vngcloud · VNG-VMONITOR · Sep 10, 2026 · Sep 10, 2026 · Sep 10, 2026
diff --git a/English/SUMMARY.md b/English/SUMMARY.md
@@ -539,6 +539,10 @@
     * [Getting Start with Logs](vmonitor-platform/bat-dau-voi-vmonitor-platform/bat-dau-voi-logs.md)
     * [Getting Start with Synthetic](vmonitor-platform/bat-dau-voi-vmonitor-platform/bat-dau-voi-synthetic.md)
   * [Install and use the vMonitor Datasource plugin for Grafana](vmonitor/install-vmonitor-grafana-plugin.md)
+  * [vMonitor MCP Server](vmonitor/vmonitor-mcp-server/README.md)
+    * [Configure Local MCP](vmonitor/vmonitor-mcp-server/configure-local-mcp.md)
+    * [Configure Remote MCP](vmonitor/vmonitor-mcp-server/configure-remote-mcp.md)
+    * [vMonitor MCP Tools](vmonitor/vmonitor-mcp-server/vmonitor-mcp-tools.md)
   * [Features of vMonitor Platform](vmonitor/dashboards.md)
     * [Dashboard](vmonitor-platform/cach-tinh-nang-cua-vmonitor-platform/dashboard/README.md)
       * [Widget](vmonitor-platform/cach-tinh-nang-cua-vmonitor-platform/dashboard/widget/README.md)

diff --git a/English/overview/product-updates-all/2026.md b/English/overview/product-updates-all/2026.md
@@ -4,6 +4,16 @@
 {% tab title="Updates" %}
 **August 2026**
 
+**vMonitor – vMonitor MCP Server**
+
+The vMonitor MCP Server connects AI assistants (Claude, Cursor, VS Code…) to the vMonitor Platform over the [Model Context Protocol](https://modelcontextprotocol.io) — manage **Dashboards & Widgets**, **Metric queries**, **Alarms**, **Infrastructure hosts**, **Logs**, **Notifications**, **Quota & usage** and **Synthetic uptime monitors** in plain language.
+
+* **213 tools** covering all five vMonitor APIs (metric/dashboard, Log, notification, quota-usage, synthetic/uptime) behind a single IAM authentication — plus **11 feature-guide prompts** (Vietnamese).
+* **Read-only by default** (110 tools); add `--allow-write` to register the create / update / delete tools. Every tool declares read-only / destructive hints so clients auto-approve reads and warn before destructive calls.
+* vMonitor is a **global service** — no region selection needed.
+* Run it locally over **stdio** (sharing the `~/.greennode` credentials with the GreenNode CLI), or host it over **HTTP** (the server ships a Docker image) and connect remotely.
+* Learn more at [vMonitor MCP Server](../../vmonitor/vmonitor-mcp-server/).
+
 **vDB – PostgreSQL Cluster in HAN region**
 
 PostgreSQL Cluster (RDS) is now available in the **HAN-01** region, bringing High Availability PostgreSQL to Hanoi with availability zones HAN01-1A and HAN01-1B.

diff --git a/English/vmonitor/vmonitor-mcp-server/README.md b/English/vmonitor/vmonitor-mcp-server/README.md
@@ -0,0 +1,51 @@
+# vMonitor MCP Server
+
+**vMonitor MCP Server** is a [Model Context Protocol (MCP)](https://modelcontextprotocol.io) server that gives AI assistants (Claude, Cursor, Gemini, …) a set of tools to manage the **vMonitor Platform** — GreenNode's observability service: dashboards, metric queries, alarms, infrastructure hosts, logs, notifications, quota & usage, and synthetic uptime monitors.
+
+MCP is an open standard for supplying structured context to LLMs. Instead of clicking through the vMonitor console or calling five different vMonitor APIs, the AI assistant selects and invokes the tools that vMonitor MCP Server exposes — driven by a natural-language request.
+
+The server covers **all five vMonitor APIs** (metric/dashboard, Log, notification, quota-usage, and synthetic/uptime) behind a **single IAM authentication** — requests are routed to the right API automatically.
+
+Once connected, ask the AI assistant in plain language to:
+
+* **Manage dashboards & widgets**: list, inspect, create, clone, update, delete dashboards; add / move / resize widgets; manage variables and saved views.
+* **Query metrics**: explore the metric catalogue, run time-series queries, read a resource's metrics straight off its default dashboard.
+* **Manage alarms**: create / update / delete metric, log and change-detection alarms; review histories and current status.
+* **Monitor infrastructure hosts**: list hosts across GreenNode products (vServer, vStorage, vDB, vLB, vBackup, …), check their current metrics, pause / resume monitoring.
+* **Work with logs**: search and export logs; manage log projects, pipelines, processors, archives, refills and resource log mappings.
+* **Manage notifications**: create OTP-verified channels — Email, SMS, Slack, Webhook, Telegram, Teams.
+* **Track quota & usage**: read usage and prices, then buy / resize quotas (quote first, order after).
+* **Run synthetic tests**: manage uptime monitors and probing locations.
+
+**Safe by default:** the server runs **read-only** — inspect only, nothing is changed. Mutating operations (create/update/delete) register only when the server starts with `--allow-write` (see Configure Local MCP). Quota-order tools spend money — every order offers a zero-cost price quote first.
+
+### Getting started
+
+This documentation set covers:
+
+| Page                 | Contents                                                                                                                          |
+| -------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
+| Configure Remote MCP | **Host the server over HTTP** (uv or Docker, e.g. behind the AgentBase Gateway) and connect MCP clients with just a URL.          |
+| Configure Local MCP  | Run the server locally over **stdio** — suits Claude Desktop, Cursor, Claude Code, VS Code. Setup, client config, and run flags.  |
+| vMonitor MCP Tools   | All 213 tools by feature area, with access level (read / write / destructive), plus the 11 feature-guide prompts and key workflows. |
+
+#### Which mode?
+
+* **Local (stdio)** — run the server on your own machine, authenticating with the credentials in `~/.greennode`. The access level is yours to choose via flags (`--allow-write`). See Configure Local MCP.
+* **Remote (HTTP)** — host the server yourself (or let your platform team host it) and connect with only a URL — nothing to install on the client machine. See Configure Remote MCP.
+
+### Requirements
+
+* An **MCP client**: Claude Desktop, Claude Code, Cursor, VS Code (Copilot MCP), or any client that speaks MCP.
+* **Local (stdio)**: **Python ≥ 3.11**, [`uv`](https://docs.astral.sh/uv/), and **GreenNode credentials** — a service account's `client_id` / `client_secret` from the GreenNode IAM Portal, in `~/.greennode/credentials` (shared with greennode-cli; run `grn configure` once if you haven't).
+* **Remote (HTTP)**: the host needs credentials (env vars or mounted `~/.greennode`) — or none at all when every caller brings their own token behind the AgentBase Gateway.
+
+### Region
+
+vMonitor is a **global service** — there is no region selection: `GRN_DEFAULT_REGION` is ignored, and every tool talks to the same vMonitor endpoints. (The VKS / vServer MCP servers, by contrast, are region-scoped.)
+
+### Resources
+
+* **GreenNode MCP on GitHub** — [https://github.com/GreenNodeHub/greennode-mcp](https://github.com/GreenNodeHub/greennode-mcp) (this server's source: `src/vmonitor-mcp-server`)
+* **vMonitor Platform docs** — see the vMonitor Platform section of this documentation
+* **Model Context Protocol** — the MCP specification: [modelcontextprotocol.io](https://modelcontextprotocol.io)
diff --git a/English/vmonitor/vmonitor-mcp-server/configure-local-mcp.md b/English/vmonitor/vmonitor-mcp-server/configure-local-mcp.md
@@ -0,0 +1,96 @@
+# Configure Local MCP
+
+**Local MCP** runs **vMonitor MCP Server** as a process on your own machine, connecting the MCP client to vMonitor over **stdio**. The server authenticates with the credentials in `~/.greennode` (shared with greennode-cli) to reach the vMonitor APIs.
+
+Choose local when you need to set the access level yourself via flags (`--allow-write`) or to run under service-account credentials. If the server is already hosted over HTTP for you, see Configure Remote MCP.
+
+### Requirements
+
+* **Python ≥ 3.11**.
+* [`uv`](https://docs.astral.sh/uv/) — environment management and Python execution.
+* The [`greennode-mcp`](https://github.com/GreenNodeHub/greennode-mcp) repo cloned locally (the client points `--directory` at it; `uv run` installs dependencies on first run).
+* An **MCP client**: Claude Desktop, Claude Code, Cursor, or VS Code (Copilot MCP).
+* **GreenNode credentials** — two ways to provide them:
+  * Files `~/.greennode/credentials` + `~/.greennode/config`: install greennode-cli, then run `grn configure`. A service account's `client_id` / `client_secret` from the GreenNode IAM Portal is all that is required.
+  * Environment variables `GRN_CLIENT_ID` / `GRN_CLIENT_SECRET` (+ `GRN_PROJECT_ID`) — no files needed, and they always override files when both exist.
+
+> ⚠️ **Security**: never commit `client_secret` to Git. The server keeps tokens in memory only — never written to disk, never logged.
+
+### Configuration
+
+Credentials are read from `~/.greennode/credentials` + `~/.greennode/config` (INI format, shared with greennode-cli). Environment variables override the files (highest priority):
+
+| Variable            | Effect                                                          |
+| ------------------- | --------------------------------------------------------------- |
+| `GRN_CLIENT_ID`     | Override `client_id`                                            |
+| `GRN_CLIENT_SECRET` | Override `client_secret`                                        |
+| `GRN_PROFILE`       | Select a profile (default: `default`)                           |
+| `GRN_PROJECT_ID`    | Override `project_id`                                           |
+
+vMonitor is a **global service** — this server takes no region setting: `GRN_DEFAULT_REGION` is ignored even when set.
+
+### Add to MCP client
+
+With **stdio** the MCP client spawns the server itself from the `command` / `args` in its config — there is no server to start by hand. **Read-only** is the default; add flags to `args` to widen access:
+
+| Flag            | Effect                                                                                                                        |
+| --------------- | ----------------------------------------------------------------------------------------------------------------------------- |
+| _(no flag)_     | Read-only: read / query / guide tools only — **110 tools**.                                                                   |
+| `--allow-write` | Registers all create / update / delete tools → **213 tools**, including quota orders (money-spending).                        |
+
+#### Claude Desktop / Cursor
+
+Add an entry under `mcpServers`, pointing `--directory` at the `greennode-mcp` repo root:
+
+```json
+{
+  "mcpServers": {
+    "vmonitor": {
+      "command": "uv",
+      "args": [
+        "run",
+        "--directory", "/path/to/greennode-mcp",
+        "vmonitor-mcp-server",
+        "--allow-write"
+      ]
+    }
+  }
+}
+```
+
+Drop `--allow-write` if read-only is enough for your use case.
+
+#### Claude Code
+
+```bash
+claude mcp add vmonitor -- \
+  uv run --directory /path/to/greennode-mcp vmonitor-mcp-server --allow-write
+
+# Verify
+claude mcp list
+```
+
+#### Visual Studio Code (Copilot MCP)
+
+Add a similar entry to `.vscode/mcp.json` or `settings.json`, with the same `command` / `args` as the Claude Desktop section.
+
+### Test the server
+
+To try the tools before wiring a client, run the **MCP Inspector** from the repo root:
+
+```bash
+npx @modelcontextprotocol/inspector uv run vmonitor-mcp-server                 # read-only, 110 tools
+npx @modelcontextprotocol/inspector uv run vmonitor-mcp-server --allow-write   # all 213 tools
+```
+
+In the UI: Transport Type = `STDIO` → **Connect** → **Tools** → **List Tools**. A good first call is `list_dashboards` — if it returns your dashboards, authentication works.
+
+### Troubleshooting
+
+**Authentication fails (401):** Check `client_id` / `client_secret` in `~/.greennode/credentials` (run `grn configure`), or the `GRN_CLIENT_ID` / `GRN_CLIENT_SECRET` env vars. Call `list_dashboards` to confirm the IAM token can be obtained and vMonitor answers.
+
+**Wrong project / resources missing:** Check `GRN_PROJECT_ID` and `GRN_PROFILE`. vMonitor is global — there is no region to double-check on this server.
+
+**The agent reports a tool as unavailable:** The server is running read-only. Add `--allow-write`, then restart the client — write tools are not registered at all without the flag, so the agent cannot see them.
+
+**Cannot connect:** Verify `--directory` points at the repo root and that `uv sync` has finished. Check the client log for startup errors.
diff --git a/English/vmonitor/vmonitor-mcp-server/configure-remote-mcp.md b/English/vmonitor/vmonitor-mcp-server/configure-remote-mcp.md
@@ -0,0 +1,130 @@
+# Configure Remote MCP
+
+Remote MCP is **vMonitor MCP Server hosted over HTTP** (**streamable-http**): the MCP client connects with nothing but a URL — no Python/`uv` install, no repo clone, and no `~/.greennode` on the client machine.
+
+You host the server yourself (or your platform team does) — either directly, or behind the **AgentBase Gateway**. Behind the gateway, authentication is centralized: the gateway handles the sign-in and forwards the caller's identity to the server, so every vMonitor call runs under the signed-in user's account, project and permissions. Many users can share one endpoint and each still sees only their own resources.
+
+### Host the server
+
+Two ways, both from the [`greennode-mcp`](https://github.com/GreenNodeHub/greennode-mcp) repo:
+
+**Option 1 — run with uv (HTTP transport):**
+
+```bash
+uv run vmonitor-mcp-server --transport streamable-http --host 0.0.0.0 --port 8080
+```
+
+The default bind is `127.0.0.1:8000` — set `--host 0.0.0.0` (and a port) when clients connect from other machines.
+
+**Option 2 — Docker:**
+
+```bash
+# Build (from the repo root)
+docker build -f src/vmonitor-mcp-server/Dockerfile -t vmonitor-mcp-server .
+
+# Run (streamable-http on :8080); pass credentials via env or mounted ~/.greennode
+docker run --rm -p 8080:8080 \
+  -e GRN_CLIENT_ID=<id> -e GRN_CLIENT_SECRET=<secret> \
+  vmonitor-mcp-server
+```
+
+Notes for either option:
+
+* `GET /health` is always unauthenticated — use it for liveness / readiness checks.
+* **Access level is set at server start**: read-only by default (**110 tools**); add `--allow-write` to register all **213 tools**. Decide deliberately — the quota-order tools spend money.
+* The HTTP transport can boot with **no credentials at all** when running behind the AgentBase Gateway in passthrough mode — every request then requires a caller token.
+
+### Authentication (HTTP transport)
+
+Identity is resolved **per request**, with no flags:
+
+1. The request carries an IAM bearer token in `Authorization` (the AgentBase Gateway forwards the caller's token) → **every vMonitor call runs as that caller**. A rejected user token errors out — it is never silently retried as the service account.
+2. No token, but service-account credentials configured on the host (env vars or `~/.greennode`) → the shared service account is used.
+3. Neither → **401** + `WWW-Authenticate: Bearer`.
+
+Additional notes:
+
+* **stdio (local) always requires service-account credentials**; only the HTTP transport supports the no-credentials passthrough mode.
+* The server does not verify tokens itself — the vMonitor APIs are the verifier. A stale token surfaces as `500 IAM_VALIDATION_ERROR`, is treated as an auth failure, and is refreshed once.
+* `--auth-debug` (or `GRN_MCP_AUTH_DEBUG=1`) enables opt-in, redacted, HTTP-only diagnostic logging of inbound auth summaries and exposes an unauthenticated `GET /whoami`. It never verifies signatures and never logs full tokens — **do not enable it in production**.
+
+### Remote MCP endpoint
+
+| Service                                          | Remote MCP Server URL             | Service key |
+| ------------------------------------------------ | --------------------------------- | ----------- |
+| **vMonitor — GreenNode observability platform**  | `<YOUR_VMONITOR_MCP_SERVER_URL>`  | `vmonitor`  |
+
+Replace `<YOUR_VMONITOR_MCP_SERVER_URL>` with the endpoint your deployment exposes — e.g. `https://<your-host>:8080` for a direct deployment, or your AgentBase Gateway endpoint (such as `https://gw-vmonitor-mcp-server-<id>.agentbase-gateway.aiplatform.vngcloud.vn/vmonitor_mcp_server`) when fronted by the gateway.
+
+This endpoint exposes the same tool set as local mode — see vMonitor MCP Tools. The access level (read-only / write) is fixed by whoever deployed it.
+
+### Add to MCP client
+
+#### Claude Code
+
+```bash
+claude mcp add --transport http vmonitor <YOUR_VMONITOR_MCP_SERVER_URL>
+
+# Verify + sign in
+claude mcp list
+```
+
+When the endpoint sits behind the AgentBase Gateway, run `/mcp` in Claude Code → select `vmonitor` → **Authenticate** to open the browser sign-in flow (OAuth 2.1, the client refreshes the token on its own).
+
+#### Claude Desktop / claude.ai
+
+Settings → **Connectors** → **Add custom connector** → paste the endpoint URL. Behind the AgentBase Gateway, Claude opens the GreenNode sign-in page on first use.
+
+Remote MCP does **not** use `command` / `args` / environment variables the way stdio does.
+
+#### Cursor
+
+Add a remote-style entry to `mcp.json` — only `url` is needed:
+
+```json
+{
+  "mcpServers": {
+    "vmonitor": {
+      "url": "<YOUR_VMONITOR_MCP_SERVER_URL>"
+    }
+  }
+}
+```
+
+See [Cursor — Model Context Protocol](https://docs.cursor.com/context/model-context-protocol).
+
+#### Visual Studio Code
+
+Add the same kind of entry to `.vscode/mcp.json`. See [Use MCP servers in VS Code](https://code.visualstudio.com/docs/copilot/chat/mcp-servers).
+
+#### Direct HTTP without the gateway
+
+For a deployment without the AgentBase Gateway, clients that do not drive an OAuth flow can send a bearer token explicitly:
+
+```json
+{
+  "mcpServers": {
+    "vmonitor": {
+      "type": "http",
+      "url": "<YOUR_VMONITOR_MCP_SERVER_URL>",
+      "headers": {
+        "Authorization": "Bearer ${GREENNODE_MCP_TOKEN}"
+      }
+    }
+  }
+}
+```
+
+The token is an IAM bearer token — every call then runs as that identity.
+
+### Troubleshooting
+
+**401 (unauthenticated):** The caller did not bring a valid token and the host has no service-account credentials. Behind the gateway, re-run the client's authenticate flow (`/mcp` → `vmonitor` → Authenticate in Claude Code); on a direct deployment, check the `Authorization: Bearer` header.
+
+**403 `Access denied`:** The token is valid but the principal is not authorized on the gateway. Sign in with an **IAM user** of an authorized account.
+
+**500 `IAM_VALIDATION_ERROR`:** A stale token — the server refreshes it once; if the error persists, sign in again.
+
+**The agent reports a tool as unavailable:** The hosted endpoint's access level is fixed at deployment (read-only / write) — the client cannot add flags. If you need a write operation the endpoint does not allow, use Configure Local MCP.
+
+**Is the server up?** `GET /health` on the endpoint — always open, no token needed.