Overall P5 status: tape devices, jukeboxes, pools with usage percentages, and running/scheduled jobs. A pool is a named collection of labeled media that backup jobs write into.

Per-slot view of the tape library: slot number, barcode (from mtx), and P5 volume id/label/pool/mode/state if known, with an unknownToP5 flag; drive loaded state from mtx. A volume is one piece of media P5 identifies by a label written at its beginning.

All P5 volumes with label, barcode, mediatype, location, mode, state, pool, used/total size (converted from KB to human units) and expiry date. A volume is one labeled piece of media (tape or disk container).

All media pools with mediatype, usage (Backup/Archive), used/total size and their volume ids. A pool is a named collection of labeled media that jobs write into.

All backup plans (and archive plans if any) with description, enabled flag, event and task names. A plan is a backup configuration grouping tasks (what to back up) and events (when, into which pool).

Everything readable about one backup plan: settings, each event (pool, level, frequency, firstrun) and each task (client, directories). An event is one schedule entry of a plan; a task defines the client and directories to back up.

Jobs with label and status plus the last report lines; all=true also includes jobs completed in the last 7 days. A job is one execution of a plan/task, tracked by an id.

One job in detail: status, label, completion, full report and protocol log. A job is one execution of a plan/task, tracked by an id.

Starts a dry-run job for a backup plan (safe: scans and reports, writes nothing). No confirm needed.

Starts a real backup job for a plan now. Requires confirm:true; without it only the command that WOULD run is returned.

Enables a backup plan so its events run on schedule. Requires confirm:true; without it only the command that WOULD run is returned.

Disables a backup plan so its events no longer run. Requires confirm:true; without it only the command that WOULD run is returned.

Stops a scheduled job (only jobs with status 'scheduled'; running jobs must be canceled via nsdchat passthrough). Requires confirm:true.

DESTRUCTIVE: labels media in a jukebox's slots for a pool — this OVERWRITES the tapes in the given slots, destroying any data on them. Only new/empty volumes can be labeled. Requires confirm:true.

Read-only. Lists the entries (path, size, volumes) held by a BACKUP volume, or by the volumes of a backup job, via Volume/Job inventory. Use it to find the volume id for restore.

Restore plan for ONE path at a chosen BACKUP version (at = a version start from restore_options). P5's CLI and REST cannot select a single path of a backup version (RestoreSelection addentry takes only archive handles; addfromvolume restores a whole volume), so this tool never starts a P5 job: it returns the full preview (source version, volume(s) with barcode and location, destination, bytes, free space, bounded tree, existing destination files, conflict policy, planId) and the exact P5 GUI steps (Restore > Backup > client > path > backup date > restore to the destination folder). confirm:true with the planId only creates the destination folder. Data comes from the catalogue copy of the backup index when the client is indexed, else P5's SQLite index. For archive entries use restore_archive; a whole volume is restore_volume.

Restores ONE entry (file, or folder with everything below) of a P5 ARCHIVE index to an alternate directory: RestoreSelection create , addentry , submit; returns the job id. Without confirm only the preview (read-back of the selection: entries and bytes from P5, free space, conflicts, policy, planId; the probe selection is destroyed, nothing submitted). confirm:true must pass that planId.

EXPLICIT whole-volume restore: EVERYTHING on a P5 backup volume (all clients, all paths) goes to an alternate directory (RestoreSelection addfromvolume). Not for single files (use restore). Preview shows the volume, its used size, free space and a planId; confirm:true must pass that planId. Returns the job id.

Adds one folder to a backup plan as a new task (addtask, client localhost, dirlist , enable - verified); a task defines what to back up. Requires confirm:true; without it only the calls that WOULD run are returned.

Adds several folders to a backup plan, one enabled task each (path checked with test -d in the container; optional task filter). Returns per-path task id or error. Requires confirm:true.

Creates a backup plan (returns its id); optional retention in days. Requires confirm:true.

Sets the retention (days) of a backup plan. Requires confirm:true.

Deletes a backup plan. Requires confirm:true.

Enables or disables a volume. Requires confirm:true.

Adds an event (schedule entry: pool + level + frequency + first run) to a backup plan. Level 1 full, 0 incremental, -1 synthetic. Frequency tokens: "D n" | "W n days..." | "M n week day". firstrun is ISO local time the local time zone, e.g. 2026-11-07T02:00. Requires confirm:true.

Sets a drive's cleaning flag (0 or 1). P5 avoids drives flagged 1 when choosing where to write. Requires confirm:true.

Schedules a jukebox inventory job updating P5's volume database; barcode=true requests a barcode scan. Requires confirm:true.

Read-only. P5 explained in plain words, per backup plan: enabled, events (pool, level, frequency in words, next run), tasks and folders, last run per task with result, retention; flags with a one-line reason and a recommendation (keep / merge / disable / delete): never ran or only failed, disabled for long, folders in several plans, tasks on folders that do not exist, pools without (appendable) volumes, events whose pool has no tape in the library; plus server-wide settings (maintenance restart window and what it waits for, plan stop/cancel times, mail). Each deletable/disable-able flag carries an apply item for governance_apply.

Applies ONE recommendation from governance_report: item is disable-plan:, delete-plan: or disable-task:. Refuses a plan with active jobs. Reads the result back. Requires confirm:true; without it only what would run is returned.

Read-only forecast of all enabled events for the next N days (default 7): start, expected duration (median of past runs), pool, drive generation needed. Warns about overlaps per drive generation and per pool, runs reaching into P5's maintenance restart window, and runs whose pool has no appendable tape in the library.

Checks that every scheduled run since since (YYYY-MM-DD or YYYY-MM-DDTHH:MM, default 24 h) produced a successful job for every enabled task of its plan; lists failed, stopped, missing and still-waiting tasks. rerun:true with confirm:true re-runs exactly the failed/stopped/missing tasks once (run_tasks_once, same pool); never cancels anything. mail:true sends the report to operatorMail through the host MTA (independent of P5's own mail). Call it after the nightly window.

Read-only. P5's mail setup in plain words (SMTP server, port, TLS, sender, login yes/no, recipients) plus what P5's log says (last mail sent, recent failures) and a one-line problem when mail is broken or silent.

P5 offers no API for its mail settings: returns the current settings, why nothing was changed and the GUI steps. Never takes a password as an argument (only a password file path).

P5 has no test-mail command. Checks that P5's SMTP server accepts connections from the P5 side and shows the log evidence; with confirm:true also sends one test mail via the host MTA to operatorMail (config only), which proves the host path, not P5's.

Read-only. Per slot: barcode, P5 volume label/pool, target pool from the config slotLayout, status ok/misplaced/foreign/empty; drives and mail slots too.

Computes the minimal list of mtx transfer moves (via free slots when needed) to reach slotLayout. Refuses while a drive is loaded or a P5 job runs. confirm:true runs the plan and then a P5 jukebox inventory + reconcile; without it only the plan is returned. For a dialog use library_plan/library_step instead.

Moves a tape (barcode or volume label) from its slot to the first free mail slot, then a P5 inventory. Same busy refusals as other tape tools. Dry plan without confirm.

Moves the tape in a mail slot to the target slot of its pool per slotLayout (else the first free slot), then a P5 inventory. Dry plan without confirm.

Read-only. Every backed-up version of a file or folder, newest first, from P5's per-client backup index: backup time, file modification time, size, plan, level, and every volume holding a copy (label, pool, barcode, current location: drive / library slot / mail slot / not in the library), plus a fetch list of tapes to bring back when no copy is in the library. Feed a version's start to restore as at.

Read-only. Per tape pool: volumes in the library, in the mail slot or out; warns about pools with no volume out of the house. With path, also the fetch list for that restore_options result.

Creates the file catalogue schema (MySQL database archive_catalog: sets, tars, entries) idempotently and shows the tables.

Packs a source directory on the P5 host into tar files (D2D2T) and records every file in the catalogue. Without confirm: only the plan (walks the source once at low I/O priority; tar names, sizes, file counts, time estimate). With confirm:true: writes the tars (tar --sort=inode, resumable per tar via .done markers, sha256 per tar, plain-text listing next to each tar) and the rows in one transaction per tar. Long-running (hours for TB-sized sets); does not hold the nsdchat lock.

Read-only. Progress of a detached pack: running or not, tars done/total, bytes, current tar, rate, ETA, last log lines.

Stops a detached pack after the current tar (stop marker; finished tars stay, rerunning pack --detach resumes). Requires confirm:true.

Read-only. Catalogue sets with tar count, file count, bytes and status.

Copies P5's per-client backup index (read-only, immutable sqlite on the P5 host, P5 is not disturbed) into the catalogue database (tables names, dirs, p5_dirs, p5_files, index_state) so find_file can search names in seconds instead of the ~5 minute scan of P5's own 9.5 GB files.db. Paths are rebuilt set-based (one recursive query), rows stream in batches of 200000. Incremental by default: only new element ids plus versions that ended since the last run; a killed run resumes. full:true rescans everything. detach:true runs it on the host (use for the first, ~84 million row sync); index_status shows progress and rows/s. Writes only to the catalogue database.

Read-only. index_sync state per client (last element id and backup time read, rows), approximate table sizes, and detached runs (running/finished/failed, rows, rows/s, log tail).

Read-only. Searches file NAMES (substring, or glob with * ?; a pattern with / also matches the directory) across all backups: the P5 backup index copy (needs index_sync) and the tar catalogue. Returns every matching file (full path) with every version (distinct mtime+size, newest first); each version lists all places it can be fetched from, cheapest first: 1 disk-tar (inside a tar still on disk, no tape needed), 2 tape-library (P5 volume in the library) or tar-on-tape in library, 3 tape-offline (only on tapes outside the library: shows the barcode to insert). Same path+mtime+size from several sources is one version with several locations. Each version has a key and each location an id for restore_version.

Restores ONE version found by find_file into a directory on the P5 host, from the cheapest place automatically (disk-tar: extracted from the tar; tape-library: P5 restore; tar on tape in library: tar restored to scratch then extracted) or from the location id given as 'from'. A version that is only on offline tapes is refused with 'insert '. Without confirm only the PLAN: host, absolute destination, source location chosen (and alternatives), bytes, free space, tree preview and every destination file that already exists (size+mtime now vs restored), conflict policy and a planId. confirm:true must pass that planId; if the destination or conflicts changed it refuses and shows the new plan.

Read-only. Finds files in the catalogue by glob (* ?) or substring on path/basename. Per hit: set, path, size, mtime, tar name, whether the tar is still on disk, and where the tar is on tape (versions from P5's backup index: date, plan, volume label, barcode, location: library slot / mail slot / out of the house).

Restores ONE file from a packed set into a directory on the P5 host: extracted from the tar when it is on disk; otherwise the tar is restored from tape (via restore, into a scratch dir under packRoot) and the member extracted, then the scratch tar is deleted. Refuses with a fetch list when the needed tape is not in the library. Without confirm only the plan (destination, source, bytes, free space, existing destination files with size+mtime, conflict policy, planId); confirm:true needs that planId.

Deploys the catalogue viewer on a docker host over ssh: a read-only web page, its own MariaDB (database archive_catalog, users catalog read/write for this MCP and catalog_ro SELECT-only for the page, data dir on the host) and a nightly dump service. Generates random passwords and the viewer login into /secrets (mode 600), copies web/, runs docker compose up -d --build, waits for health, runs catalog_init against the new database and points the MCP config (catalogMysqlContainer, catalogDbCnf) at it when the docker host is the P5 host. Without confirm: only the plan. With confirm:true the result contains the generated viewer password ONCE.

Read-only. Catalogue viewer: containers (catalog, catalog-db, catalog-dump) with state and health, database size and row counts, newest dump file, number of cache entries (p5_cache) and the cache TTL.

Copies the catalogue database archive_catalog from an existing MySQL/MariaDB (host[:port], read-only on the source) into the viewer's catalog-db: mariadb-dump --single-transaction | mariadb inside the catalog-db container, then compares row counts of sets, tars, entries before/after. Refuses when the target already holds rows unless force:true. Without confirm: only the plan. The password file is read on the machine running the MCP.

Deletes a set's rows from the catalogue (not its tar files): for test sets and re-packs. Requires confirm:true.

Proposes the steps of a rearrangement (arrange), export or import and returns a persisted session id. Nothing moves until library_step. simulate:true walks the session on a virtual library without touching hardware.

Executes exactly one next step of a session (confirm-gated) and returns what happened plus the next instruction, including human steps (put/take a tape at the mail slot; those are verified, not executed). Re-checks busy state and slot contents first and stops if reality differs from the plan. The last step runs the P5 inventory and reconcile.

Read-only. Done / next / remaining steps of a session.

Stops a session cleanly; verifies that no tape is left in a drive.

After moves: compares every volume's P5 location with mtx, checks the cleaning slot (confirm:true updates cleaningSlot in the config if the CLN tape moved) and warns about enabled plan events whose pool has no appendable volume in the library, with the plan's next run time. Reports P5 slot settings that must be checked manually.

Loads the tape in a library slot into the drive matching its generation (barcode suffix L6/L9), waits until the drive is ready, and leaves it loaded. Host-side mtx/mt, bypasses P5. Refuses if P5 has a running job or a drive is loaded, unless force. Requires confirm:true.

Rewinds the tape currently loaded from a slot and unloads it back to that slot (host-side mtx/mt). Requires confirm:true.

Reads the first block of a tape (load, rewind, dd bs=256k then 1M count=1, report bytes + printable strings + mt file/block numbers, rewind, unload). Read-only in data terms; the tape is always unloaded afterwards. No confirm needed.

DESTRUCTIVE: short-erases tapes in the given slots (rewind + mt erase 0) — this DESTROYS all contents on them. One tape at a time, reported per slot; a bad tape reports an I/O error and is still rewound+unloaded. Refuses tapes P5 still knows as a volume (or whose barcode is unknown) unless eraseKnown:true; the preview lists them under refused. Requires confirm:true.

Cleans a drive with the library's CLN* cleaning tape: load into the drive (by P5 device name or generation L6/L9), wait until the drive goes not ready -> ready (max 180 s), unload back to its slot, then set P5 Device cleaning 0. Requires confirm:true.

Raw nsdchat passthrough, e.g. args=["Volume","10140","label"]. Read-only methods (names, describe, status, label, report, usage, ...) run directly; anything else requires confirm:true.

Lists the resources of the P5 REST API (GET /rest).

P5 REST API passthrough under /rest/v1 (e.g. path "general/jobs"). GET runs directly (read-only). POST/PUT/DELETE require confirm:true; without it only the request that WOULD be sent is returned. Paths outside /rest/v1 or containing .. are rejected.

Past jobs (P5's job listing only returns scheduled ones, so job ids are walked downward from the newest known id, in batches). Per job: id, plan (describe), task (resourcename), status, completion, start time (server-local, from the protocol), size, files, and the source line ('Full save of: ...'). Scheduled jobs are excluded unless status is 'scheduled'. Filters: plan (name or id), status (status or completion, e.g. completed, running, failure), since (YYYY-MM-DD), limit (default 50).

Every backup plan and task whose directories contain the substring (case-insensitive), with the plan's and the task's enabled flag. One batched pass over all plans.

Enables a backup task and reads the flag back (reports before/after). Requires confirm:true; without it only the calls that WOULD run are returned.

Disables a backup task and reads the flag back (reports before/after). Requires confirm:true; without it only the calls that WOULD run are returned.

Replaces the directory list of a backup task, reads it back and reports before/after; if P5 did not store exactly the requested list the old value is restored and an error is returned. Requires confirm:true.

Backs up chosen tasks of a plan once, without running the whole plan. P5 cannot submit a task subset, so a temporary plan 'mcp-once-' with copies of those tasks and one event into the pool is created and started; returns the temp plan id and job id. The temp plan is kept until run_tasks_once_cleanup is called after the job finished. Requires confirm:true.

Deletes a temporary plan created by run_tasks_once (only plans named mcp-once-*, refused while one of its jobs is running or pending). Requires confirm:true.

Cancels a running OR waiting job via the REST API (falls back to nsdchat if the job stays active) and reports the job state afterwards. Requires confirm:true; without it only the requests that WOULD be sent are returned.

One-call read-only health check: container, P5 version/uptime, REST, nsdchat, running/waiting jobs, drives, cleaning flags, free space of healthPaths, Error lines in the log. Each check is ok/warn/fail with a reason.

State, image, start time and P5 version of the P5 docker container, plus the newest backup dir.

Cold backup of the P5 container (docker inspect/diff, commit to -pre-update, docker save, STOP the container, tar the compose dir, SHA256SUMS, verify). Leaves the container stopped unless restart:true. Refused while a job runs unless force. Requires confirm:true; without it the steps are listed.

Disaster-recovery kit for the P5 server itself (docker mode only): consistent copies of the small config databases (sqlite3 .backup, integrity_check) and key files, the compose project, the running image (docker save, only when its id changed) and the P5 program tree (only when the P5 version changed), plus kit-small.tar.gz (config-small + compose + manifest) for a password manager or private repo. Writes /p5-dr-kit// (7 generations, SHA256SUMS, VERIFIED). status:true lists generations. Requires confirm:true; without it the plan with sizes is returned.

Consistent copy of P5's configuration and SQLite index databases (online sqlite3 .backup, integrity_check on each copy, tar of the rest, SHA256SUMS, manifest) into /p5-config//, restorable without P5. P5 keeps running. Keeps the newest p5ConfigBackupKeep verified copies. status:true lists copies. Requires confirm:true; without it the plan (sources, destination, size, free space) is returned.

docker stop -t 120 on the P5 container. Refused while a job runs unless force. Requires confirm:true.

docker start on the P5 container, then waits until srvinfo answers. Requires confirm:true.

Installs a local .deb into the P5 container (copy, sha256 check, docker cp, dpkg-deb -I, dpkg -i), waits for srvinfo and reports the new version and log Error lines. Refused without a backup newer than 24 h unless skipBackupCheck. Requires confirm:true.