# local_ydb_upgrade_version

Upgrade a file-backed, volume-backed local-ydb profile to a target image tag. Use only for version upgrades on profiles without bindMountPath; it preflights source and target images, dumps, rebuilds, restores, reapplies auth when configured, recreates extra nodes, verifies container images, and persists the profile image after successful confirmed execution.

Agent View of the PolicyLayer registry record for `local_ydb_upgrade_version`. HTML page: https://policylayer.com/tools/local-ydb/local-ydb-upgrade-version

## Facts

- Tool: `local_ydb_upgrade_version`
- Server: Local Ydb (`@astandrik/local-ydb-mcp`) — https://policylayer.com/tools/local-ydb.md
- Install: `npx -y @astandrik/local-ydb-mcp`
- Homepage: git+https://github.com/astandrik/local-ydb-toolkit.git
- Risk category: Execute (High risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Rate-limited

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "local_ydb_upgrade_version",
    "arguments": {}
  }
}
```

## Why local_ydb_upgrade_version is rated High

This tool orchestrates a complex multi-step upgrade process: it stops and rebuilds containers, dumps and restores data, reapplies auth, and recreates nodes. While it includes backup/restore steps, it executes a chain of operations with significant blast radius — a failed or misapplied upgrade could corrupt the database, cause downtime, or result in data loss.

From the tool's own definition: "preflights source and target images, dumps, rebuilds, restores, reapplies auth when configured, recreates extra nodes, verifies container images, and persists the profile image after successful confirmed execution"

## Use case

AI agents invoke local_ydb_upgrade_version to trigger actions in Local Ydb. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Local Ydb:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "local_ydb_upgrade_version": {
      "limits": [
        {
          "counter": "local_ydb_upgrade_version_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Local Ydb (37)

- `local_ydb_cleanup_storage` — Destructive — https://policylayer.com/tools/local-ydb/local-ydb-cleanup-storage.md
- `local_ydb_destroy_stack` — Destructive — https://policylayer.com/tools/local-ydb/local-ydb-destroy-stack.md
- `local_ydb_remove_dynamic_nodes` — Destructive — https://policylayer.com/tools/local-ydb/local-ydb-remove-dynamic-nodes.md
- `local_ydb_add_dynamic_nodes` — Execute — https://policylayer.com/tools/local-ydb/local-ydb-add-dynamic-nodes.md
- `local_ydb_apply_auth_hardening` — Execute — https://policylayer.com/tools/local-ydb/local-ydb-apply-auth-hardening.md
- `local_ydb_bootstrap` — Execute — https://policylayer.com/tools/local-ydb/local-ydb-bootstrap.md
- `local_ydb_bootstrap_root_database` — Execute — https://policylayer.com/tools/local-ydb/local-ydb-bootstrap-root-database.md
- `local_ydb_check_prerequisites` — Execute — https://policylayer.com/tools/local-ydb/local-ydb-check-prerequisites.md
- `local_ydb_pull_image` — Execute — https://policylayer.com/tools/local-ydb/local-ydb-pull-image.md
- `local_ydb_restart_stack` — Execute — https://policylayer.com/tools/local-ydb/local-ydb-restart-stack.md
- `local_ydb_start_dynamic_node` — Execute — https://policylayer.com/tools/local-ydb/local-ydb-start-dynamic-node.md
- `local_ydb_auth_check` — Read — https://policylayer.com/tools/local-ydb/local-ydb-auth-check.md
- `local_ydb_container_logs` — Read — https://policylayer.com/tools/local-ydb/local-ydb-container-logs.md
- `local_ydb_database_status` — Read — https://policylayer.com/tools/local-ydb/local-ydb-database-status.md
- `local_ydb_dump_tenant` — Read — https://policylayer.com/tools/local-ydb/local-ydb-dump-tenant.md
- `local_ydb_generate_schema` — Read — https://policylayer.com/tools/local-ydb/local-ydb-generate-schema.md
- `local_ydb_graphshard_check` — Read — https://policylayer.com/tools/local-ydb/local-ydb-graphshard-check.md
- `local_ydb_healthcheck` — Read — https://policylayer.com/tools/local-ydb/local-ydb-healthcheck.md
- `local_ydb_inventory` — Read — https://policylayer.com/tools/local-ydb/local-ydb-inventory.md
- `local_ydb_list_dumps` — Read — https://policylayer.com/tools/local-ydb/local-ydb-list-dumps.md
- `local_ydb_list_versions` — Read — https://policylayer.com/tools/local-ydb/local-ydb-list-versions.md
- `local_ydb_nodes_check` — Read — https://policylayer.com/tools/local-ydb/local-ydb-nodes-check.md
- `local_ydb_pull_status` — Read — https://policylayer.com/tools/local-ydb/local-ydb-pull-status.md
- `local_ydb_reduce_storage_groups` — Read — https://policylayer.com/tools/local-ydb/local-ydb-reduce-storage-groups.md
- `local_ydb_scheme` — Read — https://policylayer.com/tools/local-ydb/local-ydb-scheme.md
- `local_ydb_status_report` — Read — https://policylayer.com/tools/local-ydb/local-ydb-status-report.md
- `local_ydb_storage_leftovers` — Read — https://policylayer.com/tools/local-ydb/local-ydb-storage-leftovers.md
- `local_ydb_storage_placement` — Read — https://policylayer.com/tools/local-ydb/local-ydb-storage-placement.md
- `local_ydb_tenant_check` — Read — https://policylayer.com/tools/local-ydb/local-ydb-tenant-check.md
- `local_ydb_add_storage_groups` — Write — https://policylayer.com/tools/local-ydb/local-ydb-add-storage-groups.md
- …and 7 more: https://policylayer.com/tools/local-ydb.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=local-ydb · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/local-ydb