Fix mcp ps uptime: parse StartedAt from podman ps JSON

List() was not extracting the StartedAt field from podman's JSON output, so LiveCheck always returned zero timestamps and the CLI showed "-" for every container's uptime. podman ps --format json includes StartedAt as a Unix timestamp (int64). Parse it into ContainerInfo.Started so the existing LiveCheck → CLI uptime display chain works. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Bump flake version to 0.6.0
2026-03-27 22:56:39 -07:00 · 2026-03-27 21:46:23 -07:00 · 2026-03-27 21:45:42 -07:00 · 2026-03-27 21:41:25 -07:00 · 2026-03-27 16:50:48 -07:00 · 2026-03-27 16:49:48 -07:00
20 changed files with 1434 additions and 165 deletions
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -198,6 +198,7 @@ mcp build <service>/<image>            Build and push a single image
 mcp deploy <service>                   Deploy all components from service definition
 mcp deploy <service>/<component>       Deploy a single component
 mcp deploy <service> -f <file>         Deploy from explicit file
+mcp undeploy <service>                 Full teardown: remove routes, DNS, certs, containers
 mcp stop <service>                     Stop all components, set active=false
 mcp start <service>                    Start all components, set active=true
 mcp restart <service>                  Restart all components
@@ -453,6 +454,7 @@ import "google/protobuf/timestamp.proto";
 service McpAgent {
  // Service lifecycle
  rpc Deploy(DeployRequest) returns (DeployResponse);
+  rpc UndeployService(UndeployRequest) returns (UndeployResponse);
  rpc StopService(ServiceRequest) returns (ServiceResponse);
  rpc StartService(ServiceRequest) returns (ServiceResponse);
  rpc RestartService(ServiceRequest) returns (ServiceResponse);
@@ -714,6 +716,40 @@ The flags passed to `podman run` are derived from the `ComponentSpec`:
 | `volumes` | `-v <mapping>` (repeated) |
 | `cmd` | appended after the image name |

+#### Undeploy Flow
+
+`mcp undeploy <service>` is the full inverse of deploy. It tears down all
+infrastructure associated with a service. When the agent receives an
+`UndeployService` RPC:
+
+1. For each component:
+   a. Remove mc-proxy routes (traffic stops flowing).
+   b. Remove DNS A records from MCNS.
+   c. Remove TLS certificate and key files from the mc-proxy cert
+      directory (for L7 routes).
+   d. Stop and remove the container.
+   e. Release allocated host ports back to the port allocator.
+   f. Update component state to `removed` in the registry.
+2. Mark the service as inactive.
+3. Return success/failure per component.
+
+The CLI also sets `active = false` in the local service definition file
+to keep it in sync with the operator's intent.
+
+Undeploy differs from `stop` in three ways:
+
+| Aspect | `stop` | `undeploy` |
+|--------|--------|-----------|
+| Container | Stopped (still exists) | Stopped and removed |
+| TLS certs | Kept | Removed |
+| Ports | Kept allocated | Released |
+| Service active | Unchanged | Set to inactive |
+
+After undeploy, the service can be redeployed with `mcp deploy`. The
+registry entries are preserved (desired state `removed`) so `mcp status`
+and `mcp list` still show the service existed. Use `mcp purge` to clean
+up the registry entries if desired.
+
 ### File Transfer

 The agent supports single-file push and pull, scoped to a specific
@@ -1203,6 +1239,102 @@ container, the effective host UID depends on the mapping. Files in
 configuration should provision appropriate subuid/subgid ranges when
 creating the `mcp` user.

+**Dockerfile convention**: Do not use `USER`, `VOLUME`, or `adduser`
+directives in production Dockerfiles. The `user` field in the service
+definition (typically `"0:0"`) controls the runtime user, and host
+volumes provide the data directories. A non-root `USER` in the
+Dockerfile maps to a subordinate UID under rootless podman that cannot
+access files owned by the `mcp` user on the host.
+
+#### Infrastructure Boot Order and Circular Dependencies
+
+MCR (container registry) and MCNS (DNS) are both deployed as containers
+via MCP, but MCP itself depends on them:
+
+- **MCR** is reachable through mc-proxy (L4 passthrough on `:8443`).
+  The agent pulls images from MCR during `mcp deploy`.
+- **MCNS** serves DNS for internal zones. Tailscale and the overlay
+  network depend on DNS resolution.
+
+This creates circular dependencies during cold-start or recovery:
+
+```
+mcp deploy → agent pulls image → needs MCR → needs mc-proxy
+mcp deploy → agent dials MCR → DNS resolves hostname → needs MCNS
+```
+
+**Cold-start procedure** (no containers running):
+
+1. **Build images on the operator workstation** for mc-proxy, MCR, and
+   MCNS. Transfer to rift via `podman save` / `scp` / `podman load`
+   since the registry is not yet available:
+   ```
+   docker save <image> -o /tmp/image.tar
+   scp /tmp/image.tar <rift-lan-ip>:/tmp/
+   # on rift, as mcp user:
+   podman load -i /tmp/image.tar
+   ```
+   Use the LAN IP for scp, not a DNS name (DNS is not running yet).
+
+2. **Start MCNS first** (DNS must come up before anything that resolves
+   hostnames). Run directly with podman since the MCP agent cannot reach
+   the registry yet:
+   ```
+   podman run -d --name mcns --restart unless-stopped \
+     --sysctl net.ipv4.ip_unprivileged_port_start=53 \
+     -p <lan-ip>:53:53/tcp -p <lan-ip>:53:53/udp \
+     -p <overlay-ip>:53:53/tcp -p <overlay-ip>:53:53/udp \
+     -v /srv/mcns:/srv/mcns \
+     <mcns-image> server --config /srv/mcns/mcns.toml
+   ```
+
+3. **Start mc-proxy** (registry traffic routes through it):
+   ```
+   podman run -d --name mc-proxy --network host \
+     --restart unless-stopped \
+     -v /srv/mc-proxy:/srv/mc-proxy \
+     <mc-proxy-image> server --config /srv/mc-proxy/mc-proxy.toml
+   ```
+
+4. **Start MCR** (API server, then web UI):
+   ```
+   podman run -d --name mcr-api --network mcpnet \
+     --restart unless-stopped \
+     -p 127.0.0.1:28443:8443 -p 127.0.0.1:29443:9443 \
+     -v /srv/mcr:/srv/mcr \
+     <mcr-image> server --config /srv/mcr/mcr.toml
+   ```
+
+5. **Push images to MCR** from the operator workstation now that the
+   registry is reachable:
+   ```
+   docker push <registry>/<image>:<tag>
+   ```
+
+6. **Start the MCP agent** (systemd service). It can now reach MCR for
+   image pulls.
+
+7. **`mcp adopt`** the manually-started containers to bring them under
+   MCP management. Then `mcp service export` to generate service
+   definition files.
+
+From this point, `mcp deploy` works normally. The manually-started
+containers are replaced by MCP-managed ones on the next deploy.
+
+**Recovery procedure** (mc-proxy or MCNS crashed):
+
+If mc-proxy or MCNS goes down, the agent cannot pull images (registry
+unreachable or DNS broken). Recovery:
+
+1. Check if the required image is cached locally:
+   `podman images | grep <service>`
+2. If cached, start the container directly with `podman run` (same
+   flags as the cold-start procedure above).
+3. If not cached, transfer the image from the operator workstation via
+   `podman save` / `scp` / `podman load` using the LAN IP.
+4. Once the infrastructure service is running, `mcp deploy` resumes
+   normal operation for other services.
+
 ---

 ## Security Model
--- a/cmd/mcp/main.go
+++ b/cmd/mcp/main.go
@@ -36,6 +36,7 @@ func main() {
 	root.AddCommand(loginCmd())
 	root.AddCommand(buildCmd())
 	root.AddCommand(deployCmd())
+	root.AddCommand(undeployCmd())
 	root.AddCommand(stopCmd())
 	root.AddCommand(startCmd())
 	root.AddCommand(restartCmd())
--- a/cmd/mcp/undeploy.go
+++ b/cmd/mcp/undeploy.go
@@ -0,0 +1,63 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"path/filepath"
+
+	"github.com/spf13/cobra"
+
+	mcpv1 "git.wntrmute.dev/mc/mcp/gen/mcp/v1"
+	"git.wntrmute.dev/mc/mcp/internal/config"
+	"git.wntrmute.dev/mc/mcp/internal/servicedef"
+)
+
+func undeployCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "undeploy <service>",
+		Short: "Fully undeploy a service: remove routes, DNS, certs, and containers",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			cfg, err := config.LoadCLIConfig(cfgPath)
+			if err != nil {
+				return fmt.Errorf("load config: %w", err)
+			}
+
+			serviceName := args[0]
+			defPath := filepath.Join(cfg.Services.Dir, serviceName+".toml")
+
+			def, err := servicedef.Load(defPath)
+			if err != nil {
+				return fmt.Errorf("load service def: %w", err)
+			}
+
+			// Set active=false in the local file.
+			active := false
+			def.Active = &active
+			if err := servicedef.Write(defPath, def); err != nil {
+				return fmt.Errorf("write service def: %w", err)
+			}
+
+			address, err := findNodeAddress(cfg, def.Node)
+			if err != nil {
+				return err
+			}
+
+			client, conn, err := dialAgent(address, cfg)
+			if err != nil {
+				return fmt.Errorf("dial agent: %w", err)
+			}
+			defer func() { _ = conn.Close() }()
+
+			resp, err := client.UndeployService(context.Background(), &mcpv1.UndeployServiceRequest{
+				Name: serviceName,
+			})
+			if err != nil {
+				return fmt.Errorf("undeploy service: %w", err)
+			}
+
+			printComponentResults(resp.GetResults())
+			return nil
+		},
+	}
+}
--- a/flake.nix
+++ b/flake.nix
@@ -10,7 +10,7 @@
    let
      system = "x86_64-linux";
      pkgs = nixpkgs.legacyPackages.${system};
-      version = "0.4.0";
+      version = "0.6.0";
    in
    {
      packages.${system} = {
@@ -27,6 +27,14 @@
            "-w"
            "-X main.version=${version}"
          ];
+          postInstall = ''
+            mkdir -p $out/share/zsh/site-functions
+            mkdir -p $out/share/bash-completion/completions
+            mkdir -p $out/share/fish/vendor_completions.d
+            $out/bin/mcp completion zsh > $out/share/zsh/site-functions/_mcp
+            $out/bin/mcp completion bash > $out/share/bash-completion/completions/mcp
+            $out/bin/mcp completion fish > $out/share/fish/vendor_completions.d/mcp.fish
+          '';
        };

        mcp-agent = pkgs.buildGoModule {
--- a/gen/mcp/v1/mcp.pb.go
+++ b/gen/mcp/v1/mcp.pb.go
@@ -25,7 +25,7 @@ const (
 type RouteSpec struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Name          string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`         // route name (used for $PORT_<NAME>)
-	Port          int32                  `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`        // external port on mc-proxy
+	Port          int32                  `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`        // mc-proxy listener port (e.g. 443, 8443, 9443); NOT the container internal port
 	Mode          string                 `protobuf:"bytes,3,opt,name=mode,proto3" json:"mode,omitempty"`         // "l4" or "l7"
 	Hostname      string                 `protobuf:"bytes,4,opt,name=hostname,proto3" json:"hostname,omitempty"` // optional public hostname override
 	unknownFields protoimpl.UnknownFields
@@ -687,6 +687,94 @@ func (x *RestartServiceResponse) GetResults() []*ComponentResult {
 	return nil
 }

+type UndeployServiceRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Name          string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UndeployServiceRequest) Reset() {
+	*x = UndeployServiceRequest{}
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[12]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UndeployServiceRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UndeployServiceRequest) ProtoMessage() {}
+
+func (x *UndeployServiceRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[12]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UndeployServiceRequest.ProtoReflect.Descriptor instead.
+func (*UndeployServiceRequest) Descriptor() ([]byte, []int) {
+	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *UndeployServiceRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+type UndeployServiceResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Results       []*ComponentResult     `protobuf:"bytes,1,rep,name=results,proto3" json:"results,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UndeployServiceResponse) Reset() {
+	*x = UndeployServiceResponse{}
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[13]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UndeployServiceResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UndeployServiceResponse) ProtoMessage() {}
+
+func (x *UndeployServiceResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[13]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UndeployServiceResponse.ProtoReflect.Descriptor instead.
+func (*UndeployServiceResponse) Descriptor() ([]byte, []int) {
+	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{13}
+}
+
+func (x *UndeployServiceResponse) GetResults() []*ComponentResult {
+	if x != nil {
+		return x.Results
+	}
+	return nil
+}
+
 type SyncDesiredStateRequest struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// All services for this node.
@@ -697,7 +785,7 @@ type SyncDesiredStateRequest struct {

 func (x *SyncDesiredStateRequest) Reset() {
 	*x = SyncDesiredStateRequest{}
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[12]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[14]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -709,7 +797,7 @@ func (x *SyncDesiredStateRequest) String() string {
 func (*SyncDesiredStateRequest) ProtoMessage() {}

 func (x *SyncDesiredStateRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[12]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[14]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -722,7 +810,7 @@ func (x *SyncDesiredStateRequest) ProtoReflect() protoreflect.Message {

 // Deprecated: Use SyncDesiredStateRequest.ProtoReflect.Descriptor instead.
 func (*SyncDesiredStateRequest) Descriptor() ([]byte, []int) {
-	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{12}
+	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{14}
 }

 func (x *SyncDesiredStateRequest) GetServices() []*ServiceSpec {
@@ -741,7 +829,7 @@ type SyncDesiredStateResponse struct {

 func (x *SyncDesiredStateResponse) Reset() {
 	*x = SyncDesiredStateResponse{}
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[13]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[15]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -753,7 +841,7 @@ func (x *SyncDesiredStateResponse) String() string {
 func (*SyncDesiredStateResponse) ProtoMessage() {}

 func (x *SyncDesiredStateResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[13]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[15]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -766,7 +854,7 @@ func (x *SyncDesiredStateResponse) ProtoReflect() protoreflect.Message {

 // Deprecated: Use SyncDesiredStateResponse.ProtoReflect.Descriptor instead.
 func (*SyncDesiredStateResponse) Descriptor() ([]byte, []int) {
-	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{13}
+	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{15}
 }

 func (x *SyncDesiredStateResponse) GetResults() []*ServiceSyncResult {
@@ -788,7 +876,7 @@ type ServiceSyncResult struct {

 func (x *ServiceSyncResult) Reset() {
 	*x = ServiceSyncResult{}
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[14]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[16]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -800,7 +888,7 @@ func (x *ServiceSyncResult) String() string {
 func (*ServiceSyncResult) ProtoMessage() {}

 func (x *ServiceSyncResult) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[14]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[16]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -813,7 +901,7 @@ func (x *ServiceSyncResult) ProtoReflect() protoreflect.Message {

 // Deprecated: Use ServiceSyncResult.ProtoReflect.Descriptor instead.
 func (*ServiceSyncResult) Descriptor() ([]byte, []int) {
-	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{14}
+	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{16}
 }

 func (x *ServiceSyncResult) GetName() string {
@@ -845,7 +933,7 @@ type ListServicesRequest struct {

 func (x *ListServicesRequest) Reset() {
 	*x = ListServicesRequest{}
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[15]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[17]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -857,7 +945,7 @@ func (x *ListServicesRequest) String() string {
 func (*ListServicesRequest) ProtoMessage() {}

 func (x *ListServicesRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[15]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[17]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -870,7 +958,7 @@ func (x *ListServicesRequest) ProtoReflect() protoreflect.Message {

 // Deprecated: Use ListServicesRequest.ProtoReflect.Descriptor instead.
 func (*ListServicesRequest) Descriptor() ([]byte, []int) {
-	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{15}
+	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{17}
 }

 type ServiceInfo struct {
@@ -884,7 +972,7 @@ type ServiceInfo struct {

 func (x *ServiceInfo) Reset() {
 	*x = ServiceInfo{}
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[16]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[18]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -896,7 +984,7 @@ func (x *ServiceInfo) String() string {
 func (*ServiceInfo) ProtoMessage() {}

 func (x *ServiceInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[16]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[18]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -909,7 +997,7 @@ func (x *ServiceInfo) ProtoReflect() protoreflect.Message {

 // Deprecated: Use ServiceInfo.ProtoReflect.Descriptor instead.
 func (*ServiceInfo) Descriptor() ([]byte, []int) {
-	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{16}
+	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{18}
 }

 func (x *ServiceInfo) GetName() string {
@@ -950,7 +1038,7 @@ type ComponentInfo struct {

 func (x *ComponentInfo) Reset() {
 	*x = ComponentInfo{}
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[17]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[19]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -962,7 +1050,7 @@ func (x *ComponentInfo) String() string {
 func (*ComponentInfo) ProtoMessage() {}

 func (x *ComponentInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[17]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[19]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -975,7 +1063,7 @@ func (x *ComponentInfo) ProtoReflect() protoreflect.Message {

 // Deprecated: Use ComponentInfo.ProtoReflect.Descriptor instead.
 func (*ComponentInfo) Descriptor() ([]byte, []int) {
-	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{17}
+	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{19}
 }

 func (x *ComponentInfo) GetName() string {
@@ -1029,7 +1117,7 @@ type ListServicesResponse struct {

 func (x *ListServicesResponse) Reset() {
 	*x = ListServicesResponse{}
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[18]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[20]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1041,7 +1129,7 @@ func (x *ListServicesResponse) String() string {
 func (*ListServicesResponse) ProtoMessage() {}

 func (x *ListServicesResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[18]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[20]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1054,7 +1142,7 @@ func (x *ListServicesResponse) ProtoReflect() protoreflect.Message {

 // Deprecated: Use ListServicesResponse.ProtoReflect.Descriptor instead.
 func (*ListServicesResponse) Descriptor() ([]byte, []int) {
-	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{18}
+	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{20}
 }

 func (x *ListServicesResponse) GetServices() []*ServiceInfo {
@@ -1074,7 +1162,7 @@ type GetServiceStatusRequest struct {

 func (x *GetServiceStatusRequest) Reset() {
 	*x = GetServiceStatusRequest{}
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[19]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[21]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1086,7 +1174,7 @@ func (x *GetServiceStatusRequest) String() string {
 func (*GetServiceStatusRequest) ProtoMessage() {}

 func (x *GetServiceStatusRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[19]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[21]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1099,7 +1187,7 @@ func (x *GetServiceStatusRequest) ProtoReflect() protoreflect.Message {

 // Deprecated: Use GetServiceStatusRequest.ProtoReflect.Descriptor instead.
 func (*GetServiceStatusRequest) Descriptor() ([]byte, []int) {
-	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{19}
+	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{21}
 }

 func (x *GetServiceStatusRequest) GetName() string {
@@ -1121,7 +1209,7 @@ type DriftInfo struct {

 func (x *DriftInfo) Reset() {
 	*x = DriftInfo{}
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[20]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[22]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1133,7 +1221,7 @@ func (x *DriftInfo) String() string {
 func (*DriftInfo) ProtoMessage() {}

 func (x *DriftInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[20]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[22]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1146,7 +1234,7 @@ func (x *DriftInfo) ProtoReflect() protoreflect.Message {

 // Deprecated: Use DriftInfo.ProtoReflect.Descriptor instead.
 func (*DriftInfo) Descriptor() ([]byte, []int) {
-	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{20}
+	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{22}
 }

 func (x *DriftInfo) GetService() string {
@@ -1190,7 +1278,7 @@ type EventInfo struct {

 func (x *EventInfo) Reset() {
 	*x = EventInfo{}
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[21]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[23]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1202,7 +1290,7 @@ func (x *EventInfo) String() string {
 func (*EventInfo) ProtoMessage() {}

 func (x *EventInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[21]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[23]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1215,7 +1303,7 @@ func (x *EventInfo) ProtoReflect() protoreflect.Message {

 // Deprecated: Use EventInfo.ProtoReflect.Descriptor instead.
 func (*EventInfo) Descriptor() ([]byte, []int) {
-	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{21}
+	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{23}
 }

 func (x *EventInfo) GetService() string {
@@ -1264,7 +1352,7 @@ type GetServiceStatusResponse struct {

 func (x *GetServiceStatusResponse) Reset() {
 	*x = GetServiceStatusResponse{}
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[22]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[24]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1276,7 +1364,7 @@ func (x *GetServiceStatusResponse) String() string {
 func (*GetServiceStatusResponse) ProtoMessage() {}

 func (x *GetServiceStatusResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[22]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[24]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1289,7 +1377,7 @@ func (x *GetServiceStatusResponse) ProtoReflect() protoreflect.Message {

 // Deprecated: Use GetServiceStatusResponse.ProtoReflect.Descriptor instead.
 func (*GetServiceStatusResponse) Descriptor() ([]byte, []int) {
-	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{22}
+	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{24}
 }

 func (x *GetServiceStatusResponse) GetServices() []*ServiceInfo {
@@ -1321,7 +1409,7 @@ type LiveCheckRequest struct {

 func (x *LiveCheckRequest) Reset() {
 	*x = LiveCheckRequest{}
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[23]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[25]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1333,7 +1421,7 @@ func (x *LiveCheckRequest) String() string {
 func (*LiveCheckRequest) ProtoMessage() {}

 func (x *LiveCheckRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[23]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[25]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1346,7 +1434,7 @@ func (x *LiveCheckRequest) ProtoReflect() protoreflect.Message {

 // Deprecated: Use LiveCheckRequest.ProtoReflect.Descriptor instead.
 func (*LiveCheckRequest) Descriptor() ([]byte, []int) {
-	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{23}
+	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{25}
 }

 type LiveCheckResponse struct {
@@ -1359,7 +1447,7 @@ type LiveCheckResponse struct {

 func (x *LiveCheckResponse) Reset() {
 	*x = LiveCheckResponse{}
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[24]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[26]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1371,7 +1459,7 @@ func (x *LiveCheckResponse) String() string {
 func (*LiveCheckResponse) ProtoMessage() {}

 func (x *LiveCheckResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[24]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[26]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1384,7 +1472,7 @@ func (x *LiveCheckResponse) ProtoReflect() protoreflect.Message {

 // Deprecated: Use LiveCheckResponse.ProtoReflect.Descriptor instead.
 func (*LiveCheckResponse) Descriptor() ([]byte, []int) {
-	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{24}
+	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{26}
 }

 func (x *LiveCheckResponse) GetServices() []*ServiceInfo {
@@ -1404,7 +1492,7 @@ type AdoptContainersRequest struct {

 func (x *AdoptContainersRequest) Reset() {
 	*x = AdoptContainersRequest{}
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[25]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[27]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1416,7 +1504,7 @@ func (x *AdoptContainersRequest) String() string {
 func (*AdoptContainersRequest) ProtoMessage() {}

 func (x *AdoptContainersRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[25]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[27]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1429,7 +1517,7 @@ func (x *AdoptContainersRequest) ProtoReflect() protoreflect.Message {

 // Deprecated: Use AdoptContainersRequest.ProtoReflect.Descriptor instead.
 func (*AdoptContainersRequest) Descriptor() ([]byte, []int) {
-	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{25}
+	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{27}
 }

 func (x *AdoptContainersRequest) GetService() string {
@@ -1453,7 +1541,7 @@ type AdoptResult struct {

 func (x *AdoptResult) Reset() {
 	*x = AdoptResult{}
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[26]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[28]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1465,7 +1553,7 @@ func (x *AdoptResult) String() string {
 func (*AdoptResult) ProtoMessage() {}

 func (x *AdoptResult) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[26]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[28]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1478,7 +1566,7 @@ func (x *AdoptResult) ProtoReflect() protoreflect.Message {

 // Deprecated: Use AdoptResult.ProtoReflect.Descriptor instead.
 func (*AdoptResult) Descriptor() ([]byte, []int) {
-	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{26}
+	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{28}
 }

 func (x *AdoptResult) GetContainer() string {
@@ -1518,7 +1606,7 @@ type AdoptContainersResponse struct {

 func (x *AdoptContainersResponse) Reset() {
 	*x = AdoptContainersResponse{}
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[27]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[29]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1530,7 +1618,7 @@ func (x *AdoptContainersResponse) String() string {
 func (*AdoptContainersResponse) ProtoMessage() {}

 func (x *AdoptContainersResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[27]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[29]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1543,7 +1631,7 @@ func (x *AdoptContainersResponse) ProtoReflect() protoreflect.Message {

 // Deprecated: Use AdoptContainersResponse.ProtoReflect.Descriptor instead.
 func (*AdoptContainersResponse) Descriptor() ([]byte, []int) {
-	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{27}
+	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{29}
 }

 func (x *AdoptContainersResponse) GetResults() []*AdoptResult {
@@ -1567,7 +1655,7 @@ type PushFileRequest struct {

 func (x *PushFileRequest) Reset() {
 	*x = PushFileRequest{}
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[28]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[30]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1579,7 +1667,7 @@ func (x *PushFileRequest) String() string {
 func (*PushFileRequest) ProtoMessage() {}

 func (x *PushFileRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[28]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[30]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1592,7 +1680,7 @@ func (x *PushFileRequest) ProtoReflect() protoreflect.Message {

 // Deprecated: Use PushFileRequest.ProtoReflect.Descriptor instead.
 func (*PushFileRequest) Descriptor() ([]byte, []int) {
-	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{28}
+	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{30}
 }

 func (x *PushFileRequest) GetService() string {
@@ -1633,7 +1721,7 @@ type PushFileResponse struct {

 func (x *PushFileResponse) Reset() {
 	*x = PushFileResponse{}
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[29]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[31]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1645,7 +1733,7 @@ func (x *PushFileResponse) String() string {
 func (*PushFileResponse) ProtoMessage() {}

 func (x *PushFileResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[29]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[31]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1658,7 +1746,7 @@ func (x *PushFileResponse) ProtoReflect() protoreflect.Message {

 // Deprecated: Use PushFileResponse.ProtoReflect.Descriptor instead.
 func (*PushFileResponse) Descriptor() ([]byte, []int) {
-	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{29}
+	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{31}
 }

 func (x *PushFileResponse) GetSuccess() bool {
@@ -1686,7 +1774,7 @@ type PullFileRequest struct {

 func (x *PullFileRequest) Reset() {
 	*x = PullFileRequest{}
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[30]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[32]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1698,7 +1786,7 @@ func (x *PullFileRequest) String() string {
 func (*PullFileRequest) ProtoMessage() {}

 func (x *PullFileRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[30]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[32]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1711,7 +1799,7 @@ func (x *PullFileRequest) ProtoReflect() protoreflect.Message {

 // Deprecated: Use PullFileRequest.ProtoReflect.Descriptor instead.
 func (*PullFileRequest) Descriptor() ([]byte, []int) {
-	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{30}
+	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{32}
 }

 func (x *PullFileRequest) GetService() string {
@@ -1739,7 +1827,7 @@ type PullFileResponse struct {

 func (x *PullFileResponse) Reset() {
 	*x = PullFileResponse{}
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[31]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[33]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1751,7 +1839,7 @@ func (x *PullFileResponse) String() string {
 func (*PullFileResponse) ProtoMessage() {}

 func (x *PullFileResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[31]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[33]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1764,7 +1852,7 @@ func (x *PullFileResponse) ProtoReflect() protoreflect.Message {

 // Deprecated: Use PullFileResponse.ProtoReflect.Descriptor instead.
 func (*PullFileResponse) Descriptor() ([]byte, []int) {
-	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{31}
+	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{33}
 }

 func (x *PullFileResponse) GetContent() []byte {
@@ -1796,7 +1884,7 @@ type NodeStatusRequest struct {

 func (x *NodeStatusRequest) Reset() {
 	*x = NodeStatusRequest{}
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[32]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[34]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1808,7 +1896,7 @@ func (x *NodeStatusRequest) String() string {
 func (*NodeStatusRequest) ProtoMessage() {}

 func (x *NodeStatusRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[32]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[34]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1821,7 +1909,7 @@ func (x *NodeStatusRequest) ProtoReflect() protoreflect.Message {

 // Deprecated: Use NodeStatusRequest.ProtoReflect.Descriptor instead.
 func (*NodeStatusRequest) Descriptor() ([]byte, []int) {
-	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{32}
+	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{34}
 }

 type NodeStatusResponse struct {
@@ -1844,7 +1932,7 @@ type NodeStatusResponse struct {

 func (x *NodeStatusResponse) Reset() {
 	*x = NodeStatusResponse{}
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[33]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[35]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1856,7 +1944,7 @@ func (x *NodeStatusResponse) String() string {
 func (*NodeStatusResponse) ProtoMessage() {}

 func (x *NodeStatusResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[33]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[35]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1869,7 +1957,7 @@ func (x *NodeStatusResponse) ProtoReflect() protoreflect.Message {

 // Deprecated: Use NodeStatusResponse.ProtoReflect.Descriptor instead.
 func (*NodeStatusResponse) Descriptor() ([]byte, []int) {
-	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{33}
+	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{35}
 }

 func (x *NodeStatusResponse) GetNodeName() string {
@@ -1966,7 +2054,7 @@ type PurgeRequest struct {

 func (x *PurgeRequest) Reset() {
 	*x = PurgeRequest{}
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[34]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[36]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1978,7 +2066,7 @@ func (x *PurgeRequest) String() string {
 func (*PurgeRequest) ProtoMessage() {}

 func (x *PurgeRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[34]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[36]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1991,7 +2079,7 @@ func (x *PurgeRequest) ProtoReflect() protoreflect.Message {

 // Deprecated: Use PurgeRequest.ProtoReflect.Descriptor instead.
 func (*PurgeRequest) Descriptor() ([]byte, []int) {
-	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{34}
+	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{36}
 }

 func (x *PurgeRequest) GetService() string {
@@ -2031,7 +2119,7 @@ type PurgeResponse struct {

 func (x *PurgeResponse) Reset() {
 	*x = PurgeResponse{}
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[35]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[37]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2043,7 +2131,7 @@ func (x *PurgeResponse) String() string {
 func (*PurgeResponse) ProtoMessage() {}

 func (x *PurgeResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[35]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[37]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2056,7 +2144,7 @@ func (x *PurgeResponse) ProtoReflect() protoreflect.Message {

 // Deprecated: Use PurgeResponse.ProtoReflect.Descriptor instead.
 func (*PurgeResponse) Descriptor() ([]byte, []int) {
-	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{35}
+	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{37}
 }

 func (x *PurgeResponse) GetResults() []*PurgeResult {
@@ -2080,7 +2168,7 @@ type PurgeResult struct {

 func (x *PurgeResult) Reset() {
 	*x = PurgeResult{}
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[36]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[38]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2092,7 +2180,7 @@ func (x *PurgeResult) String() string {
 func (*PurgeResult) ProtoMessage() {}

 func (x *PurgeResult) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[36]
+	mi := &file_proto_mcp_v1_mcp_proto_msgTypes[38]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2105,7 +2193,7 @@ func (x *PurgeResult) ProtoReflect() protoreflect.Message {

 // Deprecated: Use PurgeResult.ProtoReflect.Descriptor instead.
 func (*PurgeResult) Descriptor() ([]byte, []int) {
-	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{36}
+	return file_proto_mcp_v1_mcp_proto_rawDescGZIP(), []int{38}
 }

 func (x *PurgeResult) GetService() string {
@@ -2184,6 +2272,10 @@ const file_proto_mcp_v1_mcp_proto_rawDesc = "" +
 	"\x15RestartServiceRequest\x12\x12\n" +
 	"\x04name\x18\x01 \x01(\tR\x04name\"K\n" +
 	"\x16RestartServiceResponse\x121\n" +
+	"\aresults\x18\x01 \x03(\v2\x17.mcp.v1.ComponentResultR\aresults\",\n" +
+	"\x16UndeployServiceRequest\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\"L\n" +
+	"\x17UndeployServiceResponse\x121\n" +
 	"\aresults\x18\x01 \x03(\v2\x17.mcp.v1.ComponentResultR\aresults\"J\n" +
 	"\x17SyncDesiredStateRequest\x12/\n" +
 	"\bservices\x18\x01 \x03(\v2\x13.mcp.v1.ServiceSpecR\bservices\"O\n" +
@@ -2279,9 +2371,10 @@ const file_proto_mcp_v1_mcp_proto_rawDesc = "" +
 	"\aservice\x18\x01 \x01(\tR\aservice\x12\x1c\n" +
 	"\tcomponent\x18\x02 \x01(\tR\tcomponent\x12\x16\n" +
 	"\x06purged\x18\x03 \x01(\bR\x06purged\x12\x16\n" +
-	"\x06reason\x18\x04 \x01(\tR\x06reason2\xbf\a\n" +
+	"\x06reason\x18\x04 \x01(\tR\x06reason2\x93\b\n" +
 	"\x0fMcpAgentService\x127\n" +
-	"\x06Deploy\x12\x15.mcp.v1.DeployRequest\x1a\x16.mcp.v1.DeployResponse\x12F\n" +
+	"\x06Deploy\x12\x15.mcp.v1.DeployRequest\x1a\x16.mcp.v1.DeployResponse\x12R\n" +
+	"\x0fUndeployService\x12\x1e.mcp.v1.UndeployServiceRequest\x1a\x1f.mcp.v1.UndeployServiceResponse\x12F\n" +
 	"\vStopService\x12\x1a.mcp.v1.StopServiceRequest\x1a\x1b.mcp.v1.StopServiceResponse\x12I\n" +
 	"\fStartService\x12\x1b.mcp.v1.StartServiceRequest\x1a\x1c.mcp.v1.StartServiceResponse\x12O\n" +
 	"\x0eRestartService\x12\x1d.mcp.v1.RestartServiceRequest\x1a\x1e.mcp.v1.RestartServiceResponse\x12U\n" +
@@ -2308,7 +2401,7 @@ func file_proto_mcp_v1_mcp_proto_rawDescGZIP() []byte {
 	return file_proto_mcp_v1_mcp_proto_rawDescData
 }

-var file_proto_mcp_v1_mcp_proto_msgTypes = make([]protoimpl.MessageInfo, 37)
+var file_proto_mcp_v1_mcp_proto_msgTypes = make([]protoimpl.MessageInfo, 39)
 var file_proto_mcp_v1_mcp_proto_goTypes = []any{
 	(*RouteSpec)(nil),                // 0: mcp.v1.RouteSpec
 	(*ComponentSpec)(nil),            // 1: mcp.v1.ComponentSpec
@@ -2322,32 +2415,34 @@ var file_proto_mcp_v1_mcp_proto_goTypes = []any{
 	(*StartServiceResponse)(nil),     // 9: mcp.v1.StartServiceResponse
 	(*RestartServiceRequest)(nil),    // 10: mcp.v1.RestartServiceRequest
 	(*RestartServiceResponse)(nil),   // 11: mcp.v1.RestartServiceResponse
-	(*SyncDesiredStateRequest)(nil),  // 12: mcp.v1.SyncDesiredStateRequest
-	(*SyncDesiredStateResponse)(nil), // 13: mcp.v1.SyncDesiredStateResponse
-	(*ServiceSyncResult)(nil),        // 14: mcp.v1.ServiceSyncResult
-	(*ListServicesRequest)(nil),      // 15: mcp.v1.ListServicesRequest
-	(*ServiceInfo)(nil),              // 16: mcp.v1.ServiceInfo
-	(*ComponentInfo)(nil),            // 17: mcp.v1.ComponentInfo
-	(*ListServicesResponse)(nil),     // 18: mcp.v1.ListServicesResponse
-	(*GetServiceStatusRequest)(nil),  // 19: mcp.v1.GetServiceStatusRequest
-	(*DriftInfo)(nil),                // 20: mcp.v1.DriftInfo
-	(*EventInfo)(nil),                // 21: mcp.v1.EventInfo
-	(*GetServiceStatusResponse)(nil), // 22: mcp.v1.GetServiceStatusResponse
-	(*LiveCheckRequest)(nil),         // 23: mcp.v1.LiveCheckRequest
-	(*LiveCheckResponse)(nil),        // 24: mcp.v1.LiveCheckResponse
-	(*AdoptContainersRequest)(nil),   // 25: mcp.v1.AdoptContainersRequest
-	(*AdoptResult)(nil),              // 26: mcp.v1.AdoptResult
-	(*AdoptContainersResponse)(nil),  // 27: mcp.v1.AdoptContainersResponse
-	(*PushFileRequest)(nil),          // 28: mcp.v1.PushFileRequest
-	(*PushFileResponse)(nil),         // 29: mcp.v1.PushFileResponse
-	(*PullFileRequest)(nil),          // 30: mcp.v1.PullFileRequest
-	(*PullFileResponse)(nil),         // 31: mcp.v1.PullFileResponse
-	(*NodeStatusRequest)(nil),        // 32: mcp.v1.NodeStatusRequest
-	(*NodeStatusResponse)(nil),       // 33: mcp.v1.NodeStatusResponse
-	(*PurgeRequest)(nil),             // 34: mcp.v1.PurgeRequest
-	(*PurgeResponse)(nil),            // 35: mcp.v1.PurgeResponse
-	(*PurgeResult)(nil),              // 36: mcp.v1.PurgeResult
-	(*timestamppb.Timestamp)(nil),    // 37: google.protobuf.Timestamp
+	(*UndeployServiceRequest)(nil),   // 12: mcp.v1.UndeployServiceRequest
+	(*UndeployServiceResponse)(nil),  // 13: mcp.v1.UndeployServiceResponse
+	(*SyncDesiredStateRequest)(nil),  // 14: mcp.v1.SyncDesiredStateRequest
+	(*SyncDesiredStateResponse)(nil), // 15: mcp.v1.SyncDesiredStateResponse
+	(*ServiceSyncResult)(nil),        // 16: mcp.v1.ServiceSyncResult
+	(*ListServicesRequest)(nil),      // 17: mcp.v1.ListServicesRequest
+	(*ServiceInfo)(nil),              // 18: mcp.v1.ServiceInfo
+	(*ComponentInfo)(nil),            // 19: mcp.v1.ComponentInfo
+	(*ListServicesResponse)(nil),     // 20: mcp.v1.ListServicesResponse
+	(*GetServiceStatusRequest)(nil),  // 21: mcp.v1.GetServiceStatusRequest
+	(*DriftInfo)(nil),                // 22: mcp.v1.DriftInfo
+	(*EventInfo)(nil),                // 23: mcp.v1.EventInfo
+	(*GetServiceStatusResponse)(nil), // 24: mcp.v1.GetServiceStatusResponse
+	(*LiveCheckRequest)(nil),         // 25: mcp.v1.LiveCheckRequest
+	(*LiveCheckResponse)(nil),        // 26: mcp.v1.LiveCheckResponse
+	(*AdoptContainersRequest)(nil),   // 27: mcp.v1.AdoptContainersRequest
+	(*AdoptResult)(nil),              // 28: mcp.v1.AdoptResult
+	(*AdoptContainersResponse)(nil),  // 29: mcp.v1.AdoptContainersResponse
+	(*PushFileRequest)(nil),          // 30: mcp.v1.PushFileRequest
+	(*PushFileResponse)(nil),         // 31: mcp.v1.PushFileResponse
+	(*PullFileRequest)(nil),          // 32: mcp.v1.PullFileRequest
+	(*PullFileResponse)(nil),         // 33: mcp.v1.PullFileResponse
+	(*NodeStatusRequest)(nil),        // 34: mcp.v1.NodeStatusRequest
+	(*NodeStatusResponse)(nil),       // 35: mcp.v1.NodeStatusResponse
+	(*PurgeRequest)(nil),             // 36: mcp.v1.PurgeRequest
+	(*PurgeResponse)(nil),            // 37: mcp.v1.PurgeResponse
+	(*PurgeResult)(nil),              // 38: mcp.v1.PurgeResult
+	(*timestamppb.Timestamp)(nil),    // 39: google.protobuf.Timestamp
 }
 var file_proto_mcp_v1_mcp_proto_depIdxs = []int32{
 	0,  // 0: mcp.v1.ComponentSpec.routes:type_name -> mcp.v1.RouteSpec
@@ -2357,50 +2452,53 @@ var file_proto_mcp_v1_mcp_proto_depIdxs = []int32{
 	5,  // 4: mcp.v1.StopServiceResponse.results:type_name -> mcp.v1.ComponentResult
 	5,  // 5: mcp.v1.StartServiceResponse.results:type_name -> mcp.v1.ComponentResult
 	5,  // 6: mcp.v1.RestartServiceResponse.results:type_name -> mcp.v1.ComponentResult
-	2,  // 7: mcp.v1.SyncDesiredStateRequest.services:type_name -> mcp.v1.ServiceSpec
-	14, // 8: mcp.v1.SyncDesiredStateResponse.results:type_name -> mcp.v1.ServiceSyncResult
-	17, // 9: mcp.v1.ServiceInfo.components:type_name -> mcp.v1.ComponentInfo
-	37, // 10: mcp.v1.ComponentInfo.started:type_name -> google.protobuf.Timestamp
-	16, // 11: mcp.v1.ListServicesResponse.services:type_name -> mcp.v1.ServiceInfo
-	37, // 12: mcp.v1.EventInfo.timestamp:type_name -> google.protobuf.Timestamp
-	16, // 13: mcp.v1.GetServiceStatusResponse.services:type_name -> mcp.v1.ServiceInfo
-	20, // 14: mcp.v1.GetServiceStatusResponse.drift:type_name -> mcp.v1.DriftInfo
-	21, // 15: mcp.v1.GetServiceStatusResponse.recent_events:type_name -> mcp.v1.EventInfo
-	16, // 16: mcp.v1.LiveCheckResponse.services:type_name -> mcp.v1.ServiceInfo
-	26, // 17: mcp.v1.AdoptContainersResponse.results:type_name -> mcp.v1.AdoptResult
-	37, // 18: mcp.v1.NodeStatusResponse.uptime_since:type_name -> google.protobuf.Timestamp
-	36, // 19: mcp.v1.PurgeResponse.results:type_name -> mcp.v1.PurgeResult
-	3,  // 20: mcp.v1.McpAgentService.Deploy:input_type -> mcp.v1.DeployRequest
-	6,  // 21: mcp.v1.McpAgentService.StopService:input_type -> mcp.v1.StopServiceRequest
-	8,  // 22: mcp.v1.McpAgentService.StartService:input_type -> mcp.v1.StartServiceRequest
-	10, // 23: mcp.v1.McpAgentService.RestartService:input_type -> mcp.v1.RestartServiceRequest
-	12, // 24: mcp.v1.McpAgentService.SyncDesiredState:input_type -> mcp.v1.SyncDesiredStateRequest
-	15, // 25: mcp.v1.McpAgentService.ListServices:input_type -> mcp.v1.ListServicesRequest
-	19, // 26: mcp.v1.McpAgentService.GetServiceStatus:input_type -> mcp.v1.GetServiceStatusRequest
-	23, // 27: mcp.v1.McpAgentService.LiveCheck:input_type -> mcp.v1.LiveCheckRequest
-	25, // 28: mcp.v1.McpAgentService.AdoptContainers:input_type -> mcp.v1.AdoptContainersRequest
-	34, // 29: mcp.v1.McpAgentService.PurgeComponent:input_type -> mcp.v1.PurgeRequest
-	28, // 30: mcp.v1.McpAgentService.PushFile:input_type -> mcp.v1.PushFileRequest
-	30, // 31: mcp.v1.McpAgentService.PullFile:input_type -> mcp.v1.PullFileRequest
-	32, // 32: mcp.v1.McpAgentService.NodeStatus:input_type -> mcp.v1.NodeStatusRequest
-	4,  // 33: mcp.v1.McpAgentService.Deploy:output_type -> mcp.v1.DeployResponse
-	7,  // 34: mcp.v1.McpAgentService.StopService:output_type -> mcp.v1.StopServiceResponse
-	9,  // 35: mcp.v1.McpAgentService.StartService:output_type -> mcp.v1.StartServiceResponse
-	11, // 36: mcp.v1.McpAgentService.RestartService:output_type -> mcp.v1.RestartServiceResponse
-	13, // 37: mcp.v1.McpAgentService.SyncDesiredState:output_type -> mcp.v1.SyncDesiredStateResponse
-	18, // 38: mcp.v1.McpAgentService.ListServices:output_type -> mcp.v1.ListServicesResponse
-	22, // 39: mcp.v1.McpAgentService.GetServiceStatus:output_type -> mcp.v1.GetServiceStatusResponse
-	24, // 40: mcp.v1.McpAgentService.LiveCheck:output_type -> mcp.v1.LiveCheckResponse
-	27, // 41: mcp.v1.McpAgentService.AdoptContainers:output_type -> mcp.v1.AdoptContainersResponse
-	35, // 42: mcp.v1.McpAgentService.PurgeComponent:output_type -> mcp.v1.PurgeResponse
-	29, // 43: mcp.v1.McpAgentService.PushFile:output_type -> mcp.v1.PushFileResponse
-	31, // 44: mcp.v1.McpAgentService.PullFile:output_type -> mcp.v1.PullFileResponse
-	33, // 45: mcp.v1.McpAgentService.NodeStatus:output_type -> mcp.v1.NodeStatusResponse
-	33, // [33:46] is the sub-list for method output_type
-	20, // [20:33] is the sub-list for method input_type
-	20, // [20:20] is the sub-list for extension type_name
-	20, // [20:20] is the sub-list for extension extendee
-	0,  // [0:20] is the sub-list for field type_name
+	5,  // 7: mcp.v1.UndeployServiceResponse.results:type_name -> mcp.v1.ComponentResult
+	2,  // 8: mcp.v1.SyncDesiredStateRequest.services:type_name -> mcp.v1.ServiceSpec
+	16, // 9: mcp.v1.SyncDesiredStateResponse.results:type_name -> mcp.v1.ServiceSyncResult
+	19, // 10: mcp.v1.ServiceInfo.components:type_name -> mcp.v1.ComponentInfo
+	39, // 11: mcp.v1.ComponentInfo.started:type_name -> google.protobuf.Timestamp
+	18, // 12: mcp.v1.ListServicesResponse.services:type_name -> mcp.v1.ServiceInfo
+	39, // 13: mcp.v1.EventInfo.timestamp:type_name -> google.protobuf.Timestamp
+	18, // 14: mcp.v1.GetServiceStatusResponse.services:type_name -> mcp.v1.ServiceInfo
+	22, // 15: mcp.v1.GetServiceStatusResponse.drift:type_name -> mcp.v1.DriftInfo
+	23, // 16: mcp.v1.GetServiceStatusResponse.recent_events:type_name -> mcp.v1.EventInfo
+	18, // 17: mcp.v1.LiveCheckResponse.services:type_name -> mcp.v1.ServiceInfo
+	28, // 18: mcp.v1.AdoptContainersResponse.results:type_name -> mcp.v1.AdoptResult
+	39, // 19: mcp.v1.NodeStatusResponse.uptime_since:type_name -> google.protobuf.Timestamp
+	38, // 20: mcp.v1.PurgeResponse.results:type_name -> mcp.v1.PurgeResult
+	3,  // 21: mcp.v1.McpAgentService.Deploy:input_type -> mcp.v1.DeployRequest
+	12, // 22: mcp.v1.McpAgentService.UndeployService:input_type -> mcp.v1.UndeployServiceRequest
+	6,  // 23: mcp.v1.McpAgentService.StopService:input_type -> mcp.v1.StopServiceRequest
+	8,  // 24: mcp.v1.McpAgentService.StartService:input_type -> mcp.v1.StartServiceRequest
+	10, // 25: mcp.v1.McpAgentService.RestartService:input_type -> mcp.v1.RestartServiceRequest
+	14, // 26: mcp.v1.McpAgentService.SyncDesiredState:input_type -> mcp.v1.SyncDesiredStateRequest
+	17, // 27: mcp.v1.McpAgentService.ListServices:input_type -> mcp.v1.ListServicesRequest
+	21, // 28: mcp.v1.McpAgentService.GetServiceStatus:input_type -> mcp.v1.GetServiceStatusRequest
+	25, // 29: mcp.v1.McpAgentService.LiveCheck:input_type -> mcp.v1.LiveCheckRequest
+	27, // 30: mcp.v1.McpAgentService.AdoptContainers:input_type -> mcp.v1.AdoptContainersRequest
+	36, // 31: mcp.v1.McpAgentService.PurgeComponent:input_type -> mcp.v1.PurgeRequest
+	30, // 32: mcp.v1.McpAgentService.PushFile:input_type -> mcp.v1.PushFileRequest
+	32, // 33: mcp.v1.McpAgentService.PullFile:input_type -> mcp.v1.PullFileRequest
+	34, // 34: mcp.v1.McpAgentService.NodeStatus:input_type -> mcp.v1.NodeStatusRequest
+	4,  // 35: mcp.v1.McpAgentService.Deploy:output_type -> mcp.v1.DeployResponse
+	13, // 36: mcp.v1.McpAgentService.UndeployService:output_type -> mcp.v1.UndeployServiceResponse
+	7,  // 37: mcp.v1.McpAgentService.StopService:output_type -> mcp.v1.StopServiceResponse
+	9,  // 38: mcp.v1.McpAgentService.StartService:output_type -> mcp.v1.StartServiceResponse
+	11, // 39: mcp.v1.McpAgentService.RestartService:output_type -> mcp.v1.RestartServiceResponse
+	15, // 40: mcp.v1.McpAgentService.SyncDesiredState:output_type -> mcp.v1.SyncDesiredStateResponse
+	20, // 41: mcp.v1.McpAgentService.ListServices:output_type -> mcp.v1.ListServicesResponse
+	24, // 42: mcp.v1.McpAgentService.GetServiceStatus:output_type -> mcp.v1.GetServiceStatusResponse
+	26, // 43: mcp.v1.McpAgentService.LiveCheck:output_type -> mcp.v1.LiveCheckResponse
+	29, // 44: mcp.v1.McpAgentService.AdoptContainers:output_type -> mcp.v1.AdoptContainersResponse
+	37, // 45: mcp.v1.McpAgentService.PurgeComponent:output_type -> mcp.v1.PurgeResponse
+	31, // 46: mcp.v1.McpAgentService.PushFile:output_type -> mcp.v1.PushFileResponse
+	33, // 47: mcp.v1.McpAgentService.PullFile:output_type -> mcp.v1.PullFileResponse
+	35, // 48: mcp.v1.McpAgentService.NodeStatus:output_type -> mcp.v1.NodeStatusResponse
+	35, // [35:49] is the sub-list for method output_type
+	21, // [21:35] is the sub-list for method input_type
+	21, // [21:21] is the sub-list for extension type_name
+	21, // [21:21] is the sub-list for extension extendee
+	0,  // [0:21] is the sub-list for field type_name
 }

 func init() { file_proto_mcp_v1_mcp_proto_init() }
@@ -2414,7 +2512,7 @@ func file_proto_mcp_v1_mcp_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_proto_mcp_v1_mcp_proto_rawDesc), len(file_proto_mcp_v1_mcp_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   37,
+			NumMessages:   39,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
--- a/gen/mcp/v1/mcp_grpc.pb.go
+++ b/gen/mcp/v1/mcp_grpc.pb.go
@@ -20,6 +20,7 @@ const _ = grpc.SupportPackageIsVersion9

 const (
 	McpAgentService_Deploy_FullMethodName           = "/mcp.v1.McpAgentService/Deploy"
+	McpAgentService_UndeployService_FullMethodName  = "/mcp.v1.McpAgentService/UndeployService"
 	McpAgentService_StopService_FullMethodName      = "/mcp.v1.McpAgentService/StopService"
 	McpAgentService_StartService_FullMethodName     = "/mcp.v1.McpAgentService/StartService"
 	McpAgentService_RestartService_FullMethodName   = "/mcp.v1.McpAgentService/RestartService"
@@ -40,6 +41,7 @@ const (
 type McpAgentServiceClient interface {
 	// Service lifecycle
 	Deploy(ctx context.Context, in *DeployRequest, opts ...grpc.CallOption) (*DeployResponse, error)
+	UndeployService(ctx context.Context, in *UndeployServiceRequest, opts ...grpc.CallOption) (*UndeployServiceResponse, error)
 	StopService(ctx context.Context, in *StopServiceRequest, opts ...grpc.CallOption) (*StopServiceResponse, error)
 	StartService(ctx context.Context, in *StartServiceRequest, opts ...grpc.CallOption) (*StartServiceResponse, error)
 	RestartService(ctx context.Context, in *RestartServiceRequest, opts ...grpc.CallOption) (*RestartServiceResponse, error)
@@ -78,6 +80,16 @@ func (c *mcpAgentServiceClient) Deploy(ctx context.Context, in *DeployRequest, o
 	return out, nil
 }

+func (c *mcpAgentServiceClient) UndeployService(ctx context.Context, in *UndeployServiceRequest, opts ...grpc.CallOption) (*UndeployServiceResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(UndeployServiceResponse)
+	err := c.cc.Invoke(ctx, McpAgentService_UndeployService_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *mcpAgentServiceClient) StopService(ctx context.Context, in *StopServiceRequest, opts ...grpc.CallOption) (*StopServiceResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(StopServiceResponse)
@@ -204,6 +216,7 @@ func (c *mcpAgentServiceClient) NodeStatus(ctx context.Context, in *NodeStatusRe
 type McpAgentServiceServer interface {
 	// Service lifecycle
 	Deploy(context.Context, *DeployRequest) (*DeployResponse, error)
+	UndeployService(context.Context, *UndeployServiceRequest) (*UndeployServiceResponse, error)
 	StopService(context.Context, *StopServiceRequest) (*StopServiceResponse, error)
 	StartService(context.Context, *StartServiceRequest) (*StartServiceResponse, error)
 	RestartService(context.Context, *RestartServiceRequest) (*RestartServiceResponse, error)
@@ -235,6 +248,9 @@ type UnimplementedMcpAgentServiceServer struct{}
 func (UnimplementedMcpAgentServiceServer) Deploy(context.Context, *DeployRequest) (*DeployResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method Deploy not implemented")
 }
+func (UnimplementedMcpAgentServiceServer) UndeployService(context.Context, *UndeployServiceRequest) (*UndeployServiceResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method UndeployService not implemented")
+}
 func (UnimplementedMcpAgentServiceServer) StopService(context.Context, *StopServiceRequest) (*StopServiceResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method StopService not implemented")
 }
@@ -310,6 +326,24 @@ func _McpAgentService_Deploy_Handler(srv interface{}, ctx context.Context, dec f
 	return interceptor(ctx, in, info, handler)
 }

+func _McpAgentService_UndeployService_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UndeployServiceRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(McpAgentServiceServer).UndeployService(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: McpAgentService_UndeployService_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(McpAgentServiceServer).UndeployService(ctx, req.(*UndeployServiceRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _McpAgentService_StopService_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(StopServiceRequest)
 	if err := dec(in); err != nil {
@@ -537,6 +571,10 @@ var McpAgentService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "Deploy",
 			Handler:    _McpAgentService_Deploy_Handler,
 		},
+		{
+			MethodName: "UndeployService",
+			Handler:    _McpAgentService_UndeployService_Handler,
+		},
 		{
 			MethodName: "StopService",
 			Handler:    _McpAgentService_StopService_Handler,
--- a/internal/agent/agent.go
+++ b/internal/agent/agent.go
@@ -34,6 +34,7 @@ type Agent struct {
 	PortAlloc *PortAllocator
 	Proxy     *ProxyRouter
 	Certs     *CertProvisioner
+	DNS       *DNSRegistrar
 }

 // Run starts the agent: opens the database, sets up the gRPC server with
@@ -63,6 +64,11 @@ func Run(cfg *config.AgentConfig) error {
 		return fmt.Errorf("create cert provisioner: %w", err)
 	}

+	dns, err := NewDNSRegistrar(cfg.MCNS, logger)
+	if err != nil {
+		return fmt.Errorf("create DNS registrar: %w", err)
+	}
+
 	a := &Agent{
 		Config:    cfg,
 		DB:        db,
@@ -72,6 +78,7 @@ func Run(cfg *config.AgentConfig) error {
 		PortAlloc: NewPortAllocator(),
 		Proxy:     proxy,
 		Certs:     certs,
+		DNS:       dns,
 	}

 	tlsCert, err := tls.LoadX509KeyPair(cfg.Server.TLSCert, cfg.Server.TLSKey)
--- a/internal/agent/certs.go
+++ b/internal/agent/certs.go
@@ -176,6 +176,25 @@ func (p *CertProvisioner) issueCert(ctx context.Context, serviceName, commonName
 	return nil
 }

+// RemoveCert removes TLS certificate and key files for a service.
+func (p *CertProvisioner) RemoveCert(serviceName string) error {
+	if p == nil {
+		return nil
+	}
+
+	certPath := filepath.Join(p.certDir, serviceName+".pem")
+	keyPath := filepath.Join(p.certDir, serviceName+".key")
+
+	for _, path := range []string{certPath, keyPath} {
+		if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
+			return fmt.Errorf("remove %s: %w", path, err)
+		}
+	}
+
+	p.logger.Info("cert removed", "service", serviceName)
+	return nil
+}
+
 // certTimeRemaining returns the time until the leaf certificate at
 // path expires. Returns (0, false) if the cert cannot be read or parsed.
 func certTimeRemaining(path string) (time.Duration, bool) {
--- a/internal/agent/deploy.go
+++ b/internal/agent/deploy.go
@@ -164,6 +164,13 @@ func (a *Agent) deployComponent(ctx context.Context, serviceName string, cs *mcp
 		}
 	}

+	// Register DNS record for the service.
+	if a.DNS != nil && len(regRoutes) > 0 {
+		if err := a.DNS.EnsureRecord(ctx, serviceName); err != nil {
+			a.Logger.Warn("failed to register DNS record", "service", serviceName, "err", err)
+		}
+	}
+
 	if err := registry.UpdateComponentState(a.DB, serviceName, compName, "running", "running"); err != nil {
 		a.Logger.Warn("failed to update component state", "service", serviceName, "component", compName, "err", err)
 	}
@@ -191,7 +198,10 @@ func (a *Agent) allocateRoutePorts(service, component string, routes []registry.
 			return nil, nil, fmt.Errorf("store host port for route %q: %w", r.Name, err)
 		}

-		ports = append(ports, fmt.Sprintf("127.0.0.1:%d:%d", hostPort, r.Port))
+		// The container port must match hostPort (which is also set as $PORT),
+		// so the app's listen address matches the podman port mapping.
+		// r.Port is the mc-proxy listener port, NOT the container port.
+		ports = append(ports, fmt.Sprintf("127.0.0.1:%d:%d", hostPort, hostPort))

 		if len(routes) == 1 {
 			env = append(env, fmt.Sprintf("PORT=%d", hostPort))
--- a/internal/agent/deploy_test.go
+++ b/internal/agent/deploy_test.go
@@ -0,0 +1,159 @@
+package agent
+
+import (
+	"database/sql"
+	"fmt"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"git.wntrmute.dev/mc/mcp/internal/registry"
+)
+
+func openTestDB(t *testing.T) *sql.DB {
+	t.Helper()
+	db, err := registry.Open(filepath.Join(t.TempDir(), "test.db"))
+	if err != nil {
+		t.Fatalf("open db: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+	return db
+}
+
+func testAgent(t *testing.T) *Agent {
+	t.Helper()
+	return &Agent{
+		DB:        openTestDB(t),
+		PortAlloc: NewPortAllocator(),
+		Logger:    slog.New(slog.NewTextHandler(os.Stderr, nil)),
+	}
+}
+
+// seedComponent creates the service and component in the registry so that
+// allocateRoutePorts can store host ports for it.
+func seedComponent(t *testing.T, db *sql.DB, service, component string, routes []registry.Route) {
+	t.Helper()
+	if err := registry.CreateService(db, service, true); err != nil {
+		t.Fatalf("create service: %v", err)
+	}
+	if err := registry.CreateComponent(db, &registry.Component{
+		Name:          component,
+		Service:       service,
+		Image:         "img:latest",
+		DesiredState:  "running",
+		ObservedState: "unknown",
+		Routes:        routes,
+	}); err != nil {
+		t.Fatalf("create component: %v", err)
+	}
+}
+
+func TestAllocateRoutePorts_SingleRoute(t *testing.T) {
+	a := testAgent(t)
+	routes := []registry.Route{
+		{Name: "default", Port: 443, Mode: "l7"},
+	}
+	seedComponent(t, a.DB, "mcdoc", "mcdoc", routes)
+
+	ports, env, err := a.allocateRoutePorts("mcdoc", "mcdoc", routes)
+	if err != nil {
+		t.Fatalf("allocateRoutePorts: %v", err)
+	}
+
+	if len(ports) != 1 {
+		t.Fatalf("expected 1 port mapping, got %d", len(ports))
+	}
+	if len(env) != 1 {
+		t.Fatalf("expected 1 env var, got %d", len(env))
+	}
+
+	// Parse the port mapping: should be "127.0.0.1:<hostPort>:<hostPort>"
+	// NOT "127.0.0.1:<hostPort>:443"
+	var hostPort, containerPort int
+	n, _ := fmt.Sscanf(ports[0], "127.0.0.1:%d:%d", &hostPort, &containerPort)
+	if n != 2 {
+		t.Fatalf("failed to parse port mapping %q", ports[0])
+	}
+	if hostPort != containerPort {
+		t.Errorf("host port (%d) != container port (%d); container port must match host port for $PORT consistency", hostPort, containerPort)
+	}
+
+	// Env var should be PORT=<hostPort>
+	var envPort int
+	n, _ = fmt.Sscanf(env[0], "PORT=%d", &envPort)
+	if n != 1 {
+		t.Fatalf("failed to parse env var %q", env[0])
+	}
+	if envPort != hostPort {
+		t.Errorf("PORT env (%d) != host port (%d)", envPort, hostPort)
+	}
+}
+
+func TestAllocateRoutePorts_MultiRoute(t *testing.T) {
+	a := testAgent(t)
+	routes := []registry.Route{
+		{Name: "rest", Port: 8443, Mode: "l4"},
+		{Name: "grpc", Port: 9443, Mode: "l4"},
+	}
+	seedComponent(t, a.DB, "metacrypt", "api", routes)
+
+	ports, env, err := a.allocateRoutePorts("metacrypt", "api", routes)
+	if err != nil {
+		t.Fatalf("allocateRoutePorts: %v", err)
+	}
+
+	if len(ports) != 2 {
+		t.Fatalf("expected 2 port mappings, got %d", len(ports))
+	}
+	if len(env) != 2 {
+		t.Fatalf("expected 2 env vars, got %d", len(env))
+	}
+
+	// Each port mapping should have host port == container port.
+	for i, p := range ports {
+		var hp, cp int
+		n, _ := fmt.Sscanf(p, "127.0.0.1:%d:%d", &hp, &cp)
+		if n != 2 {
+			t.Fatalf("port[%d]: failed to parse %q", i, p)
+		}
+		if hp != cp {
+			t.Errorf("port[%d]: host port (%d) != container port (%d)", i, hp, cp)
+		}
+	}
+
+	// Env vars should be PORT_REST and PORT_GRPC (not bare PORT).
+	if env[0][:10] != "PORT_REST=" {
+		t.Errorf("env[0] = %q, want PORT_REST=...", env[0])
+	}
+	if env[1][:10] != "PORT_GRPC=" {
+		t.Errorf("env[1] = %q, want PORT_GRPC=...", env[1])
+	}
+}
+
+func TestAllocateRoutePorts_L7PortNotUsedAsContainerPort(t *testing.T) {
+	a := testAgent(t)
+	routes := []registry.Route{
+		{Name: "default", Port: 443, Mode: "l7"},
+	}
+	seedComponent(t, a.DB, "svc", "web", routes)
+
+	ports, _, err := a.allocateRoutePorts("svc", "web", routes)
+	if err != nil {
+		t.Fatalf("allocateRoutePorts: %v", err)
+	}
+
+	// The container port must NOT be 443 (the mc-proxy listener port).
+	// It must be the host port (which is in range 10000-60000).
+	var hostPort, containerPort int
+	n, _ := fmt.Sscanf(ports[0], "127.0.0.1:%d:%d", &hostPort, &containerPort)
+	if n != 2 {
+		t.Fatalf("failed to parse port mapping %q", ports[0])
+	}
+	if containerPort == 443 {
+		t.Errorf("container port is 443 (mc-proxy listener); should be %d (host port)", hostPort)
+	}
+	if containerPort < portRangeMin || containerPort >= portRangeMax {
+		t.Errorf("container port %d outside allocation range [%d, %d)", containerPort, portRangeMin, portRangeMax)
+	}
+}
--- a/internal/agent/dns.go
+++ b/internal/agent/dns.go
@@ -0,0 +1,265 @@
+package agent
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"strings"
+
+	"git.wntrmute.dev/mc/mcp/internal/auth"
+	"git.wntrmute.dev/mc/mcp/internal/config"
+)
+
+// DNSRegistrar creates and removes A records in MCNS during deploy
+// and stop. It is nil-safe: all methods are no-ops when the receiver
+// is nil.
+type DNSRegistrar struct {
+	serverURL  string
+	token      string
+	zone       string
+	nodeAddr   string
+	httpClient *http.Client
+	logger     *slog.Logger
+}
+
+// dnsRecord is the JSON representation of an MCNS record.
+type dnsRecord struct {
+	ID    int    `json:"ID"`
+	Name  string `json:"Name"`
+	Type  string `json:"Type"`
+	Value string `json:"Value"`
+	TTL   int    `json:"TTL"`
+}
+
+// NewDNSRegistrar creates a DNSRegistrar. Returns (nil, nil) if
+// cfg.ServerURL is empty (DNS registration disabled).
+func NewDNSRegistrar(cfg config.MCNSConfig, logger *slog.Logger) (*DNSRegistrar, error) {
+	if cfg.ServerURL == "" {
+		logger.Info("mcns not configured, DNS registration disabled")
+		return nil, nil
+	}
+
+	token, err := auth.LoadToken(cfg.TokenPath)
+	if err != nil {
+		return nil, fmt.Errorf("load mcns token: %w", err)
+	}
+
+	httpClient, err := newTLSClient(cfg.CACert)
+	if err != nil {
+		return nil, fmt.Errorf("create mcns HTTP client: %w", err)
+	}
+
+	logger.Info("mcns DNS registrar enabled", "server", cfg.ServerURL, "zone", cfg.Zone, "node_addr", cfg.NodeAddr)
+	return &DNSRegistrar{
+		serverURL:  strings.TrimRight(cfg.ServerURL, "/"),
+		token:      token,
+		zone:       cfg.Zone,
+		nodeAddr:   cfg.NodeAddr,
+		httpClient: httpClient,
+		logger:     logger,
+	}, nil
+}
+
+// EnsureRecord ensures an A record exists for the service in the
+// configured zone, pointing to the node's address.
+func (d *DNSRegistrar) EnsureRecord(ctx context.Context, serviceName string) error {
+	if d == nil {
+		return nil
+	}
+
+	existing, err := d.listRecords(ctx, serviceName)
+	if err != nil {
+		return fmt.Errorf("list DNS records: %w", err)
+	}
+
+	// Check if any existing record already has the correct value.
+	for _, r := range existing {
+		if r.Value == d.nodeAddr {
+			d.logger.Debug("DNS record exists, skipping",
+				"service", serviceName,
+				"record", r.Name+"."+d.zone,
+				"value", r.Value,
+			)
+			return nil
+		}
+	}
+
+	// No record with the correct value — update the first one if it exists.
+	if len(existing) > 0 {
+		d.logger.Info("updating DNS record",
+			"service", serviceName,
+			"old_value", existing[0].Value,
+			"new_value", d.nodeAddr,
+		)
+		return d.updateRecord(ctx, existing[0].ID, serviceName)
+	}
+
+	// No existing record — create one.
+	d.logger.Info("creating DNS record",
+		"service", serviceName,
+		"record", serviceName+"."+d.zone,
+		"value", d.nodeAddr,
+	)
+	return d.createRecord(ctx, serviceName)
+}
+
+// RemoveRecord removes A records for the service from the configured zone.
+func (d *DNSRegistrar) RemoveRecord(ctx context.Context, serviceName string) error {
+	if d == nil {
+		return nil
+	}
+
+	existing, err := d.listRecords(ctx, serviceName)
+	if err != nil {
+		return fmt.Errorf("list DNS records: %w", err)
+	}
+
+	if len(existing) == 0 {
+		d.logger.Debug("no DNS record to remove", "service", serviceName)
+		return nil
+	}
+
+	for _, r := range existing {
+		d.logger.Info("removing DNS record",
+			"service", serviceName,
+			"record", r.Name+"."+d.zone,
+			"id", r.ID,
+		)
+		if err := d.deleteRecord(ctx, r.ID); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// listRecords returns A records matching the service name in the zone.
+func (d *DNSRegistrar) listRecords(ctx context.Context, serviceName string) ([]dnsRecord, error) {
+	url := fmt.Sprintf("%s/v1/zones/%s/records?name=%s&type=A", d.serverURL, d.zone, serviceName)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return nil, fmt.Errorf("create list request: %w", err)
+	}
+	req.Header.Set("Authorization", "Bearer "+d.token)
+
+	resp, err := d.httpClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("list records: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("read list response: %w", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("list records: mcns returned %d: %s", resp.StatusCode, string(body))
+	}
+
+	var envelope struct {
+		Records []dnsRecord `json:"records"`
+	}
+	if err := json.Unmarshal(body, &envelope); err != nil {
+		return nil, fmt.Errorf("parse list response: %w", err)
+	}
+	return envelope.Records, nil
+}
+
+// createRecord creates an A record in the zone.
+func (d *DNSRegistrar) createRecord(ctx context.Context, serviceName string) error {
+	reqBody := map[string]interface{}{
+		"name":  serviceName,
+		"type":  "A",
+		"value": d.nodeAddr,
+		"ttl":   300,
+	}
+
+	body, err := json.Marshal(reqBody)
+	if err != nil {
+		return fmt.Errorf("marshal create request: %w", err)
+	}
+
+	url := fmt.Sprintf("%s/v1/zones/%s/records", d.serverURL, d.zone)
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(body))
+	if err != nil {
+		return fmt.Errorf("create record request: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer "+d.token)
+
+	resp, err := d.httpClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("create record: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusCreated && resp.StatusCode != http.StatusOK {
+		respBody, _ := io.ReadAll(resp.Body)
+		return fmt.Errorf("create record: mcns returned %d: %s", resp.StatusCode, string(respBody))
+	}
+
+	return nil
+}
+
+// updateRecord updates an existing record's value.
+func (d *DNSRegistrar) updateRecord(ctx context.Context, recordID int, serviceName string) error {
+	reqBody := map[string]interface{}{
+		"name":  serviceName,
+		"type":  "A",
+		"value": d.nodeAddr,
+		"ttl":   300,
+	}
+
+	body, err := json.Marshal(reqBody)
+	if err != nil {
+		return fmt.Errorf("marshal update request: %w", err)
+	}
+
+	url := fmt.Sprintf("%s/v1/zones/%s/records/%d", d.serverURL, d.zone, recordID)
+	req, err := http.NewRequestWithContext(ctx, http.MethodPut, url, bytes.NewReader(body))
+	if err != nil {
+		return fmt.Errorf("create update request: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer "+d.token)
+
+	resp, err := d.httpClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("update record: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusOK {
+		respBody, _ := io.ReadAll(resp.Body)
+		return fmt.Errorf("update record: mcns returned %d: %s", resp.StatusCode, string(respBody))
+	}
+
+	return nil
+}
+
+// deleteRecord deletes a record by ID.
+func (d *DNSRegistrar) deleteRecord(ctx context.Context, recordID int) error {
+	url := fmt.Sprintf("%s/v1/zones/%s/records/%d", d.serverURL, d.zone, recordID)
+	req, err := http.NewRequestWithContext(ctx, http.MethodDelete, url, nil)
+	if err != nil {
+		return fmt.Errorf("create delete request: %w", err)
+	}
+	req.Header.Set("Authorization", "Bearer "+d.token)
+
+	resp, err := d.httpClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("delete record: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusNoContent && resp.StatusCode != http.StatusOK {
+		respBody, _ := io.ReadAll(resp.Body)
+		return fmt.Errorf("delete record: mcns returned %d: %s", resp.StatusCode, string(respBody))
+	}
+
+	return nil
+}
--- a/internal/agent/dns_test.go
+++ b/internal/agent/dns_test.go
@@ -0,0 +1,214 @@
+package agent
+
+import (
+	"context"
+	"encoding/json"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"git.wntrmute.dev/mc/mcp/internal/config"
+)
+
+func TestNilDNSRegistrarIsNoop(t *testing.T) {
+	var d *DNSRegistrar
+	if err := d.EnsureRecord(context.Background(), "svc"); err != nil {
+		t.Fatalf("EnsureRecord on nil: %v", err)
+	}
+	if err := d.RemoveRecord(context.Background(), "svc"); err != nil {
+		t.Fatalf("RemoveRecord on nil: %v", err)
+	}
+}
+
+func TestNewDNSRegistrarDisabledWhenUnconfigured(t *testing.T) {
+	d, err := NewDNSRegistrar(config.MCNSConfig{}, slog.Default())
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if d != nil {
+		t.Fatal("expected nil registrar for empty config")
+	}
+}
+
+func TestEnsureRecordCreatesWhenMissing(t *testing.T) {
+	var gotMethod, gotPath, gotAuth string
+	var gotBody map[string]interface{}
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodGet {
+			// List returns empty — no existing records.
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = w.Write([]byte(`{"records":[]}`))
+			return
+		}
+		gotMethod = r.Method
+		gotPath = r.URL.Path
+		gotAuth = r.Header.Get("Authorization")
+		_ = json.NewDecoder(r.Body).Decode(&gotBody)
+		w.WriteHeader(http.StatusCreated)
+		_, _ = w.Write([]byte(`{"id":1}`))
+	}))
+	defer srv.Close()
+
+	d := &DNSRegistrar{
+		serverURL:  srv.URL,
+		token:      "test-token",
+		zone:       "svc.mcp.metacircular.net",
+		nodeAddr:   "192.168.88.181",
+		httpClient: srv.Client(),
+		logger:     slog.Default(),
+	}
+
+	if err := d.EnsureRecord(context.Background(), "myservice"); err != nil {
+		t.Fatalf("EnsureRecord: %v", err)
+	}
+
+	if gotMethod != http.MethodPost {
+		t.Fatalf("method: got %q, want POST", gotMethod)
+	}
+	if gotPath != "/v1/zones/svc.mcp.metacircular.net/records" {
+		t.Fatalf("path: got %q", gotPath)
+	}
+	if gotAuth != "Bearer test-token" {
+		t.Fatalf("auth: got %q", gotAuth)
+	}
+	if gotBody["name"] != "myservice" {
+		t.Fatalf("name: got %v", gotBody["name"])
+	}
+	if gotBody["type"] != "A" {
+		t.Fatalf("type: got %v", gotBody["type"])
+	}
+	if gotBody["value"] != "192.168.88.181" {
+		t.Fatalf("value: got %v", gotBody["value"])
+	}
+}
+
+func TestEnsureRecordSkipsWhenExists(t *testing.T) {
+	createCalled := false
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodGet {
+			// Return an existing record with the correct value.
+			resp := map[string][]dnsRecord{"records": {{ID: 1, Name: "myservice", Type: "A", Value: "192.168.88.181", TTL: 300}}}
+			w.Header().Set("Content-Type", "application/json")
+			_ = json.NewEncoder(w).Encode(resp)
+			return
+		}
+		createCalled = true
+		w.WriteHeader(http.StatusCreated)
+	}))
+	defer srv.Close()
+
+	d := &DNSRegistrar{
+		serverURL:  srv.URL,
+		token:      "test-token",
+		zone:       "svc.mcp.metacircular.net",
+		nodeAddr:   "192.168.88.181",
+		httpClient: srv.Client(),
+		logger:     slog.Default(),
+	}
+
+	if err := d.EnsureRecord(context.Background(), "myservice"); err != nil {
+		t.Fatalf("EnsureRecord: %v", err)
+	}
+	if createCalled {
+		t.Fatal("should not create when record already exists with correct value")
+	}
+}
+
+func TestEnsureRecordUpdatesWrongValue(t *testing.T) {
+	var gotMethod string
+	var gotPath string
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodGet {
+			// Return a record with a stale value.
+			resp := map[string][]dnsRecord{"records": {{ID: 42, Name: "myservice", Type: "A", Value: "10.0.0.1", TTL: 300}}}
+			w.Header().Set("Content-Type", "application/json")
+			_ = json.NewEncoder(w).Encode(resp)
+			return
+		}
+		gotMethod = r.Method
+		gotPath = r.URL.Path
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	d := &DNSRegistrar{
+		serverURL:  srv.URL,
+		token:      "test-token",
+		zone:       "svc.mcp.metacircular.net",
+		nodeAddr:   "192.168.88.181",
+		httpClient: srv.Client(),
+		logger:     slog.Default(),
+	}
+
+	if err := d.EnsureRecord(context.Background(), "myservice"); err != nil {
+		t.Fatalf("EnsureRecord: %v", err)
+	}
+	if gotMethod != http.MethodPut {
+		t.Fatalf("method: got %q, want PUT", gotMethod)
+	}
+	if gotPath != "/v1/zones/svc.mcp.metacircular.net/records/42" {
+		t.Fatalf("path: got %q", gotPath)
+	}
+}
+
+func TestRemoveRecordDeletes(t *testing.T) {
+	var gotMethod, gotPath string
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodGet {
+			resp := map[string][]dnsRecord{"records": {{ID: 7, Name: "myservice", Type: "A", Value: "192.168.88.181", TTL: 300}}}
+			w.Header().Set("Content-Type", "application/json")
+			_ = json.NewEncoder(w).Encode(resp)
+			return
+		}
+		gotMethod = r.Method
+		gotPath = r.URL.Path
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	defer srv.Close()
+
+	d := &DNSRegistrar{
+		serverURL:  srv.URL,
+		token:      "test-token",
+		zone:       "svc.mcp.metacircular.net",
+		nodeAddr:   "192.168.88.181",
+		httpClient: srv.Client(),
+		logger:     slog.Default(),
+	}
+
+	if err := d.RemoveRecord(context.Background(), "myservice"); err != nil {
+		t.Fatalf("RemoveRecord: %v", err)
+	}
+	if gotMethod != http.MethodDelete {
+		t.Fatalf("method: got %q, want DELETE", gotMethod)
+	}
+	if gotPath != "/v1/zones/svc.mcp.metacircular.net/records/7" {
+		t.Fatalf("path: got %q", gotPath)
+	}
+}
+
+func TestRemoveRecordNoopWhenMissing(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// List returns empty.
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"records":[]}`))
+	}))
+	defer srv.Close()
+
+	d := &DNSRegistrar{
+		serverURL:  srv.URL,
+		token:      "test-token",
+		zone:       "svc.mcp.metacircular.net",
+		nodeAddr:   "192.168.88.181",
+		httpClient: srv.Client(),
+		logger:     slog.Default(),
+	}
+
+	if err := d.RemoveRecord(context.Background(), "myservice"); err != nil {
+		t.Fatalf("RemoveRecord: %v", err)
+	}
+}
--- a/internal/agent/lifecycle.go
+++ b/internal/agent/lifecycle.go
@@ -37,6 +37,13 @@ func (a *Agent) StopService(ctx context.Context, req *mcpv1.StopServiceRequest)
 			}
 		}

+		// Remove DNS record when stopping the service.
+		if len(c.Routes) > 0 && a.DNS != nil {
+			if err := a.DNS.RemoveRecord(ctx, req.GetName()); err != nil {
+				a.Logger.Warn("failed to remove DNS record", "service", req.GetName(), "err", err)
+			}
+		}
+
 		if err := a.Runtime.Stop(ctx, containerName); err != nil {
 			a.Logger.Info("stop container (ignored)", "container", containerName, "error", err)
 		}
--- a/internal/agent/sync.go
+++ b/internal/agent/sync.go
@@ -157,6 +157,24 @@ func (a *Agent) reconcileUntracked(ctx context.Context, known map[string]bool) e

 // protoToComponent converts a proto ComponentSpec to a registry Component.
 func protoToComponent(service string, cs *mcpv1.ComponentSpec, desiredState string) *registry.Component {
+	var routes []registry.Route
+	for _, r := range cs.GetRoutes() {
+		mode := r.GetMode()
+		if mode == "" {
+			mode = "l4"
+		}
+		name := r.GetName()
+		if name == "" {
+			name = "default"
+		}
+		routes = append(routes, registry.Route{
+			Name:     name,
+			Port:     int(r.GetPort()),
+			Mode:     mode,
+			Hostname: r.GetHostname(),
+		})
+	}
+
 	return &registry.Component{
 		Name:         cs.GetName(),
 		Service:      service,
@@ -167,6 +185,7 @@ func protoToComponent(service string, cs *mcpv1.ComponentSpec, desiredState stri
 		Ports:        cs.GetPorts(),
 		Volumes:      cs.GetVolumes(),
 		Cmd:          cs.GetCmd(),
+		Routes:       routes,
 		DesiredState: desiredState,
 		Version:      runtime.ExtractVersion(cs.GetImage()),
 	}
--- a/internal/agent/undeploy.go
+++ b/internal/agent/undeploy.go
@@ -0,0 +1,100 @@
+package agent
+
+import (
+	"context"
+	"fmt"
+
+	mcpv1 "git.wntrmute.dev/mc/mcp/gen/mcp/v1"
+	"git.wntrmute.dev/mc/mcp/internal/registry"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+// UndeployService fully tears down a service: removes routes, DNS records,
+// TLS certificates, stops and removes containers, releases ports, and marks
+// the service inactive. This is the inverse of Deploy.
+func (a *Agent) UndeployService(ctx context.Context, req *mcpv1.UndeployServiceRequest) (*mcpv1.UndeployServiceResponse, error) {
+	a.Logger.Info("UndeployService", "service", req.GetName())
+
+	if req.GetName() == "" {
+		return nil, status.Error(codes.InvalidArgument, "service name is required")
+	}
+
+	serviceName := req.GetName()
+
+	components, err := registry.ListComponents(a.DB, serviceName)
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "list components: %v", err)
+	}
+
+	var results []*mcpv1.ComponentResult
+	dnsRemoved := false
+
+	for _, c := range components {
+		r := a.undeployComponent(ctx, serviceName, &c, &dnsRemoved)
+		results = append(results, r)
+	}
+
+	// Mark the service as inactive.
+	if err := registry.UpdateServiceActive(a.DB, serviceName, false); err != nil {
+		a.Logger.Warn("failed to mark service inactive", "service", serviceName, "err", err)
+	}
+
+	return &mcpv1.UndeployServiceResponse{Results: results}, nil
+}
+
+// undeployComponent tears down a single component. The dnsRemoved flag
+// tracks whether DNS has already been removed for this service (DNS is
+// per-service, not per-component).
+func (a *Agent) undeployComponent(ctx context.Context, serviceName string, c *registry.Component, dnsRemoved *bool) *mcpv1.ComponentResult {
+	containerName := ContainerNameFor(serviceName, c.Name)
+	r := &mcpv1.ComponentResult{Name: c.Name, Success: true}
+
+	// 1. Remove mc-proxy routes.
+	if len(c.Routes) > 0 && a.Proxy != nil {
+		if err := a.Proxy.RemoveRoutes(ctx, serviceName, c.Routes); err != nil {
+			a.Logger.Warn("failed to remove routes", "service", serviceName, "component", c.Name, "err", err)
+		}
+	}
+
+	// 2. Remove DNS records (once per service).
+	if len(c.Routes) > 0 && a.DNS != nil && !*dnsRemoved {
+		if err := a.DNS.RemoveRecord(ctx, serviceName); err != nil {
+			a.Logger.Warn("failed to remove DNS record", "service", serviceName, "err", err)
+		}
+		*dnsRemoved = true
+	}
+
+	// 3. Remove TLS certs (L7 routes only).
+	if hasL7Routes(c.Routes) && a.Certs != nil {
+		if err := a.Certs.RemoveCert(serviceName); err != nil {
+			a.Logger.Warn("failed to remove TLS cert", "service", serviceName, "err", err)
+		}
+	}
+
+	// 4. Stop and remove the container.
+	if err := a.Runtime.Stop(ctx, containerName); err != nil {
+		a.Logger.Info("stop container (ignored)", "container", containerName, "error", err)
+	}
+	if err := a.Runtime.Remove(ctx, containerName); err != nil {
+		a.Logger.Info("remove container (ignored)", "container", containerName, "error", err)
+	}
+
+	// 5. Release allocated ports.
+	if a.PortAlloc != nil {
+		hostPorts, err := registry.GetRouteHostPorts(a.DB, serviceName, c.Name)
+		if err == nil {
+			for _, port := range hostPorts {
+				a.PortAlloc.Release(port)
+			}
+		}
+	}
+
+	// 6. Update registry state.
+	if err := registry.UpdateComponentState(a.DB, serviceName, c.Name, "removed", "removed"); err != nil {
+		r.Success = false
+		r.Error = fmt.Sprintf("update state: %v", err)
+	}
+
+	return r
+}
--- a/internal/config/agent.go
+++ b/internal/config/agent.go
@@ -16,6 +16,7 @@ type AgentConfig struct {
 	Agent     AgentSettings   `toml:"agent"`
 	MCProxy   MCProxyConfig   `toml:"mcproxy"`
 	Metacrypt MetacryptConfig `toml:"metacrypt"`
+	MCNS      MCNSConfig      `toml:"mcns"`
 	Monitor   MonitorConfig   `toml:"monitor"`
 	Log       LogConfig       `toml:"log"`
 }
@@ -40,6 +41,26 @@ type MetacryptConfig struct {
 	TokenPath string `toml:"token_path"`
 }

+// MCNSConfig holds the MCNS DNS integration settings for automated
+// DNS record registration. If ServerURL is empty, DNS registration
+// is disabled.
+type MCNSConfig struct {
+	// ServerURL is the MCNS API base URL (e.g. "https://localhost:28443").
+	ServerURL string `toml:"server_url"`
+
+	// CACert is the path to the CA certificate for verifying MCNS's TLS.
+	CACert string `toml:"ca_cert"`
+
+	// TokenPath is the path to the MCIAS service token file.
+	TokenPath string `toml:"token_path"`
+
+	// Zone is the DNS zone for service records. Defaults to "svc.mcp.metacircular.net".
+	Zone string `toml:"zone"`
+
+	// NodeAddr is the IP address to register as the A record value.
+	NodeAddr string `toml:"node_addr"`
+}
+
 // MCProxyConfig holds the mc-proxy connection settings.
 type MCProxyConfig struct {
 	// Socket is the path to the mc-proxy gRPC admin API Unix socket.
@@ -177,6 +198,9 @@ func applyAgentDefaults(cfg *AgentConfig) {
 	if cfg.Metacrypt.Issuer == "" {
 		cfg.Metacrypt.Issuer = "infra"
 	}
+	if cfg.MCNS.Zone == "" {
+		cfg.MCNS.Zone = "svc.mcp.metacircular.net"
+	}
 }

 func applyAgentEnvOverrides(cfg *AgentConfig) {
@@ -213,6 +237,15 @@ func applyAgentEnvOverrides(cfg *AgentConfig) {
 	if v := os.Getenv("MCP_AGENT_METACRYPT_TOKEN_PATH"); v != "" {
 		cfg.Metacrypt.TokenPath = v
 	}
+	if v := os.Getenv("MCP_AGENT_MCNS_SERVER_URL"); v != "" {
+		cfg.MCNS.ServerURL = v
+	}
+	if v := os.Getenv("MCP_AGENT_MCNS_TOKEN_PATH"); v != "" {
+		cfg.MCNS.TokenPath = v
+	}
+	if v := os.Getenv("MCP_AGENT_MCNS_NODE_ADDR"); v != "" {
+		cfg.MCNS.NodeAddr = v
+	}
 }

 func validateAgentConfig(cfg *AgentConfig) error {
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -171,6 +171,11 @@ func TestLoadAgentConfig(t *testing.T) {
 	if cfg.Metacrypt.Issuer != "infra" {
 		t.Fatalf("metacrypt.issuer default: got %q, want infra", cfg.Metacrypt.Issuer)
 	}
+
+	// MCNS defaults when section is omitted.
+	if cfg.MCNS.Zone != "svc.mcp.metacircular.net" {
+		t.Fatalf("mcns.zone default: got %q, want svc.mcp.metacircular.net", cfg.MCNS.Zone)
+	}
 }

 func TestCLIConfigValidation(t *testing.T) {
@@ -521,6 +526,81 @@ node_name = "rift"
 	}
 }

+func TestAgentConfigMCNS(t *testing.T) {
+	cfgStr := `
+[server]
+grpc_addr = "0.0.0.0:9444"
+tls_cert  = "/srv/mcp/cert.pem"
+tls_key   = "/srv/mcp/key.pem"
+[database]
+path = "/srv/mcp/mcp.db"
+[mcias]
+server_url   = "https://mcias.metacircular.net:8443"
+service_name = "mcp-agent"
+[agent]
+node_name = "rift"
+[mcns]
+server_url = "https://localhost:28443"
+ca_cert    = "/srv/mcp/certs/metacircular-ca.pem"
+token_path = "/srv/mcp/metacrypt-token"
+zone       = "custom.zone"
+node_addr  = "10.0.0.1"
+`
+	path := writeTempConfig(t, cfgStr)
+	cfg, err := LoadAgentConfig(path)
+	if err != nil {
+		t.Fatalf("load: %v", err)
+	}
+
+	if cfg.MCNS.ServerURL != "https://localhost:28443" {
+		t.Fatalf("mcns.server_url: got %q", cfg.MCNS.ServerURL)
+	}
+	if cfg.MCNS.CACert != "/srv/mcp/certs/metacircular-ca.pem" {
+		t.Fatalf("mcns.ca_cert: got %q", cfg.MCNS.CACert)
+	}
+	if cfg.MCNS.Zone != "custom.zone" {
+		t.Fatalf("mcns.zone: got %q", cfg.MCNS.Zone)
+	}
+	if cfg.MCNS.NodeAddr != "10.0.0.1" {
+		t.Fatalf("mcns.node_addr: got %q", cfg.MCNS.NodeAddr)
+	}
+}
+
+func TestAgentConfigMCNSEnvOverrides(t *testing.T) {
+	minimal := `
+[server]
+grpc_addr = "0.0.0.0:9444"
+tls_cert  = "/srv/mcp/cert.pem"
+tls_key   = "/srv/mcp/key.pem"
+[database]
+path = "/srv/mcp/mcp.db"
+[mcias]
+server_url   = "https://mcias.metacircular.net:8443"
+service_name = "mcp-agent"
+[agent]
+node_name = "rift"
+`
+	t.Setenv("MCP_AGENT_MCNS_SERVER_URL", "https://override:28443")
+	t.Setenv("MCP_AGENT_MCNS_TOKEN_PATH", "/override/token")
+	t.Setenv("MCP_AGENT_MCNS_NODE_ADDR", "10.0.0.99")
+
+	path := writeTempConfig(t, minimal)
+	cfg, err := LoadAgentConfig(path)
+	if err != nil {
+		t.Fatalf("load: %v", err)
+	}
+
+	if cfg.MCNS.ServerURL != "https://override:28443" {
+		t.Fatalf("mcns.server_url: got %q", cfg.MCNS.ServerURL)
+	}
+	if cfg.MCNS.TokenPath != "/override/token" {
+		t.Fatalf("mcns.token_path: got %q", cfg.MCNS.TokenPath)
+	}
+	if cfg.MCNS.NodeAddr != "10.0.0.99" {
+		t.Fatalf("mcns.node_addr: got %q", cfg.MCNS.NodeAddr)
+	}
+}
+
 func TestDurationParsing(t *testing.T) {
 	tests := []struct {
 		input string
--- a/internal/runtime/podman.go
+++ b/internal/runtime/podman.go
@@ -199,25 +199,27 @@ func (p *Podman) Push(ctx context.Context, image string) error {
 }

 // ImageExists checks whether an image tag exists in a remote registry.
+// Uses skopeo inspect which works for both regular images and multi-arch
+// manifests, unlike podman manifest inspect which only handles manifests.
 func (p *Podman) ImageExists(ctx context.Context, image string) (bool, error) {
-	cmd := exec.CommandContext(ctx, p.command(), "manifest", "inspect", "docker://"+image) //nolint:gosec // args built programmatically
+	cmd := exec.CommandContext(ctx, "skopeo", "inspect", "--tls-verify=false", "docker://"+image) //nolint:gosec // args built programmatically
 	if err := cmd.Run(); err != nil {
-		// Exit code 1 means the manifest was not found.
 		var exitErr *exec.ExitError
-		if ok := errors.As(err, &exitErr); ok && exitErr.ExitCode() == 1 {
+		if ok := errors.As(err, &exitErr); ok && exitErr.ExitCode() != 0 {
 			return false, nil
 		}
-		return false, fmt.Errorf("podman manifest inspect %q: %w", image, err)
+		return false, fmt.Errorf("skopeo inspect %q: %w", image, err)
 	}
 	return true, nil
 }

 // podmanPSEntry is a single entry from podman ps --format json.
 type podmanPSEntry struct {
-	Names   []string `json:"Names"`
-	Image   string   `json:"Image"`
-	State   string   `json:"State"`
-	Command []string `json:"Command"`
+	Names     []string `json:"Names"`
+	Image     string   `json:"Image"`
+	State     string   `json:"State"`
+	Command   []string `json:"Command"`
+	StartedAt int64    `json:"StartedAt"`
 }

 // List returns information about all containers.
@@ -239,12 +241,16 @@ func (p *Podman) List(ctx context.Context) ([]ContainerInfo, error) {
 		if len(e.Names) > 0 {
 			name = e.Names[0]
 		}
-		infos = append(infos, ContainerInfo{
+		info := ContainerInfo{
 			Name:    name,
 			Image:   e.Image,
 			State:   e.State,
 			Version: ExtractVersion(e.Image),
-		})
+		}
+		if e.StartedAt > 0 {
+			info.Started = time.Unix(e.StartedAt, 0)
+		}
+		infos = append(infos, info)
 	}

 	return infos, nil
--- a/internal/runtime/runtime_test.go
+++ b/internal/runtime/runtime_test.go
@@ -90,18 +90,19 @@ func TestBuildRunArgs(t *testing.T) {
 	})

 	t.Run("full spec with env", func(t *testing.T) {
+		// Route-allocated ports: host port = container port (matches $PORT).
 		spec := ContainerSpec{
 			Name:    "svc-api",
 			Image:   "img:latest",
 			Network: "net",
-			Ports:   []string{"127.0.0.1:12345:8443"},
+			Ports:   []string{"127.0.0.1:12345:12345"},
 			Volumes: []string{"/srv:/srv"},
 			Env:     []string{"PORT=12345"},
 		}
 		requireEqualArgs(t, p.BuildRunArgs(spec), []string{
 			"run", "-d", "--name", "svc-api",
 			"--network", "net",
-			"-p", "127.0.0.1:12345:8443",
+			"-p", "127.0.0.1:12345:12345",
 			"-v", "/srv:/srv",
 			"-e", "PORT=12345",
 			"img:latest",
--- a/proto/mcp/v1/mcp.proto
+++ b/proto/mcp/v1/mcp.proto
@@ -8,6 +8,7 @@ import "google/protobuf/timestamp.proto";
 service McpAgentService {
  // Service lifecycle
  rpc Deploy(DeployRequest) returns (DeployResponse);
+  rpc UndeployService(UndeployServiceRequest) returns (UndeployServiceResponse);
  rpc StopService(StopServiceRequest) returns (StopServiceResponse);
  rpc StartService(StartServiceRequest) returns (StartServiceResponse);
  rpc RestartService(RestartServiceRequest) returns (RestartServiceResponse);
@@ -38,7 +39,7 @@ service McpAgentService {

 message RouteSpec {
  string name = 1;      // route name (used for $PORT_<NAME>)
-  int32 port = 2;       // external port on mc-proxy
+  int32 port = 2;       // mc-proxy listener port (e.g. 443, 8443, 9443); NOT the container internal port
  string mode = 3;      // "l4" or "l7"
  string hostname = 4;  // optional public hostname override
 }
@@ -102,6 +103,14 @@ message RestartServiceResponse {
  repeated ComponentResult results = 1;
 }

+message UndeployServiceRequest {
+  string name = 1;
+}
+
+message UndeployServiceResponse {
+  repeated ComponentResult results = 1;
+}
+
 // --- Desired state ---

 message SyncDesiredStateRequest {
Author	SHA1	Message	Date
Kyle Isom	cedba9bf83	Fix mcp ps uptime: parse StartedAt from podman ps JSON List() was not extracting the StartedAt field from podman's JSON output, so LiveCheck always returned zero timestamps and the CLI showed "-" for every container's uptime. podman ps --format json includes StartedAt as a Unix timestamp (int64). Parse it into ContainerInfo.Started so the existing LiveCheck → CLI uptime display chain works. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-27 22:56:39 -07:00
Kyle Isom	f06ab9aeb6	Bump flake version to 0.6.0 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-27 21:46:23 -07:00
Kyle Isom	f932dd64cc	Add undeploy command: full inverse of deploy Implements `mcp undeploy <service>` which tears down all infrastructure for a service: removes mc-proxy routes, DNS records, TLS certificates, stops and removes containers, releases allocated ports, and marks the service inactive. This fills the gap between `stop` (temporary pause) and `purge` (registry cleanup). Undeploy is the complete teardown that returns the node to the state before the service was deployed. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-27 21:45:42 -07:00
Kyle Isom	b2eaa69619	flake: install shell completions for mcp Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-27 21:41:25 -07:00
Kyle Isom	43789dd6be	Fix route-based port mapping: use hostPort as container port allocateRoutePorts() was using the route's port field (the mc-proxy listener port, e.g. 443) as the container internal port in the podman port mapping. For L7 routes, apps don't listen on the mc-proxy port — they read $PORT (set to the assigned host port) and listen on that. The mapping host:53204 → container:443 fails because nothing listens on 443 inside the container. Fix: use hostPort as both the host and container port, so $PORT = host port = container port. Broke mcdoc in production (manually fixed, now permanently fixed). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-27 16:50:48 -07:00
Kyle Isom	2dd0ea93fc	Fix ImageExists to use skopeo instead of podman manifest inspect podman manifest inspect only works for multi-arch manifest lists, returning exit code 125 for regular single-arch images. Switch to skopeo inspect which works for both. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-27 16:49:48 -07:00
Kyle Isom	169b3a0d4a	Fix EnsureRecord to check all existing records before updating When multiple A records exist for a service (e.g., LAN and Tailscale IPs), check all of them for the correct value before attempting an update. Previously only checked the first record, which could trigger a 409 conflict if another record already had the target value. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-27 15:17:19 -07:00
Kyle Isom	2bda7fc138	Fix DNS record JSON parsing for MCNS response format MCNS returns records wrapped in {"records": [...]} envelope with uppercase field names (ID, Name, Type, Value), not bare arrays with lowercase fields. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-27 15:12:43 -07:00
Kyle Isom	76247978c2	Fix protoToComponent to include routes in synced components Routes from the proto ComponentSpec were dropped during sync, causing the deploy flow to see empty regRoutes and skip cert provisioning, route registration, and DNS registration. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-27 14:39:26 -07:00
Kyle Isom	ca3bc736f6	Bump version to v0.5.0 for Phase D release Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-27 14:33:54 -07:00
Kyle Isom	9d9ad6588e	Phase D: Automated DNS registration via MCNS Add DNSRegistrar that creates/updates/deletes A records in MCNS during deploy and stop. When a service has routes, the agent ensures an A record exists in the configured zone pointing to the node's address. On stop, the record is removed. - Add MCNSConfig to agent config (server_url, ca_cert, token_path, zone, node_addr) with defaults and env overrides - Add DNSRegistrar (internal/agent/dns.go): REST client for MCNS record CRUD, nil-receiver safe - Wire into deploy flow (EnsureRecord after route registration) - Wire into stop flow (RemoveRecord before container stop) - 7 new tests, make all passes with 0 issues Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-27 14:33:41 -07:00