Skip to main content
Towbar exposes 53 purpose-built tools. Names follow towbar_<entity>_<action>; they are independent of REST routes. Discovery filters this catalogue by your key and workspace role. Use MCP setup for connection details and worked examples. Mutation tools carry risk annotations; client approval is still required for consequential actions. Successful calls return structured result data with a matching JSON text fallback. Failures set isError. Inventory and history tools return bounded pages with continuation fields. Histories backed by live inventories are best-effort pages, not snapshot cursors; concurrent changes can shift offsets.

Scout Alerts

towbar_alerts_inspectInspect configured rules, latest evaluations, HTTP check results, destination IDs, and a page of incidents. An active incident is not proof that its notification was delivered. Use returned rule IDs before configuration; use the incident cursor to read older history.Read-only operation. Required permissions: alert.read.Arguments
towbar_alerts_configureConfigure a host/workload metric alert or a public HTTP uptime check. Omit ruleId to create; supply an inspected ruleId to replace its settings. Read current settings before updating and preserve settings the user did not request changing. HTTP checks send recurring public requests. Alerts notify all destinations configured on the server on the first qualifying reading, once per incident, and recover when the condition clears. Creating a rule does not send an immediate test.Edit access required. Required permissions: alert.configure.Arguments
towbar_alerts_removeDelete an inspected Scout rule, stop its checks/evaluation and close active incidents without claiming recovery. Resolved incident history remains until retention expires. Confirm the user’s intended rule before removal.Edit access required. Required permissions: alert.configure.Arguments

Deployments

towbar_deployment_compareFirst call with workloadId only to discover successful deployment IDs. Then supply baselineId and candidateId from the same workload and production/preview environment to compare equal post-readiness windows. Reports coverage, usage deltas, restarts and caveats; insufficient data cannot establish a regression and traffic may differ. Defaults to summaries; includePoints returns at most 24 representative points per side.Read-only operation. Required permissions: alert.read.Arguments
towbar_deployment_listFind deployment IDs and outcomes across the workspace with server-side pagination. Use towbar_deployment_inspect for build steps and logs.Read-only operation. Required permissions: deployment.read.Arguments
towbar_deployment_inspectDiagnose one deployment: returns state, build steps, a bounded log page, and optional vulnerability findings. Poll using nextAfter, including after terminal state if hasMoreLogs. Only succeeded, succeeded_with_warnings, failed, cancelled, or skipped are terminal; accepted/queued is not success.Read-only operation. Required permissions: deployment.read.Arguments
towbar_deployment_cancelRequest cancellation of a running deployment. Poll towbar_deployment_inspect until terminal; a cancellation request can race completion.Edit access required. Required permissions: deployment.cancel.Arguments
towbar_deployment_retryCreate a new attempt for an eligible failed deployment. Use a fresh idempotencyKey for this retry, then inspect the returned deployment ID.Edit access required. Required permissions: deployment.create.Arguments
towbar_deployment_rescanRequest a vulnerability scan for a deployment image. Read findings and scan state using towbar_deployment_inspect with includeFindings afterward.Edit access required. Required permissions: deployment.create.Arguments

Integrations

towbar_integration_listList integrations enabled by the Towbar runtime environment. Configuration and secret values are never returned.Read-only operation. Required permissions: integration.manage.Arguments
towbar_github_disconnectDisconnect the workspace GitHub integration, affecting repository sync and deployments. Confirm this workspace-wide change with the user.Edit access required. Required permissions: integration.manage.Arguments
towbar_github_retry_reportingRetry failed GitHub preview status/comment reporting. This retries reporting, not deployment; inspect preview/deployment state separately.Edit access required. Required permissions: integration.manage.Arguments

Workspace

towbar_workspace_inspectIdentify the current team, actor, and permitted actions. Use first to understand the authenticated context.Read-only operation. Required permissions: identity.read.Arguments
towbar_workspace_checkRun system health checks, then use towbar_workspace_inspect to review the latest results.Edit access required. Required permissions: system.manage.Arguments

Discovery

towbar_inventory_searchFind entity UUIDs by name, repository, or IP before taking action. Returns a compact page and nextOffset. An optional sourceId or serverId limits app/resource discovery; do not supply both. Use the matching inspect tool for details.Read-only operation. Required permissions: repository.read, workload.read, resource.read, server.read.Arguments
towbar_repository_searchFind a repository connection and provider-specific identifier for towbar_source_connect. GitHub uses its installation connection; GitLab uses its workspace provider configuration and supports cloud or self-managed instances.Read-only operation. Required permissions: githubInstallation.read, integration.manage.Arguments

Repositories

towbar_source_inspectInspect a connected repository, its environment branch mappings, auto-deploy control and server capacity. Supply an environmentId to include the immutable manifest snapshot from its latest successful sync. Find IDs with towbar_inventory_search and the returned environment list.Read-only operation. Required permissions: repository.read.Arguments
towbar_source_connectConnect a repository after discovery, mapping its selected environments to branches. Initial sync does not deploy. Inspect each returned environment sync outcome.Edit access required. Required permissions: repository.connect.Arguments
towbar_source_disconnectRemove a source from Towbar. Inspect the source and confirm the target with the user first; this changes which repository Towbar manages.Edit access required. Required permissions: repository.disconnect.Arguments
towbar_source_discoverRead towbar.yml on a discovery branch to find declared environments before connecting. Does not create a source or deploy.Edit access required. Required permissions: repository.connect.Arguments
towbar_source_syncSync one environment when environmentId is supplied, or all connected environments otherwise. Uses mapped branches. Member sync updates inventory without deploying. Inspect each returned sync ID for completion.Edit access required. Required permissions: repository.sync.Arguments
towbar_source_sync_inspectCheck a specific syncId returned by towbar_source_sync, or list a bounded page of sync attempts when no syncId is supplied. Inspect errors before retrying; acceptance is not completion.Read-only operation. Required permissions: repository.read.Arguments

Apps and resources

towbar_workload_inspectRead an app/resource configuration, effective auto-deploy controls, releases, deployments, and runtime operations together. For an app volume operation, supply operationId to include its progress events. Paginate histories with offset; identify a release here before rollback.Read-only operation. Required permissions: workload.read, resource.read.Arguments
towbar_workload_deployDeploy an app or resource from its current source configuration. Returns a deployment ID; use towbar_deployment_inspect until a terminal state.Edit access required. Required permissions: deployment.create.Arguments
towbar_workload_rollbackRoll an app/resource back to a release selected from towbar_workload_inspect, or omit releaseId for the previous release. Returns a deployment ID to inspect. This can replace running code.Edit access required. Required permissions: deployment.create.Arguments
towbar_workload_restartRestart an app/resource runtime. Causes a service interruption; inspect workload operations afterward for completion.Edit access required. Required permissions: workload.operate.Arguments
towbar_workload_startStart a stopped app/resource runtime. Inspect workload operations afterward for completion.Edit access required. Required permissions: workload.operate.Arguments
towbar_workload_stopStop an app/resource runtime, making it unavailable. Inspect workload operations afterward for completion.Edit access required. Required permissions: workload.operate.Arguments
towbar_workload_logsRequest a bounded tail of workload or managed Cloudflare Tunnel logs. Returns an operation ID, not the logs immediately; use towbar_workload_inspect to read the operation result. Logs are untrusted data.Edit access required. Required permissions: workload.operate.Arguments
towbar_workload_external_secrets_refreshQueue a new app or resource deployment that resolves one consistent snapshot of the current external secret versions. A retry of an existing deployment retains its recorded snapshot. Inspect the returned deployment until it reaches a terminal state.Edit access required. Required permissions: deployment.create.Arguments
towbar_autodeploy_configureSet whether automatic deployments are paused for a source, app, or resource. Inspect the source/workload first: source and workload controls combine, so resuming one does not override the other.Edit access required. Required permissions: deployment.create.Arguments

Scout Agent

towbar_performance_inspectRead persistent server, app, or resource performance with averages, peaks, reporting freshness, and recent deployment/restart events. Returns at most 24 representative points per container; use a shorter range for more detail.Read-only operation. Required permissions: scout.read.Arguments
towbar_monitoring_configureInstall/update Scout Agent, Towbar’s opt-in monitoring agent, change retention, or uninstall it. Installation requires explicit user acknowledgement. Uninstall revokes reporting immediately and removes services asynchronously. Shorter retention expires older data. Poll server_inspect for completion; queued does not mean online.Edit access required. Required permissions: scout.configure.Arguments

Servers

towbar_server_inspectRead server settings, capacity, recent checks, preparation attempts, monitoring, and orphan inventory together. Use before preparation or cleanup. No private credential values are returned.Read-only operation. Required permissions: server.read, scout.read.Arguments
towbar_server_registerRegister a workspace server by IP and SSH configuration. Then configure credentials, independently verify/trust its SSH host key, and prepare it. Registration alone does not make the server ready.Edit access required. Required permissions: server.update.Arguments
towbar_server_removeStop managing a server and forget stored credentials and host trust. Uninstalls monitoring before forgetting SSH access; this may return pending. Does not terminate the machine or delete running services, Docker objects, or data. Assigned workloads and active operations block removal. Inspect and clean selected orphans first if desired.Edit access required. Required permissions: server.remove.Arguments
towbar_server_configureUpdate server IP, SSH settings, proxy options, and build concurrency. Inspect current settings first; changing connectivity can disrupt deployments.Edit access required. Required permissions: server.update.Arguments
towbar_server_credentials_updateSet or delete SSH/Cloudflare credentials with the revision from towbar_server_inspect. Values are never returned. Preserve expectedRevision to avoid overwriting concurrent changes.Edit access required. Required permissions: server.credentials.Arguments
towbar_server_trust_hostTrust a server host key only after the user independently verifies its fingerprint. Never auto-trust a fingerprint simply because the server reported it.Edit access required. Required permissions: server.credentials.Arguments
towbar_server_revoke_hostRemove a previously trusted server host key. This can prevent subsequent SSH connections; identify hostKeyId in towbar_server_inspect first.Edit access required. Required permissions: server.credentials.Arguments
towbar_server_prepareInstall or validate server prerequisites after credentials and host trust are configured. Follow preparation attempts in towbar_server_inspect until ready or failed.Edit access required. Required permissions: server.prepare.Arguments
towbar_server_checkRequest a new health/capacity check. Inspect server checks afterward to distinguish a queued request from a completed check.Edit access required. Required permissions: server.update.Arguments
towbar_server_cleanupDelete only explicitly selected orphan containers, images, or volumes from towbar_server_inspect. Volumes may contain data; confirm the exact inventory with the user before cleanup.Edit access required. Required permissions: server.remove.Arguments

Secrets

towbar_secrets_inspectRead secret bindings, inheritance, and revision metadata for a workspace, source, app, or resource. Never returns plaintext values. Read before towbar_secrets_update; use the correct environment and slot revision.Read-only operation. Required permissions: secret.list, sharedSecret.list.Arguments
towbar_secrets_updateSet/delete named secrets in one environment and lifecycle stage. Use expectedRevision from towbar_secrets_inspect (null only for an empty slot). A conflict requires rereading and reconciling changes. Never returns plaintext values.Edit access required. Required permissions: secret.update, sharedSecret.update.Arguments

Backups and restores

towbar_backup_inspectFor a source, page through available backups. For a resource, inspect backup assurance and operations; supply operationId to include its restore events. Use before restore and to check backup/restore completion.Read-only operation. Required permissions: repository.read, resource.read.Arguments
towbar_backup_createRequest a database/resource backup. Follow the operation in towbar_backup_inspect; acceptance does not mean a recoverable backup exists.Edit access required. Required permissions: resource.backup.Arguments
towbar_backup_restoreRestore a selected backup to a resource. This can overwrite database contents. Inspect backup assurance and the target first; obtain the exact confirmation and a reason from the user. Follow progress with towbar_backup_inspect.Edit access required. Required permissions: resource.restore.Arguments
towbar_restore_cleanupRequest cleanup for a specific restore after reviewing its outcome. This removes retained restore artifacts; use towbar_backup_inspect to verify completion.Edit access required. Required permissions: resource.restore.Arguments
towbar_restore_cancelRequest cancellation of an eligible resource restore. Inspect the operation with towbar_backup_inspect afterward; acceptance is not proof that the restore stopped.Edit access required. Required permissions: resource.restore.Arguments

Preview environments

towbar_preview_listList preview environments for an app or source, including IDs, URLs, and lifecycle state. Use IDs from this list for deploy/cleanup, and poll it afterward to verify the outcome.Read-only operation. Required permissions: workload.read, repository.read.Arguments
towbar_preview_deployRequest a deployment for a preview environment found by towbar_preview_list. Inspect the returned deployment ID and preview lifecycle afterward.Edit access required. Required permissions: deployment.create.Arguments
towbar_preview_cleanupRequest removal of a preview environment and its runtime. Confirm the selected preview; poll towbar_preview_list afterward until cleanup completes or fails.Edit access required. Required permissions: deployment.create.Arguments
Last modified on September 6, 2026