Return device / system info (read-only).

Audit the device's readiness/recovery, security posture, and firmware (#80).

Read-only. Returns per-check findings with a tiered severity; a CRITICAL (e.g. no out-of-band reset path) is what should gate a subsequent destructive op. The most valuable finding is recovery-path — whether a hung guest can be reset at all when the KVM is remote. Served through the preflight cache (#225): stable posture may come from the last assessment, and a firmware change since then adds a firmware-delta finding of what cleared/regressed.

List the capabilities the target's driver supports (read-only, offline).

Structural — makes no network call and runs no preflight; it answers "which tools/actions can this device serve?" so you can pick the right interface up front (a Redfish BMC has no video; a PiKVM has no BootProgress). Returned in the capability enum's declaration order for stable output. live_evidence additionally names which device+firmware combos this driver has real-hardware run evidence for — structural support is not live verification; call support_matrix for per-combo evidence and healthcheck for this exact device+firmware.

What has actually been exercised on real hardware, per device+firmware+capability (read-only, offline — no device call).

Aggregated from the test-run ledger shipped in the package (the same data behind the wiki Hardware-Compatibility page), with each combo's derived maturity level (#98) joined from the shipped firmware registry. This is EVIDENCE, not a guarantee: a capability listed in never_exercised (or a combo with no row at all) is unverified on that hardware — treat it as mock-only/alpha maturity and confirm destructive steps with the user. status is "fail" when every recorded live attempt failed (e.g. RM1PE V1.5.1 firmware_update, #94/#95). Filters are case-insensitive; product matches as a substring.

Re-serve the bundled operating doctrine (read-only; offline, no device I/O).

The skill's playbooks ship inside this package; this tool re-serves them so a session that never loaded the skill file — or has long since compacted it away — can re-anchor on the written doctrine instead of a faded memory of it. Call with no topic to list the topics; call with one for that playbook's full text. Read recovery the moment a host goes dark or a snapshot fails, and interfaces before picking how to do an action you haven't done this session.

Report this server's current operating posture (read-only; offline, no device I/O — answers even when the device is down).

Call this after a context compaction, when resuming a long flow, or before planning act calls: it names the target, dry-run/read-only state, which effect gates are open (by class name only — opening one is operator-only, out of band), the approval posture, any live standing approvals (#192) with their scope and time left, the recent act journal, and the last wait_for_state result for the target. All journal/wait state is in-memory: a server restart empties it (and voids receipts and frame refs), so an empty journal after a restart is expected, not evidence nothing happened. Pair with healthcheck for device health and doctrine for the operating playbooks.

Return whether the host is powered on, plus ATX detail where the driver has it (read-only).

Return the device/host event log as text (read-only).

seek is seconds of lookback (0 = the whole buffer). This is the go-to diagnostic when video/streamer/encoder or power behaviour looks wrong: the text log names a fault (e.g. a stuck encoder behind a snapshot 503) that a screenshot cannot. Tail-follow is intentionally not exposed — it blocks over the server's synchronous transport.

Capture the current KVM screen (read-only).

Returns [json_text, image]: the JSON carries a frame_ref (host:generation:hash) — pass it back to the mouse tool as observed_frame_ref so an absolute click can be refused if the host rebooted or swapped media since you looked.

It also carries the live signal state (online/resolution/fps/format, #143) and unchanged_since_last_snapshot (#141): a byte-identical frame when the screen should have changed means the pixels are stale/cached — do NOT trust them as ground truth; check signal and logs instead.

Classify the current screen's boot/run phase (read-only).

Uses the server-side vision backend when configured; cheap on-device gates (power-off, no-signal, boot-progress, OCR rules) resolve with no credentials at all. Return shapes:

• server-side / cheap-gate → a dict with mode="server" + phase fields.

• no server vision → caller-side fallback, a [json_text, Image] list: classify the image yourself against the system_prompt / phases in the JSON block.

Wait (bounded) until the screen reaches a boot/run phase (read-only).

Server-side twin of CLI watch: polls cheap power/signal/boot-progress gates, then server-side vision, until phase (a classify_screen token; unknown tokens fail fast with the valid list) is observed. timeout is seconds, capped server-side at 300 — chain calls for longer waits. Success returns phase/confidence plus a frame_ref to pass to mouse as observed_frame_ref; a timeout returns reached=false with the last observed state (never a hang, never a raised error). With no server-side vision credentials only cheap-gate phases are waitable; others fail fast pointing at classify_screen polling. Holds the driver open up to timeout s. Details: doctrine topic 'interfaces'.

Change host power state. DESTRUCTIVE.

Gated by the power effect gate + per-invocation approval (elicitation, or confirm=true under standing policy); denials come back through the same path with a typed outcome (#234). The result carries an honest effect report (#168): verified is true/false when the driver has a trustworthy power signal (Redfish PowerState, a wired ATX LED), and null — with the reason and what to do instead — when it doesn't. A power action also invalidates prior snapshot frame refs (generation bump), so a stale mouse click can't land on the post-reboot screen.

Show the host's current boot override (Redfish BootSourceOverride) — read-only.

Reports enabled (Disabled/Once/Continuous), the normalized target, the mode (UEFI/Legacy, or null if the BMC doesn't expose it), and the allowable targets the BMC advertises — so an actuator knows what set_boot_device values this box will accept before trying one.

Set the next-boot (or persistent) boot device via BootSourceOverride. CONFIG MUTATION.

Gated by the config effect gate + per-invocation approval; denials come back through the same path with a typed outcome (#234). none clears the override; once=false makes it persistent; uefi=false selects legacy BIOS mode where the target exposes it. A target the BMC doesn't advertise fails fast (call boot_options first to see allowable).

Enable an Intel AMT redirection listener over WS-Man (Intel AMT/vPro only). CONFIG MUTATION.

feature='sol' opens the SOL/IDE-R listener (16994); feature='kvm' opens KVM redirection (5900) and sets the RFB password. Gated by the config effect gate + per-invocation approval (typed same-path denials, #234). consent_off=true (KVM only) DISABLES the on-screen user-consent prompt — a surveillance escalation — and additionally requires the dedicated KVM_PILOT_MCP_ALLOW_CONSENT_OFF operator gate (see README.md); leaving it false keeps the prompt.

Send a Wake-on-LAN magic packet to power the host on. POWER (soft).

Gated by the power effect gate + per-invocation approval (typed same-path denials, #234). mac defaults to the profile's mac; broadcast to its wol_broadcast. No KVM driver is contacted — WoL is a broadcast sent from the server's own host onto the target's L2 segment.

Type text on the managed host's console over the HID keyboard. DESTRUCTIVE.

Requires the operator to enable HID (KVM_PILOT_MCP_ALLOW_HID) and a per-invocation approval — a human elicitation when the client supports it, else an explicit confirm=true under the operator's standing policy.

Press a single key (a kvmd key code, e.g. Enter/Escape/F2). DESTRUCTIVE.

Same gating as type_text (HID input): KVM_PILOT_MCP_ALLOW_HID + approval.

Send a key chord — comma-separated kvmd key codes, e.g. ControlLeft,AltLeft,Delete or ControlLeft,AltLeft,F2. DESTRUCTIVE.

Gated by effect, not transport: a reboot/power chord (Ctrl+Alt+Del, Magic SysRq) is classified power_soft/power_hard and needs KVM_PILOT_MCP_ALLOW_POWER; an ordinary session chord is hid_control and needs KVM_PILOT_MCP_ALLOW_HID — so a reboot can't slip through the HID gate.

Send Ctrl+Alt+Del to the managed host. DESTRUCTIVE.

A reboot delivered over the keyboard — classified power_soft, so it needs KVM_PILOT_MCP_ALLOW_POWER (the same gate as the power tool), never the weaker HID gate.

Move the mouse (and optionally click) on the host. DESTRUCTIVE (HID input).

A click must carry the observed_frame_ref it was planned against (from a prior snapshot); it is refused — re-snapshot and retry — if the host rebooted/swapped media since, the observation is older than KVM_PILOT_MCP_FRAME_MAX_AGE (60s default, #141), or the ref wasn't issued by this server. Move-only (button omitted) needs no ref. coord_space: percent (0.0-1.0, default — survives resolution changes), pixel, or raw kvmd. Gated by KVM_PILOT_MCP_ALLOW_HID

• per-invocation approval.

Measure and store this host's mouse commanded→observed correction (#128).

Fixes "clicks where the button should be and misses". Pointer moves only — no clicks, no keystrokes — but it visibly moves the live cursor ~10-30s, so it is gated like HID input (KVM_PILOT_MCP_ALLOW_HID; one approval covers the whole run). Preconditions: live video signal, a static screen, a visible cursor, Pillow on the server (pip install 'kvm-pilot[calibrate]'). Afterwards mouse percent coords apply it transparently (calibrated: true); stored per (host, capture resolution) — a resolution change makes it stale, never applied. Mechanism details: the MCP server README.

Inventory the KVM's virtual-media (MSD) storage (read-only).

Check this BEFORE asking the operator to download or upload an ISO — the image may already be on the device (#127). Returns stored images, the selected image, and attach state (online). host_visible_as (when known, #78) is the device name the TARGET's boot menu shows for truly presented media — match it to pick the right boot entry and to confirm the medium is really inserted. Details: doctrine topic 'interfaces'.

Mount an ISO as virtual media on the host. GATED act (media effect gate); reversible.

source is a local path or an http(s):// URL; usb=true attaches as a USB flash drive instead of a CD-ROM. Needs KVM_PILOT_MCP_ALLOW_MEDIA + per-invocation approval. Mounting bumps the frame generation, so a mouse click planned against the pre-mount screen is invalidated.

Detach virtual media (the inverse of mount_iso). GATED act (media effect gate); reversible.

Needs KVM_PILOT_MCP_ALLOW_MEDIA + per-invocation approval.

Is the managed host's OS reachable over SSH? (read-only, in-band).

Targets the host behind the KVM (its own ssh_host / KVM_PILOT_SSH_HOST), a different machine from the KVM appliance. Use this to prefer remote recovery before asking a user to physically intervene.

host overrides the profile/env ssh_host at runtime — e.g. an install-time DHCP address the profile can't know until the target boots.

Run a command on the managed host's OS over SSH. DESTRUCTIVE / in-band.

Gated by its own SSH effect gate (never the HID gate) + per-invocation approval, with typed same-path denials (#234). host overrides the profile/env ssh_host at runtime (e.g. a discovered install-time DHCP address).

Read-only diagnostics from the KVM APPLIANCE's own OS over SSH.

Targets the KVM appliance itself (its appliance_ssh channel), NOT the managed target. Reports the 1-minute load and the RV1126 video-pipeline threads in D-state. NOTE: on these units load sits at ~10 even when perfectly idle (the driver parks those threads in D-state), so it is NOT a health signal on its own — use the healthcheck encoder-wedge finding for the real tell.

Reboot the KVM APPLIANCE (not the target) to clear a wedged encoder. DESTRUCTIVE.

Recovers the RV1126 encoder wedge (the only fix — the stuck threads are unkillable kernel threads). Drops all KVM control for ~60s; the target's power is untouched. Gated by the appliance effect gate + per-invocation approval, with typed same-path denials (#234). There is no out-of-band power to the appliance, so use this deliberately, never in an automated loop.

Which INDEPENDENT recovery paths are live for the device — the lockout view.

Rolls up the REST API, appliance-SSH, target-SSH, out-of-band power, and console-HID paths, each labeled by its failure domain so redundancy is not oversold: several live paths that all ride the same appliance are ONE independent domain. summary.out_of_band_live=false means every path shares the appliance's fate — a fully hung box can't be recovered remotely.

Collect typed device events from the kvmd stream (read-only, bounded).

MCP twin of CLI events minus follow mode (#233 — an endless stream doesn't fit the synchronous stdio transport): returns up to count events or duration seconds' worth (capped 30 s), whichever first. logs is the better first diagnostic; events add the live typed stream (atx/msd/streamer state changes) to cross-check a vision wait against.

Report the device's firmware currency vs the bundled registry (read-only).

The read half of file_firmware_report (#233): reconciles the device's reported firmware/update state against the registry SSoT and says whether the registry is behind — nothing is filed, no gate is consulted. When registry_behind is true, file_firmware_report contributes the report (gated external write).

File the device's firmware-currency report as a GitHub issue when the registry is behind (MCP twin of CLI firmware-check, #189/#190). EXTERNAL WRITE — writes outside the managed device.

The read/reconcile half always runs; registry current → nothing to file, the result says so. Filing is gated as its own external_write effect (KVM_PILOT_MCP_ALLOW_EXTERNAL_WRITE + per-invocation approval); dry_run=true previews the exact issue title/body; a missing or unauthenticated gh is a graceful filed=false reason.

Scan a CIDR for hosts with an open SSH port. RISKY — opt-in.

An active network scan: noisy, and only acceptable on networks the user owns or is authorized to probe. Use it ONLY to help find a target whose address the user doesn't know, after they confirm the range — never by default. confirm=true is required to acknowledge the scan.