Probe Lucky connectivity, version, modules, and MCP settings. OpenToken is never returned.

List Lucky web listeners and their reverse-proxy routes in compact form (port, TLS, domains, backends). Use this before exposing a service.

Get a compact view of one Lucky web listener and its routes by rule key.

Idempotently attach a hostname to an existing Lucky HTTPS/HTTP listener and reverse-proxy it to a backend URL. Reuses the current TLS listener; does not create a new listen port. Domain should be a hostname without http://. Backend should be a full URL such as http://127.0.0.1:3000. If the domain already exists, only the backend (and optional name/auth) is updated.

Remove the reverse-proxy route for a hostname from its Lucky listener. The listener itself is not deleted.

Enable or disable the reverse-proxy route for a hostname without deleting it.

Read recent access logs for a hostname, a route, or the whole web module. Useful for 502 debugging.

List SSL certificates in compact form (name, domains, expiry). PEM material is never returned.

Get compact certificate metadata by key. Private keys are not returned.

Attach an existing Lucky certificate to a web listener and enable TLS. Select the listener with rule_key, listen_port, or a hostname already on that listener.

Upload a custom certificate and private key to Lucky. Prefer lucky_bind_cert for Let's Encrypt certs that already exist in Lucky.

Trigger ACME/manual sync for an existing certificate key.

List port-forward rules in compact form (listen port, target, protocol).

Idempotently map an external listen port to an internal ip:port. Matching is by listen_port + protocol unless key is provided. Does not send Lucky's full native object.

Delete a port-forward rule by key.

List DDNS tasks in compact form (provider, domains, last IP). Provider secrets are redacted. Creating a new provider task is provider-specific; use lucky_api_call only if you already have a native payload.

Force one DDNS task to update now.

List STUN/NAT mapping rules (name, listen port, public address when known).

Send a Wake-on-LAN packet. Identify the device by key, name, or MAC.

Idempotent by name (or key). expression is a cron spec; command is the shell/http payload Lucky should run.

Merge a partial patch into the FTP configure object. Secrets in the response are redacted.

Merge a partial patch into the WebDAV configure object. Secrets in the response are redacted.

List Docker containers, images, volumes, and compose projects visible to Lucky. Read-only.

List security groups, grants, and users. Passwords are redacted. Creating users with passwords is not exposed as a dedicated tool.

Query centralized logs. Pass Lucky's native query object; common fields are search, limit, and location.

List filesystem roots, or files under a path, as Lucky sees them.

Host overview, connections, processes, module overview, and network interfaces. Process kill is not available.

Cloudflared tunnels plus Coraza WAF instances.

Passwords and private keys are redacted. SFTP file operations are not exposed.

Idempotent by name. Stores host/user/port; password is optional and will be redacted in responses.

Read Lucky base settings. Passwords, OpenToken, and other secrets are redacted. Updating admin account, password, or OpenToken is not available.

List Lucky API prefixes this MCP is willing to call via lucky_api_call.

Escape hatch for allowlisted Lucky APIs. Login, admin password, OpenToken, 2FA, restore, reboot, OAuth login, and process kill are blocked. Prefer dedicated tools when one exists.