docs: bring docs up to date for Horizon 2.10 (tool counts, versions, capabilities)

README.md

@@ -24,7 +24,8 @@ Tool counts per domain:
 
 | Domain            | Tools | Highlights                                                            |
 | ----------------- | ----: | --------------------------------------------------------------------- |
-| Assist            |    20 | `whoami`, grading, HQL validators, crypto decoders, simulators        |
+| Configuration     |   126 | CRUD for connectors, profiles, CAs, triggers, roles/teams, policies, DCV automation, labels, storages |
+| Assist            |    21 | `whoami`, grading, HQL validators, crypto decoders, simulators        |
 | Lifecycle         |    17 | search/aggregate certs, requests, events, enroll, approve, revoke     |
 | Dashboards        |    12 | dashboard CRUD, charts, saved HQL queries                             |
 | Datasources       |     8 | DNS / LDAP / REST datasources, plus a `test_datasource` dry-run       |
@@ -41,7 +42,7 @@ Full per-tool table with safety tiers in [docs/tools-reference.md](docs/tools-re
 ## Prerequisites
 
 - [Bun](https://bun.sh/) 1.x+ (recommended) or Node.js >= 24.10
-- An Evertrust Horizon instance (tested on 2.8, expected to work on 2.7 and 2.9)
+- An Evertrust Horizon instance (tested on 2.10, the primary QA target; also supports 2.8 and 2.9)
 - API credentials, a client certificate, or browser-based OIDC access to that instance
 
 ## Install
@@ -185,7 +186,7 @@ See [docs/authentication.md](docs/authentication.md) for the full step-by-step g
 
 ## Tool catalog overview
 
-The 84 tools are grouped into 11 domains. Each tool ships with explicit "use when / do not use when" guidance for smaller models. The table at the top of this README lists tool counts; [docs/tools-reference.md](docs/tools-reference.md) has the full per-tool table with safety tiers and one-line descriptions.
+The 211 tools are grouped into 12 domains. Each tool ships with explicit "use when / do not use when" guidance for smaller models. The table at the top of this README lists tool counts; [docs/tools-reference.md](docs/tools-reference.md) has the full per-tool table with safety tiers and one-line descriptions.
 
 Knowledge resources are exposed at `horizon://knowledge/*` URIs. See [docs/knowledge-resources.md](docs/knowledge-resources.md) for the full catalog.
 
@@ -345,26 +346,21 @@ See [docs/development.md](docs/development.md) for environment setup, fixture ma
 
 | Horizon version | Status                                                                  |
 | --------------- | ----------------------------------------------------------------------- |
+| 2.10            | Tested - primary QA target (DCV automation, federated service accounts, identity providers, OIDC group claims, Terms of Service) |
 | 2.8.5+          | Tested (full feature set including Base64/Raw computation rules)        |
 | 2.8.0-2.8.4     | Tested (Base64/Raw computation rules not available)                     |
-| 2.7             | Expected to work (in `HORIZON_WARN_VERSIONS`)                           |
-| 2.9             | Expected to work (in `HORIZON_WARN_VERSIONS`)                           |
+| 2.7, 2.9        | Expected to work (in `HORIZON_WARN_VERSIONS`)                           |
 
 ## What is not supported
 
-The following capabilities require direct Horizon API calls or the Horizon UI:
+Most Horizon configuration objects now have full CRUD tools in the Configuration domain (126 tools): CAs, certificate profiles, PKI and third-party connectors, WCCE forests, PKI queues, triggers, storages, roles and teams, scheduled tasks, automation/execution/password policies, certificate labels, archives, system configuration, DCV automation, and Terms of Service.
 
-- **Configuration objects** - CAs, trust chains, labels, HTTP proxies, password policies, grading policies, and grading rulesets
-- **Profile management** - creating, updating, or deleting profiles (read-only listing and inspection are supported)
-- **Credential management** - creating, updating, or deleting stored credentials (read-only listing IS supported via `list_credentials`)
-- **PKI and third-party connector management** - connectors to ADCS, EJBCA, HashiCorp Vault, etc.
-- **Email/webhook trigger management** - email and webhook (Teams/Slack/Mattermost) triggers (REST notifications ARE supported via `create_rest_notification`)
-- **Trigger attachment to profiles** - use the Horizon admin UI or profile API
-- **Role, team, IDP, and principal administration**
-- **Analytics** - sync status and reindex operations
-- **SMTP and notification server configuration**
-- **Intune, Jamf, and MDM integration setup**
-- **Scheduler and system-level automation**
+The following remain read-only or out of scope:
+
+- **Read-only (list/inspect only)** - identity providers, service accounts, certificate grading policies and rulesets, and stored credentials (`list_credentials`). These can be listed and inspected but not created, updated, or deleted from the MCP server.
+- **Principal administration** - managing individual user principals.
+- **Analytics** - sync status and reindex operations.
+- **SMTP and global notification-server configuration** - individual REST/webhook notification triggers ARE supported via `create_trigger` / `create_rest_notification`.
 
 ## Contributing
 
@@ -390,7 +386,7 @@ PRs welcome. Before opening a pull request, run `bun run validate:ci` (it runs f
 | [Installation](docs/installation.md)              | Install methods, OIDC setup, troubleshooting                                   |
 | [Authentication](docs/authentication.md)          | All four auth modes with environment variable reference                        |
 | [Client setup](docs/client-setup.md)              | Claude Desktop, Claude Code, Cursor, Codex, OpenCode, MCP Inspector            |
-| [Tool reference](docs/tools-reference.md)         | All 84 tools by domain with safety tiers                                       |
+| [Tool reference](docs/tools-reference.md)         | All 211 tools by domain with safety tiers                                      |
 | [Knowledge resources](docs/knowledge-resources.md)| 17 core URIs, 4 curated playbooks, generated section resources                 |
 | [Development](docs/development.md)                | Dev setup, tests, linting                                                      |
 

docs/client-setup.md

@@ -78,7 +78,7 @@ Or with the standalone binary:
 }
 ```
 
-Start Claude Code from that directory. The 84 tools are available immediately.
+Start Claude Code from that directory. The 211 tools are available immediately.
 
 ## Cursor
 
@@ -218,4 +218,4 @@ export HORIZON_API_KEY=your-api-key
 bunx @modelcontextprotocol/inspector bunx @evertrust/horizon-mcp
 ```
 
-Opens a browser UI showing all 84 tools and the full knowledge resource catalog (17 core URIs + 4 curated playbooks + generated section URIs).
+Opens a browser UI showing all 211 tools and the full knowledge resource catalog (17 core URIs + 4 curated playbooks + generated section URIs).

docs/installation.md

@@ -3,7 +3,7 @@
 ## Prerequisites
 
 - Bun 1.x+ (recommended) or Node.js >= 24.10
-- An Evertrust Horizon instance (tested on 2.8, expected to work on 2.7 and 2.9)
+- An Evertrust Horizon instance (tested on 2.10, the primary QA target; also supports 2.8 and 2.9)
 - API credentials or a client certificate with appropriate permissions
 
 ## Install methods

docs/tools-reference.md

@@ -194,7 +194,7 @@ a `describe_<obj>_schema` read tool that must be called before create/update.
 | WCCE forest mappings | `list/get/create/update/delete_wcce_forest` | read-only + mutating |
 | Triggers (CRUD gap-fill, 11 subtypes) | `describe_trigger_schema` `create_trigger` `update_trigger` | read-only + mutating (list/get/delete in Triggers domain above) |
 
-### Configuration: System & operations (20 tools)
+### Configuration: System & operations (25 tools)
 
 | Object | Tools | Safety |
 |--------|-------|--------|