[READ] Currently firing Prometheus rule alerts, grouped by severity.

Args: target: Prometheus target name from config; omit for the default.

[READ] Pending (not-yet-firing) Prometheus rule alerts, by severity.

Args: target: Prometheus target name from config; omit for the default.

[READ] Alerts as Alertmanager sees them (post grouping/silence/inhibit).

Args: active_only: If True, exclude silenced/inhibited alerts. target: Prometheus target name from config (its Alertmanager); omit for default.

[READ] Alertmanager silences (active, pending, expired).

Args: target: Prometheus target name from config (its Alertmanager); omit for default.

[READ][analysis] Root-cause firing alerts: join each to its rule expr → cause+action.

Pulls firing alerts + alerting rules, matches them, and maps each to a likely cause and recommended action. Advisory heuristic — verify before acting.

Args: target: Prometheus target name from config; omit for the default.

[READ][analysis] Rank down/erroring scrape targets and classify each cause.

Args: target: Prometheus target name from config; omit for the default.

[READ][analysis] Find noisy/duplicate alerts → dedup/rollup recommendation.

Args: noise_threshold: Instance count at/above which an alertname is "noisy". target: Prometheus target name from config; omit for the default.

[READ] Grafana dashboards (optionally filtered by a title query).

Args: query: Optional title substring to search for. target: Grafana target name from config; omit for the default.

[READ] One dashboard's summary (title, version, panel + tag counts).

Args: uid: Dashboard UID (from list_dashboards). target: Grafana target name from config; omit for the default.

[READ] Configured Grafana datasources (id, uid, name, type, default).

Args: target: Grafana target name from config; omit for the default.

[READ] Health of one Grafana datasource.

Args: datasource_id: Numeric datasource id (from list_datasources). target: Grafana target name from config; omit for the default.

[READ] Grafana folders.

Args: target: Grafana target name from config; omit for the default.

[READ] Distinct Loki label names present in the lookback window.

Args: hours: Lookback window in hours (capped at the tool's max lookback). target: Loki target name from config; omit for the default.

[READ] Distinct values of one Loki label (bounded).

Args: name: Label name to enumerate (e.g. 'app', 'namespace'). hours: Lookback window in hours (capped at the tool's max lookback). target: Loki target name from config; omit for the default.

[READ] Bounded LogQL query_range passthrough (validation-gated).

The query MUST carry a stream selector (e.g. '{app="api"}') — an unbounded query with no selector is rejected. Lookback is capped and the line count is clamped.

Args: logql: A LogQL query with a stream selector (e.g. '{job="api"} |= "error"'). hours: Lookback window in hours (capped at the tool's max lookback). limit: Max log lines to return (clamped to the tool's max line limit). target: Loki target name from config; omit for the default.

Returns an envelope with returned/limit/truncated. If truncated is true the result is partial — re-run with a higher limit.

[READ] Canned error-level read for a stream selector (error line-filter).

Args: selector: A Loki stream selector (e.g. '{app="api"}' or 'app="api"'). hours: Lookback window in hours (capped at the tool's max lookback). limit: Max log lines to return (clamped to the tool's max line limit). target: Loki target name from config; omit for the default.

Returns an envelope with returned/limit/truncated. If truncated is true the result is partial — re-run with a higher limit.

[READ][analysis] Root-cause an error burst: current window vs baseline, per stream.

Pulls error streams for the current window (now-hours..now) and an equal-length baseline window (now-2*hours..now-hours), then classifies each burst as a new error signature, a volume spike, or a single-instance burst — with a cause + action. Advisory heuristic; verify against the raw logs.

Args: selector: A Loki stream selector to scope the analysis (e.g. '{app="api"}'). hours: Window length in hours for both current and baseline (capped). loki_target: Loki target name from config; omit for the default.

[READ][analysis] Top streams by volume + high-cardinality (high-churn) label warnings.

Ranks the highest-volume streams under the selector, flags labels with many distinct values as cardinality-explosion risks, and adds a retention hint from Loki index stats when available.

Args: selector: A Loki stream selector to scope the analysis (e.g. '{namespace="prod"}'). hours: Lookback window in hours (capped at the tool's max lookback). loki_target: Loki target name from config; omit for the default.

[READ][cross-signal] Correlate a firing Prometheus alert to its Loki log streams.

Reads the firing alert's labels from the Prometheus target, maps the Loki-friendly ones (namespace, job, service, app, container, pod, instance, component — first four, in that priority order) into a LogQL stream selector, and pulls the correlated error streams from the Loki target. Best-effort: label values are escaped into the selector and only labels the alert and Loki actually share will match.

Args: alertname: The firing alert's name (from firing_alerts / firing_alert_rca). hours: Lookback window in hours (capped at the tool's max lookback). target: Prometheus target name from config; omit for the default. loki_target: Loki target name from config; omit for the default.

[READ] Evaluate a PromQL expression at a single instant.

Args: query: A PromQL expression (e.g. 'up' or 'rate(http_requests_total[5m])'). time: Optional RFC-3339 or unix timestamp for the evaluation instant. target: Prometheus target name from config; omit for the default.

Returns an envelope with returned/limit/truncated. If truncated is true the result is partial — narrow the selector or raise the limit rather than treating it as complete.

[READ] Evaluate a PromQL expression over a time range.

Args: query: A PromQL expression. start: Range start (RFC-3339 or unix timestamp). end: Range end (RFC-3339 or unix timestamp). step: Resolution step (e.g. '60s', '5m'). target: Prometheus target name from config; omit for the default.

Returns an envelope with returned/limit/truncated. If truncated is true the result is partial — narrow the selector or raise the limit rather than treating it as complete.

[READ] Distinct values of a label (default name = all metric names).

Args: label: Label name to enumerate (default name). match: Optional PromQL selector to scope the values (e.g. '{job="api"}'). target: Prometheus target name from config; omit for the default.

Returns an envelope with returned/limit/truncated. If truncated is true the result is partial — narrow the selector or raise the limit rather than treating it as complete.

[READ] Series (label-set) metadata for a PromQL selector.

Args: match: A PromQL series selector (e.g. 'up{job="node"}'). start: Optional range start (RFC-3339 or unix timestamp). end: Optional range end (RFC-3339 or unix timestamp). target: Prometheus target name from config; omit for the default.

Returns an envelope with returned/limit/truncated. If truncated is true the result is partial — narrow the selector or raise the limit rather than treating it as complete.

[READ] Platform-aware health snapshot for the target.

Prometheus: firing-alert count + scrape up/down + rules erroring. Grafana: dashboard / datasource / folder counts.

Args: target: Target name from config; omit for the default.

[READ] Running-config fingerprint + size (never the raw YAML/secrets).

Args: target: Prometheus target name from config; omit for the default.

[READ] TSDB head cardinality stats + the top metrics by series count.

Args: target: Prometheus target name from config; omit for the default.

[READ] All recording + alerting rules, optionally filtered by type.

Args: rule_type: Filter by "alerting" or "recording"; omit for both. target: Prometheus target name from config; omit for the default.

[READ] Rule-evaluation health summary + the list of erroring rules.

Args: target: Prometheus target name from config; omit for the default.

[READ] Active scrape targets, optionally filtered by health (up/down).

Args: health: Filter by health state ("up" or "down"); omit for all. target: Prometheus target name from config; omit for the default.

[READ] Up/down scrape-health summary plus the list of unhealthy targets.

Args: target: Prometheus target name from config; omit for the default.

[READ] Targets discovered but dropped by relabeling.

Args: target: Prometheus target name from config; omit for the default.

[READ] List recorded, not-yet-applied undo tokens (most recent first).

Each entry names the original tool, the inverse tool that undo_apply would run, and a human note. Use the undoId with undo_apply.

truncated is measured (one extra row is fetched), not guessed from a length coincidence — when it is true, re-run with a higher limit.

Each entry carries effectVerified. False means the original write lost its response, so the change it reverses is PROBABLE, not confirmed — check the live state before applying, and do not report the result as a restore of a state that may never have been reached.

Args: limit: Max rows to return (default 50). target: Unused (undo state is host-local); accepted for CLI uniformity.

[WRITE][risk=medium] Apply a recorded undo by dispatching its inverse tool.

The inverse runs through its own governed tool, so its real risk tier is recorded there too. Pass dry_run=True to preview the inverse call without executing it. A token can only be applied once.

Args: undo_id: The undoId from undo_list (or an _undo_id in a write result). dry_run: If True, preview the inverse tool + params without running it. target: Passed through to the inverse tool when it accepts a target.

[WRITE][risk=medium] Create a time-boxed Alertmanager silence. Inverse: expire_silence.

Args: matchers: List of {name, value, isRegex?} to match alerts to silence. minutes: Silence duration in minutes (must be > 0; silences are time-boxed). comment: Reason recorded on the silence. dry_run: If True, preview without creating. target: Prometheus target (its Alertmanager); omit for the default.

[WRITE][risk=medium] Expire (delete) an Alertmanager silence by id.

Args: silence_id: The silence id (from list_silences / create_silence). dry_run: If True, preview without expiring. target: Prometheus target (its Alertmanager); omit for the default.

[WRITE][risk=medium] Create a Grafana annotation (an event marker).

Args: text: Annotation text. tags: Optional list of tag strings. dashboard_uid: Optional dashboard UID to attach the annotation to. dry_run: If True, preview without creating. target: Grafana target name from config; omit for the default.

[WRITE][risk=medium] Update a Grafana dashboard. Captures the prior model for undo.

The dashboard model must include its uid. The current model is fetched first and stashed so the harness records a restore undo.

Args: dashboard: Full dashboard model (must include "uid"). overwrite: Overwrite the existing dashboard version (default True). dry_run: If True, preview without updating. target: Grafana target name from config; omit for the default.

[WRITE][risk=high] Delete a Grafana dashboard. Captures the prior model BEFORE delete.

Pass dry_run=True to preview (reports the dashboard title). Optionally set an approver (OBSERVABILITY_AUDIT_APPROVED_BY) to annotate the audit row — it is not required. The prior model is captured so the recorded undo can recreate it.

Args: uid: Dashboard UID to delete (from list_dashboards). dry_run: If True, preview without deleting. target: Grafana target name from config; omit for the default.

[WRITE][risk=medium] Hot-reload the Prometheus config (POST /-/reload). No undo.

Records the pre-reload config hash. Rollback = re-apply the prior config file.

Args: dry_run: If True, preview (reports the current config hash) without reloading. target: Prometheus target name from config; omit for the default.