Control Plane

Update a Domain

update_domain

DestructiveIdempotent

Update a domain: description, tags, acceptAllHosts or acceptAllSubdomains, certChallengeType, the gvcLink or workloadLink binding, and its listeners and routes. addPorts adds a listener or changes one, addRoutes adds a route or replaces the one with the same identity, and the remove fields delete, skipping what is not there. Removals apply before additions in one write, so removeRoutes plus addRoutes changes a route's path or host. After binding gvcLink or workloadLink, re-read status.dnsConfig: bindings add records the user must create.

Input Schema

Name	Required	Description
`org`	No	Organization slug.
`tags`	No	Add or update tags without replacing the full set. Submit an empty list to clear all tags.
`domain`	Yes	Fully qualified domain name to update.
`gvcLink`	No	Bind the domain to a GVC (e.g., /org/{org}/gvc/{gvc} or //gvc/{gvc}). Mutually exclusive with `removeGvcLink` and `workloadLink`.
`addPorts`	No	Listeners to add, or to change by number: protocol, tls, or cors (each replaces its block); their routes stay.
`addRoutes`	No	Routes to add; the one with the same port, prefix or regex, and hostPrefix or hostRegex is replaced. Minimal: {portNumber, workloadLink}; omit prefix and regex to match /. Canaries split traffic by weight.
`removeTls`	No	Listeners whose TLS block is deleted; 443 with http or http2 gets the platform default back.
`removeCors`	No	Listeners whose CORS block is deleted.
`description`	No	New description for the domain.
`removePorts`	No	Listeners to delete; their traffic stops at once.
`removeRoutes`	No	Routes to delete, named by port, prefix or regex, and hostPrefix or hostRegex if set; their requests then get 404.
`workloadLink`	No	Bind the entire domain to one workload (e.g. //gvc/{gvc}/workload/{name}). Mutually exclusive with `removeWorkloadLink` and `gvcLink`.
`removeGvcLink`	No	Detach the domain from its current GVC binding.
`removeTagKeys`	No	Tag keys to remove from the resource.
`acceptAllHosts`	No	Accept any host header (overrides existing).
`certChallengeType`	No	Switch the certificate challenge, for example to dns01 when a CDN or WAF blocks http01. Not for .internal domains.
`removeWorkloadLink`	No	Detach the domain from its current workload binding.
`acceptAllSubdomains`	No	Accept any subdomain (overrides existing).

Output Schema

Name	Required	Description
`ok`	Yes
`data`	No	The full result. Read this, not only the summary.
`details`	No
`summary`	Yes
`nextSteps`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed7 schema fields changedOct 22, 2026

addedInput schema / properties / addPorts

Added value: +{
+  "description": "Listeners to add, or to change by number: protocol, tls, or cors (each replaces its block); their routes stay.",
+  "items": {
+    "properties": {
+      "cors": {
+        "description": "Replaces the whole CORS block. Shape: {allowOrigins: [{exact} or {regex}], allowMethods: [], allowHeaders: [], exposeHeaders: [], maxAge: e.g. 12h, allowCredentials}.",
+        "type": "object"
+      },
+      "number": {
+        "description": "Listener port. Only 443 and 80 serve without a dedicated load balancer; tcp needs one too.",
+        "maximum": 65535,
+        "minimum": 1,
+        "type": "integer"
+      },
+      "protocol": {
+        "description": "Required for a new listener; an existing one keeps its own when omitted.",
+        "enum": [
+          "http",
+          "http2",
+          "tcp"
+        ],
+        "type": "string"
+      },
+      "tls": {
+        "description": "Replaces the whole TLS block. Shape: {minProtocolVersion: TLSV1_0|TLSV1_1|TLSV1_2|TLSV1_3, cipherSuites: [name, e.g. ECDHE-RSA-AES128-GCM-SHA256], serverCertificate: {secretLink} (keypair secret, PEM), clientCertificate: {secretLink} (client CA for mTLS)}.",
+        "type": "object"
+      }
+    },
+    "required": [
+      "number"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

addedInput schema / properties / addRoutes

Added value: +{
+  "description": "Routes to add; the one with the same port, prefix or regex, and hostPrefix or hostRegex is replaced. Minimal: {portNumber, workloadLink}; omit prefix and regex to match /. Canaries split traffic by weight.",
+  "items": {
+    "properties": {
+      "canaries": {
+        "description": "Optional traffic split by weight to more workloads: weights total at most 100 and the rest goes to workloadLink; a canary not deployed in a location is dropped there.",
+        "items": {
+          "properties": {
+            "port": {
+              "description": "Optional workload port; omit for the workload's first port.",
+              "maximum": 65535,
+              "minimum": 80,
+              "type": "integer"
+            },
+            "weight": {
+              "description": "Percent of the route's traffic; 0 disables the canary.",
+              "maximum": 100,
+              "minimum": 0,
+              "type": "integer"
+            },
+            "workloadLink": {
+              "description": "Required workload target link, e.g. //gvc/{gvc}/workload/{name} or /org/{org}/gvc/{gvc}/workload/{name}.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "workloadLink",
+            "weight"
+          ],
+          "type": "object"
+        },
+        "type": "array"
+      },
+      "caseInsensitive": {
+        "description": "Optional. When true, prefix matches the path regardless of case. Prefix only; for a case-insensitive regex start it with (?i).",
+        "type": "boolean"
+      },
+      "headers": {
+        "description": "Header rewrites for this route.",
+        "properties": {
+          "request": {
+            "description": "Mutations applied to the upstream request headers.",
+            "properties": {
+              "set": {
+                "additionalProperties": {
+                  "type": "string"
+                },
+                "description": "Key/value pairs to set on the headers (overrides existing values). Values may embed only the Envoy wildcards %REQUESTED_SERVER_NAME%, %DOWNSTREAM_REMOTE_ADDRESS_WITHOUT_PORT%, %START_TIME%.",
+                "type": "object"
+              }
+            },
+            "type": "object"
+          }
+        },
+        "type": "object"
+      },
+      "hostPrefix": {
+        "description": "Optional Host header prefix matcher. Requires acceptAllHosts or acceptAllSubdomains on the domain.",
+        "type": "string"
+      },
+      "hostRegex": {
+        "description": "Optional Host header regex matcher. Requires acceptAllHosts or acceptAllSubdomains on the domain.",
+        "type": "string"
+      },
+      "mirror": {
+        "description": "Optional traffic mirroring targets for shadow testing; only workloadLink answers. Shape: [{workloadLink, percent 0 to 100, port (optional)}].",
+        "items": {
+          "type": "object"
+        },
+        "type": "array"
+      },
+      "port": {
+        "description": "Optional workload port override. Omit to forward to the listener port.",
+        "maximum": 65535,
+        "minimum": 80,
+        "type": "integer"
+      },
+      "portNumber": {
+        "description": "Listener the route belongs to.",
+        "maximum": 65535,
+        "minimum": 1,
+        "type": "integer"
+      },
+      "prefix": {
+        "description": "Optional path prefix to match. Exclusive with regex; omit both to match /.",
+        "type": "string"
+      },
+      "regex": {
+        "description": "Optional path regex match. Exclusive with prefix; omit both to match /. Regex routes match in written order.",
+        "type": "string"
+      },
+      "replacePrefix": {
+        "description": "Optional prefix replacement when forwarding traffic to the workload.",
+        "type": "string"
+      },
+      "replica": {
+        "description": "Optional workload replica index to target (advanced; sticky routing).",
+        "minimum": 0,
+        "type": "integer"
+      },
+      "workloadLink": {
+        "description": "Required workload target link, e.g. //gvc/{gvc}/workload/{name} or /org/{org}/gvc/{gvc}/workload/{name}.",
+        "type": "string"
+      }
+    },
+    "required": [
+      "portNumber",
+      "workloadLink"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

addedInput schema / properties / certChallengeType

Added value: +{
+  "description": "Switch the certificate challenge, for example to dns01 when a CDN or WAF blocks http01. Not for .internal domains.",
+  "enum": [
+    "http01",
+    "dns01"
+  ],
+  "type": "string"
+}

addedInput schema / properties / removeCors

Added value: +{
+  "description": "Listeners whose CORS block is deleted.",
+  "items": {
+    "maximum": 65535,
+    "minimum": 1,
+    "type": "integer"
+  },
+  "type": "array"
+}

addedInput schema / properties / removePorts

Added value: +{
+  "description": "Listeners to delete; their traffic stops at once.",
+  "items": {
+    "maximum": 65535,
+    "minimum": 1,
+    "type": "integer"
+  },
+  "type": "array"
+}

addedInput schema / properties / removeRoutes

Added value: +{
+  "description": "Routes to delete, named by port, prefix or regex, and hostPrefix or hostRegex if set; their requests then get 404.",
+  "items": {
+    "properties": {
+      "hostPrefix": {
+        "type": "string"
+      },
+      "hostRegex": {
+        "type": "string"
+      },
+      "portNumber": {
+        "maximum": 65535,
+        "minimum": 1,
+        "type": "integer"
+      },
+      "prefix": {
+        "type": "string"
+      },
+      "regex": {
+        "type": "string"
+      }
+    },
+    "required": [
+      "portNumber"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

addedInput schema / properties / removeTls

Added value: +{
+  "description": "Listeners whose TLS block is deleted; 443 with http or http2 gets the platform default back.",
+  "items": {
+    "maximum": 65535,
+    "minimum": 1,
+    "type": "integer"
+  },
+  "type": "array"
+}

Changed23 schema fields changedSep 30, 2026
- removedInput schema / $schema
```
Removed value: -"http://json-schema.org/draft-07/schema#"
```
- removedInput schema / additionalProperties
```
Removed value: -false
```
- removedInput schema / properties / description / maxLength
```
Removed value: -250
```
- removedInput schema / properties / domain / maxLength
```
Removed value: -253
```
- removedInput schema / properties / domain / minLength
```
Removed value: -1
```
- removedInput schema / properties / gvcLink / minLength
```
Removed value: -1
```
- changedInput schema / properties / org / description
```
Previous value: -"Organization slug (lowercase kebab-case). NEVER guess — if the user has not named one, ask. On org-not-found, stop and ask; do not retry variants."New value: +"Organization slug."
```
- removedInput schema / properties / org / maxLength
```
Removed value: -63
```
- removedInput schema / properties / org / minLength
```
Removed value: -1
```
- removedInput schema / properties / org / pattern
```
Removed value: -"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$"
```
- removedInput schema / properties / removeTagKeys / items / minLength
```
Removed value: -1
```
- removedInput schema / properties / tags / items / additionalProperties
```
Removed value: -false
```
- removedInput schema / properties / tags / items / properties / key / minLength
```
Removed value: -1
```
- removedInput schema / properties / tags / maxItems
```
Removed value: -50
```
- removedInput schema / properties / workloadLink / minLength
```
Removed value: -1
```
- changedInput schema / required
```
Previous value: -[
-  "org",
-  "domain"
-]New value: +[
+  "domain"
+]
```
- removedOutput schema / $schema
```
Removed value: -"http://json-schema.org/draft-07/schema#"
```
- removedOutput schema / additionalProperties
```
Removed value: -false
```
- changedOutput schema / properties / data / description
```
Previous value: -"The full machine-readable result — list rows, the resource object, query results. Read THIS, not just the summary."New value: +"The full result. Read this, not only the summary."
```
- addedOutput schema / properties / details
```
Added value: +{
+  "type": "string"
+}
```
- removedOutput schema / properties / nextSteps / description
```
Removed value: -"Recommended follow-up actions for this task, in order."
```
- removedOutput schema / properties / ok / description
```
Removed value: -"Whether the call succeeded."
```
- removedOutput schema / properties / summary / description
```
Removed value: -"One-line summary of the result."
```
First observedJun 28, 2026

TDQS

A4.7/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already flag destructive/openWorld/idempotent, and the description adds real behavior beyond them: the remove-before-add ordering within one write, the identity rule that governs route replacement, and the non-obvious side effect that gvcLink/workloadLink bindings create DNS records the user must provision. The DNS-records warning is exactly the kind of post-condition an agent cannot infer from annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, front-loaded with the mutation surface, then ordering/identity semantics, then the DNS post-condition. Every clause carries information an agent needs; no restatement of the title or schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive 18-parameter mutation with an output schema and full schema coverage, this description supplies the remaining gaps: ordering guarantees, route-replacement identity, and the DNS-provisioning consequence of binding. Nothing an agent needs to call it safely is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents each of the 18 parameters including nested TLS/CORS/canary shapes. The description adds cross-parameter semantics the schema cannot express: that addRoutes replaces the route with matching port/prefix-or-regex/host identity, and that ordering of removes vs adds determines the outcome. Marginal value over a 3 baseline, hence 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb+resource ('Update a domain') and immediately enumerates the mutable surface: description, tags, acceptAllHosts/acceptAllSubdomains, certChallengeType, bindings, listeners and routes. That enumeration makes it unmistakably the mutation counterpart to create_domain and distinct from update_gvc/update_workload.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete operational guidance: removals apply before additions in a single write, and 'removeRoutes plus addRoutes changes a route's path or host' tells the agent exactly how to achieve a rename. It also tells the agent to re-read status.dnsConfig after binding. It stops short of naming when to prefer create_domain or how to scope with org, but usage context is otherwise clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Control Plane tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.