lattice-mcp

Get fleet overview: worker counts, stack counts, container counts, failed stacks, recent deployments, fleet CPU/memory averages

Check API health and database connectivity

Get the deployed lattice-api version string. Use to check deploy drift against GitHub tags/commits (e.g. for /howfarbehind).

List all workers with status, IP, Docker version, runner version, last heartbeat

Get detailed worker info including metrics

Get recent worker metrics (CPU, memory, disk, network)

List all stacks with status, worker assignment, and deployment strategy

Get full stack details including compose YAML and env vars

List containers with status, image, ports, health. Filter by stack or status

Get full container details including config, health, env vars, ports

Get recent container logs (stdout/stderr)

Get container lifecycle events (start, stop, restart, health changes)

List deployments with status, strategy, timing. Filter by stack or status

Get deployment details including container-level status

Get deployment logs: pull, create, start, swap, rollback events with timing

Get recent audit log entries (who did what, when). Filter by user, action, or resource type to answer

Deploy a stack (all containers or specific ones)

Restart all containers in a stack

Stop all containers in a stack

Start all containers in a stack

Update stack configuration (name, description, strategy, worker, etc.)

Start a stopped container

Stop a running container

Restart a container

Force kill a container

Pause a running container

Unpause a paused container

Remove a container entirely

Recreate a container (remove and create fresh)

Reboot a worker machine

Upgrade worker runner to latest version

Stop all containers on a worker

Start all containers on a worker

Update the Lattice API container. Pass `version` to deploy or roll back to a specific tag; omit it to take whatever the compose file resolves to. Returns

Update the Lattice web container. Pass `version` to deploy or roll back to a specific tag; omit it to take whatever the compose file resolves to

Rollback a deployment to its previous state

List all API tokens

Create a new API token for AI tools or automation

Delete an API token

List managed database instances with engine, version, status, worker and health. Filter by worker, engine or status

Get one database instance: engine, port, limits, snapshot schedule, retention and backup destination

Provision a database instance on a worker. Creates a real container. Omit `port` to have a free one allocated automatically — that is the recommended path; a port already in use returns 409 naming the conflict

Update a database instance

Permanently destroy a database: its container AND its data volume are removed on the worker, then the record is retired once the worker confirms. Irreversible — every table is gone; only existing snapshots survive, so check lattice_list_database_snapshots first. Asynchronous: the instance sits in

Start, stop, restart or remove a database instance

Get a database instance

Reveal a database instance

DEPRECATED — returns root credentials from a plain GET. Use lattice_reveal_database_credentials instead, which is audited and scoped

Get a database instance

A database

Recent scheduled-snapshot attempts for a database, newest first — INCLUDING slots that were skipped and why. Scheduling lives in the control plane, so every slot leaves a row whether or not it produced a snapshot. Reach for this to answer

Get CPU and memory samples for a managed database instance. These samples were always collected but had no read path: managed databases have no row in the containers table, and every other metrics reader takes a container id. Use this rather than lattice_get_container_metrics for a database

Get a database container

Get worker-emitted lifecycle messages for a database container, including provisioning progress and the reason a create failed

Authorise an interactive console session against a running database and return the worker, container and SQL client command to run. The session itself runs over the admin WebSocket, so this returns the authorisation, not a live shell

List host ports already claimed on a worker (by databases and by stack containers) and get a free suggestion. Check this before pinning a database to a specific port

List snapshots for a database instance, with size and creation time. Check this before deleting or restoring an instance

Take a snapshot of a database instance now, outside its schedule

Restore a database instance from one of its snapshots. Overwrites current data irreversibly — take a fresh snapshot first if the present state matters

Delete a database snapshot. Destructive — that restore point is gone

List configured backup destinations that database snapshots can be shipped to

Get one backup destination

Create a backup destination. config is a free-form object whose shape depends on type (e.g. an S3 destination takes bucket, region, endpoint and credentials)

Update a backup destination. Passing config replaces the whole object, it does not merge

Delete a backup destination. Instances pointing at it lose their backup target. Destructive

Test connectivity and credentials for a backup destination without writing a real backup. The test is dispatched over the worker

List configured container registries

Add a container registry

Update a registry

Delete a registry. Containers pulling from it fail on their next deploy. Destructive

Test a saved registry

Test registry credentials before saving them

List repositories available in a registry — what images exist to deploy

List the tags published for one repository. Use this to answer

Search across workers, stacks and containers by name in one call. Faster than listing each type and filtering when you only have a partial name

Get detected fleet anomalies — restart loops, unhealthy containers, resource spikes, offline workers. The best first call when asked whether anything is wrong

Get aggregated fleet-wide CPU, memory, disk and network metrics over a time range

Get runner versions across workers and which are outdated. Use before lattice_upgrade_worker to see what actually needs upgrading

Re-poll every worker for its current runner version, refreshing what lattice_get_versions reports

Get a single container

Get the user this API token authenticates as, including role

Create an empty stack. Add containers with lattice_create_container, or use lattice_import_compose to create one from compose YAML

Delete a stack and every container in it. Destructive and not recoverable — export it first with lattice_export_stack if you might want it back

List the containers belonging to one stack

Replace a stack

Reconcile a stack

Create a new stack from a docker-compose YAML document

Export a stack

Recreate a stack from a document produced by lattice_export_stack

Save an existing stack

List a stack

Create a deploy token for a stack. The plaintext is returned once and this server masks it to its first two characters, so the usable value never enters a transcript — read it from the Lattice UI, or set LATTICE_ALLOW_SECRET_VALUES=1. Used as https://<lattice>/api/deploy/<token>?container=<name>

Delete a deploy token. Any CI pipeline using it stops being able to deploy. Destructive

Approve a deployment that is waiting on manual approval

List automations — a trigger (webhook or cron) plus ordered steps — with each one

Get one automation: trigger, ordered steps, run_as user, running_run_id (set while a run holds its guard) and last_run. http_request header values, bodies and URL paths come back masked

Create an automation: one trigger plus ordered steps. Use it to redeploy containers in SEVERAL stacks from one CI call — a deploy token only reaches one stack. Steps run in order and stop at the first failure unless continue_on_error. The automation runs as the user who owns this MCP

Update an automation. Omitted fields are left alone; description \

Switch an automation on. Re-validates it first — a renamed container or deleted stack is refused here rather than on the next firing — and makes this MCP token

Switch an automation off. It fires nothing while disabled: its webhook answers 200 with result \

Fire an automation now and wait for the verdict (a run is bounded to 50s). Returns {result, run}: result is succeeded | failed | skipped | disabled, and run.steps has every step

Replace a webhook automation

Delete an automation. It stops firing and its webhook URL stops working immediately; its run history is no longer reachable, though the audit log keeps every action it took. Destructive — lattice_disable_automation only switches it off

An automation

Add a container definition to a stack. Creates the record only — deploy the stack to actually start it. JSON-shaped fields are passed as strings, matching the API

Update a container definition. Changes the stored record — redeploy or recreate the container for them to take effect

Delete a container definition and its running container. Destructive — lattice_stop_container only stops it

Register a worker. The machine still needs the runner installed and a worker token before it connects

Update a worker

Delete a worker. Every stack pinned to it becomes undeployable. Destructive

Get live per-container resource stats from one worker

List a worker

Create a registration token for a worker, used by the runner to connect. Plaintext is returned once and this server masks it to its first two characters — read the usable value from the Lattice UI, or set LATTICE_ALLOW_SECRET_VALUES=1

Delete a worker token. If the runner is using it, it cannot reconnect after a restart. Destructive

List Docker volumes on a worker

Create a Docker volume on a worker

Delete a Docker volume on a worker. Any data stored in it is destroyed. Destructive

List Docker networks on a worker

Create a Docker network on a worker

Delete a Docker network on a worker. Containers attached to it lose connectivity. Destructive

List every tracked Docker network across the fleet

Delete a tracked network by its Lattice ID. Destructive

Force-remove a container on a worker by name, bypassing the normal lifecycle. For clearing a wedged container that ordinary remove will not shift. Destructive

List global environment variables available for interpolation into stack and container configs as ${NAME}. Values marked is_secret are masked to their first two characters by this server — the API itself only masks them for non-admin callers, and this MCP authenticates as an admin

Create a global environment variable

Update a global environment variable

Delete a global environment variable. Any config referencing ${KEY} fails to interpolate on next deploy. Destructive

List saved stack templates

Create a stack template from a config document

Delete a stack template. Destructive

List outbound webhooks that fire on fleet events

Create an outbound webhook. events is a JSON array string, e.g.

Update a webhook

Delete a webhook. Destructive

Send a test payload to a webhook to verify the endpoint accepts it

List Lattice users with roles and status

Create a local Lattice user

Update a user

Delete a Lattice user. Destructive

Get the Forta SSO configuration

Update the SSO configuration. Misconfiguring this can lock every SSO user out of Lattice — verify local admin access first

Get the SMTP configuration used for alert emails

Update the SMTP configuration

Send a test email using the saved SMTP configuration

Get per-event notification preferences

Update notification preferences. Merges into existing prefs; unknown event types are ignored rather than rejected, so verify with lattice_get_notification_prefs afterwards