[READ] Data centers with status (up, uninitialized, maintenance…) and compat version.

Args: limit: Rows to return, 1-1000 (default 100); truncated says when more exist. target: Engine target name from config; omit to use the default.

[READ] Clusters with compatibility version, CPU type and memory over-commit policy.

Args: limit: Rows to return, 1-1000 (default 100). target: Engine target name from config; omit to use the default.

[READ] KVM hosts with status, SPM role, memory and VM counts.

A field the engine did not report is null, never 0. For "what is wrong with my hosts" use host_health_rca instead of reading this list yourself.

Args: limit: Rows to return, 1-1000 (default 100); truncated says when more exist. search: Engine query language, e.g. "status=up" or "status!=up". target: Engine target name from config; omit to use the default.

[READ] One KVM host by id (see host_list).

Args: host_id: Host id. target: Engine target name from config; omit to use the default.

[READ] Engine events at or above a severity, newest first.

To follow new events, pass the highest index you have already seen as after_index: events after it come back OLDEST first (order), so repeat with the highest index returned while truncated is true and nothing is skipped. since_minutes keeps events from the last N minutes and sets scanTruncated when older ones in the window may be missing. SSO session ids in login events are redacted.

Args: limit: Rows to return, 1-1000 (default 100); truncated says when more exist. min_severity: One of normal, warning, error, alert (default normal). page: Older pages of events (not combinable with since_minutes or after_index). after_index: Only events with a higher index than this, oldest first. since_minutes: Only events from the last N minutes (1-129600). target: Engine target name from config; omit to use the default.

[READ] Engine jobs (long-running operations) with status and duration.

Args: limit: Rows to return, 1-1000 (default 100). status: Only one status: started, finished, failed, aborted, unknown. target: Engine target name from config; omit to use the default.

[READ] What needs attention on KVM hosts, ranked worst first, in one call.

Combines host status and status detail, reinstall/update flags and recent warning-or-worse events that name a host. Each finding has signal (what was measured), cause, action and rank. Hosts that the engine is installing or rebooting are reported as in progress, not failed; alert 9000 (power management not verifiable) is informational on hosts without fencing hardware. Report findings in rank order and quote their signal.

Args: events_limit: Recent warning-or-worse events to correlate, 1-1000 (default 200). events_window_hours: Ignore events older than this many hours, 1-720 (default 24); older ones are counted in eventsOutsideWindow. target: Engine target name from config; omit to use the default.

[READ] Problems with the engine itself, ranked worst first, in one call.

Reads the engine's health check, its version, its clock against this machine and its summary counts, plus warning-or-worse events that name no host, VM or storage domain: engine or CA certificate expiry, missing or failed engine backups, a cluster failing its HA reservation. Those alerts appear in no other diagnosis, so call this first for "is anything wrong". Report findings in rank order and quote their signal.

Args: events_limit: Recent warning-or-worse events to correlate, 1-1000 (default 200). events_window_hours: Ignore events older than this many hours, 1-720 (default 24). target: Engine target name from config; omit to use the default.

[READ] Storage domains with status and capacity (free, used, committed bytes and %).

The status of an attached domain comes from its data center (statusSource); it is null — not guessed — when that could not be read (statusErrors).

Args: limit: Rows to return, 1-1000 (default 100); truncated says when more exist. target: Engine target name from config; omit to use the default.

[READ] One storage domain by id, with its data-center-scoped status.

Args: domain_id: Storage domain id (see storage_domain_list). target: Engine target name from config; omit to use the default.

[READ] VMs with status, host, vCPUs, memory and high-availability flag.

Args: limit: Rows to return, 1-1000 (default 100); truncated says when more exist. search: Engine query language, e.g. "status=up" or "cluster=Default". target: Engine target name from config; omit to use the default.

[READ] One VM by id (see vm_list).

Args: vm_id: VM id. target: Engine target name from config; omit to use the default.

[READ] A VM's current statistics: memory, CPU %, network and disk usage, with units.

Args: vm_id: VM id. target: Engine target name from config; omit to use the default.

[READ] Storage-domain problems ranked worst first, in one call.

Critical when free space is below the engine's critical blocker (the engine then refuses new disks and snapshots); medium below the low-space warning, or when thin disks are committed beyond capacity while space is low (low on its own); high when an attached domain is inactive, unknown or mixed. Warning-or-worse events naming a storage domain (for example "deactivated by system") are attached to it. Unattached domains such as the default image repository are skipped. Report findings in rank order and quote their signal.

Args: events_limit: Recent warning-or-worse events to correlate, 1-1000 (default 200). events_window_hours: Ignore events older than this many hours, 1-720 (default 24). target: Engine target name from config; omit to use the default.

[READ] VM problems ranked worst first, in one call.

High for VMs stuck not_responding/unknown, paused (often storage I/O errors or a full domain — check storage_capacity_rca), or down with high availability; medium for image_locked; info for VMs mid-transition; low for config changes waiting for a restart. Recent warning-or-worse events naming a VM are attached to it, one finding per VM and code; an event is superseded (info) when the VM started after it, or when the engine reported it back up and it is up now. Down VMs without HA are normal. Report findings in rank order and quote their signal.

Args: events_limit: Recent warning-or-worse events to correlate, 1-1000 (default 200). events_window_hours: Ignore events older than this many hours, 1-720 (default 24); older ones are counted in eventsOutsideWindow. target: Engine target name from config; omit to use the default.

[READ] List recorded, not-yet-applied undo tokens (most recent first).

Each entry names the original tool, the inverse tool that undo_apply would run, and a human note. Use the undoId with undo_apply.

One extra row is read so truncated is measured rather than guessed from the row count matching the limit; when it is true, older tokens exist.

Each entry carries effectVerified. False means the original write lost its response, so the change it reverses is PROBABLE, not confirmed — check the live state before applying, and do not report the result as a restore of a state that may never have been reached.

Args: limit: Max rows to return (default 50, capped at 500). target: Unused (undo state is host-local); accepted for CLI uniformity.

[WRITE][risk=medium] Apply a recorded undo by dispatching its inverse tool.

The inverse runs through its own governed tool, so it is audited under its own risk tier. Pass dry_run=True to preview the inverse call without executing it. A token can only be applied once.

Args: undo_id: The undoId from undo_list (or an _undo_id in a write result). dry_run: If True, preview the inverse tool + params without running it. target: Passed through to the inverse tool when it accepts a target.