Opsphere — DevOps & SRE Intelligence

AWS CLI Query (generic, read-only)

aws_cli_query

Read-only

Run any read-only AWS CLI query. Only allows subcommands starting with read verbs (describe, list, get, search, scan, etc.). Blocks write operations and secrets. Useful for services without a dedicated tool: Lambda, CloudFront, SQS, SNS, Route53, etc. For Athena SQL, S3 key find, DynamoDB Query, or Aurora Data API SQL, prefer aws_athena_query / aws_s3_find / aws_dynamodb_* / aws_rds_data_query. Example: "lambda list-functions", "rds describe-db-instances --region eu-central-1".

Input Schema

Name	Required	Description
`command`	Yes	Comando AWS CLI sin prefijo "aws". Ej: "lambda list-functions", "rds describe-db-instances --region eu-central-1", "cloudfront list-distributions". Solo subcomandos read-only (describe-, list-, get-, search-, scan-*, etc.).
`profile`	No	AWS_PROFILE opcional
`context_id`	No	Optional explicit Connection Hub work context (ctx_*). Omit to use the conversation's active workspace; global Hub tools ignore it.

Output Schema

Name	Required	Description	Default
`ok`	Yes
`data`	Yes
`contractVersion`	Yes
`dataSchemaVersion`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed20 schema fields changedOct 26, 2026

removedOutput schema / properties / data / properties / command / default
```
Removed value: -""
```

addedOutput schema / properties / data / properties / exitCode / anyOf

Added value: +[
+  {
+    "type": "integer"
+  },
+  {
+    "type": "null"
+  }
+]

removedOutput schema / properties / data / properties / exitCode / default
```
Removed value: -null
```
removedOutput schema / properties / data / properties / exitCode / type
```
Removed value: -[
-  "number",
-  "null"
-]
```

addedOutput schema / properties / data / properties / gaps

Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}

addedOutput schema / properties / data / properties / parsed
```
Added value: +{
+  "type": "boolean"
+}
```

removedOutput schema / properties / data / properties / parsedJson

Removed value: -{
-  "additionalProperties": true,
-  "properties": {},
-  "type": "object"
-}

addedOutput schema / properties / data / properties / partial
```
Added value: +{
+  "type": "boolean"
+}
```

addedOutput schema / properties / data / properties / records

Added value: +{
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "facts": {
+        "items": {
+          "additionalProperties": false,
+          "properties": {
+            "path": {
+              "type": "string"
+            },
+            "value": {
+              "anyOf": [
+                {
+                  "type": [
+                    "string",
+                    "number",
+                    "boolean",
+                    "null"
+                  ]
+                },
+                {
+                  "items": {
+                    "$ref": "#/properties/data/properties/records/items/properties/facts/items/properties/value/anyOf/0"
+                  },
+                  "type": "array"
+                }
+              ]
+            }
+          },
+          "required": [
+            "path",
+            "value"
+          ],
+          "type": "object"
+        },
+        "type": "array"
+      },
+      "index": {
+        "minimum": 0,
+        "type": "integer"
+      },
+      "key": {
+        "type": "string"
+      }
+    },
+    "required": [
+      "index",
+      "facts"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

addedOutput schema / properties / data / properties / service
```
Added value: +{
+  "type": "string"
+}
```
removedOutput schema / properties / data / properties / stderr / default
```
Removed value: -""
```
removedOutput schema / properties / data / properties / stdout / default
```
Removed value: -""
```
addedOutput schema / properties / data / properties / subcommand
```
Added value: +{
+  "type": "string"
+}
```
removedOutput schema / properties / data / properties / text
```
Removed value: -{
-  "type": "string"
-}
```

addedOutput schema / properties / data / properties / total

Added value: +{
+  "minimum": 0,
+  "type": "integer"
+}

addedOutput schema / properties / data / properties / truncated
```
Added value: +{
+  "type": "boolean"
+}
```

addedOutput schema / properties / data / properties / warnings

Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}

addedOutput schema / properties / data / required

Added value: +[
+  "command",
+  "exitCode",
+  "stdout",
+  "stderr",
+  "parsed",
+  "records",
+  "total",
+  "partial",
+  "truncated",
+  "warnings",
+  "gaps"
+]

addedOutput schema / properties / dataSchemaVersion

Added value: +{
+  "const": 2,
+  "type": "number"
+}

changedOutput schema / required

Previous value: -[
-  "contractVersion",
-  "ok",
-  "data"
-]New value: +[
+  "contractVersion",
+  "dataSchemaVersion",
+  "ok",
+  "data"
+]

First observedOct 15, 2026

TDQS

A4.5/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is known; the description adds real, non-duplicated enforcement detail — the read-verb allowlist (describe/list/get/search/scan) and that secrets are blocked. It stops short of covering credential/profile requirements, region defaults, pagination, or what happens on a blocked command.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core capability, then the constraint, then the alternatives, then examples — every sentence carries weight and there is no filler. It runs slightly dense as one paragraph, but no sentence is redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description needn't explain return values, and it covers the gaps that matter: what is blocked, which sibling to prefer, and callable command examples. Remaining gaps (auth/profile behavior, region defaults, error semantics on blocked calls) are modest for a generic passthrough tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description still adds meaning beyond the schema's free-form string by defining the acceptable value class (read-verb subcommands only) and showing that extra CLI flags like --region can be appended to the command string, which the schema does not state explicitly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource (run read-only AWS CLI queries) and immediately names the distinguishing scope: a generic fallback for services without a dedicated tool. It lists covered services (Lambda, CloudFront, SQS, SNS, Route53) so an agent can tell it apart from the many aws_* siblings without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly routes the agent: use this for services lacking a dedicated tool, and prefer aws_athena_query / aws_s3_find / aws_dynamodb_* / aws_rds_data_query for those cases. This is the when-to-use plus named-alternatives pattern done properly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Opsphere — DevOps & SRE Intelligence tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?