection scope, separate from quave:write:dangerous, because it controls the safety lock that can block or allow destructive actions. When enabled, direct environment deletion and parent app/account deletion fail until the guard is disabled.
• Access review: list-members exposes member, invitation, role, MFA, and environment-access summaries; list-account-events exposes Quave ONE platform audit events.

Documentation tools

The MCP server can search and read Quave ONE documentation from an AI client.

• search-docs finds relevant documentation and blog pages by query, optional category, and limit.
• read-doc reads a page returned by search.

Start with search-docs, then pass a result path to read-doc. This is useful when an agent needs exact platform behavior before proposing a change.

Tool behavior to know

Some tools expose optional sensitive output or dangerous operations. Those paths require the associated capability even if the basic read or write action does not. For example, backup download/decryption data needs quave:read:secrets, and cleanup/deletion requires dangerous-write access.

Tool execution uses the same server-side validations as the dashboard. An MCP client’s local confirmation settings never replace those checks.