Skip to main content
Glama
safe-ssh-mcp

safe-ssh-mcp

by Areso

get_kubectl_logs

Fetch recent logs from a specific Kubernetes pod by running kubectl on a remote Linux host over SSH; target containers, previous crashed instances, or time windows for diagnosis.

Instructions

Gets the last lines log lines of a SPECIFIC kubernetes pod (kubectl logs) by running kubectl on a remote Linux host via SSH. kubectl must be configured for the SSH user there. container selects a container in a multi-container pod. previous=True returns logs of the previous, crashed instance - use it for CrashLoopBackOff. Optional since limits them to a time window: '30 min ago', '2 hours ago', '30m', '1h30m' or an absolute UTC time 'YYYY-MM-DDTHH:MM:SSZ'.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "pod": "<pod>",
      "host": "<host>",
      "user": "<user>"
    },
    "name": "get_kubectl_logs"
  }
}

Input Schema

NameRequiredDescriptionDefault
podYes
hostYes
portNo
userYes
linesNo
sinceNo
timeoutNo
key_pathNo
passwordNo
previousNo
containerNo
namespaceNodefault
accept_new_hostkeyNo

Output Schema

NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv0.2.0

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose useful behavior: the call runs kubectl remotely via SSH and requires kubectl to be preconfigured for that SSH user. But it is silent on security- and failure-relevant behavior for a 13-parameter remote-execution tool — notably what accept_new_hostkey does, how password vs key_path auth is handled, and what timeout governs (connection vs command).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Content is front-loaded with the operation and mechanism, then narrows to pod/container/previous/since specifics; every sentence adds information. Slight awkwardness in 'Optional since limits them to a time window' and no explicit grouping of the connection vs log-selection parameters.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, and the log-selection semantics are reasonably covered. However, for a 13-parameter SSH tool with zero annotation coverage, the description leaves the namespace scoping, authentication parameters, host-key handling, and timeout semantics entirely to the schema, which documents none of them.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the tool has 13 parameters, so the description must compensate — and it only meaningfully explains four of them: lines, container, previous, and since (including accepted time formats and absolute UTC form). Critical parameters such as namespace (whose 'default' value silently narrows results), host, user, key_path, password, timeout, and accept_new_hostkey get no explanation at all.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: retrieve the last `lines` log lines of a SPECIFIC kubernetes pod via `kubectl logs`, executed over SSH on a remote Linux host. That mechanism detail (kubectl-over-SSH) plus the emphasis on a single named pod cleanly separates it from describe/events style siblings and from docker/crictl log tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete condition-based guidance: previous=True is explicitly recommended for CrashLoopBackOff, and container is called out for multi-container pods. Also states the prerequisite that kubectl must be configured for the SSH user on the remote host. It does not name alternative tools (get_docker_logs, get_crictl_logs, journalctl) or say when not to use this one.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.