> ## Documentation Index
> Fetch the complete documentation index at: https://docs.westyx.cloud/llms.txt
> Use this file to discover all available pages before exploring further.

# Tools

> The twelve MCP tools exposed by the Westyx Nexus MCP server.

Every data tool takes an optional `project` (a project UUID) and an optional `env`, plus `service` / `key` where applicable. When `project` is omitted it is resolved from `.nexus-mcp.json` (or the home registry); when `env` is omitted the backend uses your personal dev environment. Read tools are annotated `readOnlyHint`; reveal and write tools are annotated `destructiveHint`, so the host client asks you to confirm before running them.

## Authentication tools

| Tool             | Description                                                                                                                                        |
| ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
| `nexus_login()`  | Sign in via the browser (Keycloak device flow). Returns a verification URL + code; once approved, an MCP key is minted and stored on this machine. |
| `nexus_logout()` | Remove the stored MCP key from this machine. To revoke it server-side, delete it on your profile page.                                             |

## Discovery

| Tool              | Description                                                                                                                                                                                      |
| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `list_projects()` | List every project you can access via MCP (across all tenants), each with its `project_id` (UUID) and your `personal_env`. Use a `project_id` in `.nexus-mcp.json` or as the `project` argument. |

## Read tools

| Tool                                       | Description                                                                                    |
| ------------------------------------------ | ---------------------------------------------------------------------------------------------- |
| `list_services(project?, env?)`            | List the services in an environment.                                                           |
| `list_configs(project?, env?, service)`    | List config entries (values in the friendly `{{secret:KEY}}` / `{{flag:KEY}}` reference form). |
| `get_config(project?, env?, service, key)` | Get a single config entry.                                                                     |
| `list_flags(project?, env?, service)`      | List feature flags for a service.                                                              |
| `get_flag(project?, env?, service, key)`   | Get a single feature flag.                                                                     |
| `list_secrets(project?, env?, service)`    | List secret **metadata only** - never cleartext values.                                        |

## Reveal and write tools

| Tool                                                                      | Description                                                                                                                                                                                                                                              |
| ------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `get_secret(project?, env?, service, key, confirm?, key_echo?)`           | Metadata by default. To reveal the cleartext value, pass `confirm: true` and `key_echo` equal to the key name. Always rejected in production and unless your grant allows reveal.                                                                        |
| `set_config(project?, env?, service, key, value, description?)`           | Create or update a config (`value` is any JSON). Creating a new key needs your grant's **create** permission, updating an existing one needs **write**. Always rejected in production.                                                                   |
| `delete_config(project?, env?, service, key, confirm)`                    | Delete a config; requires `confirm: true`. Only allowed in your **personal dev environment** - rejected on shared envs and in production.                                                                                                                |
| `set_flag(project?, env?, service, key, is_enabled, name?, description?)` | Create or update a feature flag (name / description / enabled only). Create needs **create** permission, update needs **write**. Scheduling, rollout %, and targeting are preserved untouched - those stay admin-UI only. Always rejected in production. |
| `delete_flag(project?, env?, service, key, confirm)`                      | Delete a feature flag; requires `confirm: true`. Only allowed in your **personal dev environment** - rejected on shared envs and in production.                                                                                                          |
| `set_secret(project?, env?, service, key, value, type?, description?)`    | Create or update a secret value (new version). Create needs **create** permission, update needs **write**. Always rejected in production.                                                                                                                |
| `delete_secret(project?, env?, service, key, confirm)`                    | Delete a secret; requires `confirm: true`. Only allowed in your **personal dev environment** - rejected on shared envs and in production.                                                                                                                |

## Error messages

Backend errors are translated to clear, actionable messages, for example:

* `mcp_project_required` -> "No project specified. Pass project:\<uuid>, add a .nexus-mcp.json, or run list\_projects."
* `mcp_not_member` -> "You are not a member of that project."
* `mcp_env_not_allowed` -> "That environment is not in your MCP scope (baseline personal env, or your grant)."
* `mcp_reveal_prod_forbidden` -> "Revealing secrets in production is never permitted."
* `mcp_write_not_allowed` -> "Writing is not permitted by your MCP grant (this grant is read-only)."
* `mcp_create_not_allowed` -> "Creating new items is not permitted by your MCP grant."
* `mcp_delete_not_allowed` -> "Delete is only allowed in your personal dev env, not on shared environments."

All enforcement happens on the backend; the server only forwards your call and translates the result.