Security and authorization

Quave ONE evaluates authorization on every MCP request. A client cannot widen the access granted by an OAuth consent screen or MCP key configuration.

Control	Enforced by	Effect
OAuth capabilities / MCP-key grants	Quave ONE server	Gates tool discovery and execution.
Key enabled status	Quave ONE server	Disabled keys are rejected immediately.
Account, role, and environment permissions	Quave ONE server	Applies the same platform authorization as the dashboard.
Security level and session duration	MCP client	Controls confirmation and remembered approvals when the client supports them.

Which tools your client sees

An MCP client only discovers the tools it can use. When a client lists tools, Quave ONE returns only the tools that pass both checks:

1. The grant allows the tool. For an MCP key or OAuth connection in By permissions mode, the tool's required permissions must all be granted. In By tools mode, the tool must be one of the selected tools.
2. The tool applies to you. Some tools are listed only for some users. For example, the node tools (list-nodes, get-node-metrics-series) appear only when you belong to at least one Connect account.

The MCP key tool picker and the OAuth consent tool picker use the same rules, so they never offer a tool that your key or connection could not list. Listing is not the only check: when a tool runs, Quave ONE still verifies the grant and your account, role, and environment permissions. Calling a tool that is not listed for your key or connection fails.

OAuth grants

OAuth grants use one of two server-enforced authorization modes:

• By permissions grants stable Quave ONE capability scopes. Read-only is the default starting selection when the client requested only read access, and the consent screen can show the verified client's full available capability set for an explicit step-up.
• By tools grants an explicit MCP tool allowlist. Quave ONE derives the required capability scopes for the selected tools server-side; unselected tools are not available even if they share a capability.

New OAuth grants do not mix permission mode and tool mode. Connected apps can reduce or revoke the current mode only. To add permissions, add tools, or switch modes, reconnect the client and approve a fresh OAuth request. Conditional or sensitive actions can require a fresh, explicit consent step-up.

MCP-key authorization modes

Every MCP key has one server-enforced mode.

By permissions

By permissions (SCOPES) is the default. The key grants capabilities, and Quave ONE checks each tool call against them. Discovery lists the tools whose required permissions the key grants, including tools added later; tools outside the grants are neither listed nor callable.

Scope	What It Allows	Risk Level	Always Enable?
Read Only	View apps, logs, metrics, and account information	Safe	Yes
Read Secrets	View secret environment variables and sensitive data	High Risk	Rarely
Write Configurations	Update app configuration, environment variables, and settings	Low Risk	If needed
Write Deployments	Deploy, restart, scale, and manage app environments	Medium Risk	If needed
Write Dangerous	Delete resources and perform irreversible actions	High Risk	Rarely
Manage MCP Keys	Create, update, rotate, reveal, enable, and disable MCP keys with the same or less effective tool access	Critical	Rarely
Control Destroy Protection	Enable or disable Prevent destroy on app environments. This controls a safety lock that blocks direct environment deletion and parent app/account deletion, so granting it can both protect resources and remove that protection.	Critical	Rarely
Admin	Account-level administrative operations	Critical	Rarely

By tools

By tools (TOOLS) stores an explicit list of permitted tools. Only selected tools appear in discovery, and direct calls to an unselected tool are rejected before its handler runs. A selected tool still requires its normal Quave ONE account and role checks.

Tool mode is useful when a client should perform a small, fixed workflow. It requires at least one valid tool. Dashboard groups are selection shortcuts; the stored grant is the precise selected-tool list.

Read Only (quave:read) - View apps, logs, metrics, and account information:

• list-disaster-readiness-sources - Lists visible persistent-volume environments and their DR eligibility. Eligibility is not readiness.
• list-disaster-readiness-configurations - Lists DR configuration, measured readiness and actionable reasons for visible environments.
• list-disaster-readiness-points - Lists retained recovery point candidates for the current configuration generation. Availability requires verification; this list is not Disaster Ready evidence.
• list-accounts - Lists all accounts that the authenticated user has access to
• get-current-account - Gets the current account set for the authenticated user
• get-account-security-posture - Read-only, deterministic security posture review of an account and an explicit list of critical environments: stable check IDs, status, evidence, and the exact dashboard location to fix each finding. Never returns secrets.
• list-account-events - Lists Quave ONE platform audit/access events for an account. This is platform activity, not application HTTP or ingress access logs.
• list-apps - Lists all apps for the authenticated user
• list-app-envs - Lists all app environments for the authenticated user
• get-app-env - Gets the full configuration for an app environment including resources, scaling, deployment settings, security, hosts, and pending changes (may also require additional scopes: Read Secrets)
• get-app-env-status - Gets the current runtime status and health for an app environment
• get-app-env-metrics - Gets real-time resource metrics (CPU, memory, container count)
• get-app-env-history - Gets the deployment history and activity timeline
• get-app-env-pods - Gets pod-level details for an app environment
• get-app-env-metrics-series - Gets historical time-series metrics (CPU, memory) over a time range from Prometheus. Supports time navigation with from/to parameters and configurable resolution.
• search-app-env-traces - Searches distributed traces (OpenTelemetry/Tempo) of an app environment by status, duration, span name, HTTP route or HTTP status code.
• get-app-env-trace - Gets one distributed trace of an app environment as a list of spans with timings, status and key attributes.
• get-app-env-metrics-baseline-summary - Compares a recent window against a longer baseline window for one or more metrics and returns aggregate or per-pod stats (mean, p50/p95/p99, max, stddev) plus deviation (absolute, percent, z-score) in a single call. Built for anomaly detection — use instead of pulling raw series and computing by hand.
• get-app-env-log-error-summary - Aggregates error log lines into stable signatures with counts, first/last seen, and a delta vs a prior baseline window — surfacing NEW error patterns that were not present before. Use instead of scrolling raw logs to detect new/regressed errors.
• analyze-app-env-mongodb-queries - Reads the MongoDB profiler of a Quave ONE managed MongoDB and groups slow operations by query shape (values redacted), with COLLSCAN, in-memory sort and docs-examined findings, suggested indexes and unused indexes. Uses a platform user that cannot read customer data.
• list-app-env-variables - Lists environment variables for an app environment. Set showSecrets=true to view secret values (requires quave:read:secrets scope and Secrets Access permission). (may also require additional scopes: Read Secrets)
• get-app-env-job-schedule - Gets the recurring schedule, next run, latest outcome, and occurrence history for a Job app environment.
• list-branch-previews - Lists temporary branch preview environments for an app.
• check-app-env-cname - Checks if CNAME records are properly configured for region change. All custom hosts must have CNAME records pointing to the ingress URL before changing regions. Not supported for database environments. Use the database-specific tools for supported operations.
• list-app-env-job-runs - Lists recent JobRun history for a Job app environment
• get-app-env-job-run - Gets one JobRun by ID within an app environment
• get-app-env-job-run-logs - Retrieves logs for one JobRun with filtering and pagination
• get-logs - Retrieves logs from an app environment with filtering and search
• list-app-env-backups - Lists logical database backup files for an app environment and explicitly reports whether scheduled database backups are intentionally disabled. Returns backup metadata only; no secrets are decrypted.
• list-app-env-volume-backups - Lists customer-safe volume backup recovery points for an app environment and explicitly reports whether scheduled snapshots are intentionally disabled. Returns timestamps, snapshot types and sizes, but never storage credentials, object keys or PVC names.
• get-app-env-backup-overview - Gets a customer-language backup protection summary, retention policy, storage mode and latest validation without exposing schedules, paths or credentials.
• list-app-env-backup-validations - Lists customer-safe backup validation history for an app environment.
• preview-app-env-backup-cleanup - Shows the customer-safe retention cleanup outcome without changing backup storage. The newest recovery point is always protected.
• get-account-backup-overview - Lists customer-safe backup protection, retention, storage mode and aggregate backup usage for every environment in one account.
• preview-account-backup-cleanup - Previews expired backup data eligible for cleanup across one account. Requires account admin permission; no data is deleted.
• get-app-env-backup-storage-usage - Gets aggregate database and volume backup storage usage, retention limits and storage mode without exposing bucket names, paths, keys or credentials.
• list-nodes - Lists infrastructure nodes. Internal Operator users can inspect every configured region; customers only see private regions enabled for their Connect account. Returns node name, region, IPs, capacity, and allocatable resources. To understand why a node pool scales (or does not scale down), use get-node-pool.
• get-node-metrics-series - Retrieves time-series infrastructure metrics for a specific node from Prometheus. Internal Operator users can query any configured region; customers can query nodes in private regions enabled for their Connect account. Supports CPU, memory, disk, network, filesystem, and load metrics.
• list-node-pools - Lists the node pools you can see with min/max/current/desired nodes, autoscale, power state and the last autoscaler decision with its reason.
• get-node-pool - Shows one node pool: scaling settings, autoscaler state (last decision, reason, measured CPU/memory vs scale-up and scale-down thresholds, scale-down window), power, nodes with reserved resources and app pod counts, and recent events.
• get-account-ingress-metrics-series - Retrieves account-wide nginx ingress time-series metrics from Prometheus, aggregated across every app environment of the account in the chosen region. Supports request rate, success/error rates, status code breakdown, request/response sizes, and P50/P90/P99 latency.
• get-app-env-ingress-metrics-series - Retrieves nginx ingress time-series metrics from Prometheus for a single app environment (filtered to its k8s service). Supports request rate, success/error rates, status code breakdown, request/response sizes, and P50/P90/P99 latency.
• get-account-ingress-access-log-summary - Returns aggregated nginx ingress access log buckets for an entire account (namespace), grouped by service/host/path/method/status with count and average/min/max response time. Sourced from the ingress-* Elasticsearch index. For raw individual access log hits use get-logs with type=ACCESS_LOG.
• get-account-observability-summary - Rollup across every app environment in an account: each env's status plus aggregate or per-pod recent-vs-baseline metric deltas (z-score) in a single call. Use this first for a fast account-wide anomaly sweep, then drill into a specific env with get-app-env-metrics-baseline-summary or get-app-env-log-error-summary. Env count is capped; deep dives should use the per-env tools.
• get-app-env-ingress-access-log-summary - Returns aggregated HTTP request buckets for a single app environment, grouped by host/path/method/status with count and average/min/max response time. Use this for the same aggregated request data shown in the Requests tab for a Function environment; group Functions by path, method, and status to match that view. Regular apps are sourced from nginx ingress access logs; Functions are sourced from Knative request logs enriched with AppEnvId.
• list-regions - Lists all available deployment regions with their availability status. Shows which regions are enabled for the account and available for the user based on account tier (Hobby accounts are limited to the Hobby region; Professional accounts unlock all regions). Call this before create-app-env or update-app-env-region to know which regions are available.
• list-database-presets - Lists regular-user database presets that can be created automatically via the public API (MongoDB, PostgreSQL, MySQL, Redis, CouchDB, RabbitMQ, ClickHouse). Returns each preset with its name, label, protocol (e.g. mongodb://), isPersistenceOptional flag, available versions (with the default), and per-preset limits (min/max disk MB and max replicas). Pass accountId to receive that account effective database maximum disk limit. Call this before create-app or create-app-env on a database to pick the right `dockerPreset`, `dockerPresetVersion`, and to know whether `withPersistence` applies. For database create-app calls, include the standard engine port even though the managed database is provisioned later by create-app-env: MongoDB 27017, PostgreSQL 5432, MySQL 3306, Redis 6379, CouchDB 5984, RabbitMQ 5672, ClickHouse 8123. create-app-env does not take a port. Internal-Operator-only/manual database engines (Elasticsearch, Opensearch, Kafka, etc.) are not returned.
• list-app-presets - Lists non-database Docker presets that the public API can create (Next.js, Remix, Vite, Vue.js, Express, Node.js variants, Angular, Meteor.js, Custom, Function). Returns each preset with its name, label, hasVersions flag, available versions (with the default), and capability flags (isCustom requires a Dockerfile, isFunction is the serverless preset). Call this before create-app to pick a sensible `dockerPreset` / `dockerPresetVersion`. For database presets use list-database-presets instead.
• list-solutions - Lists curated Quave ONE solutions available to create. The response contains only safe catalog metadata and never private deployment values.
• list-members - Lists account members and pending invitations with roles, MFA coverage, and environment-access summary for access review evidence.
• get-member-env-access - Gets the environment access configuration for a specific member. Shows which environments the member can access, or if they have full access.
• list-credentials - Lists all account-level credentials (container registries including AWS ECR, basic auth, TLS certificates, ACME wildcards). Returns credential metadata and sync/refresh status without sensitive values.
• get-credential - Gets details of a specific account-level credential including its type, name, sync status, and non-sensitive metadata. Sensitive fields (passwords, private keys, provider configs) are never returned through the API.
• list-credential-references - Lists all apps, environments, and hosts that reference a specific credential. Useful before deleting a credential to see what would break.
• list-agent-automation-options - Lists safe metadata needed to create or edit agent automations: enabled MCP keys, accessible LLM provider keys, contact points, delivery modes, statuses, and common schedules. Does not return secrets.
• list-agent-profiles - Lists the one-click Agent Profile catalog for an account: card copy, schedule, exact read-only tool allowlist, per-account eligibility, enabled state, and versioned What’s new entries for pending updates.
• list-agent-automations - Lists agent automations owned by the authenticated user for an account, including schedule, enabled state, next run, and last run summary.
• get-agent-automation - Gets the full editable configuration for one agent automation owned by the authenticated user.
• list-agent-automation-runs - Lists automation run history with status, timing, usage, and telemetry summary.
• get-agent-automation-run - Gets detailed automation run output including transcript, telemetry, deliveries, and optionally tool step details. (may also require additional scopes: Read Secrets)
• list-llm-provider-keys - Lists personal or account-scoped LLM provider keys without returning API key plaintext.
• get-llm-provider-key - Gets one LLM provider key metadata record without returning API key plaintext.
• search-docs - Searches Quave ONE documentation and blog posts using fuzzy matching. Returns relevant pages with excerpts. Use this to find information about deployment, CLI, billing, troubleshooting, and more.
• read-doc - Reads the full content of a specific documentation page or blog post. Use the path from search-docs results or known documentation paths.
• list-contact-points - Lists all contact points for an account. Contact points are notification destinations (Slack, Microsoft Teams, Google Chat, PagerDuty, Webhook, Email) used by alerts and automations. Each item includes status ACTIVE or PAUSED; do not send new alerts or automations to a PAUSED destination until it is updated and saved.
• get-contact-point - Gets details of a specific contact point including its configuration, status (ACTIVE or PAUSED), and lastDeliveryError when paused. Sensitive config fields (like webhook URLs) require admin permission. (may also require additional scopes: Read Secrets)
• list-alerts - Lists all alerts for an app environment. Shows alert name, metric, threshold, state, and enabled status.
• get-alert - Gets detailed information about a specific alert including its condition, contact point, and current state.
• refresh-alert-state - Refreshes the alert state from Grafana. Returns the current state (Normal, Pending, Firing, NoData, Error).
• list-sandbox-templates - Lists the sandbox templates of an account.
• get-sandbox-template - Gets a sandbox template with its current immutable revision (image, command, resources, lifetimes).
• list-sandboxes - Lists the sandboxes of an account with status filters.
• get-sandbox - Gets one sandbox with its lifecycle status, error codes, and timestamps.
• list-shared-volumes - Lists the shared volumes (NFS and object storage) of an account with their state, origin and purge deadline.
• list-storage-servers - Lists the Storage Servers (NFS and object storage) an account can create shared volumes on, platform and account-owned, per region.
• list-ai-subscriptions - Lists your personal AI subscriptions (name and env var only; values are never returned).
• get-sandbox-command - Reads the state, exit code and new output of a command started with start-sandbox-command.

Read Secrets (quave:read:secrets) - View secret environment variables and sensitive data:

• get-app-env-backup-download - Returns a time-limited backup download URL and backup decryption material. This is a sensitive operation that requires the quave:read:secrets scope and account Secrets Access permission.
• get-user-token - Retrieves the currently authenticated user profile token (decoded). This is a sensitive operation that requires the quave:read:secrets scope.
• get-app-env-token - Retrieves the CLI token for a specific app environment (decoded). Requires admin permission on the account that owns the environment.
• reveal-llm-provider-key - Reveals LLM provider API key plaintext. Requires secret-read scope and emits a secret decrypt audit event.

Write Configurations (quave:write:config) - Update app configuration, environment variables, and settings:

• set-current-account - Sets the current account for the authenticated user
• create-account - Creates a new account for the authenticated user. Account names beginning with agent-test create internal test accounts with a 100 zCloud limit, production access to us-5, staging access to all st-* regions, and Agent Sandboxes, Shared Storage and object storage volumes enabled. To add container registry credentials, use the create-credential tool after account creation.
• update-account - Updates account settings including name. Requires admin permission on the account.
• set-account-require-mfa - Enable or disable the account-wide two-factor authentication requirement.
• create-app - Creates a new app within an account. Supports CLI/source deployment modes, GitHub deployments, and managed database app shells. Pre-built images belong to each environment. AI agents should send isCliDeployment: true by default unless the user explicitly provided GitHub repo details; GitHub deployments require gitNamespace, gitRepo, and gitInstallationId. For dockerPreset CUSTOM source builds, dockerfilePath defaults to "Dockerfile" when omitted. Call list-app-presets first to discover non-database presets (Next.js, Meteor.js, Custom, Function, ...) and their versions. For databases, call list-database-presets first, pass isCliDeployment: true plus the standard engine port on create-app, then use create-app-env to provision the cluster. Database creation rules: - Database creation is a two-tool flow: first call create-app with the database dockerPreset, isCliDeployment: true, and the standard engine port; then call create-app-env to provision the managed database cluster in a region. - Do not omit isCliDeployment for database apps. Without isCliDeployment: true, create-app is interpreted as a GitHub deployment and the API will complain about missing gitNamespace/gitRepo/gitInstallationId instead of provisioning a database. - For database create-app calls, include the standard engine port even though the managed database is provisioned later by create-app-env: MongoDB 27017, PostgreSQL 5432, MySQL 3306, Redis 6379, CouchDB 5984, RabbitMQ 5672, ClickHouse 8123. create-app-env does not take a port. - Call list-database-presets first to get the eligible regular-user presets (currently MongoDB, PostgreSQL, MySQL, Redis, CouchDB, RabbitMQ, ClickHouse), their versions and defaults, and the per-preset limits (minDiskMb, maxDiskMb, maxReplicas). Internal-Operator-only/manual database engines (Elasticsearch, Opensearch, Kafka, ...) are intentionally not returned. - The chosen region must support automatic DevOps deploy (use list-regions to confirm). - "containers" is the replica count: a positive integer up to maxReplicas. Use containers > 1 only for HA setups. CouchDB currently supports exactly 1 container. - "disk" is the per-replica volume size in MB, and must be between minDiskMb and maxDiskMb. For Redis with withPersistence=false, set disk=0 (warn the user that data is lost on restart). For all other DB presets, disk is mandatory. - "withPersistence" only applies when the preset has isPersistenceOptional=true (currently Redis). Pass true (with disk > 0) or false (cache-only, disk=0). - "dockerPresetVersion" should be set; if omitted, the latest default version is used. - "databaseSettings.redis" (Redis only) supports tlsEnabled, configExtra (key/value, with denylist), and HA components (sentinel must be odd, >= 3 replicas; haproxy >= 1). Only applies when containers > 1. - "databaseSettings.mysql.parameters" (MySQL only) supports max_connections. - "databaseSettings.mysql.lowerCaseTableNames" (MySQL only, boolean, default true) controls lower_case_table_names (true = 1, case-insensitive table names; false = 0, case-sensitive). CREATE-ONLY: MySQL applies it when the data directory is initialised and it cannot be changed later; pass false only when the schema relies on case-sensitive names, and match the source value when migrating. - "databaseSettings.postgresql.parameters" (PostgreSQL only) supports work_mem, hash_mem_multiplier, max_parallel_workers_per_gather, effective_cache_size, max_connections, random_page_cost, maintenance_work_mem, shared_buffers, effective_io_concurrency, log_min_duration_statement, max_wal_size, min_wal_size, wal_buffers, checkpoint_completion_target, autovacuum_max_workers, and autovacuum_vacuum_cost_limit. - "databaseSettings.mongodb.search.enabled" (MongoDB 8.2+ only) enables the optional MongoDB Search (mongot) service. Optional "search.resources.zClouds" (1, 2, 4, or 8 per replica), "search.replicas" (1 to 3) and "search.storage" (disk in MB, default = the database disk, grow-only) size it; Search is billed as its zClouds × replicas plus its disk. Change them later with update-app-env-resources. - "databaseSettings.mongodb.tls.quaveCertOnly" (MongoDB, any version) makes the database serve only the Quave One intermediate CA certificate instead of a publicly trusted one. New MongoDB databases default to true; clients must trust the Quave One CA (or connect with tlsAllowInvalidCertificates). The value can only be chosen at creation time — changing it on an existing database is restricted to the Quave One team (contact support).
• update-app - Updates app-level deployment mode, Docker settings, port, build configuration, and health checks. Image tags are environment-specific and must be set via create-app-env or deploy-app-env-image. For persistent storage, use update-app-env-volume on a specific environment. To change the framework, use list-app-presets to discover valid `dockerPreset` and `dockerPresetVersion` values (database presets cannot be set via update-app).
• create-app-env - Creates a new environment within an app. Configure region, resources, and environment variables. Use list-regions first to see available regions for the account. For database apps, this is the step that provisions the managed cluster; pass zClouds (1, 2, 4, or 8), containers, disk, withPersistence (Redis only), dockerPresetVersion, and optional databaseSettings. Do not pass port or isCliDeployment here; those belong to create-app. Database creation rules: - Database creation is a two-tool flow: first call create-app with the database dockerPreset, isCliDeployment: true, and the standard engine port; then call create-app-env to provision the managed database cluster in a region. - Do not omit isCliDeployment for database apps. Without isCliDeployment: true, create-app is interpreted as a GitHub deployment and the API will complain about missing gitNamespace/gitRepo/gitInstallationId instead of provisioning a database. - For database create-app calls, include the standard engine port even though the managed database is provisioned later by create-app-env: MongoDB 27017, PostgreSQL 5432, MySQL 3306, Redis 6379, CouchDB 5984, RabbitMQ 5672, ClickHouse 8123. create-app-env does not take a port. - Call list-database-presets first to get the eligible regular-user presets (currently MongoDB, PostgreSQL, MySQL, Redis, CouchDB, RabbitMQ, ClickHouse), their versions and defaults, and the per-preset limits (minDiskMb, maxDiskMb, maxReplicas). Internal-Operator-only/manual database engines (Elasticsearch, Opensearch, Kafka, ...) are intentionally not returned. - The chosen region must support automatic DevOps deploy (use list-regions to confirm). - "containers" is the replica count: a positive integer up to maxReplicas. Use containers > 1 only for HA setups. CouchDB currently supports exactly 1 container. - "disk" is the per-replica volume size in MB, and must be between minDiskMb and maxDiskMb. For Redis with withPersistence=false, set disk=0 (warn the user that data is lost on restart). For all other DB presets, disk is mandatory. - "withPersistence" only applies when the preset has isPersistenceOptional=true (currently Redis). Pass true (with disk > 0) or false (cache-only, disk=0). - "dockerPresetVersion" should be set; if omitted, the latest default version is used. - "databaseSettings.redis" (Redis only) supports tlsEnabled, configExtra (key/value, with denylist), and HA components (sentinel must be odd, >= 3 replicas; haproxy >= 1). Only applies when containers > 1. - "databaseSettings.mysql.parameters" (MySQL only) supports max_connections. - "databaseSettings.mysql.lowerCaseTableNames" (MySQL only, boolean, default true) controls lower_case_table_names (true = 1, case-insensitive table names; false = 0, case-sensitive). CREATE-ONLY: MySQL applies it when the data directory is initialised and it cannot be changed later; pass false only when the schema relies on case-sensitive names, and match the source value when migrating. - "databaseSettings.postgresql.parameters" (PostgreSQL only) supports work_mem, hash_mem_multiplier, max_parallel_workers_per_gather, effective_cache_size, max_connections, random_page_cost, maintenance_work_mem, shared_buffers, effective_io_concurrency, log_min_duration_statement, max_wal_size, min_wal_size, wal_buffers, checkpoint_completion_target, autovacuum_max_workers, and autovacuum_vacuum_cost_limit. - "databaseSettings.mongodb.search.enabled" (MongoDB 8.2+ only) enables the optional MongoDB Search (mongot) service. Optional "search.resources.zClouds" (1, 2, 4, or 8 per replica), "search.replicas" (1 to 3) and "search.storage" (disk in MB, default = the database disk, grow-only) size it; Search is billed as its zClouds × replicas plus its disk. Change them later with update-app-env-resources. - "databaseSettings.mongodb.tls.quaveCertOnly" (MongoDB, any version) makes the database serve only the Quave One intermediate CA certificate instead of a publicly trusted one. New MongoDB databases default to true; clients must trust the Quave One CA (or connect with tlsAllowInvalidCertificates). The value can only be chosen at creation time — changing it on an existing database is restricted to the Quave One team (contact support).
• update-app-env-resources - Updates resource allocation for an app environment (zClouds or custom CPU/memory/disk). zClouds accepts only 1, 2, 4, or 8; use custom resources instead when a Connect account needs another size. "disk" can resize DevOps database storage and regular app local persistent volumes. It is grow-only once applied; shared NFS volumes and stateless apps do not use this disk setting. DevOps databases must stay within the per-preset limits from list-database-presets. For a managed MongoDB with Search, "databaseSettings.mongodb.search" sets the Search size (resources.zClouds), replicas and disk (storage, grow-only). For databases, this is available for automatically provisioned database presets (MongoDB, PostgreSQL, MySQL, Redis, CouchDB, RabbitMQ, or ClickHouse) deployed in a region with DevOps support.
• update-app-env-storage-autoresize - Turns disk autoresize on or off for a managed DevOps database or a local persistent volume and sets its trigger, step, maximum and cooldown. Grow-only, bounded by the account disk limit. Supports dryRun to preview the validated policy.
• update-app-env-scaling-options - Updates autoscaling and scale-to-zero together as one atomic configuration change. Scale-to-zero is available only for eligible Connect accounts with account autoscaling enabled.
• update-function-config - Updates the scaling and timeout configuration for a function app environment. Configure concurrency, timeouts, and min/max scale. Only available for function apps. Not supported for database environments. Use the database-specific tools for supported operations.
• update-app-env-job-config - Updates the command, arguments, timeout, retry, TTL, and concurrency overrides for a Job app environment.
• update-app-env-job-schedule - Configures, enables, or disables one recurring five-field cron schedule for a Job app environment.
• update-app-env-variable - Adds, updates, or removes environment variables (partial update). Use "variables" to add/update and "variablesToRemove" to delete.
• patch-json-env-var - Patches a specific field within a JSON-formatted environment variable without sending the entire JSON. Useful for updating large JSON configs like METEOR_SETTINGS. (also requires: Read Secrets)
• update-app-env-branch - Updates the git branch for an app environment. Changing the branch creates pending build changes. Not supported for database environments. Use the database-specific tools for supported operations.
• update-app-env-healthcheck - Updates the HTTP health check configuration for an app. Health check settings are shared across all environments of the app. Not supported for database environments. Use the database-specific tools for supported operations.
• update-app-env-tracing - Enables or disables OpenTelemetry tracing for one app environment and sets the app language for the injected SDK (nodejs, java, python, dotnet, or manual when the app ships its own SDK). Traces are stored per account in Tempo and shown in the account Grafana "Traces" dashboard. Only effective once Quave ONE has released tracing for the account. Not supported for database environments. Use the database-specific tools for supported operations.
• update-app-env-security - Updates security settings for an app environment including ModSecurity WAF, rate limiting, and security context (fsGroup, runAsUser, runAsGroup). Not supported for database environments. Use the database-specific tools for supported operations.
• update-app-env-allowlist - Manages the IP address allowlist and network control for an app environment. Toggle networkControlEnabled to enable or disable IP restriction enforcement. Add, update, or remove IP addresses/CIDR ranges. When network control is enabled and an allowlist is active, only connections from listed IPs are allowed. Changes trigger an immediate deploy. For databases, this is available for automatically provisioned database presets (MongoDB, PostgreSQL, MySQL, Redis, CouchDB, RabbitMQ, or ClickHouse) deployed in a region with DevOps support.
• update-app-env-volume - Configures persistent storage for an app environment. Enable/disable volumes, set the mount path, and toggle NFS shared volumes. When useVolume is enabled without NFS, blue-green deploy is automatically disabled on the app and scaling is limited to 1 container. The environment's region must support volumes. Not supported for database environments. Use the database-specific tools for supported operations.
• update-app-env-name - Updates the name of an app environment. This is a display name change that may affect CLI deploy targets. For databases, this is available for automatically provisioned database presets (MongoDB, PostgreSQL, MySQL, Redis, CouchDB, RabbitMQ, or ClickHouse) deployed in a region with DevOps support.
• add-app-env-host - Adds a custom hostname to an app environment. The hostname must be a valid domain and not already in use in the same region. Hosts are deployed immediately. Not supported for database environments. Use the database-specific tools for supported operations.
• enable-app-env-prevent-destroy - Enables the protected-environment guard that blocks direct environment deletion and parent app/account deletion.
• extend-branch-preview - Extends a branch preview environment by adding a positive TTL to its expiration time.
• update-app-env-region - Changes the region of an app environment. Requires valid CNAME records for all custom hosts (use check-app-env-cname first). This is a disruptive operation - the environment will be unreachable for ~2 minutes. Use list-regions to see available target regions. Not supported for database environments. Use the database-specific tools for supported operations.
• update-app-env-backup-retention - Updates the customer-safe backup retention days and optional storage-size cap for an environment.
• update-app-env-snapshot-options - Updates the customer-friendly recovery-point interval and replica coverage for volume snapshots.
• configure-app-env-backup-storage - Attaches or detaches an existing customer object-storage credential for backups without returning credentials. Cleanup on customer storage requires a separate explicit acknowledgement.
• update-node-pool-scaling - Changes min/max nodes, autoscale, scale-down action and autoscaler targets of a node pool. Only the fields sent change.
• update-node-pool-power - Sets a node pool power mode: normal autoscaling, a stop/start schedule, or a manual override.
• update-node-pool-disk-autogrow - Sets the autogrow policy of the data disks of a stateful node pool (threshold, step and maximum size).
• create-solution - Creates a curated solution in an account. Each component is created as a normal Quave ONE app environment through the standard creation flow.
• create-credential - Creates a new account-level credential, including static Docker registries or AWS ECR registry credentials. Requires the Manage Credentials role. Credentials are encrypted at rest and automatically synced to every region the account uses.
• update-credential - Updates an existing account-level credential. The type cannot be changed after creation. Sensitive fields left empty on update retain their stored values. Requires the Manage Credentials role.
• set-default-credential - Promotes a Container Registry credential to the account-wide default. Apps without an explicit registry selection use the default. Only Container Registry credentials support this operation. Requires the Manage Credentials role.
• sync-credential - Re-pushes a credential to every active region the account uses. For AWS ECR, also generates a fresh short-lived Docker auth token and updates refresh status. Useful when a previous sync failed (shown as Error status) or after editing a credential. Requires the Manage Credentials role.
• enable-agent-profile - Enables an Agent Profile with one call: provisions its dedicated TOOLS-mode MCP key, ensures a contact point, creates the automation from the template, and fires the first run. (may also require additional scopes: Manage MCP Keys)
• apply-agent-profile-update - Applies a reviewed Agent Profile update to the latest published template. First use list-agent-profiles to read What’s new, then pass its current profile version. It preserves the existing key and contact points, and fails closed when permissions changed and re-enablement is required.
• create-agent-automation - Creates an agent automation using the same backend validation as the dashboard UI. The selected MCP key controls what the automation can do.
• update-agent-automation - Updates an agent automation using the same backend validation as the dashboard UI.
• toggle-agent-automation - Enables or disables an agent automation without deleting it.
• create-llm-provider-key - Creates a personal or account-scoped LLM provider key. Account keys require the Manage Credentials role.
• update-llm-provider-key - Updates a personal or account-scoped LLM provider key. Account keys require the Manage Credentials role.
• set-default-llm-provider-key - Sets a personal or account-scoped LLM provider key as the default for that scope.
• test-llm-provider-key - Runs the same one-token LLM provider connectivity probe used by the dashboard UI.
• create-contact-point - Creates a new contact point for alert notifications. Supported types: slack (requires webhookUrl), pagerduty (requires integrationKey), webhook (requires url), email (requires addresses array).
• update-contact-point - Updates a contact point name or configuration. A config update resumes a PAUSED contact point. Changes are propagated to Grafana for active destinations.
• create-alert - Creates a new alert for an app environment. Supports built-in metrics (cpu_percent, memory_percent, cpu_usage, memory_usage and per-pod variants). Requires a contact point for notifications.
• copy-alert - Copies one existing enabled alert to one or more environments using stable environment names. (also requires: Read Only)
• update-alert - Updates an alert configuration. Can change name, description, metric, threshold, duration, or contact point.
• toggle-alert - Enables or disables an alert. Disabled alerts do not send notifications.
• save-sandbox-template - Creates a sandbox template, or updates the name/description/enabled flag of an existing one.
• create-sandbox-template-revision - Appends an immutable revision to a sandbox template: digest-pinned image, optional command/workingDir, resources, persistence, lifetimes and network control. New sandboxes pin the latest revision.
• create-shared-volume - Creates a shared volume on one of the account Storage Servers; app environments (update-app-env-volume) and sandboxes (volumeName) can mount it.
• create-object-storage-server - Opens an Object Storage Server on the account own S3-compatible bucket in a region, so shared volumes can be created on it.
• update-object-storage-server - Updates an Object Storage Server on the account own bucket: rotates its event hub token, changes its hub URL, or sets the uid/gid new volumes report as file owner.
• restore-shared-volume - Restores an object storage volume removed with a purge delay, before its purge deadline.
• create-ai-subscription - Stores a personal AI subscription credential that only you can use in your private sandboxes.
• update-ai-subscription - Renames a personal AI subscription or replaces its env var or value.

Write Deployments (quave:write:deploy) - Deploy, restart, scale, and manage app environments:

• configure-disaster-readiness - Enables or updates protection for selected environments. Starts asynchronous preparation and may allocate billable resources. Requires account admin permission; does not activate a live database. (also requires: Write Configurations)
• validate-disaster-readiness-now - Requests an isolated validation of retained DR data in the configured destination. May allocate temporary billable resources; does not switch source traffic, activate a live target or change normal snapshot/validation schedules. Requires account admin permission.
• apply-app-env-changes - Applies pending configuration changes to an app environment (like terraform apply). For databases, this is available for automatically provisioned database presets (MongoDB, PostgreSQL, MySQL, Redis, CouchDB, RabbitMQ, or ClickHouse) deployed in a region with DevOps support.
• scale-app-env-containers - Manually scales the number of containers for an app environment. For DevOps databases, "containers" is the replica count capped at the per-preset limit (use list-database-presets to read the current maxReplicas). Use containers > 1 only for HA setups (Redis HA settings only apply when containers > 1; CouchDB currently requires exactly 1). For databases, this is available for automatically provisioned database presets (MongoDB, PostgreSQL, MySQL, Redis, CouchDB, RabbitMQ, or ClickHouse) deployed in a region with DevOps support.
• trigger-app-env-build - Triggers a new build for an app environment. This starts the build process to create a new deployment artifact. Not supported for database environments. Use the database-specific tools for supported operations. (may also require additional scopes: Write Configurations)
• redeploy-app-env - Redeploys an app environment using the current or a specified deployment version. Useful for restarting containers or applying pending configuration changes (e.g. after rotating database credentials in env vars). For databases, this is available for automatically provisioned database presets (MongoDB, PostgreSQL, MySQL, Redis, CouchDB, RabbitMQ, or ClickHouse) deployed in a region with DevOps support.
• start-app-env - Starts a stopped app environment by redeploying its current version. Not supported for database environments. Use the database-specific tools for supported operations.
• update-app-env-image-auto-deploy - Enables or disables image auto-deploy for an image-based app environment: Quave ONE watches the deployed image tag and deploys the exact new digest whenever the tag moves. (also requires: Write Configurations)
• create-branch-preview - Creates a temporary branch preview environment cloned from an existing environment. (also requires: Write Configurations)
• run-app-env-job - Runs a finite Job app workload, optionally merging environment variables before creating the JobRun (may also require additional scopes: Write Configurations)
• cancel-app-env-job-run - Cancels a running JobRun and deletes its Kubernetes Job if it has started
• rerun-app-env-job-run - Creates a new JobRun from a previous run snapshot, with optional content or command overrides
• validate-app-env-volume-backup - Starts a non-destructive restore validation for a complete volume-backup chain or a selected full/incremental point. Requires account admin permission and the quave:write:deploy scope.
• create-app-env-from-volume-backup - Creates a separate environment restored from a volume-backup chain or selected point. Databases always create a new App; other apps can choose the source or a new App. New App destinations require target.appName. Requires account admin permission plus deploy and configuration scopes. (may also require additional scopes: Write Configurations)
• request-deploy-storage-key - Requests a pre-signed URL for uploading code to deploy. Returns an uploadUrl and storageKey. Step 1 of the code deployment process.
• notify-code-upload - Notifies that code has been uploaded and triggers the build process. Step 3 of the code deployment process (step 2 is uploading via curl). (may also require additional scopes: Write Configurations)
• deploy-app-env-image - Deploys a Docker image to one app environment. The app must have useImage=true. The image is saved only on that environment and deployed directly without a build step. Not supported for database environments. Use the database-specific tools for supported operations. (may also require additional scopes: Write Configurations)
• run-agent-automation-once - Dispatches one manual run for an agent automation. Optionally waits for the resulting run to finish. (may also require additional scopes: Read Only)
• create-sandbox - Creates an isolated gVisor sandbox from a template, or reconnects to the one already created with the same idempotency key.
• terminate-sandbox - Terminates a sandbox. Idempotent; a terminated sandbox cannot be resumed.
• pause-sandbox - Pauses a sandbox with a persistence mode: snapshots the workspace (snapshot/both) and releases the compute; the shared volume is kept. Resume with resume-sandbox.
• resume-sandbox - Resumes a paused sandbox with the same id: the workspace is restored from its shared volume before it serves.

Write Dangerous (quave:write:dangerous) - Delete resources and perform irreversible actions:

• activate-disaster-readiness - Requests activation of one explicit retained recovery point. Requires account admin permission and acknowledgment of source double-writing risk. May allocate billable resources. Confirm the selected cutoff and writer safety with the user before calling. Does not switch application traffic; receipt is not live recovery completion. (also requires: Write Deployments)
• discard-disaster-readiness-activation - Discards an in-progress activation (recovery target) that has not become live, so a stuck activation stops blocking reset or a new activation. Requires account admin permission and explicit acknowledgment that the unfinished recovery target will be discarded. Confirm with the user before calling. Does not touch the live source or a target that already became live. (also requires: Write Deployments)
• reset-disaster-readiness - Deletes Disaster Readiness configuration for one environment or the whole account, including leftover recovery destinations still owned by those settings. Live source environments and destinations that already became live are not deleted. Requires account admin permission and typing the environment or account name. Confirm with the user before calling. (also requires: Write Deployments)
• rollback-app-env - Rolls back an app environment to a previous version. If no targetContentId is specified, rolls back to the immediately previous deployment. Not supported for database environments. Use the database-specific tools for supported operations.
• stop-app-env - Stops an app environment, scaling its containers to zero. The environment can be started again later. Not supported for database environments. Use the database-specific tools for supported operations.
• remove-app-env-host - Removes a hostname from an app environment. You can specify the host by hostId or hostname. Changes are deployed immediately. Not supported for database environments. Use the database-specific tools for supported operations.
• delete-app - Permanently deletes an app and all its environments, deployments, metrics, and associated data. This action cannot be undone. Environments are destroyed automatically; managed database volumes are retained for the separate PVC cleanup/detach flow.
• delete-app-env - Permanently deletes an app environment and all its associated data (deployments, metrics, updates). This action cannot be undone. For databases, this is available for automatically provisioned database presets (MongoDB, PostgreSQL, MySQL, Redis, CouchDB, RabbitMQ, or ClickHouse) deployed in a region with DevOps support. Persistent database volumes are retained for the separate PVC cleanup/detach flow.
• delete-branch-preview - Deletes a branch preview environment only when preview metadata is present.
• run-app-env-backup-cleanup - Permanently removes expired backup data after an explicit, unexpired cleanup preview confirmation. The newest recovery point is always protected.
• run-account-backup-cleanup - Permanently removes expired backup data across one account after an explicit unexpired preview confirmation. Requires account admin permission.
• update-node-pool-node-power - Stops or starts one node of a stateful node pool. A stopped node keeps its data disk; its workloads stay down until it starts.
• grow-node-pool-disk - Grows one data disk of a stateful node pool. Irreversible: disks never shrink.
• delete-credential - Permanently deletes an account-level credential. Cannot delete credentials that are still referenced by apps, hosts, or environments. Requires the Manage Credentials role.
• delete-agent-automation - Deletes an agent automation owned by the authenticated user.
• delete-llm-provider-key - Deletes a personal or account-scoped LLM provider key. Account keys require the Manage Credentials role.
• delete-mcp-key - Deletes an MCP key with the same or less effective tool access than the current MCP key. Requires MCP-key management plus dangerous-operation protection. (also requires: Manage MCP Keys)
• delete-contact-point - Deletes a contact point. Cannot delete if alerts are using this contact point.
• delete-alert - Permanently deletes an alert. Removes from both MongoDB and Grafana.
• remove-shared-volume - Removes a shared volume claim. Object storage volumes keep their data restorable for purgeAfterDays (default 7); 0 purges now.
• execute-sandbox-command - Runs a command to completion INSIDE a sandbox through the region gateway and returns its captured output. Requires the sandbox runtime agent.
• delete-ai-subscription - Deletes a personal AI subscription and its stored value.
• start-sandbox-command - Starts a command INSIDE a sandbox and returns at once with an executionId, for builds, test suites and agent sessions longer than execute allows.
• kill-sandbox-command - Stops a command started with start-sandbox-command (SIGTERM by default, or SIGINT/SIGKILL).

Manage MCP Keys (quave:manage:mcp-keys) - Create, update, rotate, reveal, enable, and disable MCP keys with the same or less effective tool access:

• list-mcp-keys - Lists MCP keys manageable by the current MCP key and only returns keys with the same or less effective tool access.
• get-mcp-key - Gets MCP key metadata for a key with the same or less effective tool access than the current MCP key.
• create-mcp-key - Creates a scope-mode or explicit tool-mode MCP key with the same or less effective tool access than the current MCP key. (may also require additional scopes: Read Secrets)
• update-mcp-key - Updates an MCP key only when its requested effective tool access is the same or less than the current MCP key.
• toggle-mcp-key - Enables or disables an MCP key with the same or less effective tool access than the current MCP key.
• set-default-mcp-key - Sets or clears the authenticated user’s default MCP key. The default is exclusive per user. A disabled key cannot be the default.
• regenerate-mcp-key - Rotates the secret for an MCP key with the same or less effective tool access than the current MCP key. (may also require additional scopes: Read Secrets)
• reveal-mcp-key - Reveals raw MCP key plaintext for a key with the same or less effective tool access than the current MCP key. Secret-read protection remains required. (also requires: Read Secrets)

Control Destroy Protection (quave:admin:destroy-protection) - Enable or disable Prevent destroy on app environments. This controls a safety lock that blocks direct environment deletion and parent app/account deletion, so granting it can both protect resources and remove that protection.:

• disable-app-env-prevent-destroy - Disables the protected-environment guard, allowing a later environment, parent app, or account deletion.

Admin (quave:admin) - Account-level administrative operations:

• update-member-env-access - Updates which environments a member can access. Pass an empty array or omit allowedAppEnvIds to grant full access. Requires MANAGE_MEMBERS permission.

Key confirmation settings

Security level

Security level tells a compatible MCP client how aggressively to request confirmation. It is not a server authorization bypass.

Level	Behavior	Best For
Strict	Confirm every operation - Maximum security	Critical production accounts
Balanced	Recommended - Read auto-approved, writes confirmed	Most users (recommended)
Permissive	Minimal confirmations - Trust automation	Development environments
Auto	Full automation - Only confirm destructive operations	Trusted automation workflows

Session duration

Session duration tells a compatible client how long it may remember approvals. The allowed range is 5 minutes to 24 hours, with a 30-minute default. Quave ONE still evaluates the key’s grants and platform permissions on every request.

Secure operating practices

For a practical production checklist, read Safety best practices.

• Give each client or device its own OAuth grant or MCP key.
• Use least privilege: start with read access or a minimal tool allowlist.
• Keep production-changing and secret-reading capabilities separate from normal troubleshooting access.
• Revoke a connected app or disable a key immediately if it is no longer trusted.
• Never put secrets in tool prompts, startup commands, or command arguments; use Quave ONE secret environment variables instead.

The MCP server is remote HTTP only. It validates tool input and forwards authorized requests to Quave ONE; it does not launch local shell commands on your machine.