"Managing Kubernetes Clusters on AWS Elastic Beanstalk" matching MCP tools:

• aws___search_documentationA

  AWS KnowledgeA

  AWS docs search. Each result's `context` is verbatim page text -- a real chunk of the actual page, not a short snippet -- and usually already contains the answer, so answer directly from it. Use `read_documentation` only when the chunks genuinely lack the needed detail. Pick ONE topic. Add a 2nd ONLY if query genuinely spans domains. Extra topics dilute ranking. - reference_documentation -- API/SDK/CLI specs, config params - current_awareness -- new/released/announced - troubleshooting -- errors, "how to fix" (NOT for conceptual/feature questions) - amplify_docs -- Amplify (+ language) - cdk_docs -- CDK concepts/guides - cdk_constructs -- CDK code samples, L3 - cloudformation -- CFN/SAM templates - strands_docs -- Strands Agents SDK (its Skills/agents concepts go here, NOT agent_skills) - agent_skills -- this tool's guided skills (load via `retrieve_skill`) - general (default) -- architecture, best practices, tutorials, feature behavior Results: rank_order (lower=better), url, title, context (verbatim page chunk -- answer directly from it).

  ConnectorNo auth

• whoamiA

  shiplyA

  Who am I? Returns the signed-in account: email, @handle, plan + limits, counts of sites/domains/drives, and connected DNS providers. Call this first to orient before managing sites or domains.

  ConnectorNo auth

• run_cost_scanA

  Tomorrow Central: Cloud Cost SentinelB

  Start a cloud cost / FinOps scan of a linked account and return a job_id. Use this when the user wants to find idle, unused or underutilized cloud resources, review cloud spend, or estimate savings. The provider comes from the connection, and **AWS is the only provider supported today** (see `list_connections`). Other clouds will appear on this same tool as connections for them become linkable; nothing else about the call changes. READ-ONLY against your cloud: it reads resource metadata and monitoring metrics and reports; it never changes, stops or deletes anything. (It does create a scan job here and consume that account's scan quota, which is why this tool is not marked read-only.) On AWS it covers EC2 instances, EBS volumes and snapshots, RDS instances, Elastic IPs, NAT Gateways, load balancers, VPCs and VPC endpoints, site-to-site VPN and Transit Gateway attachments, Client VPN endpoints, Secrets Manager secrets, CloudFront distributions and WAF web ACLs. Resource kinds outside that list are not inspected, so a clean scan is not a claim that the whole bill is optimized. `connection_id` picks which linked AWS account to scan (see `list_connections`). Omit it to run against sample data — useful for showing the user what the output looks like before any account is linked. The scan runs asynchronously: poll `get_job(job_id)` roughly every 10 seconds until status is COMPLETED (typically 1-3 minutes), then call `list_cost_findings(job_id)`. Do NOT start another scan while one is running — each scan consumes the account's monthly quota. Pass `idempotency_key` (any unique string you choose) if you may retry on a network error: a retry with the same key returns the original job instead of starting a second scan.

  ConnectorNo auth

• find_cost_change_factorsA

  Costory: Your Finops MCPA

  Find which dimension values drove a cost change between two periods. This is a before/after analysis — compare is required (`{}` auto-derives the previous window, same as query). Prefer suggest_groupby / search / get_context first, then pass 2–4 columns (max 8). Do not invent columns. filterCel omitted or "" is unfiltered (not AWS-only). nestingEdges: a child's spend sits inside the parent — do not sum a contributor with its ancestors or descendants; independent contributors may be summed. Prefer omitting aggregationMethod (SUM). EXAMPLES: • "Why did last month's EC2 cost change?" → { datePreset: "LAST_MONTH", compare: {}, filterCel: "cos_service_name in [\"AmazonEC2\"]", columns: ["cos_region", "cos_usage_type"] } • "What drove the RDS jump in May?" → { from: "2026-05-01", to: "2026-05-31", compare: { from: "2026-04-01", to: "2026-04-30" }, filterCel: "cos_provider in [\"AWS\"] && cos_service_name in [\"AmazonRDS\"]", columns: ["cos_sub_account_id", { column: "cos_charge_description", contains: "IOPS" }] }

  ConnectorOAuth

• network_listenersA

  ReMCPB

  Use this when the user asks to inspect listening ports on a paired computer to diagnose local services, unexpected exposure or port conflicts. Reads the OS TCP listener inventory on Windows and macOS, and TCP/UDP listeners on Linux; process details depend on OS permissions. It does not connect to ports, scan remote hosts or change firewall rules.

  ConnectorOAuth

• set_email_switchesA

  GemmeinA

  Turns the app's outgoing emails (sends — on by default) and/or the new sign-in device notice (newSignIn — on by default) on or off. Send either or both; the other is left as it is. Before go-live it acts at once; once live, the founder approves it in the browser (request_email_switches).

  ConnectorNo auth

• awsinspect_batchA

  InsideOut (Riley)A

  BATCH INSPECTION: run up to 32 AWS inspect probes in one call. ⚠️ **PREREQUISITE**: Same as awsinspect — deploy attempt required. Check convostatus for hasDeployAttempt=true before calling. Use this when you need to check more than ~3 resources. The backend fetches Oracle credentials ONCE per batch and fans out probes against a single AWS config — for a 12-resource health check this is ~5–8× faster and 12× fewer Oracle round-trips than calling awsinspect 12 times. BUDGETS: - Up to 32 sub-probes per call (subs array length). - 30s per-sub timeout; 60s total batch wall-clock. - Concurrency cap 8 — sub-probes run in parallel but never saturate AWS. - 512 KB response cap: subs past the cap keep their envelope (index/service/action/ok) but have result replaced with truncated=true. PARTIAL FAILURE IS EXPECTED. The response is an ordered results array; each entry has {index, service, action, ok, result, error}. Inspect each result — do NOT abort on the first error. A credential fetch failure leaves cred-less probes (list-actions, list-metrics) succeeding anyway. REQUIRES: session_id from convoopen response (format: sess_v2_...). Supported services: account, acm, alb, apigateway, apprunner, backup, bedrock, cloudfront, cloudwatchlogs, cognito, cost-explorer, dynamodb, ebs, ec2, ecs, eks, elasticache, kms, lambda, msk, opensearch, rds, route53, s3, sagemaker, secretsmanager, sqs, vpc, waf For a specific service's actions, use awsinspect (singular) with action="list-actions" — batch is not the place for discovery. Batch responses are always summarized (no detail/raw per-sub); use singular awsinspect when you need full metadata or raw API output for one resource. EXAMPLES: - awsinspect_batch(session_id=..., subs=[ {"service":"ec2","action":"describe-instances"}, {"service":"rds","action":"describe-db-instances"}, {"service":"vpc","action":"describe-vpcs"}, {"service":"s3","action":"list-buckets"}]) - awsinspect_batch(session_id=..., subs=[ {"service":"ec2","action":"get-metrics","filters":"{\"hours\":6}"}, {"service":"rds","action":"get-metrics","filters":"{\"hours\":6}"}])

  ConnectorNo auth

• gcpinspect_batchA

  InsideOut (Riley)A

  BATCH INSPECTION: run up to 32 GCP inspect probes in one call. ⚠️ **PREREQUISITE**: Same as gcpinspect — deploy attempt required. Check convostatus for hasDeployAttempt=true before calling. Use this when you need to check more than ~3 resources. The backend fetches Oracle credentials ONCE per batch and fans out probes against a single GCP credentials blob — a 12-resource health check is ~5–8× faster and 12× fewer Oracle round-trips than calling gcpinspect 12 times. BUDGETS: - Up to 32 sub-probes per call (subs array length). - 30s per-sub timeout; 60s total batch wall-clock. - Concurrency cap 8. - 512 KB response cap: subs past the cap keep their envelope (index/service/action/ok) but have result replaced with truncated=true. PARTIAL FAILURE IS EXPECTED. The response is an ordered results array; each entry has {index, service, action, ok, result, error}. Inspect each result — do NOT abort on the first error. A credential fetch failure leaves cred-less probes (list-actions, list-metrics) succeeding anyway. REQUIRES: session_id from convoopen response (format: sess_v2_...). Supported services: apigateway, bastion, billing, certificatemanager, cloudarmor, cloudbuild, cloudcdn, clouddeploy, clouddns, cloudfunctions, cloudkms, cloudlogging, cloudmonitoring, cloudrun, cloudsql, compute, firestore, gcs, gke, iam, identityplatform, loadbalancer, memorystore, pubsub, secretmanager, vertexai, vpc For a specific service's actions, use gcpinspect (singular) with action="list-actions" — batch is not the place for discovery. Batch responses are always summarized (no detail/raw per-sub); use singular gcpinspect when you need full metadata or raw API output for one resource. EXAMPLES: - gcpinspect_batch(session_id=..., subs=[ {"service":"compute","action":"list-instances"}, {"service":"gke","action":"list-clusters"}, {"service":"cloudsql","action":"list-instances"}]) - gcpinspect_batch(session_id=..., subs=[ {"service":"compute","action":"get-metrics","filters":"{\"hours\":6}"}, {"service":"cloudrun","action":"get-metrics","filters":"{\"hours\":6}"}])

  ConnectorNo auth

• aws___get_regional_availabilityA

  AWS KnowledgeA

  AWS resource availability per region. - Max 10 regions; multi-region needs `filters`; single-region supports `next_token`. - Status: isAvailableIn | isNotAvailableIn | isPlannedIn | Not Found. - Response key: products | service_apis | cfn_resources. Not for region counts/docs/vague queries -- use `search_documentation` / `list_regions`. Filter values must EXACTLY match AWS's catalog names; guessed, partial, or pluralized names are rejected ("values in filter parameter do not exist"). If unsure of the exact name, first call once for a single region with resource_type set and NO filters to list all valid names, then re-call filtering on the exact match.

  ConnectorNo auth

• awsinspect_batchA

  InsideOut (Riley)A

  BATCH INSPECTION: run up to 32 AWS inspect probes in one call. ⚠️ **PREREQUISITE**: Same as awsinspect — deploy attempt required. Check convostatus for hasDeployAttempt=true before calling. Use this when you need to check more than ~3 resources. The backend fetches Oracle credentials ONCE per batch and fans out probes against a single AWS config — for a 12-resource health check this is ~5–8× faster and 12× fewer Oracle round-trips than calling awsinspect 12 times. BUDGETS: - Up to 32 sub-probes per call (subs array length). - 30s per-sub timeout; 60s total batch wall-clock. - Concurrency cap 8 — sub-probes run in parallel but never saturate AWS. - 512 KB response cap: subs past the cap keep their envelope (index/service/action/ok) but have result replaced with truncated=true. PARTIAL FAILURE IS EXPECTED. The response is an ordered results array; each entry has {index, service, action, ok, result, error}. Inspect each result — do NOT abort on the first error. A credential fetch failure leaves cred-less probes (list-actions, list-metrics) succeeding anyway. REQUIRES: session_id from convoopen response (format: sess_v2_...). Supported services: account, acm, alb, apigateway, apprunner, backup, bedrock, cloudfront, cloudwatchlogs, cognito, cost-explorer, dynamodb, ebs, ec2, ecs, eks, elasticache, kms, lambda, msk, opensearch, rds, route53, s3, sagemaker, secretsmanager, sqs, vpc, waf For a specific service's actions, use awsinspect (singular) with action="list-actions" — batch is not the place for discovery. Batch responses are always summarized (no detail/raw per-sub); use singular awsinspect when you need full metadata or raw API output for one resource. EXAMPLES: - awsinspect_batch(session_id=..., subs=[ {"service":"ec2","action":"describe-instances"}, {"service":"rds","action":"describe-db-instances"}, {"service":"vpc","action":"describe-vpcs"}, {"service":"s3","action":"list-buckets"}]) - awsinspect_batch(session_id=..., subs=[ {"service":"ec2","action":"get-metrics","filters":"{\"hours\":6}"}, {"service":"rds","action":"get-metrics","filters":"{\"hours\":6}"}])

  ConnectorNo auth

• gcpinspect_batchA

  InsideOut (Riley)A

  BATCH INSPECTION: run up to 32 GCP inspect probes in one call. ⚠️ **PREREQUISITE**: Same as gcpinspect — deploy attempt required. Check convostatus for hasDeployAttempt=true before calling. Use this when you need to check more than ~3 resources. The backend fetches Oracle credentials ONCE per batch and fans out probes against a single GCP credentials blob — a 12-resource health check is ~5–8× faster and 12× fewer Oracle round-trips than calling gcpinspect 12 times. BUDGETS: - Up to 32 sub-probes per call (subs array length). - 30s per-sub timeout; 60s total batch wall-clock. - Concurrency cap 8. - 512 KB response cap: subs past the cap keep their envelope (index/service/action/ok) but have result replaced with truncated=true. PARTIAL FAILURE IS EXPECTED. The response is an ordered results array; each entry has {index, service, action, ok, result, error}. Inspect each result — do NOT abort on the first error. A credential fetch failure leaves cred-less probes (list-actions, list-metrics) succeeding anyway. REQUIRES: session_id from convoopen response (format: sess_v2_...). Supported services: apigateway, bastion, billing, certificatemanager, cloudarmor, cloudbuild, cloudcdn, clouddeploy, clouddns, cloudfunctions, cloudkms, cloudlogging, cloudmonitoring, cloudrun, cloudsql, compute, firestore, gcs, gke, iam, identityplatform, loadbalancer, memorystore, pubsub, secretmanager, vertexai, vpc For a specific service's actions, use gcpinspect (singular) with action="list-actions" — batch is not the place for discovery. Batch responses are always summarized (no detail/raw per-sub); use singular gcpinspect when you need full metadata or raw API output for one resource. EXAMPLES: - gcpinspect_batch(session_id=..., subs=[ {"service":"compute","action":"list-instances"}, {"service":"gke","action":"list-clusters"}, {"service":"cloudsql","action":"list-instances"}]) - gcpinspect_batch(session_id=..., subs=[ {"service":"compute","action":"get-metrics","filters":"{\"hours\":6}"}, {"service":"cloudrun","action":"get-metrics","filters":"{\"hours\":6}"}])

  ConnectorNo auth

• byte_verify_payloadA

  byte-protocolA

  Verify-before-act: confirm a data payload an agent is about to act on actually matches what the publisher cryptographically attested to on-chain. Recomputes keccak256 of the received bytes and compares it to the on-chain EIP-712 PayloadAttestation hash. ALWAYS call this on BYTE-sourced data before acting on it; if verified=false the bytes were tampered/corrupted in transit and MUST NOT be used. Anchor the check with EITHER expectedHash (an on-chain payloadHash you already hold, e.g. from byte_query_fact / byte_buy_data) OR txHash (the settlement tx — also recovers the attestation signer and confirms it is the named publisher). Read-only; no wallet or payment required.

  ConnectorNo auth

• firmaradar_check_konkurs_eksponeringA

  FirmaradarA

  Screen a person by NAME for bankruptcy exposure ('konkursgjenganger'): leadership roles (chair / managing director) held in companies that later went bankrupt, tenure-weighted, from the dated role history. Use this for HISTORICAL leaders who are no longer in any role index and so cannot be reached via search_persons/get_person. The match is name-based (no national ID), so a hit is a REVIEW FLAG to verify (birth year / address), not a verdict. PII-sensitive — requires the search_full_enabled tier.

  ConnectorNo auth

• search_clustersA

  MRC Data — China's Apparel Supply Chain InfrastructureA

  Search Chinese apparel industrial clusters and textile markets. USE WHEN user asks: - "where is China's [denim / suit / women's wear / underwear] manufacturing concentrated" - "what is the largest [silk / cashmere / down jacket] industrial cluster in China" - "industrial cluster comparison Humen vs Shaoxing vs Haining vs Zhili" - "recommend an industrial cluster for sourcing [product]" - "where should I set up a sourcing office for [category]" - "list mega clusters for [category]" - "fabric markets in Zhejiang / Jiangsu" - "accessories / trim / zipper / button markets in China" - "which province dominates [category] exports" - "follow-up: 'tell me more about Humen's cluster scale'" - "服装产业带 / 面料市场 / 产业集群 / 纺织集群 / 辅料市场" - "做 [品类] 应该去哪个产业带 / 集群推荐" Famous clusters this database covers include: Humen (Guangdong, womenswear), Shaoxing Keqiao (Zhejiang, fabric mega-market), Haining (Zhejiang, leather), Zhili (Zhejiang, children's wear), Shengze (Jiangsu, silk), Shantou (Guangdong, underwear), Puning (Guangdong, jeans), Jinjiang (Fujian, sportswear), and more. Returns paginated cluster list with name, location, specialization, scale, supplier count, average rent and labor cost, and key advantages/risks. WORKFLOW: Cluster discovery entry point. search_clusters → compare_clusters (side-by-side up to 10 cluster_ids) OR get_cluster_suppliers (list factories in that cluster) OR analyze_market (broader market view). RETURNS: { has_more: boolean, data: [{ cluster_id, name_cn, name_en, type, province, city, specialization, scale, supplier_count, labor_cost_avg_rmb }] } EXAMPLES: • User: "Where are the biggest denim clusters in China?" → search_clusters({ specialization: "denim", scale: "mega" }) • User: "Show me fabric markets in Zhejiang" → search_clusters({ province: "Zhejiang", type: "fabric_market" }) • User: "童装产业带有哪些" → search_clusters({ specialization: "童装" }) ERRORS & SELF-CORRECTION: • Empty data array → try in order: (1) drop scale filter, (2) broaden specialization (e.g. "服装" instead of "牛仔"), (3) remove type, (4) remove province. • Specialization mismatch → both Chinese and English work. Synonyms: sportswear/运动服, womenswear/女装, underwear/内衣, denim/牛仔. • Rate limit 429 → wait 60 seconds; do not retry immediately. • Empty after 3 retries → tell user: "No clusters match [criteria]. Try broader specialization or removing filters." AVOID: Do not use this for specific factory search — use search_suppliers. Do not compare clusters by calling search_clusters twice — use compare_clusters with cluster_ids. NOTE: Source: MRC Data (meacheal.ai). 170+ clusters mapped across 31 provinces. 中文：搜索中国服装产业带和面料市场。

  ConnectorNo auth

• get_cluster_suppliersA

  MRC Data — China's Apparel Supply Chain InfrastructureA

  List all suppliers in a specific industrial cluster. USE WHEN user asks: - "what factories are in Humen cluster" - "show me suppliers in Keqiao fabric market" - "list all womenswear factories in [cluster]" - "top-quality suppliers in [cluster]" - "factory directory for [cluster]" - "page through suppliers in Shengze silk cluster" (pagination) - "follow-up after search_clusters: 'show me the factories there'" - "虎门产业带有哪些供应商 / [产业带] 的工厂列表" - "[集群] 里最好的几家工厂" PREREQUISITE: You MUST have a valid cluster_id from search_clusters. WORKFLOW: search_clusters → pick cluster_id → get_cluster_suppliers → optionally get_supplier_detail (vet top-ranked factory) OR compare_suppliers (evaluate top 3-10 factories in the cluster). RETURNS: { cluster_id, has_more, data: [supplier summary objects sorted by quality_score DESC] } EXAMPLES: • User: "What factories are in the Humen womenswear cluster?" → get_cluster_suppliers({ cluster_id: "humen_women", limit: 20 }) • User: "Show me the top 10 factories in Jinjiang sportswear cluster" → get_cluster_suppliers({ cluster_id: "jinjiang_sportswear", limit: 10 }) • User: "虎门有哪些服装厂，分页看第二页" → get_cluster_suppliers({ cluster_id: "humen_women", limit: 20, offset: 20 }) ERRORS & SELF-CORRECTION: • Empty data → either (a) cluster has no mapped suppliers (try compare_clusters to see supplier_count), or (b) cluster_id invalid. Re-run search_clusters. • cluster_id unknown → search_clusters({ specialization: "..." }) returns cluster_id values. • Rate limit 429 → wait 60 seconds; do not retry immediately. AVOID: Do not guess cluster_ids — always resolve via search_clusters. Do not use this to find suppliers globally — use search_suppliers. Do not iterate clusters in a loop — use compare_clusters. NOTE: Sorted by quality_score DESC. Source: MRC Data (meacheal.ai). 中文：列出某产业带内所有供应商，按质量评分排序。分页最多 50 条/页。

  ConnectorNo auth

• list_clustersA

  RationalBloksA

  List your registered BYOC resource pools (client-owned Kubernetes clusters). Each returned cluster has an 'id' you MUST pass as create_project's cluster_id to deploy a project onto your own infrastructure — owned hosting is retired, so every project we operate runs on your own cluster. Registering a pool is a UI action (create a bare Ubuntu box, authorise the key we generate, then we provision it into a cluster automatically) — this tool only lists pools you already registered, it never handles cluster credentials.

  ConnectorNo auth

• get_upgrade_previewA

  droplinkedA

  Aspirational roadmap to higher credit-tier ceilings for a merchant. Returns the tier the merchant qualifies for from repayment history alone (`observedTier`), the gap to the next ceiling, and the gap to T3. ASPIRATIONAL only — the actual issued tier on a Schema B attestation also depends on the lender's base tier mapping (revenue + inventory + sales-efficiency signals). Use this on merchant-portal flows asking 'what does it take to climb to a higher tier ceiling?'. Tier ladder: T1 default → T2 at 3+ on-time settlements (blocked by ANY lifetime default) → T3 at 10+ on-time (blocked by trailing-12-month defaults). When the merchant is at T3 both gap fields are null. Graceful clean-slate envelope on backend error or unknown merchant.

  ConnectorNo auth

• set_opportunity_statusA

  VarynForgeA

  Dismiss or restore an opportunity cluster. status=dismissed hides it from list_opportunities and the create_content_plan_from_opportunities harvest; status=default restores it. Dismissal lasts until the next research run rewrites the project clusters — for a durable "not my product" signal use set_excluded_terms. Removing a cluster from the pool changes the 0-100 normalization of every remaining cluster.

  Connector

  Destructive

  No auth

• create_incorporationA

  BeglaubigtA

  Create a German GmbH/UG incorporation case and return a secure Beglaubigt link where the founder provides their remaining personal details (date of birth, nationality, home address) and pays. The agent NEVER handles payment and NEVER asks for date of birth, nationality, or a person's home address in chat — those are collected only on the returned page. Collect in chat: the company (legal_form 'gmbh'|'ug', full `name` INCLUDING the legal-form suffix e.g. 'Velocent UG (haftungsbeschränkt)', `purpose`, `capital`, registered `address` and `business_address`), the `notarization` (its `type` — 'online' or 'offline' — is REQUIRED and has no default; optional `express` boolean; optional `preferred_timeframe` of 7, 14 or 30), the ownership structure (each shareholder's `share_percentage` and whether they are a managing director), and — for the first (founder) shareholder only — their `first_name` and `email` so Beglaubigt can send the completion link (tell the founder you will share their email with Beglaubigt for this). Share capital must be a whole number of euros and meet the legal minimum: GmbH at least 25000, UG at least 1. Share percentages must total 100. At least one shareholder must be a managing director, or a separate director must be included. Musterprotokoll (the standard template) supports at most 3 shareholders and exactly one managing director. Leave `documents` unset: Beglaubigt derives the articles type from the structure you send — one director with 1–3 shareholders gets the Musterprotokoll, anything larger gets individual (custom) articles. A notarization preferred_timeframe, if provided, must be 7, 14, or 30. Governance terms apply only when the derived articles are individual; Beglaubigt ignores them for a Musterprotokoll. You may optionally set: shareholders_meeting_quorum, shareholders_resolution_majority, significant_transactions_majority (percentages 0–100), representation_type ('joint' | 'sole' | 'section181'), majority_type ('simple' | 'two_thirds' | 'unanimous'), and notice_period_months. The optional additional_services field just records which follow-up options the founder wants information about later. It is non-binding: including it orders nothing, enrols the founder in nothing, and adds no charge — the link covers the one-time incorporation fee only. Recognised values: 'authority-registrations', 'business-liability-insurance', 'trademark-registration', 'bookkeeping', 'tax-advisor-support', 'business-address'. `package` (set at `incorporation.package`) is REQUIRED by this tool and sets the price shown on the completion page. The tiers are 'simple' | 'standard' | 'priority'. Ask the founder which one they want and send their answer — never choose for them. There is no package step on the completion page, so if you do not ask, the founder is never asked at all. Read the `packages://incorporation` resource for each tier's scope and structural limits, and tell the founder that exact prices depend on the partner tenant and are shown on the completion page before they pay — do not quote a figure yourself. Omitting the package is refused before anything is created, because omission silently bills the middle tier. Calls are NOT idempotent: every successful call creates a new incorporation case. When collecting these details, gather them conversationally across turns — one field at a time for each person — instead of asking for everything in a single message; call this tool only once all details are confirmed.

  ConnectorNo auth

• ml_dsa_signA

  CipherHUB Cryptography ToolkitA

  [pqc_signature] 使用 ML-DSA 私钥对消息签名（FIPS 204）。 【双模式】sign_mode 支持 RAW（默认）和 EXTERNAL_MU 两种模式。 - RAW 模式：直接签名原始消息（liboqs，最大 256 字节） - EXTERNAL_MU 模式：先计算 mu = SHAKE-256(tr||M', 64)，再通过 OpenSSL 3.5+ mu 模式签名（最大 2048 字节），与 AWS KMS ML-DSA EXTERNAL_MU 语义等价 【消息长度策略】 - RAW：最大 256 字节，空消息合法 - EXTERNAL_MU：最大 2048 字节，空消息合法 - > 256 且 <= 2048 字节：使用 EXTERNAL_MU - > 2048 字节：拒绝 【算法】algorithm 支持 ML-DSA-44 / ML-DSA-65（默认）/ ML-DSA-87。 【参数】 - private_key_in_hex：ml_dsa_keygen 返回的私钥 hex - public_key_spki_in_hex：EXTERNAL_MU 模式必填，ml_dsa_keygen 返回的公钥 hex（SPKI DER） - message_in_hex：待签消息 hex - context_in_hex：可选上下文 hex（最大 255 字节） - sign_mode：RAW 或 EXTERNAL_MU（默认 RAW） 【输出】signature_in_hex、signature_in_base64、algorithm、message_bytes、signature_bytes。

  ConnectorNo auth

• create_cloud_connectionA

  Tomorrow Central: Cloud Cost SentinelB

  Start linking a cloud account so it can be scanned. `provider` is "aws", the only provider supported today; `account_id` is the 12-digit AWS account number. `software` is the Tomorrow Central software the link is for; omit it for Cloud Cost Sentinel. Each software has its own read-only role, so link once per software. This is a two-party flow and you cannot finish it alone — creating the read-only IAM role requires the human's AWS credentials. Returns a `launch_url`. Hand the human these instructions verbatim: 1. Open the launch_url (a pre-filled CloudFormation quick-create link). 2. Review the read-only role it creates, then click Create stack. 3. Tell you when the stack says CREATE_COMPLETE. Then call `verify_connection` with the returned connection_id. Verification fails with a clear message until the role exists, so polling it every ~15 seconds is safe and expected. No ARN or secret needs to be copied by anyone.

  ConnectorNo auth