# Local YDB MCP (npm · @astandrik/local-ydb-mcp)

Operate local-ydb deployments through local or SSH-backed MCP tools.

- Trust score: 81/100 (high trust)
- Change this week: +55
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@astandrik/local-ydb-mcp`: 81/100 (this document), [markdown](https://verifymcp.io/servers/astandrik-local-ydb-mcp/astandrik-local-ydb-mcp.md), [page](https://verifymcp.io/servers/astandrik-local-ydb-mcp/astandrik-local-ydb-mcp)

## Channel facts

- Registry: `npm`
- Package: `@astandrik/local-ydb-mcp`
- Version: `0.15.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 90/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (145 of 150), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (145 of 150), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to astandrik/local-ydb-toolkit).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 0 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 76/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 8091 tokens (~207/item across 39 items; 39 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add astandrik-local-ydb-mcp -- npx -y @astandrik/local-ydb-mcp
```

### Codex

```bash
codex mcp add astandrik-local-ydb-mcp -- npx -y @astandrik/local-ydb-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "astandrik-local-ydb-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@astandrik/local-ydb-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add astandrik-local-ydb-mcp --command npx --arg -y --arg @astandrik/local-ydb-mcp
```

### Hermes

```yaml
mcp_servers:
  astandrik-local-ydb-mcp:
    command: "npx"
    args: ["-y", "@astandrik/local-ydb-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "astandrik-local-ydb-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@astandrik/local-ydb-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 81, +1)

- [functional] Package version: 0.14.1 → 0.15.0

### 2026-08-02 (score 80, +29)

- [security improvement] Known CVEs: unverified → partial
- [security improvement] Provenance: unverified → pass
- [security improvement] Install scripts: unverified → pass
- [security] The attested source repository moved: astandrik/local-ydb-toolkit
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] License: unverified → pass
- [functional] Licence: MIT

### 2026-08-01 (score 51, +46)

- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Schema quality: unverified → 100
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Tool coverage: unverified → 100

### 2026-07-31 (score 5, −70)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 75, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-29 (score 93, +8)

- [functional improvement] Schema quality: unverified → excellent

### 2026-07-28 (score 85, +59)

- [security improvement] Known CVEs: unverified → partial
- [security improvement] Provenance: unverified → pass
- [security improvement] Install scripts: unverified → pass
- [security] The attested source repository moved: astandrik/local-ydb-toolkit
- [functional regression] Security disclosure: unverified → fail
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Schema quality: unverified → 100
- [functional improvement] License: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Tool coverage: 100
- [functional] First check of Schema quality: unverified
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: fail
- [functional] Licence: MIT

### 2026-07-26 (score 26)

First indexed and scored.

## MCP tools (39)

### `local_ydb_inventory` (~116 tokens)

Read-only Docker inventory for a local-ydb target profile. Returns the public profile, Docker containers and volumes visible on the selected target, and inspect data for the configured static and primary dynamic containers; use before mutating tools to capture current stack state.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.

### `local_ydb_database_status` (~116 tokens)

Read-only YDB admin database status for the configured tenant path. Returns the command, stdout, stderr, and ok flag; use this for tenant state before bootstrap/restart troubleshooting, and use local_ydb_tenant_check for scheme reachability.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.

### `local_ydb_healthcheck` (~285 tokens)

Read-only YDB monitoring healthcheck for the configured tenant or root database. Uses the official YDB CLI SelfCheck path, returns selfCheckResult, issue counts, issue types, capped raw output, and whether the database is healthy; use after local_ydb_status_report for database-level diagnostics.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `databasePath` (string): YDB database path to check. Defaults to the configured tenant path; only the configured tenant path or root database path are accepted.
- `maxIssues` (integer): Maximum number of issue_log entries returned in the issues field. Counts still cover the full response. Defaults to 100.
- `maxOutputBytes` (integer): Maximum UTF-8 bytes returned per raw stdout/stderr stream. Defaults to 65536.
- `noCache` (boolean): Pass --no-cache to force YDB to bypass cached healthcheck results.
- `noMerge` (boolean): Pass --no-merge to keep individual YDB healthcheck issue records separate.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.
- `timeoutMs` (integer): Server-side YDB healthcheck timeout in milliseconds. Defaults to 120000.

### `local_ydb_container_logs` (~146 tokens)

Read recent Docker logs from the configured static or primary dynamic local-ydb container. Use when bootstrap, restart, or readiness checks fail; target selects the container role and lines controls the tail length.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `lines` (integer): Number of recent log lines to read. Defaults to 200.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.
- `target` (string, required): Container role to read logs from: static node or primary dynamic tenant node.

### `local_ydb_status_report` (~135 tokens)

Read-only aggregate report for quick diagnosis. Runs local_ydb_inventory, local_ydb_auth_check, local_ydb_tenant_check, local_ydb_nodes_check, and local_ydb_healthcheck, returning each result; use this first for broad stack health, then run focused checks for database status, GraphShard, storage, or logs.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.

### `local_ydb_tenant_check` (~102 tokens)

Read-only check that uses the YDB CLI to verify the configured tenant path is reachable. Use after bootstrap or restore to confirm tenant metadata before node or GraphShard checks.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.

### `local_ydb_scheme` (~250 tokens)

Read-only YDB scheme list or describe with capped stdout/stderr. It uses the root database for rootDatabase paths and the tenant database otherwise; list supports recursive/long/onePerLine flags, describe supports stats, and incompatible flag combinations are rejected.

Input parameters:

- `action` (string): Scheme operation to run. Defaults to list.
- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `long` (boolean): For action=list, pass -l for detailed object attributes.
- `maxOutputBytes` (integer): Maximum UTF-8 bytes returned per stdout/stderr stream. Defaults to 65536.
- `onePerLine` (boolean): For action=list, pass -1 to print one object per line.
- `path` (string): Scheme path to inspect. Defaults to the configured tenant root.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.
- `recursive` (boolean): For action=list, pass -R to recursively list subdirectories.
- `stats` (boolean): For action=describe, pass --stats.

### `local_ydb_generate_schema` (~244 tokens)

Read-only structured YDB table DDL generator. It renders strict JSON specs for CREATE TABLE, ALTER TABLE, DROP TABLE, and secondary indexes, returns the generated script with official references and warnings, and can optionally validate through the YDB JS SDK without applying changes.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `databasePath` (string): YDB database path to use when validate=true. Defaults to the configured tenant root.
- `maxOutputBytes` (integer): Maximum UTF-8 bytes returned per validation issue stream when validate=true. Defaults to 65536.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.
- `statements` (array, required): Structured schema statement specs to render into YDB table DDL.
- `timeoutMs` (integer): SDK validation timeout in milliseconds when validate=true. Defaults to 120000.
- `validate` (boolean): If true, validate the generated DDL through local_ydb_apply_schema action=validate. This tool never applies DDL.

### `local_ydb_apply_schema` (~291 tokens)

Validate or apply YDB table DDL through the official YDB JS SDK. It accepts raw YQL DDL for PRAGMA plus CREATE TABLE, ALTER TABLE, and DROP TABLE; action=apply validates first and executes only with confirm=true.

Input parameters:

- `action` (string): Schema operation to run. validate only checks the YQL DDL through the YDB SDK; apply validates first and executes only with confirm=true.
- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `confirm` (boolean): Must be true to execute action=apply after SDK validation succeeds. Omit or false for validation plus plan-only output.
- `databasePath` (string): YDB database path for SDK validation/application. Defaults to the configured tenant root; root database paths use the static gRPC port.
- `maxOutputBytes` (integer): Maximum UTF-8 bytes returned per validation/execution issue stream. Defaults to 65536.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.
- `script` (string, required): YQL DDL script to validate or apply. Supports PRAGMA plus CREATE TABLE, ALTER TABLE, and DROP TABLE statements.
- `timeoutMs` (integer): SDK operation timeout in milliseconds. Defaults to 120000.

### `local_ydb_sql` (~456 tokens)

Run managed YQL v1 against the configured local-ydb target through Query Service. query uses SnapshotRO, explain returns plan/AST, and execute always runs EXPLAIN first and sends one NoTx execution only with confirm=true.

Input parameters:

- `action` (string): Managed YQL action. query uses SnapshotRO, explain returns plan/AST without execution, and execute always EXPLAIN-preflights before optional confirmed NoTx execution.
- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `confirm` (boolean): Considered only for action=execute. Must be true to send one NoTx execution after successful EXPLAIN; query remains SnapshotRO even when true.
- `databasePath` (string): Configured tenant or root database path. Defaults to the selected profile tenant path; root paths use the static gRPC port.
- `maxOutputBytes` (integer): Shared retained-output budget for issues, plan/AST, columns, and rows.
- `maxRows` (integer): Maximum retained rows per result set. The first limit hit stops all further result capture: read-only execution is cancelled, while confirmed NoTx execution drains without capturing later output.
- `parameters` (object): Typed YQL parameters keyed by bare name. The request is limited to 100 parameters, 1,000 descriptor nodes, 10,000 value nodes, and 1 MiB of serialized parameter data. Struct field names must be well-…
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.
- `script` (string, required): Well-formed-Unicode YQL v1 script; lone UTF-16 surrogates are rejected. Parameter DECLARE statements are generated from parameters and prepended before execution.
- `timeoutMs` (integer): Single deadline in milliseconds shared by connection, session, preflight, execution, and cancellation.

### `local_ydb_permissions` (~270 tokens)

Inspect or change YDB scheme permissions for a path. The default list action is read-only; grant, revoke, set, clear, chown, and inheritance changes return a plan unless confirm=true.

Input parameters:

- `action` (string): Permissions operation to run. Defaults to list, which is read-only and does not require confirm.
- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `confirm` (boolean): Must be true to execute mutating actions. Omit or false for plan-only output. Not required for action=list.
- `maxOutputBytes` (integer): For action=list, maximum UTF-8 bytes returned per stdout/stderr stream. Defaults to 65536.
- `owner` (string): New owner for action=chown.
- `path` (string): Scheme path to manage. Defaults to the configured tenant root.
- `permissions` (array): Permission names for grant, revoke, and set actions. Each item is passed as its own -p argument.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.
- `subject` (string): User or group subject for grant, revoke, and set actions.

### `local_ydb_nodes_check` (~107 tokens)

Read-only check of dynamic node registration through viewer/json nodelist. Use after starting, adding, or removing dynamic nodes; use local_ydb_tenant_check first when tenant reachability is unknown.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.

### `local_ydb_graphshard_check` (~115 tokens)

Read-only GraphShard check through viewer/json capabilities and tabletinfo for the configured tenant. Returns graphShardExists, tablet ids, and viewer status details; use after tenant bootstrap when GraphShard support or tablet visibility is the specific question.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.

### `local_ydb_auth_check` (~110 tokens)

Read-only auth audit that checks anonymous viewer whoami status and configured YDB CLI tenant access, using root credentials when rootPasswordFile is configured. Use after auth hardening or password rotation to verify the expected posture.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.

### `local_ydb_storage_placement` (~98 tokens)

Read-only storage inspection that returns ReadStoragePool output and BSC physical placement. Use before adding or reducing storage groups to confirm the exact pool shape.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.

### `local_ydb_add_storage_groups` (~180 tokens)

Increase NumGroups for one tenant storage pool using the current ReadStoragePool definition. Without confirm=true this returns the DefineStoragePool plan, rollback, target pool, and target count; when the update succeeds it verifies NumGroups and tenant metadata.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `confirm` (boolean): Must be true to execute planned commands. Omit or false for plan-only output.
- `count` (integer): Number of storage groups to add. Defaults to 1.
- `poolName` (string): Explicit storage pool name. Defaults to <tenantPath>:<storagePoolKind>.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.

### `local_ydb_reduce_storage_groups` (~194 tokens)

Reduce NumGroups for a tenant storage pool by dumping the tenant, rebuilding the profile stack with a smaller storagePoolCount, restoring the dump, and reapplying auth when needed.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `confirm` (boolean): Must be true to execute planned commands. Omit or false for plan-only output.
- `count` (integer): Number of storage groups to remove from the current tenant pool. Defaults to 1.
- `dumpName` (string): Optional dump directory name under profile.dumpHostPath to preserve before rebuild.
- `poolName` (string): Explicit storage pool name. Defaults to <tenantPath>:<storagePoolKind>.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.

### `local_ydb_storage_leftovers` (~118 tokens)

Read-only search for candidate leftover local-ydb Docker volumes, dumps, and PDisk/data paths. It scans Docker volume names plus profile.storageSearchPaths and deletes nothing; use before local_ydb_cleanup_storage to decide exact paths or volumes to remove.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.

### `local_ydb_list_versions` (~126 tokens)

List published registry tags for a local-ydb container image, with numeric version tags sorted newest first. Use before local_ydb_upgrade_version to choose a target tag; pageSize and maxPages bound registry pagination and the response reports truncation.

Input parameters:

- `image` (string): Container image name to inspect. Defaults to ghcr.io/ydb-platform/local-ydb.
- `maxPages` (integer): Maximum number of registry pages to fetch before truncating the result. Defaults to 10.
- `pageSize` (integer): Requested tags per registry page. Defaults to 100.

### `local_ydb_pull_image` (~160 tokens)

Plan or start a background Docker pull for a local-ydb image on the selected target. Without confirm=true it returns inspect and pull commands only; with confirm=true it returns a jobId for local_ydb_pull_status unless the image is already present.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `confirm` (boolean): Must be true to start the background Docker pull. Omit or false for plan-only output.
- `image` (string): Container image to pull. Defaults to the selected profile image.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.

### `local_ydb_pull_status` (~47 tokens)

Check the status of a background Docker image pull started by local_ydb_pull_image.

Input parameters:

- `jobId` (string, required): Background pull job id returned by local_ydb_pull_image.

### `local_ydb_destroy_stack` (~194 tokens)

Remove tenant metadata, local-ydb containers, network, and storage for a profile, with optional host-path cleanup.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `confirm` (boolean): Must be true to execute planned commands. Omit or false for plan-only output.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.
- `removeAuthArtifacts` (boolean): Delete explicit authConfigPath, dynamicNodeAuthTokenFile, and rootPasswordFile when configured. Defaults to false.
- `removeBindMountPath` (boolean): Delete profile.bindMountPath when the profile uses a bind mount. Defaults to false.
- `removeDumpHostPath` (boolean): Delete profile.dumpHostPath. Defaults to false because it may be shared.

### `local_ydb_bootstrap_root_database` (~152 tokens)

Bootstrap a plain local YDB database at /local with only a static node. Use for generic local database requests that do not need a CMS tenant, GraphShard, or dynamic nodes; without confirm=true this returns the image preflight, Docker network/storage/static-node, and verification plan without executing it.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `confirm` (boolean): Must be true to execute planned commands. Omit or false for plan-only output.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.

### `local_ydb_bootstrap` (~141 tokens)

Bootstrap a tenant topology: static node with GraphShard flags, configured CMS tenant, and primary dynamic tenant node. Use only for tenant, GraphShard, dump/restore, or dynamic-node scenarios; without confirm=true this returns the full plan and creates nothing.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `confirm` (boolean): Must be true to execute planned commands. Omit or false for plan-only output.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.

### `local_ydb_check_prerequisites` (~149 tokens)

Check target-host prerequisites for Docker, curl, ruby, and the configured rootPasswordFile when present. Without confirm=true it returns checks, missing items, manual actions, and any apt-get install plan; with confirm=true it may install only supported curl/ruby packages and never installs Docker.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `confirm` (boolean): Must be true to execute planned commands. Omit or false for plan-only output.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.

### `local_ydb_create_tenant` (~131 tokens)

Create the configured CMS tenant when the static node is already running. Use before local_ydb_start_dynamic_node for tenant topologies; without confirm=true this returns the planned status/create command and creates nothing.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `confirm` (boolean): Must be true to execute planned commands. Omit or false for plan-only output.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.

### `local_ydb_start_dynamic_node` (~142 tokens)

Start the configured primary dynamic tenant node for an existing CMS tenant. Use after local_ydb_create_tenant or when admin status is PENDING_RESOURCES; use local_ydb_add_dynamic_nodes for extra nodes. Without confirm=true this returns a plan only.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `confirm` (boolean): Must be true to execute planned commands. Omit or false for plan-only output.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.

### `local_ydb_add_dynamic_nodes` (~275 tokens)

Add extra dynamic tenant nodes beyond the configured primary dynamic node, one at a time. Without confirm=true it returns container/port plans; with confirm=true it starts each node, verifies its IC port appears in viewer/json nodelist, and checks tenant metadata.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `confirm` (boolean): Must be true to execute planned commands. Omit or false for plan-only output.
- `count` (integer): Number of additional dynamic nodes to add. Defaults to 1.
- `grpcPortStart` (integer): gRPC port for the first added node. Defaults to profile.dynamicGrpc + startIndex - 1.
- `icPortStart` (integer): Interconnect port for the first added node. Defaults to profile.dynamicIc + startIndex - 1.
- `monitoringPortStart` (integer): Monitoring port for the first added node. Defaults to profile.dynamicMonitoring + startIndex - 1.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.
- `startIndex` (integer): Suffix for the first added container. Defaults to 2, producing <dynamicContainer>-2.

### `local_ydb_remove_dynamic_nodes` (~205 tokens)

Remove extra dynamic tenant nodes one at a time and verify nodelist disappearance when the node IC port can be resolved.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `confirm` (boolean): Must be true to execute planned commands. Omit or false for plan-only output.
- `containers` (array): Explicit extra dynamic-node container names to remove.
- `count` (integer): Number of extra dynamic nodes to remove. Defaults to 1.
- `nodeIds` (array): Explicit YDB dynamic-node IDs to remove. IDs must resolve to extra dynamic-node containers; the profile's base dynamic node is not removable through this option.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.
- `startIndex` (integer): Minimum suffix to consider removable. Defaults to 2.

### `local_ydb_restart_stack` (~134 tokens)

Restart the selected profile by stopping dynamic and static containers, starting the static node, ensuring the configured tenant, then starting the dynamic node. Use after config or runtime changes; without confirm=true this returns the restart plan only.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `confirm` (boolean): Must be true to execute planned commands. Omit or false for plan-only output.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.

### `local_ydb_upgrade_version` (~213 tokens)

Upgrade a file-backed, volume-backed local-ydb profile to a target image tag. Use only for version upgrades on profiles without bindMountPath; it preflights source and target images, dumps, rebuilds, restores, reapplies auth when configured, recreates extra nodes, verifies container images, and persists the profile image after successful confirmed execution.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `confirm` (boolean): Must be true to execute the version upgrade plan. Omit or false for plan-only output.
- `dumpName` (string): Optional dump directory name under profile.dumpHostPath for the upgrade backup.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.
- `version` (string, required): Target image tag such as 26.1.1.6, 26.1, latest, or nightly.

### `local_ydb_list_dumps` (~105 tokens)

Read-only list of available tenant dumps under profile.dumpHostPath. Use before restore to choose a dumpName; it only reports top-level dump directories that contain the existing tenant dump folder.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.

### `local_ydb_dump_tenant` (~195 tokens)

Dump the configured tenant or a tenant-relative path using a local-ydb helper container on the static container network. It creates profile.dumpHostPath/dumpName, excludes .sys objects, writes the dump under dumpName/tenant, and without confirm=true returns the mkdir/helper-container plan only.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `confirm` (boolean): Must be true to dump the tenant. Omit or false for plan-only output.
- `dumpName` (string): Optional dump directory name under profile.dumpHostPath.
- `path` (string): Relative YDB object or directory path to dump inside the configured tenant. Defaults to . for tenant-wide dump semantics.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.

### `local_ydb_restore_tenant` (~246 tokens)

Restore the configured tenant or destination path from a dump under profile.dumpHostPath, with optional post-restore scheme describe and bounded count-query verification. Use after bootstrap or rebuild when the target tenant is ready; without confirm=true this returns the restore plan and does not write data.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `confirm` (boolean): Must be true to restore the tenant from the selected dump. Omit or false for plan-only output.
- `countQueries` (array): Optional bounded whole-table SELECT COUNT(*) or COUNT(1) queries to verify restored data after the restore command.
- `describePaths` (array): Optional tenant-relative paths to verify with scheme describe after the restore command.
- `dumpName` (string, required): Dump directory name under profile.dumpHostPath.
- `path` (string): Destination directory path for YDB tools restore -p, relative to the configured tenant. Defaults to . for tenant root.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.

### `local_ydb_prepare_auth_config` (~196 tokens)

Generate a hardened YDB config from the current static-node config. Use before local_ydb_write_dynamic_auth_config and local_ydb_apply_auth_hardening; without confirm=true this returns the planned write only.

Input parameters:

- `configHostPath` (string): Host path for the generated hardened config. Defaults to profile.authConfigPath when present.
- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `confirm` (boolean): Must be true to write the hardened config file. Omit or false for plan-only output.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.
- `sid` (string): SID to place into viewer, monitoring, administration, and register_dynamic_node_allowed_sids. Defaults to profile.dynamicNodeAuthSid or root@builtin.

### `local_ydb_write_dynamic_auth_config` (~184 tokens)

Write the text-proto dynamic-node auth token file needed for mandatory-auth startup. Use after choosing the SID for auth hardening; without confirm=true this returns the planned file write only.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `confirm` (boolean): Must be true to write the dynamic-node auth token file. Omit or false for plan-only output.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.
- `sid` (string): SID to store in both StaffApiUserToken and NodeRegistrationToken.
- `tokenHostPath` (string): Host path for the generated text-proto auth token file. Defaults to profile.dynamicNodeAuthTokenFile when present.

### `local_ydb_apply_auth_hardening` (~168 tokens)

Apply a reviewed hardened YDB config file and restart local-ydb so auth settings take effect. Use only after preparing and reviewing the config; without confirm=true this returns the apply/restart plan only.

Input parameters:

- `configHostPath` (string): Reviewed config.yaml path on the selected target host. Defaults to profile.authConfigPath when present.
- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `confirm` (boolean): Must be true to apply the auth hardening config and restart local-ydb. Omit or false for plan-only output.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.

### `local_ydb_set_root_password` (~201 tokens)

Rotate the runtime root password with ALTER USER and sync the host auth config and root password file to match. YDB may reject passwords that violate auth_config.password_complexity; this tool requires a non-empty password value.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `confirm` (boolean): Must be true to rotate and persist the root password. Omit or false for plan-only output.
- `password` (string, required): New non-empty root password without carriage returns or newlines to apply to the runtime root user and then persist into the host auth config and root password file. YDB defaults to no password compl…
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.

### `local_ydb_cleanup_storage` (~184 tokens)

Delete only the explicitly supplied local-ydb host paths or Docker volumes. Use after inspecting local_ydb_storage_leftovers; without confirm=true this returns the cleanup plan and removes nothing.

Input parameters:

- `configPath` (string): Explicit local-ydb config file path to load for this tool call. Useful when the MCP server should pick up a different config without restart.
- `confirm` (boolean): Must be true to remove the explicitly supplied storage paths or Docker volumes. Omit or false for plan-only output.
- `paths` (array): Explicit host filesystem paths to remove. Nothing is deleted unless each path is supplied here and confirm=true.
- `profile` (string): Named profile from local-ydb.config.json. Defaults to config.defaultProfile.
- `volumes` (array): Explicit Docker volume names to remove. Nothing is deleted unless each volume is supplied here and confirm=true.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/astandrik-local-ydb-mcp/astandrik-local-ydb-mcp#diagnostics

## Score history

- 2026-08-03: 81
- 2026-08-02: 80
- 2026-08-01: 51
- 2026-07-31: 5
- 2026-07-30: 75
- 2026-07-29: 93
- 2026-07-28: 85
- 2026-07-26: 26

## Links

- npm package: https://www.npmjs.com/package/@astandrik/local-ydb-mcp
- Socket report: https://socket.dev/npm/package/@astandrik/local-ydb-mcp
- Repository: https://github.com/astandrik/local-ydb-toolkit
- Website: https://local-ydb-toolkit.ydb-qdrant.tech/
- Changelog RSS feed: https://verifymcp.io/servers/astandrik-local-ydb-mcp/astandrik-local-ydb-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/astandrik-local-ydb-mcp/astandrik-local-ydb-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/astandrik-local-ydb-mcp/astandrik-local-ydb-mcp