Skip to main content
Glama
safe-ssh-mcp

safe-ssh-mcp

by Areso

get_journal_errors

Retrieve recent journald entries at warning priority or above from all units and the kernel to identify which service is failing; optionally limit to current boot or a time window.

Instructions

Gets recent journald entries of priority warning and above (warning, err, crit, alert, emerg) from ALL units and the kernel. USE THIS TOOL FIRST when you don't know which service is at fault. With current_boot_only=True only entries since the last boot are returned. Optional since limits them to a time window: '30 min ago', '2 hours ago', 'today', 'yesterday' or 'YYYY-MM-DD HH:MM:SS' (the last lines entries within it are returned).

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "host": "<host>",
      "user": "<user>"
    },
    "name": "get_journal_errors"
  }
}

Input Schema

NameRequiredDescriptionDefault
hostYes
portNo
userYes
linesNo
sinceNo
timeoutNo
key_pathNo
passwordNo
current_boot_onlyNo
accept_new_hostkeyNo

Output Schema

NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv0.2.0

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries the full burden, and it does disclose the important behaviors: the priority threshold, the ALL-units-plus-kernel coverage, the boot-scoping effect of current_boot_only, and the subtle rule that only the last 'lines' entries within the 'since' window are returned. It does not mention SSH connection or authentication requirements, or that the call is a read-only remote operation, which leaves some operational context unstated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the core scope statement, then adds the routing hint and the parameter nuances in short, dense sentences. The enumerated since formats are worth their space. Slight sprawl from mixing usage guidance and parameter detail in one block, but little waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and the filtering behavior is well covered. However, for a 10-parameter remote-SSH tool with zero schema coverage and no annotations, the connection and authentication parameters and any timeout or host-key behavior remain unexplained, leaving real gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 10 parameters, so the description must compensate. It gives genuinely useful semantics for three of them (since with accepted formats, current_boot_only, and lines via the 'last entries within the window' rule), but host, user, port, timeout, key_path, password, and accept_new_hostkey are entirely undocumented, including the security-relevant accept_new_hostkey.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Gets recent journald entries') plus the exact filter scope: priority warning and above, from ALL units and the kernel. An agent can distinguish it from log-oriented siblings like get_dmesg or get_docker_logs because the scope of ALL units plus kernel is explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit routing guidance: 'USE THIS TOOL FIRST when you don't know which service is at fault.' That is a clear when-to-use condition. It stops short of naming when not to use it (for example, when the faulty service is already known, or when dmesg or docker logs is the better source), so it is strong but not complete.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.