From 7ca841855888e655d620147e045c4398687008a8 Mon Sep 17 00:00:00 2001 From: MajidAbuRmila Date: Thu, 29 Oct 2026 22:52:48 +0200 Subject: [PATCH] Move identity and policy tools to the core profile in the AI docs --- ai/examples.mdx | 2 +- ai/mcp.mdx | 4 ++-- ai/tools.mdx | 16 ++++++++-------- 3 files changed, 11 insertions(+), 11 deletions(-) diff --git a/ai/examples.mdx b/ai/examples.mdx index ab5098e1..23286ba6 100644 --- a/ai/examples.mdx +++ b/ai/examples.mdx @@ -498,7 +498,7 @@ the link where I create its key. - A workload needs `reveal` to read a secret's values; `use` only attaches a secret to a GVC or workload. For a workload, `grant_workload_secret_access` sets the identity and the policy in one call. The policy and service account prompts need the `full` profile, and the key is shown once, in the Console, never in the chat. + A workload needs `reveal` to read a secret's values; `use` only attaches a secret to a GVC or workload. For a workload, `grant_workload_secret_access` sets the identity and the policy in one call. The service account prompt needs the `full` profile, and the key is shown once, in the Console, never in the chat. --- diff --git a/ai/mcp.mdx b/ai/mcp.mdx index 5582ba3f..5b981d31 100644 --- a/ai/mcp.mdx +++ b/ai/mcp.mdx @@ -55,9 +55,9 @@ The full tool catalog is larger than most AI tools can hold in context at once | Profile | What it includes | |---------|------------------| | `readonly` | Investigation only. Metrics, logs, traces, workload events, replicas and deployments, one-call workload diagnosis, quotas, the audit trail, configuration inventory, and Terraform export, plus a generic read tool that works on **every** resource kind. It advertises no tool that creates, updates, deletes or executes a command, so an assistant on this profile cannot change a live resource. | -| `core` *(default)* | The everyday deploy-and-operate journey. [Job tools](/ai/tools#jobs) do a whole task in one call: deploy an app, add a database, create or rotate a secret without its value passing through the chat, and diagnose, restart, roll back, or open a workload to other workloads. Around them: GVCs, workloads, deployments, logs, image builds (from a repository, or from app files the assistant writes itself, so a chat can take an app from the user's request to a running URL), custom domains, the template catalog, volume sets with their snapshots and resizing, Terraform export, metrics, traces, the audit trail, and quota increase requests, plus a generic read/delete tool that works on **every** resource kind. | +| `core` *(default)* | The everyday deploy-and-operate journey. [Job tools](/ai/tools#jobs) do a whole task in one call: deploy an app, add a database, create or rotate a secret without its value passing through the chat, and diagnose, restart, roll back, or open a workload to other workloads. Around them: GVCs, workloads, deployments, logs, image builds (from a repository, or from app files the assistant writes itself, so a chat can take an app from the user's request to a running URL), custom domains, the template catalog, volume sets with their snapshots and resizing, identities and policies, Terraform export, metrics, traces, the audit trail, and quota increase requests, plus a generic read/delete tool that works on **every** resource kind. | | `mk8s` | Everything in `core`, **plus** `create_mk8s` and `update_mk8s`, which create and update managed Kubernetes (mk8s) clusters on every supported provider. | -| `full` | Everything in `mk8s`, **plus** the full administrative and fine-tuning surface: identities and policies, permission lookups, workload promotion, standalone volume set creation, quota and event reads, replica and command lists, replica stops, docs filesystem queries, cloud-account registration (AWS, GCP, Azure, NATS), org IAM (users, groups, service accounts), network-bridge agents, identity network-resource bindings, IP sets, audit contexts, external logging, advanced workload tuning (load balancer, sidecar, rollout, security, retry), and org settings. | +| `full` | Everything in `mk8s`, **plus** the full administrative and fine-tuning surface: permission lookups, workload promotion, standalone volume set creation, quota and event reads, replica and command lists, replica stops, docs filesystem queries, cloud-account registration (AWS, GCP, Azure, NATS), org IAM (users, groups, service accounts), network-bridge agents, identity network-resource bindings, IP sets, audit contexts, external logging, advanced workload tuning (load balancer, sidecar, rollout, security, retry), and org settings. | ```text Examples https://mcp.cpln.io/mcp # core (default) diff --git a/ai/tools.mdx b/ai/tools.mdx index 1fb07c25..6e942e49 100644 --- a/ai/tools.mdx +++ b/ai/tools.mdx @@ -15,9 +15,9 @@ The server advertises a different set of tools depending on the `toolsets` query | Profile | Tools | Endpoint | Includes | | :------ | :---: | :------- | :------- | | `readonly` | 27 | `https://mcp.cpln.io/mcp?toolsets=readonly` | Investigation only: observability, runtime state, inventory, generic reads, and one-call workload diagnosis. Nothing that creates, updates, deletes, or executes, so an assistant on this profile cannot change a live resource. | -| `core` | 45 | `https://mcp.cpln.io/mcp` | The default. [Job tools](#jobs) that do a whole task in one call (deploy an app, add a database, create or rotate a secret, and diagnose, restart, or roll back a workload), plus workloads, GVCs, image builds (from a repository, or from source the assistant writes itself), domains, templates, volume sets with their snapshots and resizing, observability (logs, metrics, traces, audit), quota increase requests, and Terraform export. | -| `mk8s` | 47 | `https://mcp.cpln.io/mcp?toolsets=mk8s` | Everything in `core` plus `create_mk8s` and `update_mk8s`, which provision and update [managed Kubernetes](/mk8s/overview) clusters on every supported provider. | -| `full` | 95 | `https://mcp.cpln.io/mcp?toolsets=full` | Every tool, including identities, policies, workload promotion, quota and event reads, replica stops, agents, cloud accounts, IP sets, service accounts, groups, audit contexts, external logging, and advanced workload configuration. | +| `core` | 49 | `https://mcp.cpln.io/mcp` | The default. [Job tools](#jobs) that do a whole task in one call (deploy an app, add a database, create or rotate a secret, and diagnose, restart, or roll back a workload), plus workloads, GVCs, image builds (from a repository, or from source the assistant writes itself), domains, templates, volume sets with their snapshots and resizing, identities and policies, observability (logs, metrics, traces, audit), quota increase requests, and Terraform export. | +| `mk8s` | 51 | `https://mcp.cpln.io/mcp?toolsets=mk8s` | Everything in `core` plus `create_mk8s` and `update_mk8s`, which provision and update [managed Kubernetes](/mk8s/overview) clusters on every supported provider. | +| `full` | 95 | `https://mcp.cpln.io/mcp?toolsets=full` | Every tool, including workload promotion, quota and event reads, replica stops, agents, cloud accounts, IP sets, service accounts, groups, audit contexts, external logging, and advanced workload configuration. | Connecting to `https://mcp.cpln.io/mcp` with no query parameter gives you the `core` profile. To switch profiles, point your client at the URL with the `?toolsets=` parameter — see your tool's [setup page](/ai/mcp#compatible-tools) for where the endpoint URL is configured. @@ -157,14 +157,14 @@ Configure [custom domains](/reference/domain), their port listeners, routes, TLS ## Identity & access -Manage [identities](/reference/identity), [policies](/reference/policy), [groups](/reference/group), [service accounts](/reference/serviceaccount), and the private-network resources attached to an identity. All are in `full`. In `core`, credential-free cloud access for a workload takes one call with `grant_cloud_access` under [Jobs](#jobs), and secret access with `grant_workload_secret_access` under [Workloads](#workloads). +Manage [identities](/reference/identity), [policies](/reference/policy), [groups](/reference/group), [service accounts](/reference/serviceaccount), and the private-network resources attached to an identity. Creating and updating identities and policies works in `core`; the rest are in `full`. For one workload, credential-free cloud access takes one call with `grant_cloud_access` under [Jobs](#jobs), and secret access with `grant_workload_secret_access` under [Workloads](#workloads). | Name | Label | Description | Access | | :--- | :---- | :---------- | :----- | -| `create_identity` | Create an Identity | Create a GVC-scoped identity for workload access to secrets, cloud resources, and private networks. | Write · `full` | -| `update_identity` | Update an Identity | Update an identity's settings and bound credentials. | Destructive · `full` | -| `create_policy` | Create a Policy | Create a policy that grants permissions on resources to principals. | Write · `full` | -| `update_policy` | Update a Policy | Update a policy's bindings, targets, or permissions. | Destructive · `full` | +| `create_identity` | Create an Identity | Create a GVC-scoped identity for workload access to secrets, cloud resources, and private networks. | Write | +| `update_identity` | Update an Identity | Update an identity's settings and bound credentials. | Destructive | +| `create_policy` | Create a Policy | Create a policy that grants permissions on resources to principals. | Write | +| `update_policy` | Update a Policy | Update a policy's bindings, targets, or permissions. | Destructive | | `create_group` | Create a Group | Create a group of users and service accounts, with optional tag-based membership. | Write · `full` | | `edit_group` | Edit a Group | Update a group's membership or membership query. | Destructive · `full` | | `create_service_account` | Create a Service Account | Create a service account for programmatic access. | Write · `full` |