[READ] Diagnose redis memory pressure → cause + action, with numbers.

The flagship memory RCA: used vs maxmemory (+ eviction policy — noeviction near the limit means writes will OOM), evicted-keys pressure, fragmentation ratio (high = defrag, below 1 = likely swapping), and the SCAN-budgeted big-key sample. Every finding carries its numbers, not a black-box verdict. Pass 'telemetry' for pure analysis, or a target to pull live.

Args: used_pct: used/maxmemory %% at/above which pressure is flagged (default 85). telemetry: Injected {memory:{...memory_stats fields}, evictedKeys, bigKeys:{topKeys:[...]}}; skips the live pull. target: redis target name from config; omit for the default.

Returns dict: {pressure, usedPctOfMax, maxmemoryPolicy, fragmentationRatio, evictedKeys, thresholds, findings:[{cause, action, evidence}], note}.

[READ] Diagnose redis latency → slowlog digest + stall causes + actions.

The flagship latency RCA: digests the SLOWLOG by command pattern (flagging O(N)/blocking commands), and reads stall signals from INFO — blocked clients, fork stalls (BGSAVE/AOF rewrite), delayed AOF fsyncs (slow disk), and dataset loading. Every finding carries its numbers. Pass 'telemetry' for pure analysis, or a target to pull live.

Args: slow_us: Slowlog duration (microseconds) at/above which a pattern is flagged (default 10000 = 10ms). telemetry: Injected {slowlog:[{command, durationUs}], blockedClients, latestForkUsec, aofDelayedFsync, aofRewriteInProgress, rdbBgsaveInProgress, loading}; skips the live pull. target: redis target name from config; omit for the default.

Returns dict: {slowlogPatterns, patternsOverThreshold, thresholds, findings:[{cause, action, evidence}], note}.

[READ] Rank backlogged queues and map each to a cause + action.

The flagship backlog RCA: flags queues over the backlog threshold and classifies each — no consumers attached, unacked pileup (consumers not acking), publish rate outpacing delivery, or residual backlog — plus global memory/disk watermark alarms that block every publisher via flow control. Every finding carries its numbers. Pass 'queues' (and optionally 'nodes') for pure analysis, or a target to pull live.

Args: vhost: Restrict the live pull to one vhost; omit for all. top: How many queue rows to return, deepest first (default 20). queues: Injected rows {name, vhost, messages, messagesReady, messagesUnacked, consumers, publishRate, deliverRate, state}. nodes: Injected node_health rows {name, memAlarm, diskAlarm, ...}. target: rabbitmq target name from config; omit for the default.

Returns dict: {queuesEvaluated, backloggedCount, globalFindings, queues:[{name, vhost, messages, consumers, cause, action, ...}], thresholds, note}.

[READ] Connection/channel churn → cause + action; works on both platforms.

The flagship churn analysis: for a redis target — new-connections rate vs steady clients (reconnect-per-operation smell) and rejected connections (maxclients); for a rabbitmq target — overview churn rates, channels-per- connection ratio (leak smell), and growth vs a prior snapshot. Both group clients by source so a finding can be pinned to an app. Call it once, keep the returned snapshot fields, and pass them back later as 'history' for delta-based churn. Pass 'snapshot' for pure analysis, or a target to pull live.

Args: snapshot: Injected snapshot (from a prior call's live pull shape); skips the live pull. history: A prior snapshot for delta analysis (optional). target: Broker target name from config; omit for the default.

Returns dict: {platform, metrics, bySource, comparedToHistory, thresholds, findings:[{cause, action, evidence}], note}.

[READ] One-shot summary: platform + version + backlog/memory/client health.

Platform-dispatched: a redis target reports memory posture, clients, ops/sec and hit rate; a rabbitmq target reports queue/message totals, connection/channel counts, rates, and node alarms.

Args: target: Broker target name from config; omit for the default.

[READ] Broker identity + totals: version, queue/message counts, rates, churn.

Args: target: rabbitmq target name from config; omit for the default.

[READ] Queues (optionally one vhost), deepest backlog first.

Args: vhost: Restrict to one vhost (the default vhost is '/'); omit for all. target: rabbitmq target name from config; omit for the default.

Returns an envelope: {"queues": [...], "returned": N, "limit": L, "truncated": bool}. When "truncated" is true there is more than was returned — do not treat this as the complete set.

[READ] One queue's full detail: counts, rates, consumers, memory, arguments.

Args: vhost: The queue's vhost (the default vhost is '/'). name: Queue name (from list_queues). target: rabbitmq target name from config; omit for the default.

[READ] Client connections grouped by peer host, busiest first.

Args: target: rabbitmq target name from config; omit for the default.

Returns an envelope: {"connections": [...], "returned": N, "limit": L, "truncated": bool}. When "truncated" is true there is more than was returned — do not treat this as the complete set.

[READ] Channels with unacked/prefetch pressure, most unacked first.

Args: target: rabbitmq target name from config; omit for the default.

Returns an envelope: {"channels": [...], "returned": N, "limit": L, "truncated": bool}. When "truncated" is true there is more than was returned — do not treat this as the complete set.

[READ] Policies (optionally one vhost) with pattern, priority, definition.

Args: vhost: Restrict to one vhost (the default vhost is '/'); omit for all. target: rabbitmq target name from config; omit for the default.

Returns an envelope: {"policies": [...], "returned": N, "limit": L, "truncated": bool}. When "truncated" is true there is more than was returned — do not treat this as the complete set.

[READ] Node memory/disk/fd posture + watermark alarms, most loaded first.

Args: target: rabbitmq target name from config; omit for the default.

[READ] redis server identity + health basics: version, role, clients, ops/sec, hit rate.

Args: target: redis target name from config; omit for the default.

[READ] redis memory posture: used vs maxmemory, eviction policy, fragmentation, peaks.

Args: target: redis target name from config; omit for the default.

[READ] Connected redis clients grouped by source address, busiest first.

Args: target: redis target name from config; omit for the default.

Returns an envelope: {"clients": [...], "returned": N, "limit": L, "truncated": bool}. When "truncated" is true there is more than was returned — do not treat this as the complete set.

[READ] Recent SLOWLOG entries, slowest first.

Args: count: Max entries to pull (capped at 128). target: redis target name from config; omit for the default.

Returns an envelope: {"entries": [...], "returned": N, "limit": L, "truncated": bool}. When "truncated" is true there is more than was returned — do not treat this as the complete set.

[READ] CONFIG GET for a glob pattern (e.g. 'maxmemory*').

Args: pattern: Config-name glob (default '*'). target: redis target name from config; omit for the default.

[READ] Per-db key counts and expiry coverage from INFO keyspace.

Args: target: redis target name from config; omit for the default.

[READ] SCAN-budgeted big-key sample — largest sampled keys first.

Walks at most 10,000 keys with SCAN and sizes at most 200 of them with MEMORY USAGE (never KEYS *), so it is safe on a production instance; coveragePct reports how partial the sample is.

Args: top: How many key rows to return, largest first (default 20). target: redis target name from config; omit for the default.

Returns an envelope: {"topKeys": [...], "returned": N, "limit": L, "truncated": bool}. When "truncated" is true there is more than was returned — do not treat this as the complete set.

[READ] List recorded, not-yet-applied undo tokens (most recent first).

Each entry names the original tool, the inverse tool that undo_apply would run, and a human note. Use the undoId with undo_apply.

Returns {"undos": [...], "returned": N, "limit": L, "truncated": bool}. truncated is measured (one extra row is fetched), not guessed from a length coincidence: when it is true there are MORE tokens than shown, so re-run with a higher limit rather than reporting the list as complete.

Each entry carries effectVerified. False means the original write lost its response, so the change it reverses is PROBABLE, not confirmed — check the live state before applying, and do not report the result as a restore of a state that may never have been reached.

Args: limit: Max rows to return (default 50, capped at 500). target: Unused (undo state is host-local); accepted for CLI uniformity.

[WRITE][risk=medium] Apply a recorded undo by dispatching its inverse tool.

The inverse runs through its own governed tool, so it is audited under its own risk tier. Pass dry_run=True to preview the inverse call without executing it. A token can only be applied once.

Args: undo_id: The undoId from undo_list (or an _undo_id in a write result). dry_run: If True, preview the inverse tool + params without running it. target: Passed through to the inverse tool when it accepts a target.

[WRITE][risk=medium] Set one redis config parameter; reversible.

Reads the parameter first (CONFIG GET) so the harness records an undo that restores its prior value. Runtime-only — not persisted to the config file. Pass dry_run=True to preview.

Refuses the parameters that would lock this tool out of the instance (requirepass, masterauth, bind, port, protected-mode, maxclients, unixsocket, aclfile, tls-*) — the undo could never be replayed over a connection those settings break. Change those in redis.conf and restart. The refusal applies under dry_run too: a preview whose real call would be refused must report that, not a green 'wouldSet'.

Args: parameter: Config parameter name (e.g. maxmemory-policy), from redis_config_get. value: New value. dry_run: If True, preview without changing. target: redis target name from config; omit for the default.

[WRITE][risk=medium] Disconnect one redis client by id or addr. IRREVERSIBLE.

Captures the client's CLIENT LIST row as priorState (who/where/last command) before the kill — the connection cannot be restored, so no undo is recorded; most clients transparently reconnect. Pass dry_run=True to preview.

Refuses this tool's own connection, by id or by addr — including under dry_run, which must report a refusal rather than preview a call that will be refused.

Args: client_id: Client id from redis_clients (preferred). addr: Or the client's 'ip:port' address. dry_run: If True, preview without disconnecting. target: redis target name from config; omit for the default.

[WRITE][risk=high] Purge all ready messages from a rabbitmq queue. IRREVERSIBLE.

Reads the queue first so priorState carries the message count about to be destroyed (audit evidence); unacked messages are not purged. No undo — purged messages cannot be restored. Pass dry_run=True to preview.

Args: vhost: The queue's vhost (the default vhost is '/'). name: Queue name (from list_queues). dry_run: If True, preview without purging. target: rabbitmq target name from config; omit for the default.

[WRITE][risk=high] Delete a rabbitmq queue; the undo re-declares its definition.

Reads the queue first so priorState carries the definition (durable / auto_delete / arguments) and message count; the recorded undo re-declares the queue with those properties — its messages are NOT restored. Pass dry_run=True to preview.

Args: vhost: The queue's vhost (the default vhost is '/'). name: Queue name (from list_queues). dry_run: If True, preview without deleting. target: rabbitmq target name from config; omit for the default.

[WRITE][risk=medium] Declare (create) a rabbitmq queue; undo deletes it if new.

Records whether the queue already existed; the undo (delete) is recorded only for a newly-created queue. Also the replay target for delete_queue's undo. Pass dry_run=True to preview.

Args: vhost: The queue's vhost (the default vhost is '/'). name: Queue name to declare. durable: Survive broker restarts (default True). auto_delete: Delete when the last consumer disconnects (default False). arguments: Optional x-arguments (e.g. {'x-queue-type': 'quorum'}). dry_run: If True, preview without declaring. target: rabbitmq target name from config; omit for the default.

[WRITE][risk=medium] Create/update a rabbitmq policy; reversible.

Reads the policy first: the recorded undo restores the prior policy fields, or deletes the policy when it is newly created. Pass dry_run=True to preview.

Args: vhost: The policy's vhost (the default vhost is '/'). name: Policy name. pattern: Regex the policy matches queue/exchange names against. definition: Policy definition object (e.g. {'max-length': 100000}). priority: Policy priority (higher wins; default 0). apply_to: 'queues', 'exchanges', or 'all' (default). dry_run: If True, preview without changing. target: rabbitmq target name from config; omit for the default.

[WRITE][risk=medium] Delete a rabbitmq policy; the undo re-creates it.

Reads the policy first so the recorded undo can re-create it exactly. Pass dry_run=True to preview.

Args: vhost: The policy's vhost (the default vhost is '/'). name: Policy name (from list_policies). dry_run: If True, preview without deleting. target: rabbitmq target name from config; omit for the default.