@@ -112,6 +112,7 @@ diskpush mediaanalyzer login
 diskpush mediaanalyzer analyze ~/Pictures/2024 --sort
 
 # Back up Postgres, Supabase, MySQL and SQLite: tagged, verified, pruned, pushed
+diskpush dbbackup discover --save            # every database on every server you have, over ssh
 diskpush dbbackup add shop --kind postgres --push backup@nas:/srv/db
 diskpush dbbackup run --tags nightly
 diskpush dbbackup restore shop --to-env STAGING_DATABASE_URL
 
@@ -18,7 +18,7 @@ import { ArgvError, hasFlag, isKnownCommand, looksLikeEndpoint, parseArgv } from
 import { autoUpdate, reexec } from './self-update.js'
 import { findPluginCall, runPluginCommand, runPlugins } from './commands/plugins.js'
 import { pluginHelp } from './help.js'
-import { loadPlugins } from './plugins.js'
+import { loadPlugins, serverDirectory } from './plugins.js'
 import { PluginError } from '@diskpush/plugin-api'
 import { existsSync } from 'node:fs'
 
@@ -41,7 +41,7 @@ async function runPlugin(argv: readonly string[]): Promise<number | null> {
     })
     for (const { name, error } of failures) output.warn(`plugin ${name} did not load: ${error}`)
     if (await autoUpdate(call.pluginId, output) === 'updated') reexec()
-    return await runPluginCommand(registry, call.pluginId, call.args, output)
+    return await runPluginCommand(registry, call.pluginId, call.args, output, serverDirectory(store))
   } catch (error) {
     if (error instanceof PluginError) {
       process.stderr.write(`${error.message}\n`)
 
@@ -9,6 +9,7 @@ import {
   type DiskpushPlugin,
   type PluginRegistry,
   type ProgressSink,
+  type ServerDirectory,
 } from '@diskpush/plugin-api'
 import { EXIT } from '../exit-codes.js'
 import { failure, type Output } from '../output.js'
@@ -174,6 +175,7 @@ export async function runPluginCommand(
   pluginId: string,
   argv: readonly string[],
   output: Output,
+  servers?: ServerDirectory,
 ): Promise<number> {
   const plugin = await registry.require(pluginId)
   const args = stripGlobalFlags(argv)
@@ -208,6 +210,7 @@ export async function runPluginCommand(
     signal: controller.signal,
     surface: 'cli',
     env: process.env,
+    ...(servers ? { servers } : {}),
     cwd: process.cwd(),
     json: output.isJson,
     print: (text) => output.line(text),
 
@@ -7,7 +7,9 @@
  * the user's privileges, exactly like the CLI itself.
  */
 import { spawn } from 'node:child_process'
-import { diskpushHome } from '@diskpush/database'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+import { diskpushHome, knownHostsPath, type DiskPushStore } from '@diskpush/database'
 import {
   PluginRegistry,
   loadExternalPlugins,
@@ -18,10 +20,13 @@ import {
   type EntryRef,
   type LoadFailure,
   type ProgressSink,
+  type ServerDirectory,
   type SettingsBackend,
 } from '@diskpush/plugin-api'
+import { toServerRef } from '@diskpush/ssh-core'
 import { dbBackupPlugin } from '@diskpush/plugin-dbbackup'
 import { mediaAnalyzerPlugin } from '@diskpush/plugin-mediaanalyzer'
+import { sshConfigHosts } from './resolve.js'
 
 /** Plugins that ship with DiskPush. */
 export const BUILTIN_PLUGINS = [mediaAnalyzerPlugin, dbBackupPlugin]
@@ -43,6 +48,23 @@ export async function loadPlugins(
   return { registry, failures }
 }
 
+/**
+ * The servers a plugin may work on: the same list `diskpush fleet servers`
+ * shows (saved SSH connections, then ~/.ssh/config hosts, saved names
+ * winning), and the known_hosts files DiskPush and OpenSSH keep.
+ */
+export function serverDirectory(store: DiskPushStore, env: NodeJS.ProcessEnv = process.env): ServerDirectory {
+  return {
+    async list() {
+      const saved = (await store.listConnections()).filter((connection) => connection.kind !== 's3')
+      const savedNames = new Set(saved.map((connection) => connection.name))
+      return [...saved, ...sshConfigHosts(env).filter((host) => !savedNames.has(host.name))].map(toServerRef)
+    },
+    knownHostsFiles: [join(homedir(), '.ssh', 'known_hosts'), knownHostsPath(env)],
+    sshConfigFile: env.DISKPUSH_SSH_CONFIG ?? null,
+  }
+}
+
 /**
  * Opens a URL in the browser. http(s) only: a plugin must not be able to
  * hand the desktop opener a file path or a custom scheme.
 
@@ -10,7 +10,7 @@
 import { homedir } from 'node:os'
 import { isAbsolute, join, resolve } from 'node:path'
 import { shell, type WebContents } from 'electron'
-import { diskpushHome } from '@diskpush/database'
+import { diskpushHome, knownHostsPath } from '@diskpush/database'
 import {
   PluginError,
   PluginRegistry,
@@ -24,11 +24,15 @@ import {
   type LoadFailure,
   type LogLevel,
   type ProgressSink,
+  type ServerDirectory,
   type SettingDef,
 } from '@diskpush/plugin-api'
+import { toServerRef } from '@diskpush/ssh-core'
 import { dbBackupPlugin } from '@diskpush/plugin-dbbackup'
 import { mediaAnalyzerPlugin } from '@diskpush/plugin-mediaanalyzer'
 import { ExternalUrlSchema, IPC, type PluginActionRequest } from '../../shared/contract.js'
+import { fleetServers } from './fleet.js'
+import { isLocalConnectionId } from './local-session.js'
 import { store } from './store.js'
 
 /** The same built-in list as the CLI's (apps/cli/src/plugins.ts). */
@@ -125,13 +129,22 @@ async function openUrl(url: string): Promise<void> {
   await shell.openExternal(ExternalUrlSchema.parse(url))
 }
 
+/** The Fleet tab's servers, without its synthetic localhost: a plugin runs here already. */
+const servers: ServerDirectory = {
+  async list() {
+    return (await fleetServers()).filter((connection) => !isLocalConnectionId(connection.id)).map(toServerRef)
+  },
+  knownHostsFiles: [join(homedir(), '.ssh', 'known_hosts'), knownHostsPath()],
+  sshConfigFile: process.env.DISKPUSH_SSH_CONFIG ?? null,
+}
+
 /** Starts `work` under a fresh AbortController, reports its outcome, and returns at once. */
 function launch(jobId: string, sender: WebContents, work: (host: HostContext) => Promise<ActionResult>): { jobId: string } {
   if (running.has(jobId)) throw new PluginError('That job id is already running.')
   const controller = new AbortController()
   running.set(jobId, controller)
   const progress = sink(jobId, sender)
-  const host: HostContext = { progress, openUrl, signal: controller.signal, surface: 'desktop', env: process.env }
+  const host: HostContext = { progress, openUrl, signal: controller.signal, surface: 'desktop', env: process.env, servers }
   void (async () => {
     let result: ActionResult
     try {
 
@@ -118,6 +118,55 @@ diskpush dbbackup restore shop --to-env STAGING_URL        # asks before it writ
 diskpush dbbackup cron --at "15 3 * * *"                   # a crontab line to paste
 ```
 
+### Every database on every server: `discover`
+
+You do not have to list your databases. `discover` looks on every server
+DiskPush already knows (saved connections and `~/.ssh/config` hosts, the same
+list as `diskpush fleet servers`) over the ssh keys and agent you already use,
+and lists what it finds; `--save` keeps them for backup.
+
+```bash
+diskpush dbbackup discover                          # look everywhere, change nothing
+diskpush dbbackup discover dev2 vienna              # just these
+diskpush dbbackup discover --save --tags nightly --keep-last 14 --push backup@nas:/srv/db
+diskpush dbbackup run --tags nightly                # back them all up
+```
+
+On each server one read-only shell script, sent in a single ssh call, finds:
+
+| What | How it is found | How it is backed up |
+| --- | --- | --- |
+| Postgres / Supabase in Docker | `docker ps` (images `postgres`, `postgis`, `supabase/postgres`, `timescale`, `pgvector`…; a compose project ending `-supabase` makes it Supabase), then each container's databases with `psql` inside it, signing in the way the image allows (`POSTGRES_USER`, `postgres`, `supabase_admin`, over the socket or `127.0.0.1`) | `docker exec <container> pg_dump …` on the server |
+| MySQL / MariaDB in Docker | `docker ps`, then `mysql -uroot` inside the container with the container's own `MYSQL_ROOT_PASSWORD` | `docker exec <container> mysqldump …`, with that same password from the container's environment |
+| Native Postgres | every online cluster (`pg_lsclusters`), as the `postgres` OS user | `sudo -n -u postgres pg_dump -p <port> …` |
+| Native MySQL / MariaDB | root over the local socket | `mysqldump` as root |
+| SQLite | files under `/srv`, `/opt`, `/var/www`, `/root`, `/home` (setting `sqliteRoots`) whose first bytes are SQLite's header, skipping dependency, cache, source-checkout, worktree, `backups` and `tmp` folders, hidden folders and files, `*.bak*`/replica copies and `opencode.db`; files over 4 GB are listed as skipped (`--max-sqlite-mb`) | SQLite's online backup on the server, `PRAGMA quick_check`, then the file itself comes back |
+
+**The dump runs on the server; only its bytes come back over ssh.** No
+database port is opened to this machine, no `pg_dump` of the right version is
+needed here, and **no database password is copied anywhere**: a container is
+entered with `docker exec`, a native install through its socket. A database
+that discovery lists is one that it reached exactly the way the backup will.
+The same completion-line rule applies, so a dump cut short by a dropped
+connection is still thrown away.
+
+Each database is named after its server and what a person would call it
+(`dev2-crawlproof`, `dev2-nichedb-supabase`, `bbs-agentbbs-bbs`), and app
+env files (`~/www/*/app.env`, `*/.env`) that point at it are shown beside it,
+passwords masked on the server before they are read. Running `discover` again
+adds only what is new, and names anything saved that a reachable server no
+longer has.
+
+Git forges (`github.com`, `gitlab.com`, …) and second aliases of the same
+`user@host:port` are not looked on, and two aliases that turn out to reach the
+same machine (same `/etc/machine-id`) are listed once, under the one with the
+most access. A server that cannot be reached is reported and the rest carry on.
+Probing uses `ssh -o BatchMode=yes`: an unknown host key fails rather than
+asks, unless you pass `--accept-new`. The login needs to be root, in the
+`docker` group, or have passwordless `sudo` for what it should see; the report
+says when it cannot get in somewhere. In the desktop, *Find databases on every
+server* under Plugins… does the same and saves what it finds.
+
 **File names are the catalogue.** `shop--20261017T031500Z--nightly+prod.sql.gz`
 is database `shop`, taken at that UTC time, tagged `nightly` and `prod`. Each
 database gets its own folder under the backup folder (`~/Backups/diskpush`
@@ -174,7 +223,7 @@ the file really is SQLite), and *Verify backup* on a backup. *Back up every
 database now* is under Plugins… in the desktop.
 
 **Settings:** `backupDir`, `keepLast`, `keepDays`, `push`, `rsh` (the ssh
-command for pushes), and `pg_dumpPath` / `mysqldumpPath` / `psqlPath` /
+command for pushes), `sqliteRoots` (where discovery looks for SQLite files), and `pg_dumpPath` / `mysqldumpPath` / `psqlPath` /
 `mysqlPath` / `sqlite3Path` to pin a tool.
 
 ## Writing a plugin
@@ -237,6 +286,7 @@ it (`ctx.surface` says which: `cli`, `tui` or `desktop`).
 | `openUrl(url)` | the user's browser; http and https only |
 | `signal` | aborted on Ctrl+C, esc, or Cancel. Stop, save what you have, return |
 | `env` | environment variables |
+| `servers` | optional: the user's servers (`list()` → name, host, port, username, keyPath, jumpHost, sshConfigAlias, passwordAuth; never a password), plus `knownHostsFiles` and `sshConfigFile` to hand to `ssh`. Absent where a host has none to offer |
 | `print`, `warn`, `printJson`, `json`, `prompt`, `cwd` | commands only |
 
 An action returns `{ ok, message, changed? }`. `changed: true` makes the file
 
@@ -71,6 +71,36 @@ export interface ProgressSink {
   log(level: LogLevel, message: string): void
 }
 
+/**
+ * A server DiskPush can reach over SSH, as the host knows it: a saved
+ * connection or a `~/.ssh/config` host. Enough to build an `ssh` command
+ * line; never a password.
+ */
+export type ServerRef = {
+  /** What the user calls it: the connection name or the ssh_config alias. */
+  name: string
+  host: string
+  port: number
+  username: string
+  /** An identity file. Null: the agent and ssh's own defaults. */
+  keyPath: string | null
+  /** ProxyJump, e.g. `bastion` or `user@bastion:2222`. */
+  jumpHost: string | null
+  /** Set for a ~/.ssh/config host: connect by the alias so the rest of that entry applies. */
+  sshConfigAlias: string | null
+  /** The connection signs in with a password, which nothing non-interactive can use. */
+  passwordAuth: boolean
+}
+
+/** The servers the user has given DiskPush, for plugins that work on them over ssh. */
+export interface ServerDirectory {
+  list(): Promise<ServerRef[]>
+  /** known_hosts files to trust, in order: pass them to ssh as UserKnownHostsFile. */
+  knownHostsFiles: string[]
+  /** An ssh_config other than ~/.ssh/config (DISKPUSH_SSH_CONFIG), for `ssh -F`. */
+  sshConfigFile: string | null
+}
+
 /** Everything any plugin code is handed, whichever surface is running it. */
 export interface BaseContext {
   settings: PluginSettings
@@ -86,6 +116,8 @@ export interface BaseContext {
   surface: Surface
   /** Environment variables, so a plugin can take an API key from one. */
   env: Readonly<Record<string, string | undefined>>
+  /** The user's servers. Absent on a host that has none to offer; optional, so older plugins and hosts are unaffected. */
+  servers?: ServerDirectory
 }
 
 export interface ActionContext extends BaseContext {