Planned

None of this is built.

• The rest of the verbs as tools, named sqlmc_<noun>_<verb>, mirroring the CLI one-for-one over the same operations calls — never a third implementation.
• destructiveHint on anything that writes, as honestly as the read-only annotations are set today.
• Confirmation on destructive calls. sqlmc_run_execute without a confirmationToken will return the plan and open no connection — the same design sqlmc_list_coverage already uses, extended to runs. The token is the plan id, so consent applies to a specific plan; if the workspace changed underneath, the caller is handed a fresh plan rather than executing something nobody looked at.
• Long runs. wait: true blocks and reports progress, degrading to returning a runId after timeoutSeconds; wait: false returns the runId at once. sqlmc_run_status polls and sqlmc_run_cancel cancels, backed by an in-process registry that falls back to the run log — so the log stays the authority and status survives a server restart.
• A workspace watcher, so a long-lived server does not serve connections and target groups that somebody edited in the app an hour ago.