List orderable products from the RareCloud catalog. Use to answer "what plans can I deploy?" Returns SKU, kind (legacy_vps / cloud_compute / proxy / ...), category, display name. Filter by kind or backend to narrow results.

Get full details for a single catalog product including all plans (sizes), their specs (vCPU, RAM, disk, bandwidth), pricing for every supported billing cycle, and supported billing tracks. Use before generating a Terraform plan or before recommending a specific SKU.

List available RareCloud datacenter regions. Each region has a slug (e.g. "frankfurt-de"), display name, country code, and which backends can provision there.

List available OS images (Ubuntu / Debian / Rocky / Windows Server / etc) that can be installed on new servers. Use to validate an image slug before recommending it.

Get the live, order-ready detail for one product SKU: every billing cycle with its price, the plans (sizes) on offer, and the config options (e.g. the OS-template field) a purchase must fill in. Richer than get_catalog_plan — use this right before building an order or quoting a price. The sku comes from list_catalog_products or a list_catalog_listings card.

List the OS templates selectable at purchase time for a legacy VPS / dedicated-server SKU — each with slug, display name, and version. Use to pick a valid OS before ordering one of these products. (For the OS list of an already-running server use list_os_templates with a service_id instead.) The sku comes from list_catalog_products.

List the deploy-wizard product cards for one category — the same tiles the console shows on the "create" screen, each with sku, display name, tier, pricing, specs, and available regions. Use to browse "what can I deploy in this category?" and to grab a sku to pass on to get_product_details.

List the managed-Kubernetes (Gardener shoot) versions currently offered, newest-supported first. Use to pick or validate a version before deploying a cloud-k8s cluster.

List all services in the authenticated account: VPS servers, cloud VMs, proxies, hosting, domains. Returns each service's id, kind, name, status, IPv4, region, specs, billing cycle. Use to answer "what do I have running?" or to find a service ID for follow-up calls.

Get full details for a single service by ID: status, network config, billing state, current-month usage. Use when you need more than the list_services summary (e.g. to inspect logs, current cost, attached resources).

Get resource metrics (CPU / RAM / disk / bandwidth time series) for a single service. Use to answer "is my server busy?" or "how much bandwidth have I used?".

List existing backups for a single legacy VPS server. Use to check whether a recent backup exists before a risky change, or to find a backup ID for restore.

Setup state of a pending service: whether its order is paid, whether the VM exists yet, and whether provisioning looks stuck (paid but unprovisioned past the grace period). Use after a deploy to watch it land, or to diagnose a service that stays pending.

Operating systems a legacy VPS can be reinstalled with (Virtualizor templates). Read-only; the reinstall itself is a destructive write and is not exposed as an MCP tool.

Plans (and billing cycles with prices) a service could be upgraded/downgraded to, from its product group. Read-only; the actual upgrade creates an invoice and is not exposed as an MCP tool.

Get the mounted-ISO status for a legacy VPS: whether a rescue/install ISO is currently attached and, if so, which one. Use to check a server's boot media before a reinstall or rescue. Read-only; mount/unmount are writes and are not exposed as MCP tools. The service_id comes from list_services.

List the SSH keys registered in a legacy VPS's key library (Virtualizor) — each with id, name, publicKey, and a server-computed fingerprint. These are the keys selectable when reinstalling this server. Distinct from list_ssh_keys, which returns the keys already installed on the running server. The service_id comes from list_services.

Get whether a service auto-renews from account balance ({enabled}). Auto-renew defaults on: at the due date the renewal invoice is paid automatically from promo bonus first, then real credit — enabled:false is the per-service opt-out (bonus still applies). Use to confirm a service won't lapse, or explain an unexpected renewal charge. The service_id comes from list_services.

List the authenticated account's orders — the purchase records behind its services. Each has an id, orderNumber, date, status, paymentStatus, the linked invoiceId, and its line items. Use for "what have I ordered?" or to find an order id to inspect.

Get one order by id: its line items (product, plan, cycle, price), status, paymentStatus, and the invoice it belongs to. Use after list_orders to see exactly what a purchase contained. The id comes from list_orders.

List invoices for the authenticated account: number, status (paid / unpaid / cancelled), issued date, total. Use for "summarize my last 6 months of spend" or "which invoices are unpaid".

Get full details for a single invoice: every line item, taxes, payment method used, payment timestamp. Use after list_invoices when more detail is needed.

Get the current account credit balance (Pattern A v2 prepaid credit). Use for "how much do I have left?", or to check before suggesting actions that would consume credit (cloud-compute hourly billing).

List credit ledger entries (top-ups, voucher redemptions, hourly metering debits, refunds) for the authenticated account. Use to explain "where did my credit go?" or to reconcile a balance.

Preview what paying an invoice from the account balance would consume — promo bonus first, then real credit, then any remaining shortfall. Read-only; consumes nothing. Pass an invoice id from list_invoices. Use before discussing a "pay from balance" action.

List the account's available payment options (WHMCS gateways). There is no stored-card vault — these are the gateways offered at checkout. Use for "how can I pay?".

Get the currently-active credit (deposit-match) campaign in public shape — the "double your credits" promo — or {campaign:null} when none is running. Check before suggesting a top-up so the user can catch a bonus match.

Get the account's promo (bonus) balance in cents (EUR). This is a SEPARATE non-WHMCS balance that depletes first, as a taxed discount line, at consumption. Pair with get_credit_balance for the full "how much can I spend?" picture.

List all bonus-credit ledger entries (newest first): campaign grants (positive) and promo consumption (negative). Use to explain "where did my bonus go?" — distinct from get_credit_ledger, which tracks real (WHMCS) credit.

Get the spending-alert state: the configured threshold, month-to-date spend, and whether the alert has triggered. Use for "am I close to my spending alert?".

Get the cloud auto-suspend state for the account — normal / grace-period / suspended — that drives the dashboard billing banner. Use to check whether a low balance is putting services at risk of suspension.

List support tickets for the authenticated account: id, subject, status (open / awaiting-staff / awaiting-client / closed), department, last-updated. Use for "do I have any open tickets?".

Get a single support ticket with its full message thread. Use after list_tickets to read the conversation or check the latest staff reply.

List the support departments and their numeric ids — the department ids accepted when opening a ticket (POST /tickets). Use before drafting a new ticket to pick the right department.

Get the authenticated user's profile: email, name, country, billing currency, account creation date. Use for "what account am I on?" or to confirm identity before suggesting cross-account actions.

List the SSH keys on a specific server (legacy VPS). SSH keys are per-server in the API, not account-wide. Pass a service_id from list_services.

Get account resource limits and current usage (servers / vCPUs / snapshots / IPs / volumes / DNS zones / etc). Use before recommending a deploy to make sure the user has headroom.

List the users linked to this client account — accepted members AND pending invitations. Each entry has a status (active / invited / disabled); the account owner is flagged isOwner. Use for "who has access to my account?" or to find a linked user before discussing collaborators.

Get the authenticated account's affiliate status and stats: referral link, visitors / signups / conversion rate, commissions summary (pending maturation / available balance / total withdrawn), payout minimum, and the per-referral list. Returns {active:false} when the affiliate program is not enabled. Use for "how are my referrals doing?".

Get the authenticated user's two-factor (TOTP) status — whether 2FA is enabled on the account. Use to check the account's security posture before advising on hardening.

List the account-wide SSH public keys registered on the profile — the keys offered at deploy time when creating a new server. Account-scoped, NOT per-server: for the keys already installed on one running server use list_ssh_keys (service_id) instead.

Get the account audit trail (newest first): sign-ins, 2FA changes, service actions, and billing operations. Page with limit (1–200, default 50) and before (a cursor from a prior page). Use for "show my recent account activity" or a security review.

List the emails WHMCS sent to this account (invoices, notices, password resets), newest first. Pass id to fetch a single message including its HTML body; page older results with offset. Use for "what emails did I get?" or to read one message.

List the account's billing / technical contacts — additional email-copy recipients with no login of their own. Use for "who else receives my invoices and notices?".

List block storage volumes in the account: id, name, size, status, which VM it is attached to, region. Use for "what storage do I have?" or to find a volume id.

Get one block storage volume: id, name, size, status, region, and which VM it is attached to. Use after list_volumes to inspect a single volume.

List private networks (VPCs): id, name, CIDR, status, attached VM count, whether it is the default. Use to map the account's network topology.

Get one private network (VPC): id, name, CIDR, status, whether it is the default, and its attached VMs. Use after list_networks to inspect a single network.

List L4 load balancers: id, name, status, public IP, listener port, member count. Use for "what load balancers exist?".

Get one load balancer with its members (backend VMs and ports). Use after list_load_balancers to inspect membership.

List the backend members of a load balancer — each member VM's private fixed IP and its port in the pool. Use after list_load_balancers to inspect exactly which VMs sit behind a load balancer. The id comes from list_load_balancers.

List reserved (static) public IPs: id, address, status, which VM it is attached to. Use to see floating IPs and what they point at.

List cloud firewalls (security groups): id, name, status, attached VM count, rule count. Use for "what firewalls do I have?" or to find a firewall id.

Get one firewall (security group) including its full inbound/outbound rule set and which VMs it is attached to. Use after list_firewalls to inspect a firewall's rules.

List registered domains: id, name, status, expiry, auto-renew. Use for "what domains do I own?" or to find a domain id.

Get one domain: nameservers, transfer lock, WHOIS privacy, auto-renew, expiry. Use after list_domains for management detail.

Check whether a domain name is available to register — a pre-purchase WHOIS availability lookup for a single domain. Pass the full domain (e.g. example.com). Use before quoting a registration or suggesting an alternative name.

List register / transfer / renew prices per TLD, in the account currency. Use to quote what a .com / .io / etc costs before recommending or ordering a domain.

Get the nameservers currently set on an owned domain — where its DNS is delegated. Use to see the domain's delegation before recommending a change. Read-only; replacing the nameservers is a write and is not exposed as an MCP tool yet. The id comes from list_domains.

Get the registrant WHOIS contact on an owned domain (registrar-dependent). Use to review who the domain is registered to. Read-only; updating the contact is a write and is not exposed as an MCP tool yet. The id comes from list_domains.

Get the DNS host records on an owned domain — its A / CNAME / MX / TXT / etc entries (registrar-dependent; returns a not-implemented error when the registrar exposes no DNS API). Use to read the domain's current records. Read-only; replacing the records is a write and is not exposed as an MCP tool yet. The id comes from list_domains.

Get the combined management snapshot for an owned domain in one call: status, expiry, auto-renew, WHOIS ID protection, nameservers, and transfer lock (per-registrar fields are null when the registrar exposes no API for them). Use as the one-stop "how is this domain configured?" read. The id comes from list_domains.

Get the current scale of a managed Kubernetes cluster: its worker node pools plus any add-ons (autoscaler bounds, HA control plane, etc.). Use to answer "how big is my cluster right now?" or to read current sizing before planning a resize. Read-only; changing the scale is a write and is not exposed as an MCP tool. The service_id comes from list_services (a cloud-k8s service).

List the worker node pools of a managed Kubernetes cluster — each pool's name, machine type/flavor, node count, and autoscaling min/max. Use to inspect how the cluster's compute is organized before a scale change, or to find a pool by name. Read-only; adding/editing/removing pools are writes and are not exposed as MCP tools. The service_id comes from list_services (a cloud-k8s service).

Fetch a SHORT-LIVED admin kubeconfig for a managed Kubernetes cluster — a freshly-minted cluster-admin credential that expires within hours and leaves NO standing credential behind. Prefer this for one-off, interactive kubectl access. For standing automation that must keep working, use a long-lived credential instead (list_cluster_kubeconfigs + download_cluster_kubeconfig). SECURITY: the result is a LIVE CREDENTIAL — a kubeconfig YAML embedding a bearer token that grants cluster-admin. Treat it as a secret: do NOT echo it back to the user or repeat its contents unless the user explicitly asks to see it; pass it straight to the tool that consumes it. Returns the raw kubeconfig YAML as a text block. The service_id comes from list_services (a cloud-k8s service).

List the LONG-LIVED kubeconfig credentials issued for a managed Kubernetes cluster — metadata only (id, name, role admin|view, createdAt, expiresAt, revokedAt, lastDownloadedAt, status active|expired|revoking|revoked). Each is a revocable, per-credential ServiceAccount meant for standing automation (CI, GitOps). The token itself is NEVER returned here — re-download an active one with download_cluster_kubeconfig. Use to see which credentials exist, which are still active, and to find a credential_id. The service_id comes from list_services (a cloud-k8s service).

Re-download a LONG-LIVED kubeconfig credential for a managed Kubernetes cluster by its credential id — a revocable, per-credential ServiceAccount kubeconfig for standing automation that must keep working (unlike the short-lived admin config from get_cluster_kubeconfig). Works for ACTIVE credentials only; revoked or expired credentials return an error. SECURITY: the result is a LIVE CREDENTIAL — a kubeconfig YAML embedding a bearer token. Treat it as a secret: do NOT echo it back to the user or repeat its contents unless the user explicitly asks to see it; pass it straight to the tool that consumes it. Returns the raw kubeconfig YAML as a text block. service_id and credential_id both come from list_cluster_kubeconfigs.

List your residential proxy services: id, name, flavor (ISP fixed-IP plan vs GB Residential bandwidth bucket), status, plan, and expiry. Use for "what proxy services do I have?" or to find a proxy service id.

Get the residential proxy catalog for the order wizard: ISP IP-count tiers with EUR + USD pricing per Day/Week/Month, orderable locations, protocol + authentication options, plus a gb section of monthly GB Residential bandwidth-bucket tiers (EUR + USD). Use to quote what an ISP plan or a GB bucket costs before recommending or ordering a proxy service. No input.

Get one residential proxy service: flavor (ISP fixed-IP plan vs GB Residential bandwidth bucket), status, plan, location, and expiry/renewal. Use after list_proxies to inspect a single service. The id comes from list_proxies.

List the live proxy endpoints and credentials (ip, port, username, password) for an active proxy service — this is the direct endpoint list for ISP fixed-IP plans. For a GB Residential bucket the endpoints live under its proxy-requests instead (use list_proxy_requests + get_proxy_request_list). SECURITY: the result contains LIVE CREDENTIALS — usernames and passwords that grant use of the proxies. Treat it as a secret: do NOT echo it back to the user or repeat its contents unless the user explicitly asks to see it; pass it straight to the tool that consumes it. The id comes from list_proxies.

Get the authentication settings for a proxy service: the auth method, the proxy credentials (null when the service is IP-authenticated only), the IP whitelist, and the caller's detected IP. Use to see how the service authenticates before adding a whitelisted IP or switching auth mode. SECURITY: the result may contain LIVE CREDENTIALS — the proxy username and password (null for IP-only services). Treat it as a secret: do NOT echo it back to the user or repeat its contents unless the user explicitly asks to see it; pass it straight to the tool that consumes it. Read-only; changing the auth method / credentials / whitelist are writes and are not exposed as MCP tools yet. The id comes from list_proxies.

List the countries (id + name) selectable when creating a GB Residential proxy-request. Use to pick a valid country before creating a proxy-request on a GB bucket. GB Residential only — ISP fixed-IP plans do not use this. No input.

List the rotation intervals (id + label: all, high, 1min, 10min, 30min) selectable when creating a GB Residential proxy-request. Use to pick a valid rotation before creating a proxy-request on a GB bucket. GB Residential only — ISP fixed-IP plans do not use this. No input.

List the proxy-requests on a GB Residential bandwidth bucket — the country + rotation-interval + count groups that allocate endpoints from the bucket. Use to see the groups on a GB service or to find a proxy-request id. GB Residential only; ISP fixed-IP plans expose their endpoints directly via get_proxy_list. The id comes from list_proxies (a GB Residential service).

List the live proxy endpoints and credentials (ip, port, username, password) for one proxy-request on a GB Residential bucket. Use to fetch the endpoints for a specific country/rotation group; for ISP fixed-IP plans use get_proxy_list instead. SECURITY: the result contains LIVE CREDENTIALS — usernames and passwords that grant use of the proxies. Treat it as a secret: do NOT echo it back to the user or repeat its contents unless the user explicitly asks to see it; pass it straight to the tool that consumes it. The id (a GB Residential service) comes from list_proxies and the request_id from list_proxy_requests.

Get the IP-replacement allowance and history for a proxy service: the included monthly allowance (1/month), how much is used, and past replacement requests. Use to check whether a free IP replacement is available before requesting one. Read-only; requesting a replacement is a write and is not exposed as an MCP tool yet. The id comes from list_proxies.

Set the hostname of a service (cloud VM or legacy VPS). Requires scope services:write. The service_id comes from list_services; hostname is a valid DNS hostname (1–253 chars). Plain write — no billing impact, not destructive.

Deploy (order + provision) a new service and CHARGE the account. Requires scope services:write. Polymorphic: category selects the product family (cloud-vm | cloud-k8s | cloud-volume | cloud-loadbalancer | cloud-network | server | hosting | proxy | domain); category may be omitted and is then inferred from the catalog product. productId (alias plan) is the catalog SKU; the other fields depend on the family — discover them with get_product_details, list_catalog_listings, list_kubernetes_versions, list_regions, list_images. SPENDS MONEY: this places a real order and provisions billable infrastructure. You MUST pass confirm:true, and only after the user has approved the plan and its cost (preview cost with get_product_details).

Permanently destroy a service and release its resources. Requires scope services:write. IRREVERSIBLE: the service and its data are gone for good. You MUST pass confirm:true, and only after the user has explicitly approved. service_id comes from list_services.

Resize a cloud VM service to a new flavor (target plan PUBLIC SKU, e.g. c-4vcpu-8gb). Requires scope services:write. Runs asynchronously (returns 202) and MAY CHANGE the price of the service. Pass confirm:true only after the user has approved the new size and its cost. service_id from list_services.

Create an upgrade order moving a service to a new product/plan. Requires scope services:write. SPENDS MONEY: this places a real upgrade order and bills the difference. Pass confirm:true only after the user has approved the change and its cost (preview with list_upgrade_options). service_id from list_services.

Ensure a renewal invoice exists for a service (renew the current term). Requires scope services:write. SPENDS MONEY: generates/settles a renewal invoice from your balance. Pass confirm:true only after the user has explicitly approved. service_id from list_services.

File a cancellation request for a service. Requires scope services:write. DESTRUCTIVE: schedules teardown of the service — type "immediate" stops it now; "end_of_term" cancels at the paid-through date. Pass confirm:true only after the user has explicitly approved. service_id from list_services.

Toggle auto-renew (renew automatically from account balance) for a service. Requires scope services:write. Plain write — no immediate charge, not destructive. service_id from list_services.

Create an on-demand backup of a legacy VPS service. Requires scope services:write. Plain write — no billing impact, not destructive. service_id from list_services.

Mount a rescue/install ISO on a VPS as a virtual CD-ROM. Requires scope services:write. The iso_url is fetched server-side (SSRF-guarded against private/metadata targets). Plain write — not destructive. service_id from list_services.

Unmount the currently mounted ISO from a VPS. Requires scope services:write. Plain write — not destructive. service_id from list_services.

Set the root/administrator password of a VPS service. Requires scope services:write. The password value is a secret — it is never echoed back or logged. DESTRUCTIVE: overwrites the current credential and may reboot the guest. Pass confirm:true only after the user has explicitly approved. service_id from list_services.

Power on a service (cloud VM or legacy VPS). Requires scope services:write. Plain write — no billing impact, not destructive. service_id from list_services.

Power off a service (cloud VM or legacy VPS). Requires scope services:write. Plain write — no billing impact, not destructive. service_id from list_services.

Reboot a service (cloud VM or legacy VPS). Requires scope services:write. Plain write — no billing impact, not destructive. service_id from list_services.

Reinstall (rebuild from scratch) a service — works on BOTH a cloud VM (Nova UUID service_id) and a legacy VPS (numeric service_id). Requires scope services:write. IRREVERSIBLE: wipes the current disk and reinstalls the OS image; the service keeps its IP (and, for a cloud VM, keeps a one-time consolePassword in the response only when no password was supplied). Requires imageId, a curated OS template/image slug (see list_os_templates / list_images / get_service os-templates). password and sshPublicKey are optional (sshPublicKey only applies to a cloud VM). You MUST pass confirm:true, and only after the user has explicitly approved the rebuild and understands the data loss. service_id from list_services. SECURITY: the response may include a one-time consolePassword root credential (cloud VM only, returned when no password was supplied). Treat it as a secret: do NOT echo it back to the user or store it, unless the user explicitly asks for it.

Reset the root password on a RUNNING cloud VM (Nova UUID service_id) live via qemu-guest-agent — the VM keeps running and keeps its data (this is NOT a reboot/rebuild). Requires scope services:write. CLOUD VM ONLY: a legacy VPS (numeric service_id) is rejected — use set_service_password for that. You must supply the new password (8–128 chars); the value is a secret and is never echoed back or logged. The previous credential stops working immediately, so pass confirm:true only after the user has explicitly approved. service_id from list_services.

Install an SSH public key directly onto a running service (per-server), distinct from add_service_ssh_key_to_library, which registers a key in the server's reinstall-time key library. Requires scope services:write. Plain write — no billing impact, not destructive. service_id from list_services.

Register a new SSH key in a legacy VPS's key library (Virtualizor) — the set of keys selectable when reinstalling this server (see list_service_ssh_key_library). Distinct from add_service_ssh_key, which installs a key directly on the running server. Requires scope services:write. Plain write — no billing impact, not destructive. service_id from list_services.

Apply a SET of library SSH keys (see list_service_ssh_key_library) to a legacy VPS, replacing whichever keys are currently authorized on the server. Requires scope services:write. Omit keyIds (or pass an empty array) to apply an empty set. Plain write — no billing impact, not destructive. service_id from list_services.

Set the autoscaling bounds (minimum/maximum worker count) of the FIRST node pool of a managed Kubernetes cluster. Requires scope services:write. minimum >= 1 and maximum >= minimum (enforced server-side). Adjusts an existing pool — it does not add one (use add_cluster_pool for that). service_id comes from list_services (a cloud-k8s service); read current sizing with get_cluster_scale.

Add a named worker node pool to a managed Kubernetes cluster. Requires scope services:write. SPENDS MONEY: a new pool provisions billable worker nodes. Pass confirm:true only after the user has approved the pool and its cost. name is the pool name (lowercase letters/digits/hyphens, start with a letter, max 15, unique in the cluster); minimum/maximum are the autoscaling bounds; machineType (worker flavor, resolved server-side) and volumeSizeGb (per-node root volume, 10-1000 GiB, default 30) are optional. service_id comes from list_services; inspect existing pools with list_cluster_pools.

Edit an existing worker node pool of a managed Kubernetes cluster — any of its autoscaling bounds (minimum/maximum), machineType, or per-node volumeSizeGb (10-1000 GiB). Requires scope services:write. Send only the fields you want to change; omitted fields are left as-is. Plain write — not gated. service_id from list_services; pool is the pool name from list_cluster_pools.