Start a persistent background build of the system/HM closure, without activation. Returns job_id promptly. Poll build(job_id=...) for bounded live log tails and status: running, ok, failed, or interrupted. Pass the previous poll's log_offset to receive only new stderr. Jobs survive MCP disconnects and server restarts; repeated starts for the same running target reuse its job. On success returns store_path; successful output is a short tail with log_truncated and full local log_paths. on build failure includes failed_derivation{drv, log_tail} when available.

Build the new closure and diff it against the running system (nvd, falling back to nix store diff-closures): package additions, removals, version changes as structured packages plus closure_size; the raw diff text only when it does not parse. Include the changeset in the reply and switch unless the user asked only to preview or check. For hosts requiring coordinated fleet deployment, use the repository's deployment orchestrator.

Activate the configuration (sudo -n nixos-rebuild switch / home-manager switch). Records rollback_generation first. Returns a structured 'summary' (units changed, derivations built, package delta, systemd health, and a bounded warnings list from the captured switch log) plus gen before/after; on success the raw log is trimmed to a tail (pass full_log=True for all of it). Status is 'degraded' when activation succeeded but units newly failed. No implicit validation by default; pass validate=True to gate on check('dry-build') first. On a sudo auth failure returns a 'privilege' diagnosis. Local activation only; hosts requiring cluster cordon/drain and readiness gating must use their fleet orchestrator.

action='list': enumerate system/HM generations with dates and current marker. NixOS entries include path when the profile link exists. action='rollback': revert to the previous generation, or pass generation= to activate that generation. Bare rollback is previous-only. Pass mode='home-manager' for HM generations.

Evaluate the final merged value of an attribute in the user's actual NixOS/Home Manager configuration via nix eval (e.g. attr='services.openssh.enable'). flake_uri and mode auto-resolve when omitted. Pass a list of attrs to batch several evals into one call, returning per-attr results and failed_count / succeeded_count. Mixed results have status='partial', all failed have status='failed'. Values above the size guard degrade to attr names / length / a head slice (truncated: true). Text fallback and truncation include a hint to request narrower leaf attributes.

Where does this configuration set an option: files declaring it and every file defining it, with each contributed value (e.g. attr='services.openssh.enable'). The bridge from mcp-nixos discovery to editing the right file. For integrated Home Manager, query the NixOS config with attr='home-manager.users..'.

Validation ladder for the configuration, fast to slow: level='lint' (statix+deadnix; returns a structured findings list), 'dry-build' (evaluate and plan the closure build), 'dry-activate' (NixOS only, shows what activation would change). Successful output is a short tail with log_truncated and full local log_paths; failures retain their capped diagnostics.