Check gateway liveness, readiness, and build version (public, no auth).

Authenticated user profile. Uses MCP session token or EREBRUS_BEARER_TOKEN. If unauthenticated, returns session status + how to log in.

Which login methods the gateway has configured (public).

Show whether this MCP session has a user PASETO (from login tools or EREBRUS_BEARER_TOKEN fallback).

Start wallet-signature login (GET /api/v2/auth). Returns flow_id + message to sign with the wallet.

Complete wallet login (POST /api/v2/auth). Stores the PASETO in this MCP session for subsequent tools.

Passwordless email login: send a 6-digit OTP (POST /api/v2/auth/email/login/start). Public; no prior session.

Verify email OTP and log in (POST /api/v2/auth/email/login/verify). Stores PASETO in MCP session.

Store an already-issued user PASETO in this MCP session (e.g. from a previous login). Prefer wallet/email tools for agents.

Clear the MCP session PASETO. Env EREBRUS_BEARER_TOKEN fallback (if set) still applies until process exit.

Create an organization; caller becomes owner. Requires user session/Bearer.

List organizations for the authenticated user.

Get one organization by id.

Plan entitlements / limits for an org.

Mint org API key (returned ONCE). Owner only. Useful for long-lived machine VPN/usage via X-Api-Key.

List key metadata (prefixes only).

Revoke API key by id. Owner only.

Create ere_reg_* token for node install. Returned once. Requires user session.

List nodes registered to the org control plane.

Get one org control-plane node by id.

Runtime VPN nodes for orgs the caller belongs to (includes private).

Public node directory (GET /api/v2/nodes).

Build install command + port checklist. Does not SSH. Needs a registration token string.

List VPN clients for the authenticated user (Bearer session).

Provision a VPN client on a node. Requires name, node_id, and client WireGuard public key. User needs org membership (public nodes) or node org membership (private).

Fetch WireGuard/credentials config for a client (owner/admin).

Delete a VPN client by id.

Provision via org API key route POST /api/v2/org/vpn/clients (X-Api-Key). Requires EREBRUS_API_KEY. Node must belong to the key's org.

List clients for the API key's org (GET /api/v2/org/vpn/clients).

Org usage via X-Api-Key (GET /api/v2/org/usage) or user Bearer on /orgs/{id}/usage.

List nodes available for Drop uploads (GET /api/v2/drop/nodes). scope=public or private (private requires org_id).

Reserve an upload slot (POST /api/v2/drop/uploads). Then call drop_upload_content with the upload id.

PUT raw content for a reserved upload (base64-encoded body, max ~15MB decoded recommended for MCP).

GET status for a reserved/in-progress upload.

List authenticated user's Drop files.

Get metadata for one Drop file.

Delete a Drop file by id.

User Drop usage stats.

Org-scoped Drop file metadata (GET /orgs/{id}/drop/files).

Org-scoped Drop usage (GET /orgs/{id}/drop/usage).