"How to deploy Docker on a server through SSH" matching MCP tools:

• get_verifierA

  GoodeyeA

  Read a verifier's full definition (criterion, calibration examples, judge config); user-scoped verifiers only. ``verifier_id`` accepts a verifier UUID string or an accessible user-scope name. Any caller who can reach the verifier can read it: the owner, and skill grantees at any role (a view/exec grantee can read, not only run). Platform ``system:...`` aliases and system verifier UUIDs are never returned (NotFound): system rows are run-only and their internal config never surfaces through list, get, deploy, or revoke. Defaults to the current version; pass ``version`` to pin. Returns the full deploy-time payload (``criterion``, ``input_contract``, ``input_fields``, ``few_shot_examples``, ``judge_model_config``, ``reasoning_field_description``) plus ``config_hash`` (canonical-JSON SHA-256 over the config) so callers can detect drift across versions. A verifier you have no access to (and any revoked one) surfaces as NotFound. Platform-managed verifiers are run-only and never returned here.

  ConnectorOAuth

• deploy_appA

  DockholdA

  Deploy a GitHub repository as a live web app on Dockhold. Call this when the user wants to put an app online, get a shareable HTTPS URL, or host a demo. Returns the new app id. Two paths: a PUBLIC repo needs only repo_url; a PRIVATE repo needs repo_url plus github_installation_id (call list_github_repos first, each repo comes with the installation_id to pass here). Deploying a private repo turns on auto-deploy: future pushes to that repo redeploy the app automatically. The app builds and comes online automatically; poll get_app_status to watch it. Set memory_mb to size the app's compute, one of the values get_resource_usage reports under compute.steps_mb: 256 MB fits a static site or a small API, 512 MB fits a typical Node or Python web app, and anything that holds data in memory needs more. Omit it and the app gets the minimum slice (256 MB) so it doesn't take your whole compute pool; resize_app changes the size later with no rebuild, applied as a rolling update that replaces the app's instances. The response reports memory_mb (what this app got) and compute_available_mb (what's left in your pool), so size the next app off that. This tool needs a GitHub repo URL: if the code only exists locally (no repo), it cannot be used here, and the user should run `npx dockhold login` then `npx dockhold deploy` in the project folder instead. Requires a token with the deploy scope.

  ConnectorNo auth

• read_fileA

  BorealHostB

  Read the contents of a file from a site's container. Max file size: 512KB. Binary files are rejected — use the site's file manager or SSH for binary files. Requires: API key with read scope. Args: slug: Site identifier path: Relative path to the file Returns: {"path": "wp-config.php", "content": "<?php ...", "size": 1234, "encoding": "utf-8"} Errors: NOT_FOUND: File doesn't exist VALIDATION_ERROR: File is binary or exceeds 512KB

  ConnectorNo auth

• get-logsA

  mcpA

  Get build and runtime logs for a deployment. If no deployment_id is provided, returns logs for the latest deployment. Use this after calling deploy to monitor build progress and diagnose failures. Logs include: framework detection output, dependency installation, build steps, container startup, and health check results. If a deployment fails, check the logs for error details — common issues include missing dependencies, build errors, or the app not listening on the correct PORT (check the PORT env var — 8080 for auto-detected frameworks, or the EXPOSE value from Dockerfile).

  ConnectorNo auth

• leaseA

  CoolantC

  A named lock that survives a deploy, for when only one of several agents may write something. Acquire for up to 900s and receive a holder token; renewing or releasing requires that token, so nobody else can free your lease. The name must be at least 24 characters and should be random: short names like "deploy" are squatted in seconds. Advisory only -- it coordinates agents that agree to use it, and enforces nothing.

  ConnectorNo auth

• campaignstack_explain_capabilitiesA

  campaignstackA

  Explain how the pieces of this workspace fit together, so you can pick the right tool without opening several to compare them. Call this when you are choosing between similar tools, when a request does not obviously map to one tool, or when an error tells you to consult it. topic: overview (default), watchers (how to choose between the eight ways to monitor something), workflows (how a workflow gets its leads, and which tool creates which kind), platforms (what can be acted on and what is tracking-only), outreach_and_safety (who sends, what the limits are, and what to confirm with the user first). It is a static reference and returns no live counts: each topic names the list tool that does (campaignstack_get_signal_agents, campaignstack_get_workflows, and so on). Costs nothing and reads no workspace data.

  ConnectorAPI key

• delete_projectA

  NovenceA

  IRREVERSIBLE. Permanently delete a hosting project: the live site, preview URLs, and custom domain stop serving (HTTP 410), every deployed and staged file is erased, forms stop accepting submissions, site MCP and owner-edit go away, and project-scoped API keys and pending invites are revoked. There is no undo and no restore. Owner only. Only call this when the human has explicitly asked to delete this specific project; never to clean up after a failed deploy or to start over (redeploy instead). confirm must equal the project's exact name or suffix — get it from get_project and read it back to the human first. Calling again on a deleted project returns alreadyDeleted=true.

  Connector

  Destructive

  No auth

• findagent_edit_departmentA

  FindAgentA

  Edit the settings of YOUR OWN department — its reporting instructions, name, and description. `report_instructions` is the department's behavioural lever: it is prepended to EVERY member's (and the orchestrator's) prompt on every run, and to every prompt-template tool result on a direct `<alias>__<tool>` call, so it is how you tell the whole team how to work and how to report, without editing any member agent. Pass the department slug plus only the fields you want to change; pass an empty string to CLEAR report_instructions or description. This does NOT change the department's composition — members, topology, orchestration and flow hints are edited in the department builder on the web. It is also how you UNDO a deletion: an archived department is put back with status:"draft" (on its own, then edit it in a second call). Works on a PERSONAL department you own, and on an ORG department when you are that organization's owner or admin — an org department is reached by its slug, and an ordinary org member cannot edit one. Call findagent_list_my_agents to see the personal departments you own.

  ConnectorOAuth

• get_pm_playbookA

  AIOProductOS MCPA

  How to operate as a product manager on AIOProductOS. No arguments and no side effects — returns the same operating guide as plain text every call (deterministic): how to ground in the product brain, keep work welded to the spine (insight→feature→task→outcome), prioritise on evidence (affected accounts + MRR + reach), and what 'done' means. Call it FIRST, before planning or prioritising, to load the house rules the other tools assume.

  ConnectorNo auth

• get_resource_usageA

  DockholdA

  Show your account's compute, database-RAM, and storage pools: how much you've bought, how much is used, and how much is free, plus every app's current size. Call this before any resize tool (the allowed sizes come from its steps fields), and to explain to the user why an app ran out of memory or a deploy was refused for capacity.

  ConnectorNo auth

• get_security_evidenceA

  turva-mcpA

  Returns the latest public web-security scan results for turva.dev's own domain (Hardenize, Internet.nl site and mail), each with its scan date. Use this when a user asks about turva.dev's own security posture or wants evidence beyond agent-readiness scores. For the agent-readiness score itself, which is a separate measurement, use get_agent_readiness instead. Read-only: returns static JSON that is compiled into the Worker, so it changes nothing and updates only on deploy.

  ConnectorNo auth

• tfdeployA

  InsideOut (Riley)A

  WORKFLOW: Step 4 of 4 - Deploy infrastructure to the cloud Deploy infrastructure by starting a Terraform job for an InsideOut session. This tool initiates the actual deployment process after Terraform files have been generated. IMPORTANT: This starts a long-running job (15+ minutes). Use tfstatus to monitor progress. SINGLE-FLIGHT: only one TF job (apply/plan/destroy/drift) runs per session at a time. If another job is already in flight, tfdeploy returns tf_job_conflict with the live job_id — attach with tfstatus/tflogs instead of retrying, or pass force_new=true to override. Returns confirmation that the deployment has started. REQUIRES: session_id from convoopen response (format: sess_v2_...). OPTIONAL: plan_id (string) — Apply a previously created plan from tfplan. Preview-then-apply workflow: tfplan → tflogs (review) → tfdeploy(plan_id=...). OPTIONAL: sandbox (boolean, default false) — deploys real generated Terraform. Set to true for cheap sandbox template (testing only). OPTIONAL: ignore_drift (boolean, default false) - when true, proceeds with deploy even if infrastructure drift is detected. By default, deploys fail on drift. Use after reviewing drift details via tfdrift or tflogs. OPTIONAL: force_new (boolean, default false) - bypass the session-level single-flight guard. Use only when the existing run is provably wedged. CREDENTIAL FLOW (if credentials are missing): 1. Response includes a connect_url — present it to the user 2. Call credawait(session_id=...) to poll for credentials 3. When credawait returns success, retry tfdeploy Do NOT call credawait without first showing the connect URL to the user.

  Connector

  Destructive

  No auth

• goal-add-criterionA

  Planner (proof-of-done)A

  Append an acceptance criterion to a goal. The text must describe an observable check over an artifact (e.g. "GET /api/health returns 200 with {status:ok}"), not a subjective approval. Each criterion has a class: pre-merge (default — proved in CI / by attached evidence) or post-deploy (proved by an executable probe against the deployed prod instance). A post-deploy criterion MUST carry probeSpec {method, url, expect:{http_code, body:{field: expectedValue}}} — the request the runner sends and the answer it must get; without it the call is rejected with error=probe_required. Passing probeSpec alone implies probeClass=post-deploy. Set visualEvidenceSuggested=true only when adopting visualAcSuggestion from goal-create, goal-get, or the ready_for_work advisory returned by goal-update; it remains an ordinary AC. Grove mode: AC (class and probe included) can only be added while goal is in backlog, except accepting a visual advisory in ready_for_work: that starts a direct checking_ac recheck, without intermediate backlog. Other edits are frozen once started; quality linter blocks high-severity issues. Standard mode: AC editable until goal is closed, linter is advisory. Returns criterion id, position, text, probeClass, probeSpec and any quality findings.

  ConnectorNo auth

• pingA

  Gachi Data API — Japan Station & Accessibility DataA

  Connection test / health check — call this first to confirm the server is reachable. Returns server identity, deploy version, tool count, station coverage, and the update times of the realtime layers (JMA alerts, train status) so you can confirm freshness, not just liveness. No auth, no arguments, lightweight.

  ConnectorNo auth

• update_graph_schemaA

  RationalBloksA

  Replace a graph project's WHOLE schema (saves to database, does NOT deploy). DESTRUCTIVE: an entity, relationship or field the schema leaves out is deleted by the next deploy. ⚠️ Follow ALL rules from create_graph_project: • Must have "nodes" key with at least one entity • Each entity needs "description" and "schema" with field definitions • Each field is {"type": "...", "required": true/false} — required defaults to false • Relationships need "from", "to", and "cardinality" • Field types: string, integer, float, boolean, date, json • Relationship types should be UPPER_SNAKE_CASE • Entity names should be PascalCase WORKFLOW: 1. get_graph_schema to see the current schema (its 'version' pins the save) 2. preview_schema_change with the new schema: check 'diff' and 'plan' 3. update_graph_schema (pass expected_version to be refused if someone else saved meanwhile) 4. deploy_graph_staging, then get_job_status

  Connector

  Destructive

  No auth

• get_ssh_infoA

  BorealHostB

  Get SSH connection info for a VPS/dedicated site. Only available for VPS/dedicated plans (not shared hosting). Requires: API key with read scope. Args: slug: Site identifier Returns: {"host": "184.107.x.x", "port": 22, "username": "admin", "ssh_command": "ssh admin@184.107.x.x"} Errors: NOT_FOUND: Unknown slug FORBIDDEN: Plan does not support SSH (shared plans)

  ConnectorNo auth

• tfdeployA

  InsideOut (Riley)A

  WORKFLOW: Step 4 of 4 - Deploy infrastructure to the cloud Deploy infrastructure by starting a Terraform job for an InsideOut session. This tool initiates the actual deployment process after Terraform files have been generated. IMPORTANT: This starts a long-running job (15+ minutes). Use tfstatus to monitor progress. SINGLE-FLIGHT: only one TF job (apply/plan/destroy/drift) runs per session at a time. If another job is already in flight, tfdeploy returns tf_job_conflict with the live job_id — attach with tfstatus/tflogs instead of retrying, or pass force_new=true to override. Returns confirmation that the deployment has started. REQUIRES: session_id from convoopen response (format: sess_v2_...). OPTIONAL: plan_id (string) — Apply a previously created plan from tfplan. Preview-then-apply workflow: tfplan → tflogs (review) → tfdeploy(plan_id=...). OPTIONAL: sandbox (boolean, default false) — deploys real generated Terraform. Set to true for cheap sandbox template (testing only). OPTIONAL: ignore_drift (boolean, default false) - when true, proceeds with deploy even if infrastructure drift is detected. By default, deploys fail on drift. Use after reviewing drift details via tfdrift or tflogs. OPTIONAL: force_new (boolean, default false) - bypass the session-level single-flight guard. Use only when the existing run is provably wedged. CREDENTIAL FLOW (if credentials are missing): 1. Response includes a connect_url — present it to the user 2. Call credawait(session_id=...) to poll for credentials 3. When credawait returns success, retry tfdeploy Do NOT call credawait without first showing the connect URL to the user.

  Connector

  Destructive

  No auth

• one_shotA

  quantifymeA

  End-to-end deploy: generate strategy → train → deploy live. One of `prompt` (free-form NL), `preset` (curated winning strategy), or `community_id` (copy a published community strategy) is required. If more than one is passed, precedence is community_id > preset > prompt. Args: prompt: Natural-language strategy description (e.g. "Buy when RSI < 30, sell > 70"). symbol: Currency pair to backtest on. One of: EURUSD, USDJPY, GBPUSD, USDCHF, USDCAD, AUDUSD, NZDUSD. Default EURUSD. timeframe: Candle granularity. One of: 1min, 5min, 15min, 1h. Default 15min. claude_model: Which Claude variant to use for code generation. "sonnet" (default — best quality, 1/day free) or "haiku" (faster, 3/day free). Ignored when `preset` is set (no generation needed). preset: Curated winning-strategy slug. Skips Claude generation entirely — deploys a pre-saved strategy known to backtest well on the chosen symbol. Available slugs: ema_cross_fast, momentum, scalper_stack, sma_only, trend_ema, volatility, bb_squeeze, all_mix, pivot_kid_ema. Not every slug exists for every symbol — call list_models afterwards to confirm what deployed. community_id: Copy-trade a published community strategy. Pass the `id` of an entry from `browse_community`. Loads that exact strategy code, skips Claude generation, then trains + deploys it. `symbol`/`timeframe` still apply to the backtest+deploy. webhook_url: Optional webhook to receive live signals. telegram_chat_id: Optional Telegram chat ID for signal delivery. Returns IMMEDIATELY (the deploy runs in the background so the live card can stream progress) with: - job_token (str): pass to get_deploy_result to fetch the final result. - poll_url (str): the card polls this for live progress; you can ignore it. - pending (bool): always true here — the deploy is still running. - symbol, timeframe (str). Call this EXACTLY ONCE per request. Pass the user's words as `prompt`; do not pre-pick presets/community strategies - the server routes (vague → the best curated preset for the market, or a fresh build when there is none; specific rules → a fresh generation). A community strategy deploys only after the user has seen its author and code (get_strategy_code) and picked it: then pass its `community_id`. NEXT STEP (always): call get_deploy_result(job_token) ONCE — it blocks until the deploy finishes and returns the out-of-sample stats + `stem` + `source`/`author` as TEXT so you can summarize. The live card already shows the chart, so you do NOT need get_model_chart. If source='community', tell the user it used a pre-existing strategy by @author and offer to generate a custom one. If the result carries a `suggestion`, you may offer that community strategy.

  Connector

  Destructive

  No auth

• find_strategyA

  quantifymeA

  Find an existing PROVEN strategy that matches a plain-English idea, so you can offer the user a choice — deploy the existing one, or generate a fresh custom one. Mirrors the quantifyme.ai landing experience: "Found <X> by @<author> (WR/PF) — Use it / Generate fresh". Use this when a user wants to browse for an existing strategy. A vague deploy request does NOT need it: one_shot(prompt=...) deploys the best curated preset or a fresh build. A community strategy is another user's code, so it deploys only after the user has seen its author and code (get_strategy_code with the match's community_id) and picked it. Present the match (if any) and ASK: • Use it → one_shot(community_id=<match.community_id>) — deploys the exact strategy they picked (no generation). • Generate fresh → one_shot(prompt="<their description>") — Claude writes a brand-new custom strategy for them. If there's no match, just offer to generate fresh. Args: description: the user's strategy idea in plain English (e.g. "buy EURUSD 15min when RSI < 30, sell when RSI > 70"). symbol: optional pair to constrain the match (EURUSD, USDJPY, GBPUSD, USDCHF, USDCAD, AUDUSD, NZDUSD). timeframe: optional granularity to constrain the match (1min/5min/15min/1h). Returns: dict with: - match: the best existing strategy, or null. When present: {community_id, title, username, wr, pf, ret, n_trades, symbol, timeframe}. Pass community_id to one_shot to deploy it unchanged. - description: echoed back — pass as one_shot(prompt=...) to generate fresh. - suggestion: a ready-to-show sentence offering the user the choice.

  ConnectorNo auth

• get_strategy_codeA

  quantifymeA

  Get the actual Python code behind a community leaderboard strategy. Use after `browse_community`: pass an entry's `id` here to read its real `feature_engineering()` + `strategy_config()` source so the user can inspect or tweak it. To deploy it unchanged, pass the same id to `one_shot` as `community_id`. Read-only, no signup needed. Args: community_id: The `id` of a community entry (from `browse_community`). Returns: dict with: id, title, username, description, symbol, timeframe, metrics {total_ret, win_rate, profit_factor, n_trades, mdd, sharpe_strat}, and `code` (the full Python source). SHOW the code to the user, and offer to deploy it via one_shot(community_id=...) or tweak it first.

  ConnectorNo auth

• deploy_vpnA

  mcpB

  Stands up a redu VPN gateway (WireGuard tunnelled over wstunnel on WSS/443) on your PRIVATE network, so you (or your team) can reach the private IPs of the VMs you deployed on redu, over a single https endpoint - no UDP, no extra ports. This is the TENANT VPN for reaching your OWN deployed resources; it is NOT a general internet VPN. GUARDRAIL: the first call does NOT deploy - it returns the plan + hourly cost for approval, because it creates a BILLED VM. Show the user, get their explicit 'go', then call again with confirm:true (required even in yolo mode). The gateway asset is redu's, deployed onto YOUR VM (you can SSH in to read it). Fresh WireGuard keys are generated per deploy; the client PRIVATE key is returned ONCE and is never stored server-side.

  ConnectorNo auth