Args:
    health_type: Принимается для совместимости со старой схемой
        инструмента, но пока не используется — отчёт всегда
        включает все проверки (default: "all").
    database_url: Database URL (optional, uses DATABASE_URL from .env if omitted).

Args:
    schema_name: Schema to analyze (default: "public").
    database_url: Database URL (optional, uses DATABASE_URL from .env if omitted).

Args:
    sql: SQL statement to execute.
    database_url: Database URL (optional, uses DATABASE_URL from .env if omitted).

Args:
    sql: SQL statement to explain.
    analyze: If true, actually executes the query for real timing data
        (default: value of EXPLAIN_ANALYZE in .env, normally false).
        WARNING: true really runs the query, including any
        INSERT/UPDATE/DELETE it contains — use with care.
    database_url: Database URL (optional, uses DATABASE_URL from .env if omitted).

Args:
    sql: Raw SQL text to format.

Args:
    database_url: Database URL (optional, uses DATABASE_URL from .env if omitted).

Args:
    database_url: Database URL (optional, uses DATABASE_URL from .env if omitted).

Args:
    database_url: Database URL (optional, uses DATABASE_URL from .env if omitted).

Args:
    schema_name: Schema containing the object.
    object_name: Table or view name.
    database_url: Database URL (optional, uses DATABASE_URL from .env if omitted).

Args:
    schema_name: Schema to analyze (default: "public").
    sort_by: Sort order — "total", "table", or "indexes" (default: "total").
    database_url: Database URL (optional, uses DATABASE_URL from .env if omitted).

Args:
    limit: How many queries to return (optional, defaults to
        TOP_QUERIES_DEFAULT_LIMIT from .env).
    sort_by: Принимается для совместимости со старой схемой
        инструмента, но пока не используется — сортировка всегда
        по total_exec_time (default: "resources").
    database_url: Database URL (optional, uses DATABASE_URL from .env if omitted).

Args:
    schema_name: Name of the schema to list objects from.
    object_type: One of "table", "view", "sequence" (default: "table").
    database_url: Database URL (optional, uses DATABASE_URL from .env if omitted).

Args:
    database_url: Database URL (optional, uses DATABASE_URL from .env if omitted).

Returns a JSON array with one entry per tool: name, description and
inputSchema (parameters). Does NOT require a database connection —
useful for discovering capabilities at runtime.

Returns:
    JSON string: [{"name": ..., "description": ..., "parameters": ...}, ...]

Args:
    action: One of:
        - "status"   (default) — list all certs with metadata, no changes.
        - "generate" — create a new cert, set as active. ttl_days applies.
        - "rotate"   — create a new cert (version+1), set as active,
                       previous one becomes ROTATING (decrypt still works
                       in grace period).
        - "rekey"    — re-encrypt connections.json and llm_connections.json
                       with the new active cert (run after rotation).
        - "revoke"   — mark cert by `kid` as REVOKED (compromised).
                       Decrypt NO longer works for it.
        - "validate" — same as status, but also tries to decrypt a known
                       secret (currently no-op placeholder, returns status).
    ttl_days: Certificate lifetime for generate/rotate (default 90).
    subject: Subject CN for new certs (default "postgres-mcp secrets").
    use_passphrase: If true, new cert will be passphrase-protected
        (raw key encrypted with PBKDF2(passphrase)). Passphrase is read
        from env CERT_PASSPHRASE.
    kid: For action="revoke" — which certificate to revoke.
    reason: Free-text reason recorded in audit log and cert notes.

Returns:
    JSON with details of the operation. For "status" — list of certs.
    For generate/rotate — new cert metadata. For revoke — boolean.
    For rekey — statistics {scanned, rekeyed, skipped, errors}.

Examples:
    # See current state
    action="status"
    # Create a new cert (auto-active)
    action="generate" ttl_days=90
    # Rotate (new active, old → ROTATING for grace period)
    action="rotate"
    # Re-encrypt connections files with new cert
    action="rekey"
    # Revoke a compromised cert
    action="revoke" kid="dec-abc123..." reason="leaked on GitHub"