MCP tools

Once your agent connects to nyxory’s MCP endpoint, it gets the nyx_ tools below: deploy, inspect, manage secrets, control infrastructure, all scoped to the projects you can access. Call nyx_brain first on any deploy: it returns the deploy cookbook plus a live snapshot of the project’s current state, and tells the agent which form of project to use for the rest of the run.

Brain

Tool

Purpose

nyx_brain

The first call of every deploy. Returns the deploy cookbook plus a live snapshot of a repo’s project state. Takes optional repo_url, project and agent_briefing; without repo_url, the answer starts with how to create a repository. Where architecture requirements are switched on, an Enterprise feature on dedicated instances, the answer also carries data.reference_architectures with data.ranking (model or keyword), data.cloud_strategy and data.requirements, and the tool takes reference: set to the id of a reference architecture, it returns that template’s build instructions with the project’s values filled in.

Architecture

Tool

Purpose

nyx_exception_request

Request an exception from an architecture requirement for one project. An Enterprise feature on dedicated instances; agents only see the tool where it is switched on. Takes project, subject (technology:<name>, or a building block: postgres, bucket, storage, public_url, custom_domain, images, memory), reason, and optional duration (30, 90, 365 or unlimited, default 90). Returns the request with its state and created; the same open request comes back instead of a second one. A person decides, never the agent. See Architecture requirements.

Workspace

Tool	Purpose
nyx_shell	Run a shell command in the agent’s project workspace (default cwd /workspace/repo, default timeout 120s, max 600s). Returns stdout, stderr, and exit code separately.
nyx_read_file	Read a UTF-8 file from the workspace (over 2 MiB fails — use nyx_shell with grep/head/tail instead).
nyx_write_file	Write or overwrite a file under /workspace, atomically.
nyx_edit_file	Replace a unique substring in a file — the substring must occur exactly once, matched literally, no regex.

Secrets

Tool	Purpose
nyx_set_secret	Encrypt a value and store it as a project secret or app secret. The operator materializes it and rolls affected workloads automatically.

Build & deploy

Tool	Purpose
nyx_build_and_push_image	Build a container image from the repo (Buildpacks or Dockerfile) and push it, as its own build job. Returns the image_ref to put in the manifest, or, if the build is still running after about 45 seconds, status: building with a build_job to follow with nyx_build_status.
nyx_build_status	Check builds without starting one. With only project, it lists every build in the project, including auto-deploy builds; with job as well ({"project":"…","job":"…"}), it watches that build and returns its phase, image_ref once pushed, and the last log lines.
nyx_deploy_manifests	Apply the app CRD and related resources atomically — full app_manifest + rest_manifests on first deploy, only the changed rest_manifests on an update.

Apps

Tool	Purpose
nyx_app_list	List every app across all projects the user can access — personal workspace and every shared workspace they own or are a member of. Each row names its workspace and workspace_name.
nyx_app_get	Get detail on one app, including its ingress hosts. With view: deployments, its rollout history; with view: uptime, its availability history, one figure per day, up to 90 days back.
nyx_app_logs	Read an app’s container logs directly, without a nyx_shell + kubectl detour. Structured, RFC3339-timestamped lines, filterable by tail, since, grep, container, pod, and previous.
nyx_app_security	Fixable CVEs in the app’s deployed image, from the registry’s scan plus the bill of materials the build attached. Splits findings into your own dependencies and the base image. See Security scanning.

Operations

Tool	Purpose
nyx_ops_events	Read a project’s operations feed: what the platform detected, what it did about it, and the authority it acted under.
nyx_runs	List a project’s agent runs, newest first, with status, duration, cost, and the platform’s one-word verdict (loop, budget80, baseline:2.1x). Without project, lists runs across every project you can see. With run (an ID from the list), shows that run step by step, with its alerts and the project’s typical run. Records what each tool was called with, not what it returned.

Project docs

Tool	Purpose
nyx_doc_list	List the project’s documents: the ones nyxory keeps per app and your own. With query, searches them, ranked by relevance.
nyx_doc_get	Read one document by slug, as listed by nyx_doc_list. With question, asks the project’s documents instead: an answer with its sources; a question they can’t answer is flagged as a gap, with a draft for a person to approve.
nyx_doc_write	Write or update a document (slug, body, optional title and app). Durable and versioned, unlike files in the agent workspace, which is wiped when idle.

Agents & budgets

Tool	Purpose
nyx_agent_scaffold	Agent template: the files to write and the manifest for a headless agent with the nyx run wrapper. Call it before building an agent.
nyx_budget_set	Set an advisory monthly budget for one app or the whole project: shown in the console and under account.budgets of nyx_project_list, not enforced. The enforced limit is the gateway application’s budget (nyx_ai_app).
nyx_config_reference	What may go into the repo’s deploy/ folder on this instance (allowed kinds, fields, rules, examples).

AI gateway

Tool	Purpose
nyx_ai_models	List models: name, provider, region, type, price, lock state, month spend.
nyx_ai_apps	List gateway applications: key prefixes, models, budget, lock state, last use — never key material.
nyx_ai_app	Change one gateway application: budget (set_budget, the limit that actually stops model calls), models, filter, archive, key rotation. Apps on nyxory need no setup where pod identity works; a key application is for callers outside the platform.
nyx_ai_calls	List single calls: model, tokens, cost, status, latency. Metadata only; prompts and outputs are not stored by default.

Backup & restore

Tool	Purpose
nyx_backup_list	List an app’s backups and its plan’s keep-N slots — trigger, phase, size, pinned image.
nyx_backup	action: create takes a point-in-time, crash-consistent backup of an app: CSI volume snapshots, manifests, and image reference. action: restore restores an app from a backup in data, app, or full mode; it takes a safety snapshot first automatically and pauses auto-deploy for app/full.

Databases & buckets

Tool	Purpose
nyx_data	Remove a Postgres database (type: postgres) or delete a bucket with every object in it (type: bucket). Takes project, name and confirm (the name typed again); owner-approval-gated. Taking the file out of deploy/ removes neither. See Configure your app from the repo.

Projects

Tool	Purpose
nyx_project_list	The whole picture in one call: the account (plan, RAM pool with baseline and extra packs, budget), the workspaces the user can act in with their role (owner, admin, member), and every project they can access. Each project carries workspace (id) and workspace_name; the workspace id is the workspace argument of nyx_project_add.
nyx_project_state	Get a project’s RAM allocation, current pod reservations, and remaining headroom in the account pool. With view: map, the project’s system map as compact text instead: every app with state, image, ports, volumes, and entry points, the measured connections between apps, and code-evidenced calls to external systems.
nyx_project_add	Create a new project. Takes name (display name; the namespace is assigned by the server) and, when the user has more than one workspace, workspace — without it the call is refused with the list of workspaces instead of silently landing in the personal one.
nyx_project	Change a project by action: rename its display label (the ID stays the same), ram sets its RAM allocation in MB (rounded to 256 MB steps), delete removes it (destructive, owner-approval-gated).

Domains

Tool	Purpose
nyx_domain_list	List the user’s custom domains, across all projects or filtered. With host, that domain’s phase and next required step.
nyx_domain	action: add registers a custom hostname against an app. action: remove deletes a domain, cascading to its ingress and certificate (owner-approval-gated).

Git sources

Tool	Purpose
nyx_github_install_url	Generate a signed install URL for the nyxory GitHub App, valid for 10 minutes.
nyx_clone_repo	Clone a repository into the agent workspace: through a connected GitHub installation, an approved HTTPS Git connection (connection_id), or a hosted nyxory git remote. Takes repo_url, optional branch, depth, installation_id. Returns the checkout path and commit SHA. See Deploy from a private repo.
nyx_github_list	List the user’s connected GitHub App installations; with kind: repos, the repos visible to one installation.
nyx_git_remote_create	Create a hosted nyxory git remote and a short-lived push credential for a project — for local sources that don’t come from GitHub.

Disconnecting a GitHub installation is yours too: it runs in the console, see Deploy from a private repo. API tokens are yours to manage, not your agent’s: create and revoke them with nyx token (see the CLI reference).