feat(mcp): remote instance (device) read tools

forge/ee/lib/mcp/tools/devices.js

@@ -1,5 +1,13 @@
 const { z } = require('zod')
 
+const { teamId, remoteInstanceId, basePagination, basePaginationKeys, searchQuery, searchQueryKeys, auditLogFilters, auditLogFilterKeys, appendQuery } = require('../schemas')
+
+// Audit-log routes accept cursor+limit pagination, free-text query, event
+// (single name or array) and username. The device audit-log route has no scope
+// parameter, so these tools only compose the base audit-log fragments.
+const auditLogInput = { ...basePagination, ...searchQuery, ...auditLogFilters }
+const auditLogKeys = [...basePaginationKeys, ...searchQueryKeys, ...auditLogFilterKeys]
+
 module.exports = [
     {
         name: 'platform_list_remote_instances',
@@ -189,5 +197,41 @@ module.exports = [
             const response = await inject({ method: 'PUT', url: `/api/v1/devices/${args.remoteInstanceId}`, payload: { application: args.applicationId } })
             return response
         }
+    },
+    {
+        name: 'platform_get_remote_instance_audit_log',
+        title: 'Get Remote Instance Audit Log',
+        description: `FlowFuse platform automation tool:
+            Reads the audit log for a remote instance/device, showing events like connection changes,
+            deployments, and configuration changes for that device.
+            Use this when the user wants to know what has happened to a specific remote instance.
+            Set format to "csv" to export the log as a downloadable file instead of reading entries directly.`,
+        annotations: { readOnlyHint: true, destructiveHint: false },
+        inputSchema: {
+            remoteInstanceId,
+            ...auditLogInput,
+            format: z.enum(['json', 'csv']).optional().describe('Output format. "json" (default) reads entries directly; "csv" exports the log as a downloadable CSV file.')
+        },
+        handler: async (args, { inject }) => {
+            const suffix = args.format === 'csv' ? '/audit-log/export' : '/audit-log'
+            const url = appendQuery(`/api/v1/devices/${args.remoteInstanceId}${suffix}`, args, auditLogKeys)
+            const response = await inject({ method: 'GET', url })
+            return response
+        }
+    },
+    {
+        name: 'platform_list_team_provisioning_tokens',
+        title: 'List Team Provisioning Tokens',
+        description: `FlowFuse platform automation tool:
+            Lists a team's device provisioning tokens. This summary view omits the token secret.
+            Use this to see what provisioning tokens exist for a team without exposing their secrets.`,
+        annotations: { readOnlyHint: true, destructiveHint: false },
+        inputSchema: {
+            teamId
+        },
+        handler: async (args, { inject }) => {
+            const response = await inject({ method: 'GET', url: `/api/v1/teams/${args.teamId}/devices/provisioning` })
+            return response
+        }
     }
 ]

forge/routes/auth/permissions.js

@@ -82,7 +82,10 @@ const IMPLICIT_TOKEN_SCOPES = {
         'stack:list',
         'flow-blueprint:list',
         'project:status',
-        'template:list'
+        'template:list',
+        // remote instance reads
+        'device:audit-log', // get remote instance audit log
+        'team:device:provisioning-token:list' // list team device provisioning tokens
     ]
 }