[READ] Down upstreams grouped per service, each mapped to cause + action.

The flagship availability RCA: pulls server-level upstream health, groups per service, and classifies each outage/degradation (connection refused, L4/L7 health-check failure class, DNS, admin maint/drain, all-servers-down) with a recommended action. Every finding carries its numbers. Pass 'upstreams' for pure analysis, or a target to pull live.

Args: service: Optional service/backend filter when pulling live. upstreams: Injected rows {service, server, address, status, checkInfo}; skips the live pull. target: Proxy target name from config; omit for the default.

Returns dict: {servicesEvaluated, outages, degraded, findings:[{service, serversTotal, up, down, maint, failingServers, cause, action}], note}.

[READ] TLS cert inventory bucketed by days-to-expiry + renewal hints.

The flagship cert sweep for traefik/caddy targets: collects the TLS domain inventory, live-probes each domain's served leaf cert (bounded handshake), and buckets by expiry: expired / critical / warning / ok — with a platform-specific renewal hint (ACME resolver / storage checks). Pass 'certs' for pure analysis over {domain, daysToExpiry} rows. haproxy targets return the support matrix's teaching note.

Args: warn_days: Days-to-expiry at/below which a cert is a warning (default 30). critical_days: Days at/below which a cert is critical (default 7). port: TLS port to probe (default 443). certs: Injected rows {domain, daysToExpiry, notAfter?}; skips pull+probe. target: Proxy target name from config; omit for the default.

Returns dict: {certsEvaluated, expired, critical, warning, ok, unknown, certificates (soonest first), thresholds, renewalHint, note}.

[READ] Rank services by 5xx share vs the fleet baseline, cause + action.

The flagship error RCA: reads per-service status-code counters (traefik /metrics, haproxy stats), flags services whose 5xx rate crosses the threshold with enough traffic, and maps the dominant code to a cause (503 no-upstream / 502 conn-fail / 504 timeout / 500 app error). Every entry carries its numbers and its multiple vs the fleet baseline. Pass 'counters' for pure analysis. caddy targets return the support matrix's teaching note (no per-route counters).

Args: error_rate_pct: 5xx %% at/above which a service is flagged (default 5.0). min_requests: Minimum requests before a service can be flagged (default 30). counters: Injected rows {service, total, codes:{...}} and/or classes:{"5xx": n}; skips the live pull. target: Proxy target name from config; omit for the default.

Returns dict: {servicesEvaluated, flaggedCount, fleetErrorRatePct, thresholds, flagged:[{service, requestsTotal, errors5xx, errorRatePct, dominantCode, vsBaselineX, severity, cause, action}], note}.

[READ] Shadowed routes, dead routes, and redirect loops (static).

The flagship routing hygiene analysis: fetches the route table and service list and statically finds (1) routes fully covered by an earlier/higher- priority route (they can never match), (2) routes pointing at a missing service or one with zero servers up, and (3) redirect chains that loop. Every finding names the covering route / missing service. Pass 'routes' (and optionally 'services') for pure analysis.

Args: routes: Injected rows {name, hosts, paths, priority, service, enabled, redirectTo}; skips the live pull. services: Injected rows {name, serversTotal, serversUp} for dead-route detection. target: Proxy target name from config; omit for the default.

Returns dict: {routesEvaluated, shadowedCount, deadCount, redirectLoopCount, shadowedRoutes, deadRoutes, redirectLoops, note}.

[READ] TLS domain inventory for a traefik/caddy target; optionally handshake-probe each domain for its live expiry.

On haproxy this returns the support matrix's teaching note (certs are .pem files in haproxy.cfg).

Args: probe: If True, TLS-handshake each domain (bounded) to read expiry. port: TLS port to probe (default 443). target: Proxy target name from config; omit for the default.

[READ] The live config tree (caddy /config/) or merged dynamic state (traefik /api/rawdata), sanitised and bounded. haproxy returns the support matrix's teaching note.

Args: target: Proxy target name from config; omit for the default.

[READ] Search the config tree for a string; returns matching config paths (on caddy, directly usable by get/set_config_value).

Args: query: Case-insensitive substring to find in keys and values. target: Proxy target name from config; omit for the default.

Returns an envelope: {"matches": [...], "returned": N, "limit": L, "truncated": bool}. When "truncated" is true there is more than was returned — narrow the query rather than treating these as every match.

[READ] One value out of the caddy config tree by config path (e.g. apps/http/servers/srv0/routes/0). Off-caddy platforms return the support matrix's teaching note.

Args: path: Slash-separated config path (dot-segments rejected). target: Proxy target name from config; omit for the default.

[READ] Routes normalised across platforms: {name, hosts, paths, priority, service, tls, enabled, redirectTo}.

Traefik router names and caddy config paths (apps/http/servers/...) come back exactly as the other tools expect them.

Args: host: Optional hostname filter (keeps host-less catch-alls). target: Proxy target name from config; omit for the default.

[READ] One route's full detail by name (from list_routes).

Args: name: Route name — traefik router name, caddy route config path, or haproxy frontend name. target: Proxy target name from config; omit for the default.

[READ] Which routes would serve a host/path (static match, best first).

Args: host: Hostname to match (e.g. app.example.com). path: Request path to match (default /). target: Proxy target name from config; omit for the default.

[READ] Services / backends with per-service server-up counts.

Args: target: Proxy target name from config; omit for the default.

[READ] One service/backend's full detail by name (from list_services).

Args: name: Service name — traefik service name, caddy route config path, or haproxy backend name. target: Proxy target name from config; omit for the default.

[READ] Server-level upstream health rows: {service, server, address, status(up/down/maint/drain), checkInfo, weight}. Feeds backend_health_rca.

Args: service: Optional service/backend filter. target: Proxy target name from config; omit for the default.

[READ] One upstream server's health/state row.

Args: service: Service/backend name. server: Server name or address (from list_upstreams). target: Proxy target name from config; omit for the default.

[READ] Middlewares (traefik). On caddy/haproxy this returns the support matrix's teaching note (their equivalents live inside routes / haproxy.cfg).

Args: target: Proxy target name from config; omit for the default.

[READ] One-shot summary: platform/version + route/service counts + upstream up/down health.

Args: target: Proxy target name from config; omit for the default.

[READ] Version / build info (traefik /api/version, haproxy /v2/info; caddy returns a teaching note — its admin API has no version endpoint).

Args: target: Proxy target name from config; omit for the default.

[READ] Listeners: traefik entrypoints / caddy server listen addresses / haproxy frontends — where traffic enters this proxy.

Args: target: Proxy target name from config; omit for the default.

[READ] Per-service traffic snapshot: requests, latency/rate/sessions where the platform exposes it (traefik /metrics, haproxy stats; caddy returns the support matrix's teaching note).

Args: target: Proxy target name from config; omit for the default.

Returns an envelope: {"services": [...], "returned": N, "limit": L, "truncated": bool, "total": T}. When "truncated" is true this proxy serves more services than were returned.

[READ] Per-service request/status-code counters (feeds error_rate_rca).

traefik: parsed from the /metrics text endpoint (per-code); haproxy: Data Plane stats (per-class hrsp_*); caddy: teaching note (no per-route counters).

Args: target: Proxy target name from config; omit for the default.

Returns an envelope: {"services": [...], "returned": N, "limit": L, "truncated": bool, "total": T}. When "truncated" is true this proxy serves more services than were returned (only the busiest services are returned).

[READ] List recorded, not-yet-applied undo tokens (most recent first).

Each entry names the original tool, the inverse tool that undo_apply would run, and a human note. Use the undoId with undo_apply.

Returns {"undos": [...], "returned": N, "limit": L, "truncated": bool}. truncated is measured (one extra row is fetched), not guessed from a length coincidence: when it is true there are MORE tokens than shown, so re-run with a higher limit rather than reporting the list as complete.

Each entry carries effectVerified. False means the original write lost its response, so the change it reverses is PROBABLE, not confirmed — check the live state before applying, and do not report the result as a restore of a state that may never have been reached.

Args: limit: Max rows to return (default 50, capped at 500). target: Unused (undo state is host-local); accepted for CLI uniformity.

[WRITE][risk=medium] Apply a recorded undo by dispatching its inverse tool.

The inverse runs through its own governed tool, so it is audited under its own risk tier. Pass dry_run=True to preview the inverse call without executing it. A token can only be applied once.

Args: undo_id: The undoId from undo_list (or an _undo_id in a write result). dry_run: If True, preview the inverse tool + params without running it. target: Passed through to the inverse tool when it accepts a target.

[WRITE][risk=medium] Set a caddy config subtree (e.g. a route's upstreams); reversible — the prior subtree is fetched first and the undo restores it.

Caddy applies the change immediately. On traefik/haproxy this raises the support matrix's teaching error. Pass dry_run=True to preview.

Refuses the 'admin' subtree: that configures the admin API this tool speaks to, so disabling or moving it would end the connection the undo needs. Change the admin block in caddy's own config file and reload locally. The refusal applies under dry_run too — a preview whose real call would be refused must report that, not a green 'wouldSet'.

Args: path: Slash-separated config path (from search_config / list_routes, e.g. apps/http/servers/srv0/routes/0/handle/0/upstreams). value: The JSON value to write at that path. insert: Insert into an array at that index instead of replacing. This is what re-creating a deleted array element requires — Caddy rejects a create at an index past the (now shorter) array. dry_run: If True, preview without changing. target: Proxy target name from config; omit for the default.

[WRITE][risk=high] Delete a caddy config subtree; reversible — the subtree is captured first and the undo re-creates it.

Pass dry_run=True to preview.

Refuses the 'admin' subtree and the config root: both remove the admin API this tool speaks to, leaving the undo with no way to reach the server. The refusal applies under dry_run too, which must report it rather than preview a call that will be refused.

Args: path: Slash-separated config path to delete. dry_run: If True, preview without deleting. target: Proxy target name from config; omit for the default.

[WRITE][risk=high] Replace caddy's FULL running config; reversible — the prior config is snapshotted first and the undo re-loads it.

Pass dry_run=True to preview.

Refuses a config that disables the admin API or moves admin.listen off the configured base_url — the undo re-POSTs the snapshot over that same API. Send the admin block unchanged, or omit it. The refusal applies under dry_run too, which must report it rather than preview a refused call.

Args: config: The full config tree to load (a JSON object). dry_run: If True, preview without loading. target: Proxy target name from config; omit for the default.

[WRITE][risk=medium] Set an haproxy server's admin state (ready / drain / maint); reversible — the prior admin state is fetched first and the undo restores it.

drain finishes in-flight sessions but takes no new ones; maint removes the server immediately; ready returns it to rotation. On traefik/caddy this raises the support matrix's teaching error. Pass dry_run=True to preview.

Args: backend: Backend name (from list_services). server: Server name inside the backend (from list_upstreams). state: One of ready, drain, maint. dry_run: If True, preview without changing. target: Proxy target name from config; omit for the default.

[WRITE][risk=medium] Set an haproxy server's load-balancing weight (0-256); reversible — the prior weight is fetched first and the undo restores it.

Weight 0 stops new traffic to the server without a state change. On traefik/caddy this raises the support matrix's teaching error. Pass dry_run=True to preview.

Args: backend: Backend name (from list_services). server: Server name inside the backend (from list_upstreams). weight: New weight, 0-256. dry_run: If True, preview without changing. target: Proxy target name from config; omit for the default.