"UpCloud" matching MCP tools:

• ssh_repair_nodeA

  AnkraB

  Repair one Kubernetes node of an Ankra-provisioned cluster (Hetzner, OVH, UpCloud, DigitalOcean, or Scaleway) at the OS level over SSH-via-bastion: restarts the node's Kubernetes service unit (k3s / k3s-agent / kubelet) wrapped in Ankra's node-recovery engine, which classifies the failure and applies the matched curated fix (clear a failed unit, extend a start timeout, kill stale listeners, unblock the apiserver firewall, re-bootstrap the kubelet), verifies, and retries once. This is a privileged, not-cleanly-reversible action on a production node and briefly disrupts its workloads, so it requires confirmation. It does NOT run arbitrary commands - only the curated recovery plan. Always call ssh_diagnose_node first to confirm the node is broken at the OS level (not merely unreachable via bastion, which a node reboot - restart_node - addresses instead). Identify the node with node_id (preferred) or node_name. Not available for imported or managed-Kubernetes clusters, nor (yet) Proxmox/HPE Morpheus.

  Connector

  Destructive

  OAuth

• ssh_kubectl_readA

  AnkraB

  Run one allowlisted, read-only kubectl command INSIDE an Ankra-provisioned cluster (Hetzner, OVH, UpCloud, DigitalOcean or Scaleway) by executing it on a control-plane node over SSH-via-bastion, using that node's own admin kubeconfig. REACH FOR THIS ONLY WHEN THE CLUSTER'S AGENT IS NOT ANSWERING. While the agent is checking in, a get, describe, logs or events call here is REFUSED and names the tool to use instead: get_pods or cluster_query, describe_resource, get_pod_logs, get_events. Those answer the same question in one call, while this one dials the bastion, runs kubectl as cluster-admin and holds a scheduler job for up to 90 seconds. When the agent stops checking in they stop being an option - get_pod_logs and query_logs refuse outright, and the resource reads fall back to a cached inventory from before the outage - and this becomes the only live view left, because it does not use the agent at all; every result is stamped source=break_glass_ssh with executed_at. That is the state to use it in: to find out what is actually wrong with the agent itself - is its Deployment rolled out, is its pod Pending or CrashLoopBackOff or bound to a dead node, what do its logs and events say. If the agent IS checking in and you still need this, it is because an agent-path read already failed this turn (CLUSTER_OFFLINE, NO_AGENT or AGENT_TIMEOUT) or the tool it named refuses what you asked it for - get_pod_logs serves previous=true only on agent 2.1.1058 or newer, and refuses below it: set agent_path_unavailable=true, which is honoured and recorded. Verbs: get, describe, logs, events, top, version, api_resources, rollout_status. This is an allowlist, not a shell: there is no exec, port-forward, apply, patch, edit, create, scale, drain, cp, --raw, jsonpath or go-template, and no way to pass raw flags. Structured output (yaml/json) of Secrets is refused, though get and describe of them still report names, types and key names. Output is capped and credential-shaped strings are redacted. The command runs on a control-plane node, chosen automatically unless you pass node_id/node_name. Not available for imported or managed-Kubernetes clusters (they have no bastion), nor (yet) Proxmox/HPE Morpheus. Read-only: use ssh_kubectl_recover to change anything.

  ConnectorOAuth

• get_etcd_membersA

  AnkraB

  Inspect the etcd cluster membership of an Ankra-provisioned cluster (Hetzner, OVH, UpCloud, DigitalOcean, or Scaleway) by running a read-only inspection on one control-plane node over SSH-via-bastion: the member list (hex and decimal ids, names, peer/client URLs, learner flag), each member's health, any active etcd alarms, and a quorum summary (voting members, healthy voters, quorum size, has_quorum plus the quorum_evidence it rests on, and failure_tolerance - healthy voters minus quorum size, floored at 0). failure_tolerance counts only voters observed serving, so it is a conservative lower bound: a voter whose health is unknown does not count towards it (health_unknown_voting_members says how many), and 0 can mean either no margin left or quorum already lost. Member health is three-valued: 'health' is 'serving', 'not_serving', or 'unknown' when no signal was readable at all, in which case 'healthy' is null rather than false - report unknown as unknown, never as down - and 'health_source' names the signal that decided it: 'client_endpoint' (the member's own client endpoint), 'local_health' (this node's own /health, for the member of the node the inspection runs on), 'raft_peer_link' (the local etcd's raft peer link to that member), 'member_list' (the member has no client endpoint because it never started), or 'unavailable' (no signal was readable at all). Use it BEFORE touching a degraded control-plane node, to know the quorum margin; and before remove_etcd_member, to get the member id. Identify the node to run on with node_id (preferred, from list_cluster_nodes) or node_name - it must be a control-plane node, and when one control-plane node is down, pick a HEALTHY peer (the inspection talks to the local etcd of the node it runs on). Runs nothing that changes the cluster. Not available for imported or managed-Kubernetes clusters, nor (yet) Proxmox/HPE Morpheus.

  ConnectorOAuth

• remove_etcd_memberA

  AnkraB

  Remove one member from the etcd cluster of an Ankra-provisioned cluster (Hetzner, OVH, UpCloud, DigitalOcean, or Scaleway) - the cleanup step when a dead control-plane node is being replaced: its stale etcd member must be removed before a replacement joins, or quorum math breaks. Executes on a HEALTHY control-plane peer (node_id/node_name - never the node whose member is being removed) over SSH-via-bastion; a node that is not control-plane is refused before any removal is attempted. The scheduler re-reads live membership immediately before acting and REFUSES to remove: a member still observed serving (by any health source, not only its own endpoint), a member whose health could not be read at all (unknown is not dead), the member of the node the command runs on, an id that does not uniquely match, or any non-learner voter whose removal would leave fewer healthy voters than the post-removal quorum - a refusal comes back as a structured result explaining why, with the live member list as evidence. This is an irreversible control-plane change: a removed member cannot rejoin with its old identity. Call get_etcd_members first and pass the member_id it listed (hex or decimal). Not available for imported or managed-Kubernetes clusters, nor (yet) Proxmox/HPE Morpheus.

  Connector

  Destructive

  OAuth

• list_upcloud_optionsA

  AnkraB

  List the LIVE UpCloud catalogue a credential can reach: every datacentre zone with UpCloud's own description, and every server plan with its vCPU, memory, storage, current_offering flag, monthly EUR list price, and - for the GPU plans - gpu_count and gpu_model. ALWAYS call this instead of list_instance_types before create_upcloud_cluster or before answering any question about UpCloud zones, plans, GPUs, or prices: list_instance_types serves a frozen offline snapshot that stops at PREMIUM-8xCPU-32GB and contains NO GPU plan, so it cannot be used to conclude that UpCloud offers no GPU. UpCloud's two Helsinki zones are told apart only by their description, so read the zone list rather than guessing from the zone id. It also lists gateway_plans, the NAT gateway plans create_upcloud_cluster's gateway_plan accepts, with bandwidth_mbps, server_number and high_availability (a one-server plan loses all cluster egress while UpCloud rebuilds it). Read-only; talks to the UpCloud API, so it can take a few seconds.

  ConnectorOAuth

• scale_workersA

  AnkraB

  Scale the workers of an Ankra-provisioned self-managed cluster (Hetzner, OVH, UpCloud, DigitalOcean, Scaleway, Proxmox VE, or HPE Morpheus). With node_group_name, scales that node group to worker_count (0-100; the target is clamped into the group's autoscaling bounds when autoscaling is enabled); without it, performs the legacy whole-cluster scale to worker_count (1-10; refused while any node group has autoscaling enabled - scale the group directly instead). The cluster must be online and free of in-progress operations. New workers provision in the background. On scale-down the highest-index workers drain one at a time through the eviction API, honouring PodDisruptionBudgets, and are then terminated; a worker whose drain a PodDisruptionBudget refuses is kept in service and the scale-down is withdrawn for it, so the group can settle above worker_count. Call list_node_groups first to see the current counts, and again afterwards to confirm them.

  ConnectorOAuth

• request_provider_quota_increaseA

  AnkraB

  Raise a cloud-provider limit for a credential, or produce the exact request a person has to submit when the provider has no API for it. Call get_provider_quotas first: it names the dimensions and says whether the provider is automatable. Azure is the only provider Ankra can submit to (through the Microsoft.Quota API); for Hetzner, OVH, UpCloud, DigitalOcean, Scaleway, Proxmox VE and HPE Morpheus this call still SUCCEEDS and returns status manual_action_required with a manual_action object holding the console URL, the navigation path and a ready-to-paste request_text pre-filled with the live numbers - relay that to the user rather than retrying. One call may at most double a limit (or add 16 to a small one); ask for more by repeating the call. The limit can only go up: this tool will not lower one.

  Connector

  Destructive

  OAuth

• check_cluster_mesh_readinessA

  AnkraB

  Check whether the given clusters could form one mesh, with the failing checks spelled out per cluster. Takes CLUSTER ids, not a mesh id. Read 'eligible' before 'ready': ready means the cluster can join right now, eligible means it can join now OR after make_cluster_mesh_ready prepares it in place, and only an ineligible cluster has to be rebuilt. Each check also reports 'remediable' individually - a failing identity or transport check on an upcloud or proxmox kubeadm Cilium cluster is remediable, so reach for make_cluster_mesh_ready; the cloud, the distribution and the container network are not, and no operation on a running cluster changes them. Always run this before create_cluster_mesh so you can tell the user which clusters actually qualify. Read-only.

  ConnectorOAuth

• upcloud_start_serverA

  UpCloud MCP by usefulapiA

  Start a stopped server (billing for a started server resumes). Fails with 409 if it is not stopped. `async` returns immediately — poll upcloud_get_server for state=started. UpCloud: POST /1.3/server/{uuid}/start.

  Connector

  Destructive

  No auth

• ssh_kubectl_recoverA

  AnkraB

  Run one allowlisted STATE-CHANGING kubectl command inside an Ankra-provisioned cluster (Hetzner, OVH, UpCloud, DigitalOcean or Scaleway) from a control-plane node over SSH-via-bastion, for recovering a cluster whose in-cluster ankra-agent is offline and which therefore cannot be reached any other way. Verbs, and when each is the right one: rollout_restart (the agent Deployment exists and looks healthy to its ReplicaSet but never checks in - the usual fix); rollout_undo (the agent self-upgraded and the new revision never checked in - roll back to the revision that worked); delete_pod (one named pod is stuck Terminating, or is bound to a node that is gone, so the ReplicaSet will not replace it); cordon and uncordon (stop scheduling onto a sick node, or allow it again). This is an allowlist, not a shell: it cannot exec, apply, patch, scale, drain or delete anything other than exactly one named pod, and it accepts no label selector on the delete path, so a mistaken confirmation costs at most one pod. Call ssh_kubectl_read FIRST to confirm what is actually broken - restarting a rollout that is failing to pull an image just repeats the failure. This changes a production cluster and requires confirmation. Not available for imported or managed-Kubernetes clusters, nor (yet) Proxmox/HPE Morpheus.

  Connector

  Destructive

  OAuth

• upcloud_stop_serverA

  UpCloud MCP by usefulapiA

  DISRUPTIVE: stop a running server — it goes offline until started again with upcloud_start_server. soft (default) sends an ACPI shutdown; with a timeout, a hard stop follows if it is still running. hard is like pulling the plug and can lose unsaved data. UpCloud: POST /1.3/server/{uuid}/stop.

  Connector

  Destructive

  No auth

• restart_nodeA

  AnkraB

  Restart one provisioned VM node of an Ankra-managed cluster (Hetzner, OVH, UpCloud, DigitalOcean, Scaleway, or Proxmox) - a control-plane node, a worker, or the cluster's bastion/gateway. Schedules a native reboot (falling back to a power cycle) through the cloud provider API as a tracked operation; the node must be in the 'up' state and have no restart already in flight. Workloads on the node are briefly unavailable while it reboots. This is the fix for a VM that is hung or powered off - the case where SSH cannot reach the node at all. It is not a remedy for failed addon/manifest deploys or an unresponsive cluster agent, which ride the agent's outbound message-bus connection rather than node SSH. Identify the node with node_id (preferred, from list_cluster_nodes), node_name (exact match), or target="bastion" (the cluster's singleton bastion/gateway, no name needed). Always call list_cluster_nodes first if you do not already have the node_id. Not supported for HPE Morpheus or non-Ankra-provisioned clusters.

  ConnectorOAuth

• ssh_diagnose_nodeA

  AnkraB

  Diagnose one Kubernetes node of an Ankra-provisioned cluster (Hetzner, OVH, UpCloud, DigitalOcean, or Scaleway) at the OS level over SSH-via-bastion, for failures below the Kubernetes layer that kubectl-style tools cannot see: a NotReady node whose kubelet stopped posting status, a node the reconcile history reports as ssh_unreachable, a crash-looping k3s/kubelet service. Returns a read-only diagnostics snapshot (systemd unit state, recent journal, kubectl node view, network and listener state, apiserver firewall drops) plus any node-recovery symptoms detected. If the node cannot be reached over SSH at all, the report instead carries a path_diagnosis naming the hop that failed (bastion or node), the cause class (connect_timeout, connection_refused, no_route, auth_rejected, handshake_failed, tunnel_prohibited, ...) and the verbatim dial error - use it to tell a dead bastion from a dead node from a rejected SSH key before recommending anything. Hetzner diagnoses of an unreachable node additionally include a firewall_inspection: which Hetzner Cloud Firewalls are applied to the bastion and node servers and whether they admit inbound TCP 22 (these firewalls filter the public interface only, so they can block the platform's hop to the bastion but never the private bastion-to-node hop). Runs nothing that changes the node. Identify the node with node_id (preferred, from list_cluster_nodes) or node_name; the bastion/gateway has no kubelet - use diagnose_bastion for it. Use this before ssh_repair_node. Not available for imported or managed-Kubernetes clusters, nor (yet) Proxmox/HPE Morpheus.

  ConnectorOAuth

• get_node_cloud_init_logA

  AnkraB

  Read the cloud-init status and the tail of /var/log/cloud-init-output.log for one node of an Ankra-provisioned cluster (Hetzner, OVH, UpCloud, DigitalOcean, or Scaleway), over SSH-via-bastion. This is the debug surface for node-group user_data: that document runs once, at first boot, before anything else can observe it, so a failed provisioning script is invisible to every other tool - the node either joins looking perfectly healthy (cloud-init's growpart fallback restores an ordinary full-disk root when a carve fails) or never appears at all. Use it when a node group carries user_data and a node came up wrong: partitions or mounts that are missing, a package that should have been installed, a first-boot script whose effect is absent. Returns cloud-init's own status (including whether it reported an error) plus the output-log tail, and runs nothing that changes the node. Repeated calls attach to an in-flight fetch instead of dispatching a duplicate. Identify the node with node_id (preferred, from list_cluster_nodes) or node_name. Not available for imported or managed-Kubernetes clusters. For OS-level failures unrelated to first boot, use ssh_diagnose_node.

  ConnectorOAuth

• plan_os_patchesA

  AnkraB

  Dry-run the rolling OS security-patch lane on an Ankra-provisioned cluster (Hetzner, OVH, UpCloud, DigitalOcean, Scaleway, AWS or Ankra Cloud): on every node and the bastion it simulates the pending apt upgrades against the package lists the host already has and changes nothing. Ankra's unattended upgrades deliberately hold back the packages whose updates restart networking in place (systemd, udev, netplan, the container runtime, iptables/nftables), so their security fixes only arrive through run_os_patches; this shows what is waiting. Per host: the pending, security and held-back packages, whether a reboot is owed, how old the package lists are, and a stateful_verdict - would_skip names the single-replica workloads with volumes (or the database node pool) that make run_os_patches skip the node unless include_stateful_nodes is true. It also returns the order a run would take (control planes first, one at a time, then the workers, the bastion last), the hosts a run would leave out and why (a node that is not up, a cluster's only control plane), and the cluster's patch policy. A host whose status is not success has an unknown plan, not an empty one. It waits about 40 seconds for the hosts; when completed is false, call get_os_patch_status a minute later for the finished plan.

  ConnectorOAuth

• upcloud_restart_serverA

  UpCloud MCP by usefulapiA

  DISRUPTIVE: stop and start a running server. soft (default) needs a timeout: after it, timeout_action=destroy hard-stops and restarts, ignore (API default) aborts and leaves the server running. hard power-cycles immediately. UpCloud: POST /1.3/server/{uuid}/restart.

  Connector

  Destructive

  No auth

• stop_clusterA

  AnkraB

  Stop an Ankra-provisioned self-managed cluster (Hetzner, OVH, UpCloud, DigitalOcean, Scaleway, AWS, Proxmox VE, or HPE Morpheus). On Hetzner, OVH, UpCloud, DigitalOcean, Proxmox VE and Morpheus a stop TERMINATES every VM of the cluster at the provider (control planes, workers, bastion/gateway); on Scaleway and AWS the servers are instead powered off and kept with their volumes (etcd and the cluster's state survive; retained storage, gateway and IPs remain billable). On the terminating providers the platform first captures the cluster's state - an encrypted etcd snapshot uploaded to the organisation's backup vault - and tears the VMs down only once it is stored (k3s and kubeadm clusters on Hetzner, OVH, UpCloud, DigitalOcean, Proxmox VE and Morpheus); start_cluster then restores it so Secrets, ConfigMaps, custom resources and PersistentVolume/Claim bindings come back and StatefulSets reattach their existing cloud disks. preserve_state=false skips the capture (data on the VMs' disks is then destroyed; only the cluster's Ankra configuration is preserved and start_cluster re-provisions from it); preserve_state=true refuses a stop whose state cannot be captured. Cloud block volumes are never deleted by a stop. mode 'pause' (k3s on Hetzner, UpCloud and DigitalOcean) instead powers the servers off and keeps them with their disks, exactly like a Scaleway or AWS stop: etcd, local data and the nodes' identities survive and start_cluster powers them back on, at the price of compute and storage still billing while paused - offer it when the user wants a short stop with everything intact, and the default teardown when they want to stop paying for the VMs. Use before change_control_plane on a single-controller cluster (a 3-controller cluster resizes live without stopping). Confirm with the user before calling.

  Connector

  Destructive

  OAuth

• create_managed_clusterA

  AnkraB

  Create and provision a new MANAGED Kubernetes cluster - the cloud provider operates the control plane. Providers: eks (AWS), aks (Azure), gke (GCP), doks (DigitalOcean), uks (UpCloud), ovh_mks (OVH), kapsule (Scaleway; only for organisations with Scaleway enabled), ankracloud_k8s (Ankra Cloud Kubernetes; only for organisations with Ankra Cloud enabled); this is the ONLY way to create clusters on AWS, Azure, or GCP. Requires a provider credential (optional for ankracloud_k8s, which uses the organisation's built-in Ankra Cloud credential), a location slug, and at least one node pool ({name, size, count}); use list_managed_k8s_options first to resolve locations, versions, and node sizes. Optional: kubernetes_version, ha (DOKS only), cluster_plan (UKS only), kapsule.private_network_id (required for Kapsule). The cluster begins provisioning at the provider immediately after confirmation.

  Connector

  Destructive

  OAuth

• upcloud_modify_serverA

  UpCloud MCP by usefulapiA

  Change a server's title, hostname and/or simple-backup schedule. Only these reversible fields are exposed — no resizing or plan change (billing) and no firewall toggle. simple_backup is `HHMM,daily|dailies|weeklies|monthlies` (UTC time) or `no` to disable. UpCloud: PUT /1.3/server/{uuid}.

  Connector

  Destructive

  No auth

• list_cluster_nodesA

  AnkraB

  List the provisioned VM nodes of an Ankra-managed cluster (Hetzner, OVH, UpCloud, DigitalOcean, Scaleway, Proxmox, or HPE Morpheus): every control-plane and worker server plus the cluster's single bastion/gateway node, with id, name, role, node group, instance type, observed Kubernetes version, location, lifecycle state, IPs, and the cloud provider's live status/power state when available. Use this before restart_node to find the exact node to target - each node's 'is_bastion_or_gateway' flag identifies the bastion/gateway even though its name varies by cluster. The per-node kubernetes_version identifies which nodes sit on the wrong side of a kubelet version skew. Not available for imported (non-Ankra-provisioned) or managed-Kubernetes clusters. Read-only.

  ConnectorOAuth

• list_node_groupsA

  AnkraB

  List the day-2 topology of an Ankra-provisioned self-managed cluster (Hetzner, OVH, UpCloud, DigitalOcean, Scaleway, Proxmox VE, or HPE Morpheus) in one call: every worker node group (instance type, node count, scaling bounds, labels, taints, autoscaling settings), the control plane (count, instance type, supported counts, whether it can be changed right now and why not), and the legacy whole-cluster worker count. Call this before scale_workers, add_node_group, update_node_group, delete_node_group, or change_control_plane. Not available for imported or managed-Kubernetes clusters. Read-only.

  ConnectorOAuth