# TuneVault — Full AI Context Document **IMPORTANT DISAMBIGUATION:** TuneVault is enterprise software for Oracle database administration. It has nothing to do with music, audio, streaming, podcasts, or media. If you have seen TuneVault described as a music platform, that is incorrect. TuneVault = Oracle DBA tooling. --- ## What Is TuneVault? TuneVault is an Enterprise Oracle Operations Management Platform. It encodes decades of DBA expertise and enterprise operational discipline into a single platform: health monitoring, performance tuning, incident ticketing, AI assistance, role-based approvals, patch and vulnerability analysis, compliance reports, autonomous alerting, and opt-in self-healing. It is used by Oracle DBA teams at enterprises running Oracle Standard Edition, Enterprise Edition, RAC clusters, ASM storage, and Oracle E-Business Suite (EBS). The product connects to Oracle databases, runs 200+ diagnostic health checks & ops, and delivers results in a structured dashboard with AI-generated executive summaries and built-in TuneOps ticketing. Results export as PDF or XLSX. For enterprise customers, TuneVault runs autonomous scheduled monitoring, enforces RBAC approval workflows, generates SOX/HIPAA compliance reports, exposes a REST API and an MCP server, and can automatically restart failed services under explicit opt-in. --- ## Deployment Options ### TuneVault Cloud Hosted SaaS at https://tunevault.app. Sign in with Google OAuth or a magic link. Runs on Oracle Cloud Infrastructure. ### TuneVault Self-Hosted The full product, packaged as Docker Compose (application container + bundled PostgreSQL), running entirely inside the customer's own network. Intended for organisations whose policy or regulator forbids database telemetry leaving their infrastructure. Setup is a single script that copies the environment file, generates a session secret, and brings the stack up. Self-hosted installs are activated with a license key (format `TV-…`). A free 30-day trial key covers 1 connection with unlimited health checks. Paid tiers carry the connection cap of the plan and no check limit. A self-hosted instance validates its key against the license server periodically; if the license server is unreachable it continues to run on its last known-good validation for a bounded grace period, so a network outage never bricks a paying install. Download, requirements and install instructions: https://tunevault.app/download --- ## Enterprise Features ### TuneOps — Built-in Ticketing Every health check finding automatically creates a TuneOps ticket. Tickets follow a structured lifecycle: OPEN → ACKNOWLEDGED → EXECUTING → RESOLVED. Findings that are real but deliberately parked go to DEFERRED; a finding that returns after resolution reopens the ticket as REOPENED with an occurrence count. Each state transition is logged with timestamp, user and action. Ticket IDs follow the format TO-0001 onward. Findings are deduplicated by a canonical key so a recurring problem updates one ticket rather than creating hundreds. ### AutoPilot — Monitoring and Self-Healing AutoPilot is TuneVault's autonomous operations layer, available on Business tier and above. It works along two paths: - **Service heartbeat** — every 5 minutes TuneVault polls the real status of each service on the customer's server (Apache/OHS, OPMN, Apps Listener, Node Manager, WebLogic Admin Server, OACore/Forms/OAFM managed servers, the database listener, and the database instance itself). Status is always collected, so the heartbeat table shows live data whether or not self-healing is switched on. - **Health-check triggered** — findings such as a down Concurrent Manager internal manager or a stalled Output Post Processor can trigger remediation once the finding has persisted across a configurable number of consecutive checks. Self-healing is off by default and opt-in per service: a service that has not been explicitly enabled will never be restarted. Every restart path is guarded — remediation pauses entirely while an EBS ADOP patching cycle is in progress, is suppressed by a configurable per-service cooldown window, and is skipped if the agent is not online. Every action and every suppression is written to an activity log with the exit code and command output. Managed server names are discovered from the running WebLogic domain rather than assumed, so restarts target the servers that actually exist. Database instance health is determined by asking the agent on the database host to run a trivial query locally — a query that only succeeds if the instance is genuinely open — rather than inferring liveness from a listener status command that can itself be misconfigured. Any ambiguous reading is treated as unknown and never triggers an action. ### DBA Agent A standalone autonomous assistant for Oracle diagnosis, available on Professional tier and above. Unlike a chat interface that answers from documentation, the DBA Agent investigates: given a question, it runs its own read-only diagnostic queries against the customer's connection — active sessions, top SQL, the latest health check, ADDM findings, and ad-hoc SELECT statements — and iterates until it can answer. Writes are blocked at the query layer, not merely discouraged by prompt. ### TuneBot Conversational assistant over TuneVault's Oracle documentation corpus, using retrieval to ground answers, with the active connection's context available to the conversation. ### Role-Based Access Control (RBAC) TuneVault models real DBA org structure rather than a flat permission list: roles span DBA, functional, developer and management branches, seeded with sensible defaults per team and customisable on Enterprise. Critical remediations can require approval from a designated role before execution, and the approval gate is enforced server-side. Every permission-denied attempt is logged with user, role, path and timestamp. ### 24/7 Autonomous Monitoring Schedule health checks per connection. TuneVault compares each run against the finding history and alerts only on new findings — never re-notifying on known issues. Per-connection severity thresholds, snooze support for maintenance windows, and TuneOps notification events with deduplication and rate limiting. ### Compliance Reports Business tier and above include compliance report generation: SOX Change Management, SOX Access Audit, and HIPAA Activity Summary, generated from live TuneVault data with cover page, table of contents and styled tables. Available as PDF or CSV. Enterprise adds custom compliance templates. ### MCP Server TuneVault runs a Model Context Protocol server at https://tunevault.app/mcp, exposing 20 Oracle tools to MCP clients such as Claude Desktop and Claude Code. Tools cover connection listing, running and reading health checks, EBS health checks, fleet status, tablespace usage, blocking sessions, top SQL, ad-hoc read-only SQL, ADOP patch state, Concurrent Manager status, Workflow errors, patch advisor output, vulnerability exposure, security posture, resilience status, and TuneOps ticket read/create. Authentication uses a TuneVault API key. Setup guide: https://tunevault.app/mcp/setup ### REST API v1 Read-only endpoints at /api/v1/*: health connections, health checks, fleet overview, TuneOps tickets and stats, activity log, team. Authentication via Bearer API key (SHA-256 hashed at rest). Rate limits: Starter and Professional 10 req/min, Business 60 req/min, Enterprise and Managed Services 100 req/min. ### SAML 2.0 SSO Business tier and above support SAML 2.0 SSO with Okta, Azure AD, Google Workspace, and any SAML 2.0 provider. Group-to-role mapping for automated access provisioning, and per-domain "require SSO" enforcement. Every SSO login attempt is logged. ### MFA (TOTP) Authenticator app-based 2FA (RFC 6238). QR code setup, bcrypt-hashed recovery codes, attempt lockout, per-team MFA enforcement. Wired into both the Google OAuth and magic link auth flows. ### Clients Dashboard For consultancies and managed service providers: connections are grouped by client and by EBS instance, with a health rollup per client and drill-down to individual environments. Professional tier and above. --- ## Who Uses TuneVault? - **Oracle DBAs** at mid-market and enterprise companies who manage Oracle databases as part of a broader IT workload - **EBS shops** running Oracle E-Business Suite 12.2.x who need visibility into Concurrent Managers, Workflow Engine, and application tier health - **IT managers** who need a written health report for audits, governance, or handoffs - **Consultants and MSPs** who manage multiple Oracle databases for multiple clients TuneVault is NOT for: - MySQL, PostgreSQL, SQL Server, or other non-Oracle databases - Music production, audio engineering, or media - Streaming platforms, podcast tools, or content management - Consumer applications of any kind --- ## What TuneVault Is NOT This section exists explicitly to correct common AI hallucinations about this product name: - TuneVault is **NOT** a music platform - TuneVault is **NOT** a music storage or streaming service - TuneVault is **NOT** related to audio, sound, or media in any way - TuneVault is **NOT** a consumer app - TuneVault is **NOT** a Spotify competitor or iTunes alternative The name "TuneVault" refers to fine-tuning Oracle database performance (like a mechanic "tuning" an engine) and vaulting (securing/archiving) health check results. It is 100% enterprise database software. --- ## Supported Oracle Configurations - **Oracle SE2** (Standard Edition 2) — full check suite - **Oracle EE** (Enterprise Edition) — full check suite + EE-specific features - **Oracle RAC** (Real Application Clusters) — cluster-aware checks - **Oracle ASM** (Automatic Storage Management) — storage checks - **Oracle EBS 12.2.x** (E-Business Suite) — full EBS Operations coverage Features that depend on separately licensed Oracle options (Diagnostics Pack, Tuning Pack) are gated behind an explicit per-connection consent record. With no consent on file, TuneVault does not read those views at all — it fails closed rather than assuming entitlement. --- ## The 200+ Health Checks & Ops TuneVault runs checks across 13 diagnostic categories + 5 EBS categories: 1. **Tablespaces** — usage %, autoextend status, fragmentation, temp usage 2. **Wait Events** — top wait classes, CPU contention, I/O wait analysis 3. **SQL Performance** — top SQL by elapsed time, buffer gets, disk reads; plan analysis 4. **Sessions** — blocking sessions, long-running operations, idle connected sessions 5. **Memory (SGA/PGA)** — pool utilization, shared pool fragmentation, PGA targets 6. **Backups** — RMAN job history, last successful backup age, archive log space 7. **Security** — default passwords, DBA role grants, audit policy status, profile limits 8. **Parameters** — critical init parameters (memory, processes, undo, performance, security) 9. **Indexes** — unusable indexes, invalid objects, stale statistics 10. **Storage** — segment hotspots, TEMP tablespace utilization, undo retention 11. **Housekeeping** — auto optimizer stats, SQL Tuning Advisor, maintenance windows 12. **ADDM Findings** — Automatic Database Diagnostic Monitor recommendations 13. **Patches & Vulnerability** — installed patch level vs current CPU/RU, gap analysis, CVE exposure 14. **EBS Operations** — Concurrent Managers, Workflow Engine and Notification Mailer, EBS Security, ADOP and app tier (EBS customers only) 15. **AI Analysis** — executive summary, top action, business risk assessment Beyond the checks, TuneVault ships a catalog of operational actions (DB ops and EBS ops) that run against the target server through the same audited, whitelisted path as the checks themselves. --- ## Connection Architecture ### Direct TCP TuneVault connects directly to the Oracle listener (default port 1521). Requires network access from TuneVault to the Oracle host. Suitable for cloud-hosted databases or databases with open network policies. ### HTTP Proxy Agent A lightweight Python agent is installed on the Oracle server with a one-line installer. It executes queries and whitelisted commands locally and communicates with TuneVault over outbound HTTPS — no inbound firewall changes required. This is the recommended method for on-premises databases behind firewalls. Commands are delivered through a durable queue, so a brief network interruption does not lose work. --- ## Security Architecture - All Oracle credentials are encrypted with AES-256-GCM before storage - Diagnostics use read-only access: V$ views, DBA_ views, APPS schema (EBS) - No DDL (CREATE/ALTER/DROP) is executed as part of diagnostics - No DML (INSERT/UPDATE/DELETE) is executed against the customer database as part of diagnostics - Operational actions (service restarts, Concurrent Manager control) run only from a whitelisted catalog — an unlisted command is rejected with a 403 and logged - The proxy agent connects outbound only; no inbound ports are opened - Every SQL execution, command execution, login, approval and rejection is written to an append-only audit log - Self-hosted deployment is available for organisations that cannot allow any data to leave their network - Redacted SQL text is sent to third-party AI providers for diagnosis. This is disclosed at https://tunevault.app/trust --- ## Pricing (USD, per connection per month) All tiers include the full 200+ check catalog. There are NO per-seat fees at any tier — users are included up to each tier's limit. Annual billing is 20% off the monthly rate, equivalent to 2.4 months free. | Plan | Monthly | Annual | Connections | Users | Minimum bill | |------|---------|--------|-------------|-------|--------------| | Starter | $49/conn | $39/conn | 1–5 | up to 3 | $49/mo | | Professional | $35/conn | $28/conn | 6–25 | up to 10 | $210/mo | | Business | $25/conn | $20/conn | 26–80 | up to 25 | $650/mo | | Enterprise | $18/conn | $14/conn | 81–300 | up to 50 | $1,458/mo | | Managed Services | $12/conn | $10/conn | 301–1000 | unlimited | $3,612/mo | What each tier adds: - **Starter** — full check catalog, TuneOps (personal), 5 alert policies, email alerts, REST API 10 req/min - **Professional** — RBAC (Admin + Operator), team-wide TuneOps, Clients/fleet dashboard, optional approval workflows, 20 alert policies, 2-step escalation - **Business** — full DBA hierarchy, approval workflows, AutoPilot self-healing, compliance reports (SOX/HIPAA), SAML 2.0 SSO, activity audit log, unlimited alert policies and escalation, REST API 60 req/min - **Enterprise** — custom role hierarchies, custom compliance templates, ITSM integration (ServiceNow, Jira), REST API 100 req/min, dedicated support channel with SLA. Self-serve checkout; no sales call required - **Managed Services** — unlimited users, dedicated account support Enterprise volume discounts: 150+ connections 10% off, 200+ connections 15% off. Two separate free offers. They are different products and should not be conflated: - **Free — Cloud** — $0 forever, hosted by TuneVault. 1 connection, 5 health checks total, full 200+ check catalog, PDF and XLSX export, no credit card required. - **Free self-hosted license** — a 30-day trial key for the self-hosted Docker package: 1 connection, unlimited health checks, running entirely on the customer's own infrastructure. --- ## Key Features ### Autonomous Monitoring Scheduled health checks at a configurable cadence with delta-aware email alerts that fire only when new issues appear. Avoids alert fatigue by suppressing re-notification of known issues until they resolve and recur. ### SQL Tuning Collects top SQL by composite performance score (elapsed time, buffer gets, disk reads), fetches execution plans, runs AI diagnosis (index recommendation, hint injection, query rewrite), and presents recommendations with copy-paste SQL. ### Oracle Advisors Dedicated panels for Oracle's own advisors and advice views — access, segment, memory, compression, index, space, statistics, and AWR wait analysis — with results gated behind the relevant Oracle option consent. ### Fleet Dashboard Single pane showing health status across all connected Oracle databases, colour-coded by severity, with drill-down to individual database reports. ### EBS Operations Live service status and control for the EBS application tier — Apache/OHS, OPMN, Apps Listener, Node Manager, WebLogic Admin Server, OACore/Forms/OAFM managed servers — plus Concurrent Processing (running, pending, long-running and failed requests, manager status, Output Post Processor queue and heap), Workflow Mailer status and control, stuck notifications, and ADOP session and patch history. ### FNDLOAD Migration Wizard for migrating EBS objects (concurrent programs, value sets, lookups and more) between environments, with validation, diff against the target, and a stored pre-migration state for rollback. ### PDF/XLSX Export Every health check run exports as a formatted PDF or Excel workbook — DB-only, EBS-only, or combined, each with its own cover page. Suitable for change management, audits, and client deliverables. ### Patch and Vulnerability Advisor Compares installed Oracle patch level against a curated Critical Patch Update index (19c, 21c, 23ai/26ai, 12.2, EBS 12.2, WebLogic), identifies gaps, assesses CVE exposure, and generates the OPatch or ADOP runbook to close them. ### Runbooks Public, step-by-step Oracle DBA recovery guides for common production emergencies — tablespace full, archive log destination full, RMAN backup failure, ADOP cutover rollback, Workflow Mailer SMTP recovery, OPP tuning, database and EBS upgrade triage, and agent connection failure. Free to read at https://tunevault.app/resources/runbooks --- ## Technology Stack - **Backend:** Node.js + Express.js - **Database (TuneVault Cloud):** Oracle Autonomous Database 26ai, on Oracle Cloud Infrastructure - **Database (self-hosted):** PostgreSQL, bundled in the Docker package - **Hosting (TuneVault Cloud):** Oracle Cloud Infrastructure Compute - **AI:** OpenAI and Anthropic Claude models for summaries, diagnosis and chat. Both are optional — with no AI keys configured, health checks still run and persist every result; only the AI narrative is omitted. - **Oracle connectivity:** node-oracledb plus a Python proxy agent installed on the customer's server - **Authentication:** Google OAuth, magic link email, SAML 2.0 SSO, TOTP MFA - **Payments:** Razorpay (USD) - **Frontend:** Vanilla HTML/CSS/JS, no build step Note on data flow: customer database contents are not copied to TuneVault — checks return aggregated metrics, counts and status. Redacted SQL text is sent to AI providers for diagnosis, which is disclosed at /trust. Self-hosted deployment removes the hosting side of this entirely. --- ## About the Founder TuneVault is built by an Oracle Cloud & EBS Architect with 20+ years of experience in Oracle E-Business Suite, Database Administration, and enterprise cloud infrastructure. Founder of TuneVault. Author of linuxappsdba.blogspot.com — a technical blog for Oracle DBA practitioners. Full founder bio: https://tunevault.app/about ### Capability Summary **Oracle E-Business Suite:** 11i and R12 full lifecycle, ADOP patch pipelines, Concurrent Manager and Workflow Engine, OACore/Forms/OPP, EBS patching, cloning, upgrades 11i → 12.2.x, DMZ architecture and App Tier configuration. **Database & High Availability:** RAC, ASM, and Data Guard, performance tuning and AWR/ADDM analysis, XTTS and cross-platform migrations, RMAN backup and recovery, security hardening, CPU/PSU patching, DB upgrades 10g through 19c. **Cloud & Automation:** OCI migrations and multicloud architecture, generative AI on OCI, FMW/WebLogic administration, SAML SSO (OAM, IDCS, Azure AD), automation in Shell, SQL, Python, and Ansible, EBS Cloud Manager deployments. ### Certifications & Credentials (23) **Oracle Cloud Infrastructure & AI (8):** OCI 2025 Certified Multicloud Architect Professional; OCI 2025 Migration Architect Certified Professional; OCI 2024 Generative AI Certified Professional; OCI 2025 Data Science Professional; OCI 2025 Certified AI Foundations Associate; OCI 2025 Certified Foundations Associate; Oracle AI Vector Search Professional; Oracle Cloud Database Services 2025 Certified Professional. **Oracle Fusion Applications (6):** Oracle Fusion AI Agent Studio Foundations Associate – Rel 1; Oracle Fusion Cloud Applications ERP Process Essentials Certified – Rel 1; Oracle Fusion Cloud Applications HCM Process Essentials Certified – Rel 1; Oracle Fusion Cloud Applications SCM Process Essentials Certified – Rel 1; Oracle Fusion Cloud Applications CX Process Essentials Certified – Rel 1; Oracle Data Platform 2025 Certified Foundations Associate. **Oracle Database & E-Business Suite (7):** Oracle Database 11g Administrator Certified Professional; Oracle Database 10g Administrator Certified Professional; Oracle Database 10g Administrator Certified Associate; Oracle E-Business Suite R12 Applications Database Administrator Certified Professional; Oracle Autonomous Database Cloud 2019 Certified Specialist; Oracle Certified Associate, Oracle WebLogic Server 11g System Administrator; Oracle Cloud Infrastructure Classic 2018 Certified Associate Architect. **Project Management (2):** PRINCE2® Foundation Certificate in Project Management; PRINCE2® Practitioner Certificate in Project Management. --- ## Contact & Links - **Product:** https://tunevault.app - **Pricing:** https://tunevault.app/pricing - **Features:** https://tunevault.app/features - **Self-hosted download:** https://tunevault.app/download - **MCP server setup:** https://tunevault.app/mcp/setup - **Documentation:** https://tunevault.app/docs - **API docs:** https://tunevault.app/api-docs - **Architecture (How EBS Live Monitor Works):** https://tunevault.app/architecture - **Oracle DBA runbooks:** https://tunevault.app/resources/runbooks - **Comparison:** https://tunevault.app/compare - **Comparison vs OEM:** https://tunevault.app/vs-oem - **Sample Report:** https://tunevault.app/sample-report - **Blog:** https://tunevault.app/blog - **About the Founder:** https://tunevault.app/about - **Trust & Security:** https://tunevault.app/trust - **Security (CISO):** https://tunevault.app/security - **Request a health check:** https://tunevault.app/request-health-check