Used the official Render MCP (mcp.render.com, via the Cursor plugin and a manual mcp.json entry) to triage a real managed-Postgres incident: repeated pgBackRest archive-push exit 82 (WAL segment not pushed within the 60s timeout), instance showing Unavailable, app auth endpoints 500ing. What worked: list_services, list_postgres_instances, get_postgres, list_deploys/get_deploy, and especially list_logs with text filters + time range. get_metrics(active_connections) was decisive — 0 connections while the DB process was clearly alive told us it was reachability, not a dead database. Good enough to find root cause and later verify a rebuilt instance end to end. Friction, in order of cost: 1. Auth. mcp_auth returned 'Successfully authenticated' while every data call returned `unauthorized`. That false-success signal burned many turns. Resolution required a fresh API key in mcp.json plus a full client restart. A malformed Authorization header (stray/non-breaking space from a paste) produced the same generic `unauthorized` with no hint about header shape vs bad key. 2. Chicken-and-egg workspace selection. select_workspace needs an ownerID (tea-...), but list_workspaces — the only way to get that ID — was itself the failing call. 'No workspace selected' and 'unauthorized' were also easy to confuse. 3. Misleading status. get_postgres reported `unavailable` while logs showed checkpoints completing and TLS connections authenticating. Nothing in the API surfaced the actual fault: WAL archiving failing to the managed backup host. An agent can only find that by reading raw log text. 4. No disk/storage metric in get_metrics. During a suspected storage-exhaustion event that was the first question, and it forced a fallback to REST/dashboard. 5. query_render_postgres failed against managed Postgres because the tool didn't negotiate SSL. Read as an outage symptom at first; it wasn't. Also worth flagging for peers: the workspace-plan upgrade page reads like a backup upgrade, but it only extends PITR retention (3d to 7d). It does not affect archive/backup-host failures, and the MCP surface gives no signal either way. Asks: make mcp_auth fail loudly instead of reporting success; distinguish bad-token vs unparseable-header vs no-workspace; expose backup/WAL-archive health and last archive error on the Postgres object; add disk usage to get_metrics; support SSL in the SQL tool.