Control Plane

Update a Workload

update_workload

DestructiveIdempotent

Update a workload (PATCH: only the fields passed change). Type and name are immutable. A cron workload takes schedule, job policy, suspend, capacityAI, and containers here, not autoscaling, timeoutSeconds, or debug; schedule and job fields are rejected on other types. Read it with get_resource first so a rollback exists, and never downgrade probes or autoscaling silently. loadBalancer, sidecar, extras, and requestRetryPolicy are set by the configure_workload_* tools, which need ?toolsets=full. A new image or exposure for an app: deploy_app.

Input Schema

Name	Required	Description
`gvc`	Yes	GVC name.
`org`	No	Organization slug.
`name`	Yes	Workload name. Immutable: renaming is delete and recreate, which loses the URL and internal DNS.
`tags`	No	Add or update tags without replacing the full set. Submit an empty list to clear all tags.
`debug`	No	Enable or disable spec.defaultOptions.debug. Not valid for a cron workload.
`public`	No	true adds 0.0.0.0/0 to the external inbound and outbound allow lists and keeps every other rule. false removes only 0.0.0.0/0 and ::/0 from external inbound. Mutually exclusive with firewallConfig.
`suspend`	No	Enable or disable spec.defaultOptions.suspend (for a cron workload, pauses/resumes scheduled runs)
`schedule`	No	New cron schedule (NUMERIC 5-field expression, e.g. "0 /6 * *" — no macros or day/month names). Only valid when the target workload is type "cron".
`multiZone`	No	{ enabled: true } spreads replicas across the availability zones of each location; by default they stay in one zone
`capacityAI`	No	Enable or disable spec.defaultOptions.capacityAI (default ON for serverless/standard/cron; on cron the new reservation takes effect at the next scheduled run). Not for a vm workload: a VM always reserves its full cpu and memory. Explicit true is rejected with the cpu metric and with GPUs.
`containers`	No	Optional container patches, merged by required `name` into existing containers. Minimal patch item is { "name": "app" }; other containers are preserved. Set only fields you want to change. An unknown name ADDS a new container and must include image.
`autoscaling`	No	Autoscaling patch → merged key-by-key into spec.defaultOptions.autoscaling.
`description`	No	Update workload description
`historyLimit`	No	Number of completed job instances to retain (default 5)
`identityLink`	No	Identity the workload runs as, for cloud and secret access, e.g. //identity/my-id. For a secret, grant_workload_secret_access sets it.
`localOptions`	No	Per-location overrides, merged by location into spec.localOptions; other locations keep theirs. An override replaces defaultOptions in its location, and later defaultOptions changes skip it. An existing override takes only the given fields; a new one starts as a copy of defaultOptions plus them.
`removeTagKeys`	No	Tag keys to remove from the resource.
`restartPolicy`	No	What to do when a job instance fails
`firewallConfig`	No	Replace the firewall config wholesale.
`rolloutOptions`	No	How replicas are replaced during a rollout and shut down; the given fields merge into the stored ones.
`timeoutSeconds`	No	Set spec.defaultOptions.timeoutSeconds — max request duration (platform default 5s; serverless caps at 600)
`securityOptions`	No	User and volume group for every container; the given fields merge into the stored ones.
`concurrencyPolicy`	No	What to do when a run is due while a prior run is still active (default Forbid)
`removeIdentityLink`	No	true deletes spec.identityLink, revoking the cloud/secret access it granted.
`removeLocalOptions`	No	Location links whose override to delete, e.g. //location/aws-us-east-2; they then follow defaultOptions. A location also in localOptions is rebuilt from defaultOptions plus its fields.
`supportDynamicTags`	No	Enable or disable spec.supportDynamicTags (detects image digest changes)
`activeDeadlineSeconds`	No	Max seconds to wait for the job to complete before it is stopped
`removeSecurityOptions`	No	true deletes spec.securityOptions: processes run as the image user and volumes keep their default owner.
`capacityAIUpdateMinutes`	No	Fewest minutes between Capacity AI reservation changes, at least 2

Output Schema

Name	Required	Description
`ok`	Yes
`data`	No	The full result. Read this, not only the summary.
`details`	No
`summary`	Yes
`nextSteps`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed8 schema fields changedOct 28, 2026

changedInput schema / properties / capacityAI / description

Previous value: -"Enable or disable spec.defaultOptions.capacityAI — applies to every type (default ON for serverless/standard/cron; on cron the new reservation takes effect at the next scheduled run). Explicit true is rejected with the cpu metric and with GPUs."New value: +"Enable or disable spec.defaultOptions.capacityAI (default ON for serverless/standard/cron; on cron the new reservation takes effect at the next scheduled run). Not for a vm workload: a VM always reserves its full cpu and memory. Explicit true is rejected with the cpu metric and with GPUs."

addedInput schema / properties / capacityAIUpdateMinutes

Added value: +{
+  "description": "Fewest minutes between Capacity AI reservation changes, at least 2",
+  "minimum": 2,
+  "type": "integer"
+}

addedInput schema / properties / localOptions

Added value: +{
+  "description": "Per-location overrides, merged by location into spec.localOptions; other locations keep theirs. An override replaces defaultOptions in its location, and later defaultOptions changes skip it. An existing override takes only the given fields; a new one starts as a copy of defaultOptions plus them.",
+  "items": {
+    "description": "One location's options, in place of defaultOptions",
+    "properties": {
+      "autoscaling": {
+        "description": "This location's autoscaling. Same fields as the top-level autoscaling, merged key by key",
+        "type": "object"
+      },
+      "capacityAI": {
+        "description": "Dynamic CPU/memory reservation from historical usage. Default on, except stateful. Explicitly true is rejected with the cpu metric and with GPUs.",
+        "type": "boolean"
+      },
+      "capacityAIUpdateMinutes": {
+        "description": "Fewest minutes between Capacity AI reservation changes, at least 2",
+        "minimum": 2,
+        "type": "integer"
+      },
+      "debug": {
+        "description": "Enable debug response headers when \"x-cpln-debug: true\" is sent",
+        "type": "boolean"
+      },
+      "location": {
+        "description": "Location link this override applies to, e.g. //location/aws-us-east-2",
+        "type": "string"
+      },
+      "multiZone": {
+        "description": "{ enabled: true } spreads replicas across the availability zones of each location; by default they stay in one zone",
+        "properties": {
+          "enabled": {
+            "type": "boolean"
+          }
+        },
+        "type": "object"
+      },
+      "suspend": {
+        "description": "Suspend the workload (no replicas run)",
+        "type": "boolean"
+      },
+      "timeoutSeconds": {
+        "description": "Max request duration in seconds (platform default 5; serverless caps at 600)",
+        "maximum": 3600,
+        "minimum": 1,
+        "type": "integer"
+      }
+    },
+    "required": [
+      "location"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

addedInput schema / properties / multiZone

Added value: +{
+  "description": "{ enabled: true } spreads replicas across the availability zones of each location; by default they stay in one zone",
+  "properties": {
+    "enabled": {
+      "type": "boolean"
+    }
+  },
+  "type": "object"
+}

addedInput schema / properties / removeLocalOptions

Added value: +{
+  "description": "Location links whose override to delete, e.g. //location/aws-us-east-2; they then follow defaultOptions. A location also in localOptions is rebuilt from defaultOptions plus its fields.",
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}

addedInput schema / properties / removeSecurityOptions

Added value: +{
+  "description": "true deletes spec.securityOptions: processes run as the image user and volumes keep their default owner.",
+  "type": "boolean"
+}

addedInput schema / properties / rolloutOptions

Added value: +{
+  "description": "How replicas are replaced during a rollout and shut down; the given fields merge into the stored ones.",
+  "properties": {
+    "maxSurgeReplicas": {
+      "description": "Max replicas created above desired count during a rollout, e.g. \"1\" or \"25%\" (default 25%; standard only)",
+      "type": "string"
+    },
+    "maxUnavailableReplicas": {
+      "description": "Max replicas unavailable during a rollout, e.g. \"1\" or \"25%\" (default 25%; standard only)",
+      "type": "string"
+    },
+    "minReadySeconds": {
+      "description": "Seconds a new replica must stay healthy before the rollout moves on (default 0; standard and stateful)",
+      "minimum": 0,
+      "type": "integer"
+    },
+    "rolloutOnReferenceChange": {
+      "description": "true restarts replicas whenever a secret or the identity the workload uses changes",
+      "type": "boolean"
+    },
+    "scalingPolicy": {
+      "description": "Start and stop replicas in order (OrderedReady, default) or all at once (stateful only)",
+      "enum": [
+        "OrderedReady",
+        "Parallel"
+      ],
+      "type": "string"
+    },
+    "terminationGracePeriodSeconds": {
+      "description": "Graceful termination window incl. preStop hook (default 90; max 900 unless cpln/relaxGracePeriodMax tag)",
+      "maximum": 3600,
+      "minimum": 0,
+      "type": "number"
+    }
+  },
+  "type": "object"
+}

addedInput schema / properties / securityOptions

Added value: +{
+  "description": "User and volume group for every container; the given fields merge into the stored ones.",
+  "properties": {
+    "filesystemGroupId": {
+      "description": "Group id that owns mounted volumes, so a non-root user can write them",
+      "maximum": 65534,
+      "minimum": 1,
+      "type": "integer"
+    },
+    "runAsUser": {
+      "description": "User id for every container process (unset: the image user). Avoid 1337, the mesh proxy uid: its traffic bypasses the sidecar, losing mTLS and firewall enforcement.",
+      "maximum": 65534,
+      "minimum": 1,
+      "type": "integer"
+    }
+  },
+  "type": "object"
+}

Changed4 schema fields changedOct 22, 2026

changedInput schema / properties / containers / items / properties / minCpu / description

Previous value: -"Minimum CPU when CapacityAI is enabled. On stateful (no CapacityAI) it is the static reservation while cpu stays the burst ceiling — stateful needs cpu:minCpu ratio ≤ 4 and gap ≤ 4000m. Min 25m; must be ≤ cpu."New value: +"Minimum CPU when CapacityAI is enabled. On stateful with CapacityAI off (its default) it is the static reservation while cpu stays the burst ceiling, and needs cpu:minCpu ratio ≤ 4 and gap ≤ 4000m. Min 25m; must be ≤ cpu."

changedInput schema / properties / containers / items / properties / minMemory / description

Previous value: -"Minimum memory when CapacityAI is enabled. On stateful (no CapacityAI) it is the static reservation while memory stays the burst ceiling — stateful needs memory:minMemory ratio ≤ 4 and gap ≤ 4096Mi. Min 32Mi; must be ≤ memory."New value: +"Minimum memory when CapacityAI is enabled. On stateful with CapacityAI off (its default) it is the static reservation while memory stays the burst ceiling, and needs memory:minMemory ratio ≤ 4 and gap ≤ 4096Mi. Min 32Mi; must be ≤ memory."

changedInput schema / properties / gvc / description

Previous value: -"GVC slug. If the user named none, list_resources (kind \"gvc\") and let them choose."New value: +"GVC name."

changedInput schema / properties / public / description

Previous value: -"Convenience shortcut: opens the external firewall BOTH ways — inbound 0.0.0.0/0 AND outbound 0.0.0.0/0. Mutually exclusive with firewallConfig (an explicit firewallConfig overrides it)."New value: +"true adds 0.0.0.0/0 to the external inbound and outbound allow lists and keeps every other rule. false removes only 0.0.0.0/0 and ::/0 from external inbound. Mutually exclusive with firewallConfig."

Changed96 schema fields changedSep 30, 2026

removedInput schema / $schema

Removed value: -"http://json-schema.org/draft-07/schema#"

removedInput schema / additionalProperties
```
Removed value: -false
```
removedInput schema / properties / autoscaling / additionalProperties
```
Removed value: -false
```
removedInput schema / properties / autoscaling / properties / keda / additionalProperties
```
Removed value: -false
```

changedInput schema / properties / autoscaling / properties / keda / description

Previous value: -"KEDA scaling configuration (use with metric=\"keda\"; standard/stateful only). The GVC must enable KEDA FIRST — update_gvc with spec.keda.enabled: true. Trigger auth secrets are listed in the GVC spec.keda.secrets and referenced via authenticationRef.name. When a trigger source is itself a Control Plane workload, that workload's internal firewall must allow cpln://internal/keda in inboundAllowWorkload."New value: +"For metric keda on standard or stateful. The GVC needs spec.keda.enabled first (update_gvc); trigger auth secrets are listed in its spec.keda.secrets. A workload used as a trigger source must admit cpln://internal/keda. Shape: {triggers: [{type, metadata, name, metricType, authenticationRef: {name}}], advanced, fallback, pollingInterval, cooldownPeriod}."

removedInput schema / properties / autoscaling / properties / keda / properties

Removed value: -{
-  "advanced": {
-    "additionalProperties": false,
-    "properties": {
-      "scalingModifiers": {
-        "additionalProperties": false,
-        "properties": {
-          "activationTarget": {
-            "description": "New activation target value for the composed metric",
-            "type": "string"
-          },
-          "formula": {
-            "description": "Formula composing metrics together (mathematical/conditional statements)",
-            "type": "string"
-          },
-          "metricType": {
-            "enum": [
-              "AverageValue",
-              "Value",
-              "Utilization"
-            ],
-            "type": "string"
-          },
-          "target": {
-            "description": "New target value for the composed metric",
-            "type": "string"
-          }
-        },
-        "type": "object"
-      }
-    },
-    "type": "object"
-  },
-  "cooldownPeriod": {
-    "minimum": 1,
-    "type": "integer"
-  },
-  "fallback": {
-    "additionalProperties": false,
-    "properties": {
-      "behavior": {
-        "enum": [
-          "static",
-          "currentReplicas",
-          "currentReplicasIfHigher",
-          "currentReplicasIfLower"
-        ],
-        "type": "string"
-      },
-      "failureThreshold": {
-        "description": "Consecutive failures required to trigger fallback",
-        "type": "integer"
-      },
-      "replicas": {
-        "description": "Replica count to scale to when fallback triggers",
-        "type": "integer"
-      }
-    },
-    "required": [
-      "failureThreshold",
-      "replicas"
-    ],
-    "type": "object"
-  },
-  "initialCooldownPeriod": {
-    "minimum": 1,
-    "type": "integer"
-  },
-  "pollingInterval": {
-    "minimum": 1,
-    "type": "integer"
-  },
-  "triggers": {
-    "description": "KEDA triggers used for scaling",
-    "items": {
-      "additionalProperties": false,
-      "properties": {
-        "authenticationRef": {
-          "additionalProperties": false,
-          "properties": {
-            "name": {
-              "description": "Name of a secret listed in the GVC spec.keda.secrets",
-              "minLength": 1,
-              "type": "string"
-            }
-          },
-          "required": [
-            "name"
-          ],
-          "type": "object"
-        },
-        "metadata": {
-          "additionalProperties": {
-            "type": "string"
-          },
-          "description": "Trigger configuration parameters",
-          "type": "object"
-        },
-        "metricType": {
-          "description": "Metric type used for scaling",
-          "enum": [
-            "AverageValue",
-            "Value",
-            "Utilization"
-          ],
-          "type": "string"
-        },
-        "name": {
-          "description": "Optional trigger name",
-          "type": "string"
-        },
-        "type": {
-          "description": "KEDA trigger type, e.g. \"prometheus\", \"aws-sqs\"",
-          "minLength": 1,
-          "type": "string"
-        },
-        "useCachedMetrics": {
-          "description": "Cache metric values during the polling interval",
-          "type": "boolean"
-        }
-      },
-      "required": [
-        "type"
-      ],
-      "type": "object"
-    },
-    "type": "array"
-  }
-}

changedInput schema / properties / autoscaling / properties / metric / description

Previous value: -"Single scaling metric (mutually exclusive with multi). Allowed values depend on the workload TYPE: serverless → concurrency, cpu, memory, rps, disabled; standard/stateful → cpu, memory, latency, rps, keda, disabled. concurrency is serverless-ONLY; latency, keda, and multi are standard/stateful-only. Omitted → serverless defaults to concurrency; standard/stateful default to cpu — and the cpu default silently disables Capacity AI. Choose the metric that matches the workload type and its traffic shape (rps/concurrency for HTTP, cpu/memory for compute)."New value: +"Single metric, exclusive with multi. serverless: concurrency (default), cpu, memory, rps, disabled. standard and stateful: cpu (turns Capacity AI off), memory, latency, rps, keda, disabled. Omitted on standard with Capacity AI on, it is disabled, which holds minScale replicas. rps or concurrency for HTTP, cpu or memory for compute."

removedInput schema / properties / autoscaling / properties / multi / items / additionalProperties
```
Removed value: -false
```
removedInput schema / properties / autoscaling / properties / multi / minItems
```
Removed value: -1
```
removedInput schema / properties / containers / items / additionalProperties
```
Removed value: -false
```
removedInput schema / properties / containers / items / properties / command / maxLength
```
Removed value: -256
```
removedInput schema / properties / containers / items / properties / cpu / maxLength
```
Removed value: -20
```
removedInput schema / properties / containers / items / properties / cpu / pattern
```
Removed value: -"^([0-9]+)(m|(\\.[0-9]{1,3}))?$"
```

changedInput schema / properties / containers / items / properties / env / description

Previous value: -"Optional environment variables for this container. Omit to leave unset."New value: +"Optional environment variables for this container. Omit to leave unset. Grant access to each referenced secret with grant_workload_secret_access."

removedInput schema / properties / containers / items / properties / env / items / additionalProperties
```
Removed value: -false
```
removedInput schema / properties / containers / items / properties / env / items / properties / name / maxLength
```
Removed value: -120
```
removedInput schema / properties / containers / items / properties / env / items / properties / name / minLength
```
Removed value: -1
```
removedInput schema / properties / containers / items / properties / env / items / properties / name / pattern
```
Removed value: -"^[-._a-zA-Z][-._a-zA-Z0-9]*$"
```

changedInput schema / properties / containers / items / properties / env / items / properties / value / description

Previous value: -"Literal value, or a secret reference like cpln://secret/<name>.<key>. Secret refs require the workload identity to have reveal permission or the deployment PAUSES — after create_workload, grant it with grant_workload_secret_access."New value: +"Non-sensitive literal value, or a secret reference like cpln://secret/<name>.<key>. Never send passwords, API keys, or tokens. The workload identity needs reveal permission on a referenced secret, or the deployment PAUSES."

removedInput schema / properties / containers / items / properties / env / items / properties / value / maxLength
```
Removed value: -4096
```
removedInput schema / properties / containers / items / properties / gpu / additionalProperties
```
Removed value: -false
```

removedInput schema / properties / containers / items / properties / gpu / properties

Removed value: -{
-  "custom": {
-    "additionalProperties": false,
-    "description": "Custom (non-NVIDIA) GPU resource specification",
-    "properties": {
-      "quantity": {
-        "description": "Number of custom GPUs to allocate (default 1)",
-        "maximum": 8,
-        "minimum": 0,
-        "type": "number"
-      },
-      "resource": {
-        "description": "Custom GPU resource name (e.g., amd.com/gpu)",
-        "maxLength": 64,
-        "pattern": "^[a-zA-Z0-9./_-]*$",
-        "type": "string"
-      },
-      "runtimeClass": {
-        "description": "Runtime class for the custom GPU",
-        "maxLength": 64,
-        "pattern": "^[a-zA-Z0-9./]*$",
-        "type": "string"
-      }
-    },
-    "required": [
-      "resource"
-    ],
-    "type": "object"
-  },
-  "nvidia": {
-    "additionalProperties": false,
-    "description": "NVIDIA GPU resource specification",
-    "properties": {
-      "model": {
-        "description": "NVIDIA GPU model",
-        "enum": [
-          "t4",
-          "a10g"
-        ],
-        "type": "string"
-      },
-      "quantity": {
-        "description": "Number of NVIDIA GPUs to allocate (default 1)",
-        "maximum": 4,
-        "minimum": 0,
-        "type": "number"
-      }
-    },
-    "required": [
-      "model"
-    ],
-    "type": "object"
-  }
-}

changedInput schema / properties / containers / items / properties / image / description

Previous value: -"Image reference (required): org-internal = //image/NAME:TAG (long form /org/<org>/image/NAME:TAG also valid; no pull secret needed); public Docker Hub = bare (nginx:latest, never docker.io/...); other registries = exact host path — PRIVATE external registries need a pull secret on the GVC (docker, ecr, or gcp secret types only). Must be linux/amd64."New value: +"Image: //image/NAME:TAG for this org, or an exact external reference. A private external registry needs a docker, ecr, or gcp pull secret on the GVC."

removedInput schema / properties / containers / items / properties / image / minLength
```
Removed value: -1
```
removedInput schema / properties / containers / items / properties / lifecycle / additionalProperties
```
Removed value: -false
```

removedInput schema / properties / containers / items / properties / lifecycle / properties

Removed value: -{
-  "postStart": {
-    "additionalProperties": false,
-    "description": "Action to perform after the container starts",
-    "properties": {
-      "exec": {
-        "additionalProperties": false,
-        "properties": {
-          "command": {
-            "description": "Command run immediately after the container starts",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          }
-        },
-        "required": [
-          "command"
-        ],
-        "type": "object"
-      }
-    },
-    "required": [
-      "exec"
-    ],
-    "type": "object"
-  },
-  "preStop": {
-    "additionalProperties": false,
-    "description": "Action to perform before the container stops. When omitted the platform runs a default preStop of sh -c \"sleep N\" — an image without sleep (e.g. distroless) or a custom preStop that fails causes ALL containers in the replica to be SIGKILLed immediately.",
-    "properties": {
-      "exec": {
-        "additionalProperties": false,
-        "properties": {
-          "command": {
-            "description": "Command run immediately before the container stops",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          }
-        },
-        "required": [
-          "command"
-        ],
-        "type": "object"
-      }
-    },
-    "required": [
-      "exec"
-    ],
-    "type": "object"
-  }
-}

removedInput schema / properties / containers / items / properties / livenessProbe / additionalProperties
```
Removed value: -false
```

changedInput schema / properties / containers / items / properties / livenessProbe / description

Previous value: -"Optional probe that restarts the container when it fails. If present, set exactly one handler."New value: +"Optional probe that restarts the container when it fails."

removedInput schema / properties / containers / items / properties / livenessProbe / properties

Removed value: -{
-  "exec": {
-    "additionalProperties": false,
-    "description": "Optional probe handler: execute a command to check health (exit 0 = healthy). Use exactly one handler total.",
-    "properties": {
-      "command": {
-        "description": "Command to execute for the health check",
-        "items": {
-          "type": "string"
-        },
-        "minItems": 1,
-        "type": "array"
-      }
-    },
-    "required": [
-      "command"
-    ],
-    "type": "object"
-  },
-  "failureThreshold": {
-    "description": "Consecutive failures to be considered failed (default 3)",
-    "maximum": 20,
-    "minimum": 1,
-    "type": "integer"
-  },
-  "grpc": {
-    "additionalProperties": false,
-    "description": "Optional probe handler: perform a gRPC health check. Use exactly one handler total.",
-    "properties": {
-      "port": {
-        "description": "Port to perform the gRPC health check on",
-        "maximum": 65535,
-        "minimum": 80,
-        "type": "integer"
-      }
-    },
-    "required": [
-      "port"
-    ],
-    "type": "object"
-  },
-  "httpGet": {
-    "additionalProperties": false,
-    "description": "Optional probe handler: perform an HTTP GET health check (2xx/3xx = healthy). Use exactly one handler total.",
-    "properties": {
-      "httpHeaders": {
-        "description": "Custom HTTP headers to include in the health check request",
-        "items": {
-          "additionalProperties": false,
-          "properties": {
-            "name": {
-              "description": "HTTP header name",
-              "maxLength": 128,
-              "type": "string"
-            },
-            "value": {
-              "description": "HTTP header value",
-              "maxLength": 128,
-              "type": "string"
-            }
-          },
-          "required": [
-            "name",
-            "value"
-          ],
-          "type": "object"
-        },
-        "type": "array"
-      },
-      "path": {
-        "description": "HTTP path to request (default \"/\")",
-        "maxLength": 256,
-        "type": "string"
-      },
-      "port": {
-        "description": "Port to perform the HTTP health check on (defaults to the container port)",
-        "maximum": 65535,
-        "minimum": 80,
-        "type": "integer"
-      },
-      "scheme": {
-        "description": "HTTP scheme to use (default HTTP)",
-        "enum": [
-          "HTTP",
-          "HTTPS"
-        ],
-        "type": "string"
-      }
-    },
-    "type": "object"
-  },
-  "initialDelaySeconds": {
-    "description": "Seconds to wait before the first check (readiness default 10, liveness default 60)",
-    "maximum": 600,
-    "minimum": 0,
-    "type": "integer"
-  },
-  "periodSeconds": {
-    "description": "How often to perform the check (default 10)",
-    "maximum": 600,
-    "minimum": 1,
-    "type": "integer"
-  },
-  "successThreshold": {
-    "description": "Consecutive successes to be considered healthy (default 1)",
-    "maximum": 20,
-    "minimum": 1,
-    "type": "integer"
-  },
-  "tcpSocket": {
-    "additionalProperties": false,
-    "description": "Optional probe handler: perform a TCP socket health check. Use exactly one handler total.",
-    "properties": {
-      "port": {
-        "description": "Port to perform the TCP socket check on (defaults to the container port)",
-        "maximum": 65535,
-        "minimum": 80,
-        "type": "integer"
-      }
-    },
-    "type": "object"
-  },
-  "timeoutSeconds": {
-    "description": "Seconds after which the check times out (default 1)",
-    "maximum": 600,
-    "minimum": 1,
-    "type": "integer"
-  }
-}

removedInput schema / properties / containers / items / properties / memory / maxLength
```
Removed value: -20
```
removedInput schema / properties / containers / items / properties / memory / pattern
```
Removed value: -"^[0-9]+(\\.[0-9]{1,3})?(G|M|k|Gi|Mi|Ki)?$"
```
removedInput schema / properties / containers / items / properties / metrics / additionalProperties
```
Removed value: -false
```

removedInput schema / properties / containers / items / properties / metrics / properties

Removed value: -{
-  "dropMetrics": {
-    "description": "Drop metrics whose names match these regex patterns",
-    "items": {
-      "type": "string"
-    },
-    "type": "array"
-  },
-  "path": {
-    "description": "HTTP path where Prometheus metrics are exposed (default /metrics)",
-    "maxLength": 128,
-    "type": "string"
-  },
-  "port": {
-    "description": "Port where Prometheus metrics are exposed",
-    "maximum": 65535,
-    "minimum": 80,
-    "type": "integer"
-  }
-}

removedInput schema / properties / containers / items / properties / metrics / required
```
Removed value: -[
-  "port"
-]
```
removedInput schema / properties / containers / items / properties / minCpu / maxLength
```
Removed value: -20
```
removedInput schema / properties / containers / items / properties / minCpu / pattern
```
Removed value: -"^([0-9]+)(m|(\\.[0-9]{1,3}))?$"
```
removedInput schema / properties / containers / items / properties / minMemory / maxLength
```
Removed value: -20
```
removedInput schema / properties / containers / items / properties / minMemory / pattern
```
Removed value: -"^[0-9]+(\\.[0-9]{1,3})?(G|M|k|Gi|Mi|Ki)?$"
```
removedInput schema / properties / containers / items / properties / name / maxLength
```
Removed value: -64
```
removedInput schema / properties / containers / items / properties / name / minLength
```
Removed value: -2
```
removedInput schema / properties / containers / items / properties / name / pattern
```
Removed value: -"^[a-z][a-z0-9-]*[a-z0-9]$"
```
removedInput schema / properties / containers / items / properties / ports / items / additionalProperties
```
Removed value: -false
```
removedInput schema / properties / containers / items / properties / readinessProbe / additionalProperties
```
Removed value: -false
```

changedInput schema / properties / containers / items / properties / readinessProbe / description

Previous value: -"Optional probe that gates whether the container receives traffic. If present, set exactly one handler."New value: +"Optional probe that gates whether the container receives traffic."

removedInput schema / properties / containers / items / properties / readinessProbe / properties

Removed value: -{
-  "exec": {
-    "additionalProperties": false,
-    "description": "Optional probe handler: execute a command to check health (exit 0 = healthy). Use exactly one handler total.",
-    "properties": {
-      "command": {
-        "description": "Command to execute for the health check",
-        "items": {
-          "type": "string"
-        },
-        "minItems": 1,
-        "type": "array"
-      }
-    },
-    "required": [
-      "command"
-    ],
-    "type": "object"
-  },
-  "failureThreshold": {
-    "description": "Consecutive failures to be considered failed (default 3)",
-    "maximum": 20,
-    "minimum": 1,
-    "type": "integer"
-  },
-  "grpc": {
-    "additionalProperties": false,
-    "description": "Optional probe handler: perform a gRPC health check. Use exactly one handler total.",
-    "properties": {
-      "port": {
-        "description": "Port to perform the gRPC health check on",
-        "maximum": 65535,
-        "minimum": 80,
-        "type": "integer"
-      }
-    },
-    "required": [
-      "port"
-    ],
-    "type": "object"
-  },
-  "httpGet": {
-    "additionalProperties": false,
-    "description": "Optional probe handler: perform an HTTP GET health check (2xx/3xx = healthy). Use exactly one handler total.",
-    "properties": {
-      "httpHeaders": {
-        "description": "Custom HTTP headers to include in the health check request",
-        "items": {
-          "additionalProperties": false,
-          "properties": {
-            "name": {
-              "description": "HTTP header name",
-              "maxLength": 128,
-              "type": "string"
-            },
-            "value": {
-              "description": "HTTP header value",
-              "maxLength": 128,
-              "type": "string"
-            }
-          },
-          "required": [
-            "name",
-            "value"
-          ],
-          "type": "object"
-        },
-        "type": "array"
-      },
-      "path": {
-        "description": "HTTP path to request (default \"/\")",
-        "maxLength": 256,
-        "type": "string"
-      },
-      "port": {
-        "description": "Port to perform the HTTP health check on (defaults to the container port)",
-        "maximum": 65535,
-        "minimum": 80,
-        "type": "integer"
-      },
-      "scheme": {
-        "description": "HTTP scheme to use (default HTTP)",
-        "enum": [
-          "HTTP",
-          "HTTPS"
-        ],
-        "type": "string"
-      }
-    },
-    "type": "object"
-  },
-  "initialDelaySeconds": {
-    "description": "Seconds to wait before the first check (readiness default 10, liveness default 60)",
-    "maximum": 600,
-    "minimum": 0,
-    "type": "integer"
-  },
-  "periodSeconds": {
-    "description": "How often to perform the check (default 10)",
-    "maximum": 600,
-    "minimum": 1,
-    "type": "integer"
-  },
-  "successThreshold": {
-    "description": "Consecutive successes to be considered healthy (default 1)",
-    "maximum": 20,
-    "minimum": 1,
-    "type": "integer"
-  },
-  "tcpSocket": {
-    "additionalProperties": false,
-    "description": "Optional probe handler: perform a TCP socket health check. Use exactly one handler total.",
-    "properties": {
-      "port": {
-        "description": "Port to perform the TCP socket check on (defaults to the container port)",
-        "maximum": 65535,
-        "minimum": 80,
-        "type": "integer"
-      }
-    },
-    "type": "object"
-  },
-  "timeoutSeconds": {
-    "description": "Seconds after which the check times out (default 1)",
-    "maximum": 600,
-    "minimum": 1,
-    "type": "integer"
-  }
-}

removedInput schema / properties / containers / items / properties / removeEnvNames / items / minLength
```
Removed value: -1
```

changedInput schema / properties / containers / items / properties / volumes / description

Previous value: -"Volume mounts for this container"New value: +"Volume mounts for this container."

removedInput schema / properties / containers / items / properties / volumes / items / additionalProperties
```
Removed value: -false
```

removedInput schema / properties / containers / items / properties / volumes / items / description

Removed value: -"Mount an object store bucket, volume set, secret, or scratch volume into the container"

removedInput schema / properties / containers / items / properties / volumes / items / properties

Removed value: -{
-  "path": {
-    "description": "Absolute mount path inside the container (required for non-vm workloads). /tmp, /var, /dev are reserved.",
-    "minLength": 1,
-    "type": "string"
-  },
-  "recoveryPolicy": {
-    "description": "For persistent volumes: retain (default) or recycle existing data on replica creation",
-    "enum": [
-      "retain",
-      "recycle"
-    ],
-    "type": "string"
-  },
-  "uri": {
-    "description": "Volume source URI: s3://bucket, gs://bucket, azureblob://account/container, azurefs://account/share, cpln://volumeset/<name>, cpln://secret/<name>, or scratch://<name>.",
-    "minLength": 1,
-    "pattern": "^(s3|gs|azureblob|azurefs|cpln|scratch|k8s):\\/\\/.+",
-    "type": "string"
-  }
-}

removedInput schema / properties / containers / items / properties / volumes / items / required
```
Removed value: -[
-  "uri",
-  "path"
-]
```
removedInput schema / properties / containers / items / properties / volumes / maxItems
```
Removed value: -15
```
removedInput schema / properties / containers / items / properties / workingDir / maxLength
```
Removed value: -128
```
removedInput schema / properties / containers / maxItems
```
Removed value: -8
```
removedInput schema / properties / containers / minItems
```
Removed value: -1
```
removedInput schema / properties / firewallConfig / additionalProperties
```
Removed value: -false
```
removedInput schema / properties / firewallConfig / properties / external / additionalProperties
```
Removed value: -false
```
removedInput schema / properties / firewallConfig / properties / external / properties / http / additionalProperties
```
Removed value: -false
```
removedInput schema / properties / firewallConfig / properties / external / properties / http / properties / inboundHeaderFilter / items / additionalProperties
```
Removed value: -false
```
removedInput schema / properties / firewallConfig / properties / external / properties / http / properties / inboundHeaderFilter / items / properties / key / maxLength
```
Removed value: -128
```
removedInput schema / properties / firewallConfig / properties / external / properties / inboundAllowCIDR / maxItems
```
Removed value: -250
```
removedInput schema / properties / firewallConfig / properties / external / properties / outboundAllowHostname / items / maxLength
```
Removed value: -128
```
removedInput schema / properties / firewallConfig / properties / external / properties / outboundAllowHostname / items / pattern
```
Removed value: -"^(?![0-9]+$)(?!.*-$)([*]?)(?!-)[a-z0-9-.]+$"
```
removedInput schema / properties / firewallConfig / properties / external / properties / outboundAllowPort / items / additionalProperties
```
Removed value: -false
```
removedInput schema / properties / firewallConfig / properties / internal / additionalProperties
```
Removed value: -false
```
removedInput schema / properties / firewallConfig / properties / internal / properties / inboundAllowWorkload / items / maxLength
```
Removed value: -256
```
removedInput schema / properties / firewallConfig / properties / internal / properties / inboundAllowWorkload / items / minLength
```
Removed value: -1
```

changedInput schema / properties / gvc / description

Previous value: -"GVC slug (lowercase kebab-case). Use the GVC the user named; otherwise discover with list_resources (kind=\"gvc\") and let them choose — never guess (a wrong GVC targets the wrong environment)."New value: +"GVC slug. If the user named none, list_resources (kind \"gvc\") and let them choose."

removedInput schema / properties / gvc / maxLength
```
Removed value: -63
```
removedInput schema / properties / gvc / minLength
```
Removed value: -1
```

removedInput schema / properties / gvc / pattern

Removed value: -"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$"

changedInput schema / properties / identityLink / description

Previous value: -"Identity link granting 3rd-party cloud resource access, e.g. //identity/my-id"New value: +"Identity the workload runs as, for cloud and secret access, e.g. //identity/my-id. For a secret, grant_workload_secret_access sets it."

removedInput schema / properties / identityLink / maxLength
```
Removed value: -256
```
removedInput schema / properties / identityLink / minLength
```
Removed value: -1
```
removedInput schema / properties / identityLink / pattern
```
Removed value: -"^(\\/org\\/[^/]+\\/.+|\\/\\/.+)$"
```

changedInput schema / properties / name / description

Previous value: -"Workload name (lowercase kebab-case, must start with a letter, max 49 chars, cannot end with -headless). The name is IMMUTABLE — \"renaming\" requires delete + recreate (loses public URL, internal DNS, policy targetLinks)."New value: +"Workload name. Immutable: renaming is delete and recreate, which loses the URL and internal DNS."

removedInput schema / properties / name / maxLength
```
Removed value: -49
```
removedInput schema / properties / name / minLength
```
Removed value: -2
```
removedInput schema / properties / name / pattern
```
Removed value: -"^[a-z]([-a-z0-9])*[a-z0-9]$"
```

changedInput schema / properties / org / description

Previous value: -"Organization slug (lowercase kebab-case). NEVER guess — if the user has not named one, ask. On org-not-found, stop and ask; do not retry variants."New value: +"Organization slug."

removedInput schema / properties / org / maxLength
```
Removed value: -63
```
removedInput schema / properties / org / minLength
```
Removed value: -1
```

removedInput schema / properties / org / pattern

Removed value: -"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$"

removedInput schema / properties / removeTagKeys / items / minLength
```
Removed value: -1
```
removedInput schema / properties / schedule / minLength
```
Removed value: -1
```
removedInput schema / properties / tags / items / additionalProperties
```
Removed value: -false
```
removedInput schema / properties / tags / items / properties / key / minLength
```
Removed value: -1
```
removedInput schema / properties / tags / maxItems
```
Removed value: -50
```

changedInput schema / required

Previous value: -[
-  "org",
-  "gvc",
-  "name"
-]New value: +[
+  "gvc",
+  "name"
+]

removedOutput schema / $schema

Removed value: -"http://json-schema.org/draft-07/schema#"

removedOutput schema / additionalProperties
```
Removed value: -false
```

changedOutput schema / properties / data / description

Previous value: -"The full machine-readable result — list rows, the resource object, query results. Read THIS, not just the summary."New value: +"The full result. Read this, not only the summary."

addedOutput schema / properties / details
```
Added value: +{
+  "type": "string"
+}
```

removedOutput schema / properties / nextSteps / description

Removed value: -"Recommended follow-up actions for this task, in order."

removedOutput schema / properties / ok / description
```
Removed value: -"Whether the call succeeded."
```
removedOutput schema / properties / summary / description
```
Removed value: -"One-line summary of the result."
```

Changed5 schema fields changedAug 21, 2026

changedInput schema / properties / capacityAI / description

Previous value: -"Enable or disable spec.defaultOptions.capacityAI (default ON for serverless/standard, stripped on stateful/cron; explicit true is rejected with the cpu metric and with GPUs). Not valid for a cron workload."New value: +"Enable or disable spec.defaultOptions.capacityAI — applies to every type (default ON for serverless/standard/cron; on cron the new reservation takes effect at the next scheduled run). Explicit true is rejected with the cpu metric and with GPUs."

changedInput schema / properties / containers / items / properties / gpu / properties / custom / properties / resource / pattern
```
Previous value: -"^[a-zA-Z0-9./]*$"New value: +"^[a-zA-Z0-9./_-]*$"
```

addedInput schema / properties / containers / items / properties / removeLivenessProbe

Added value: +{
+  "description": "true deletes the livenessProbe on this container.",
+  "type": "boolean"
+}

addedInput schema / properties / containers / items / properties / removeReadinessProbe

Added value: +{
+  "description": "true deletes the readinessProbe on this container.",
+  "type": "boolean"
+}

addedInput schema / properties / removeIdentityLink

Added value: +{
+  "description": "true deletes spec.identityLink, revoking the cloud/secret access it granted.",
+  "type": "boolean"
+}

Changed1 schema field changedAug 14, 2026

changedInput schema / properties / containers / items / properties / env / items / properties / value / description

Previous value: -"Literal value, or a secret reference like cpln://secret/<name>.<key>. Secret refs require the workload identity to have reveal permission or the deployment PAUSES — after create_workload, grant it with workload_reveal_secret."New value: +"Literal value, or a secret reference like cpln://secret/<name>.<key>. Secret refs require the workload identity to have reveal permission or the deployment PAUSES — after create_workload, grant it with grant_workload_secret_access."

First observedJun 28, 2026

TDQS

Score is being calculated.

All Control Plane tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.