{"authentication":{"oauth2":{"authorization_server":"https://safegrd.dev","resource_metadata":"https://safegrd.dev/.well-known/oauth-protected-resource/mcp","scopes":["mcp"]},"required":true,"schemes":["oauth2","bearer"]},"description":"Read backups and Fire Drills, and ask for a backup or a drill. No tool deletes, disables, re-routes or re-keys a backup.","documentationUrl":"https://safegrd.dev/docs/mcp","instructions":"SafeGrd backs up databases, file trees and mailboxes, encrypted on the customer's host, and runs Fire Drills that restore a backup to check it. list_organizations and list_surfaces return the ids the other tools take. get_surface_setup and get_host_setup return a console link or shell commands for setting up a new surface; they change nothing. request_backup queues a backup and request_drill queues a Fire Drill; list_drills shows the result. A request runs at the host's next check-in, or on SafeGrd for a surface SafeGrd backs up or drills. No tool here deletes, disables, re-routes or re-keys a backup.","prompts":[],"remotes":[{"type":"streamable-http","url":"https://safegrd.dev/mcp"}],"resources":[],"serverInfo":{"name":"safegrd","title":"SafeGrd","version":"1.1.0","websiteUrl":"https://safegrd.dev","icons":[{"src":"https://safegrd.dev/static/brand/mark.svg","mimeType":"image/svg+xml","sizes":["any"]},{"src":"https://safegrd.dev/static/brand/mark-512.png","mimeType":"image/png","sizes":["512x512"]}]},"tools":[{"_meta":{"securitySchemes":[{"scopes":["mcp"],"type":"oauth2"}]},"annotations":{"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"readOnlyHint":true,"title":"List organizations"},"description":"List the organizations this token belongs to, with their plan and quotas. Start here: every other tool takes an id from this or from list_surfaces.","inputSchema":{"additionalProperties":false,"properties":{},"type":"object"},"name":"list_organizations","securitySchemes":[{"scopes":["mcp"],"type":"oauth2"}],"title":"List organizations"},{"_meta":{"securitySchemes":[{"scopes":["mcp"],"type":"oauth2"}]},"annotations":{"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"readOnlyHint":true,"title":"List projects"},"description":"List an organization's projects (environments such as production or staging).","inputSchema":{"additionalProperties":false,"properties":{"org_id":{"description":"Organization id, from list_organizations.","type":"string"}},"required":["org_id"],"type":"object"},"name":"list_projects","securitySchemes":[{"scopes":["mcp"],"type":"oauth2"}],"title":"List projects"},{"_meta":{"securitySchemes":[{"scopes":["mcp"],"type":"oauth2"}]},"annotations":{"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"readOnlyHint":true,"title":"List surfaces"},"description":"List protected surfaces (databases, file trees, mailboxes) and hosts, with last backup, drill and alert state. Optionally filter by project_id. Returns {items, next_cursor}; pass next_cursor back as cursor for the next page. next.backup_at and next.drill_at are when each is due, and next.backup_by and next.drill_by say who starts it: \"host\" is the host's daemon at its next check-in, \"safegrd\" is SafeGrd, \"plugin\" is the WordPress plugin, and \"schedule\" means no daemon has checked in, so it runs only when cron, a CI job or a person runs safegrd on the host.","inputSchema":{"additionalProperties":false,"properties":{"cursor":{"description":"next_cursor from the previous page.","type":"string"},"limit":{"description":"How many to return, up to 200; more is read as 200. Default 25.","minimum":1,"type":"integer"},"project_id":{"description":"Project id, from list_projects.","type":"string"}},"type":"object"},"name":"list_surfaces","securitySchemes":[{"scopes":["mcp"],"type":"oauth2"}],"title":"List surfaces"},{"_meta":{"securitySchemes":[{"scopes":["mcp"],"type":"oauth2"}]},"annotations":{"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"readOnlyHint":true,"title":"Get surface"},"description":"Get one surface or host by node_id. next.backup_at and next.drill_at are when each is due, and next.backup_by and next.drill_by say who starts it: \"host\" is the host's daemon at its next check-in, \"safegrd\" is SafeGrd, \"plugin\" is the WordPress plugin, and \"schedule\" means no daemon has checked in, so it runs only when cron, a CI job or a person runs safegrd on the host.","inputSchema":{"additionalProperties":false,"properties":{"node_id":{"description":"Node id of a surface or host, from list_surfaces.","type":"string"}},"required":["node_id"],"type":"object"},"name":"get_surface","securitySchemes":[{"scopes":["mcp"],"type":"oauth2"}],"title":"Get surface"},{"_meta":{"securitySchemes":[{"scopes":["mcp"],"type":"oauth2"}]},"annotations":{"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"readOnlyHint":true,"title":"List snapshots"},"description":"List a surface's snapshots, newest first: when, how big, locked until when, and whether a drill has verified them. Each is a summary; get_snapshot has its tables and files. Returns {items, next_cursor}; pass next_cursor back as cursor for older ones.","inputSchema":{"additionalProperties":false,"properties":{"cursor":{"description":"next_cursor from the previous page.","type":"string"},"limit":{"description":"How many to return, up to 200; more is read as 200. Default 25.","minimum":1,"type":"integer"},"node_id":{"description":"Node id of a surface or host, from list_surfaces.","type":"string"}},"required":["node_id"],"type":"object"},"name":"list_snapshots","securitySchemes":[{"scopes":["mcp"],"type":"oauth2"}],"title":"List snapshots"},{"_meta":{"securitySchemes":[{"scopes":["mcp"],"type":"oauth2"}]},"annotations":{"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"readOnlyHint":true,"title":"Get snapshot"},"description":"Get one snapshot's recorded metadata: digests, counts, lock, Threat Shield verdict.","inputSchema":{"additionalProperties":false,"properties":{"snapshot_id":{"description":"Snapshot id, from list_snapshots.","type":"string"}},"required":["snapshot_id"],"type":"object"},"name":"get_snapshot","securitySchemes":[{"scopes":["mcp"],"type":"oauth2"}],"title":"Get snapshot"},{"_meta":{"securitySchemes":[{"scopes":["mcp"],"type":"oauth2"}]},"annotations":{"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"readOnlyHint":true,"title":"List Fire Drills"},"description":"List a surface's Fire Drill reports, newest first: each restore test, its assertions and its signature. Each assertion's result is passed, failed or not_run; not_run does not fail the drill. An assertion of kind \"check\" is one the customer wrote on the host (drill.checks in its config, or verify --checks): fix it there, not in the console. Returns {items, next_cursor}.","inputSchema":{"additionalProperties":false,"properties":{"cursor":{"description":"next_cursor from the previous page.","type":"string"},"limit":{"description":"How many to return, up to 200; more is read as 200. Default 25.","minimum":1,"type":"integer"},"node_id":{"description":"Node id of a surface or host, from list_surfaces.","type":"string"}},"required":["node_id"],"type":"object"},"name":"list_drills","securitySchemes":[{"scopes":["mcp"],"type":"oauth2"}],"title":"List Fire Drills"},{"_meta":{"securitySchemes":[{"scopes":["mcp"],"type":"oauth2"}]},"annotations":{"destructiveHint":false,"idempotentHint":false,"openWorldHint":false,"readOnlyHint":false,"title":"Request a backup"},"description":"Ask for a backup of a surface now, for example before running a migration. The host's daemon runs it at its next check-in; a surface SafeGrd backs up is queued on SafeGrd and needs no daemon. At most hourly: each backup is locked and cannot be deleted early. With on=safegrd, SafeGrd backs up a host's surface itself, from the credential it holds, spending one of the plan's on-demand runs.","inputSchema":{"additionalProperties":false,"properties":{"node_id":{"description":"Node id of a surface or host, from list_surfaces.","type":"string"},"on":{"description":"\"safegrd\" runs it on SafeGrd's machines now, whatever normally runs the surface. A run the schedule did not call for spends one of the organization's on-demand runs for the month; the reply says how many are left.","type":"string"}},"required":["node_id"],"type":"object"},"name":"request_backup","securitySchemes":[{"scopes":["mcp"],"type":"oauth2"}],"title":"Request a backup"},{"_meta":{"securitySchemes":[{"scopes":["mcp"],"type":"oauth2"}]},"annotations":{"destructiveHint":false,"idempotentHint":false,"openWorldHint":false,"readOnlyHint":false,"title":"Request a Fire Drill"},"description":"Ask for a Fire Drill now: restore the surface's latest snapshot and check it. The host's daemon runs it at its next check-in; a surface set to drill on SafeGrd is queued there and needs no daemon. Counted against the plan's drill cadence. With on=safegrd, SafeGrd drills it now even before the cadence allows, spending one of the plan's on-demand runs when it is not yet due. Read the result with list_drills.","inputSchema":{"additionalProperties":false,"properties":{"node_id":{"description":"Node id of a surface or host, from list_surfaces.","type":"string"},"on":{"description":"\"safegrd\" runs it on SafeGrd's machines now, whatever normally runs the surface. A run the schedule did not call for spends one of the organization's on-demand runs for the month; the reply says how many are left.","type":"string"}},"required":["node_id"],"type":"object"},"name":"request_drill","securitySchemes":[{"scopes":["mcp"],"type":"oauth2"}],"title":"Request a Fire Drill"},{"_meta":{"securitySchemes":[{"scopes":["mcp"],"type":"oauth2"}]},"annotations":{"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"readOnlyHint":true,"title":"Storage usage"},"description":"Hosted storage for an organization: whether it is offered, the quota, and how much is locked.","inputSchema":{"additionalProperties":false,"properties":{"org_id":{"description":"Organization id, from list_organizations.","type":"string"}},"required":["org_id"],"type":"object"},"name":"get_storage_usage","securitySchemes":[{"scopes":["mcp"],"type":"oauth2"}],"title":"Storage usage"},{"_meta":{"securitySchemes":[{"scopes":["mcp"],"type":"oauth2"}]},"annotations":{"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"readOnlyHint":true,"title":"Surface setup steps"},"description":"Return the console link and steps for adding a database or bucket to SafeGrd: Supabase, DigitalOcean or Heroku through their sign-in, a connection string, or an S3 bucket. kind on_host returns the commands for a database on a machine you run. Read only: the setup is finished in the console. Also says whether this account and plan can finish it.","inputSchema":{"additionalProperties":false,"properties":{"kind":{"description":"Where the data is: a Supabase, DigitalOcean or Heroku database through that platform's sign-in, any database by connection string, an S3 bucket, or a database on a machine you run.","enum":["supabase","digitalocean","heroku","connection_string","bucket","on_host"],"type":"string"},"org_id":{"description":"Organization id, from list_organizations.","type":"string"},"project_id":{"description":"Project id, from list_projects.","type":"string"}},"required":["org_id","kind"],"type":"object"},"name":"get_surface_setup","securitySchemes":[{"scopes":["mcp"],"type":"oauth2"}],"title":"Surface setup steps"},{"_meta":{"securitySchemes":[{"scopes":["mcp"],"type":"oauth2"}]},"annotations":{"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"readOnlyHint":true,"title":"Host install commands"},"description":"Return the shell commands that install the SafeGrd CLI on a machine, enroll it, add its database and take the first backup and Fire Drill. Read only: nothing changes until the commands are run on that machine.","inputSchema":{"additionalProperties":false,"properties":{"org_id":{"description":"Organization id, from list_organizations.","type":"string"},"project_id":{"description":"Project id, from list_projects.","type":"string"}},"required":["org_id"],"type":"object"},"name":"get_host_setup","securitySchemes":[{"scopes":["mcp"],"type":"oauth2"}],"title":"Host install commands"},{"_meta":{"securitySchemes":[{"scopes":["mcp"],"type":"oauth2"}]},"annotations":{"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"readOnlyHint":true,"title":"Fire Drill statistics"},"description":"Fire Drill statistics across an organization: pass rate, last results, surfaces never proven.","inputSchema":{"additionalProperties":false,"properties":{"org_id":{"description":"Organization id, from list_organizations.","type":"string"}},"required":["org_id"],"type":"object"},"name":"get_drill_stats","securitySchemes":[{"scopes":["mcp"],"type":"oauth2"}],"title":"Fire Drill statistics"}]}