[READ] List stored backups with id, name, type, creationTime.

Args: target: Veeam target name from config; omit to use the default.

[READ] List the protected objects (VMs/agents) inside a stored backup.

Args: backup_id: Veeam backup id (see backup_list). target: Veeam target name from config.

[READ] Triage recent backup-job sessions: flag every Failed/Warning run.

Pulls the recent sessions, fetches the failing log records for each bad run, and categorizes the likely cause (repository full, source/guest unreachable, credential/VSS failure, retry exhaustion) worst-first, citing the session result and the matched error substring for every finding.

Args: target: Veeam target name from config; omit to use the default.

[READ] Flag backup repositories running low on free space.

Pulls per-repository capacity state and reports worst-first findings for any repository under the free-space thresholds (<15% warn, <10% critical), each citing the measured free% and free bytes plus an extend/offload/retention action.

Args: target: Veeam target name from config; omit to use the default.

[READ] List managed servers (id, name, type, description).

Args: target: Veeam target name from config; omit to use the default.

[READ] List backup proxies (id, name, type, server).

Args: target: Veeam target name from config; omit to use the default.

[READ] List backup jobs with id, name, type, status, lastResult.

Use job_get for full detail of a single job.

Args: target: Veeam target name from config; omit to use the default.

[READ] Return detail for a single backup job by id.

Args: job_id: Veeam job id (see job_list). target: Veeam target name from config.

[WRITE] Start a backup job. Runs as an async session. Inverse: job_stop.

Poll progress with session_list / session_get; do not re-issue. Pass dry_run=True to preview.

Args: job_id: Veeam job id. dry_run: If True, preview without starting. target: Veeam target name from config.

[WRITE] Stop a running backup job. Inverse: job_start.

Pass dry_run=True to preview.

Args: job_id: Veeam job id. dry_run: If True, preview without stopping. target: Veeam target name from config.

[WRITE] Retry a failed backup job (re-runs failed objects only).

Runs as an async session — poll with session_list / session_get. Inverse: job_stop (cancels the in-flight retry). Pass dry_run=True to preview.

Args: job_id: Veeam job id. dry_run: If True, preview without retrying. target: Veeam target name from config.

[WRITE] Enable a backup job (clears the disabled flag). Inverse: job_disable.

Pass dry_run=True to preview.

Args: job_id: Veeam job id. dry_run: If True, preview without enabling. target: Veeam target name from config.

[WRITE] Disable a backup job (skips scheduled runs). Inverse: job_enable.

Pass dry_run=True to preview.

Args: job_id: Veeam job id. dry_run: If True, preview without disabling. target: Veeam target name from config.

[READ] One-shot health summary: jobs by last result, repos near full, running sessions.

Call this first to triage a Veeam environment before drilling into a specific job, repository, or session.

Args: target: Veeam target name from config; omit to use the default.

[READ] List backup repositories with id, name, type, path.

Args: target: Veeam target name from config; omit to use the default.

[READ] Detail for one repository incl. capacity/free/used when known.

Args: repository_id: Veeam repository id (see repository_list). target: Veeam target name from config.

[READ] Capacity summary for every repository (capacity/free/used/used%).

Args: target: Veeam target name from config; omit to use the default.

[READ] List restore points (id, name, creationTime, type).

Pass backup_id to filter to one backup's restore points (preview — server filter support varies by Veeam version).

Args: backup_id: Optional Veeam backup id (see backup_list) to filter by. target: Veeam target name from config; omit to use the default.

[WRITE] Start a VM restore from a restore point. IRREVERSIBLE — no undo token.

Overwrites or creates a VM; confirm with the user before calling. Runs as an async session — poll with session_list / session_get. Pass dry_run=True to preview: the preview resolves the opaque restore-point id to the VM name and creation time it would restore, so there is something real to confirm.

Refuses when that VM name matches the configured VBR host — with no target mapping this is a restore-to-original, so it would overwrite the Veeam server serving this API. The name check is a safety net, not a proof (a VM display name is not a hostname) and it fails open when the restore point cannot be resolved; read the preview before approving.

Args: restore_point_id: Restore point id (see restore_list_points). dry_run: If True, preview without restoring. target: Veeam target name from config.

[READ] List recent sessions with id, name, type, state, result.

Args: target: Veeam target name from config; omit to use the default.

[READ] Poll one session by id to check job/restore progress.

Use after job_start or start_vm_restore to follow the operation instead of re-issuing it.

Args: session_id: Veeam session id (see session_list). target: Veeam target name from config.

[READ] Return the log records (events) of one session.

Use to see why a session failed instead of re-running the job blind.

Args: session_id: Veeam session id (see session_list). target: Veeam target name from config.

[WRITE] Stop a running session (cancels the underlying operation).

No undo token — a stopped session must be re-issued via the originating job/restore. Pass dry_run=True to preview.

Args: session_id: Veeam session id (see session_list). dry_run: If True, preview without stopping. target: Veeam target name from config.

[READ] List recorded, not-yet-applied undo tokens (most recent first).

Each entry names the original tool, the inverse tool that undo_apply would run, and a human note. Use the undoId with undo_apply.

Returns an envelope rather than a bare list::

{"undos": [...], "returned": 50, "limit": 50, "truncated": true}

so a truncated read announces itself. A bare list cannot say "there is more" — the consumer has to infer it from the length happening to equal the limit, and a smaller local model faced with a capped result tends to report that it has seen every token. One extra row is requested so truncated is measured rather than guessed from a length coincidence.

Each entry carries effectVerified. False means the original write lost its response, so the change it reverses is PROBABLE, not confirmed — check the live state before applying, and do not report the result as a restore of a state that may never have been reached.

Args: limit: Max rows to return (default 50, capped at 500). target: Unused (undo state is host-local); accepted for CLI uniformity.

[WRITE][risk=medium] Apply a recorded undo by dispatching its inverse tool.

The inverse runs through its own governed tool, so it is audited under its own risk tier. Pass dry_run=True to preview the inverse call without executing it. A token can only be applied once.

Args: undo_id: The undoId from undo_list (or an _undo_id in a write result). dry_run: If True, preview the inverse tool + params without running it. target: Passed through to the inverse tool when it accepts a target.