Skip to main content
Glama
BenedatLLC

Kubernetes Tools MCP Server

by BenedatLLC

get_events

List cluster- or namespace-wide Kubernetes events filtered by reason, type, or involved object to diagnose evictions, scheduling failures, and warnings.

Instructions

Lists cluster- or namespace-wide events with optional server-side filtering.

Unlike `get_pod_events` (which is scoped to a single named pod), this supports
the sweep queries common in capacity/storage runbooks — e.g. all "Evicted"
events, or all "FailedScheduling" events — where the affected pods often have no
stable name to look up. Note Kubernetes expires an event record about an hour
(by default) after its last occurrence, so events that stopped repeating
earlier than that are gone.

Parameters
----------
namespace : Optional[str], default=None
    Namespace to list events from. If None, lists across all namespaces.
reason : Optional[str], default=None
    If set, only return events with this reason (e.g. "Evicted",
    "FailedScheduling", "BackOff").
involved_kind : Optional[str], default=None
    If set, only return events whose involved object is of this kind (e.g.
    "Pod", "Node", "PersistentVolumeClaim").
involved_name : Optional[str], default=None
    If set, only return events whose involved object has this name.
event_type : Optional[str], default=None
    If set, only return events of this type ("Normal" or "Warning").

Returns
-------
list of EventSummary
    Matching events. Each EventSummary has the following fields:

    last_seen : Optional[datetime.timedelta]
        Time since the event was last seen (if available).
    first_seen : Optional[datetime.timedelta]
        Time since the first occurrence combined into this record (if
        available).
    count : Optional[int]
        How many occurrences Kubernetes combined into this record: repeats
        of the same event on the same object are counted in one record
        rather than listed separately. The count covers first_seen to
        last_seen, not the object's lifetime - a record that stops repeating
        expires (after 1h by default), and a later repeat starts a new one.
        For a crash-looping container, count the "Created" or "Started"
        events to get restarts. "BackOff" is emitted repeatedly while the
        kubelet waits to restart, so its count is several times the number
        of restarts. count divided by (first_seen - last_seen) is the
        average rate over that window, not the current back-off.

        A record can lag behind what it counts. By default the kubelet
        writes at most one event update per object and event type
        ("Normal" or "Warning") every 5 minutes, once a burst of 25 is
        used up; occurrences in between are counted but only written with
        the next update, which then jumps by several at once. So count and
        last_seen describe the most recent *written* occurrence and can
        trail reality by several occurrences and tens of minutes. They lag
        together, so the rate above still holds, but last_seen is not the
        time of the last restart: for that, use the container status
        (last_state.finished_at, state.started_at from
        get_pod_container_statuses) or PodSummary.last_restart, which come
        from the kubelet's status rather than from events. "Pulled",
        "Created" and "Started" share one write budget, so their counts for
        the same restarts can differ by a few; don't compare counts across
        reasons.
    type : str
        Type of the event ("Normal" or "Warning").
    reason : str
        Reason for the event.
    object : str
        The involved object as "Kind/name" (or just the name when the kind is
        unavailable).
    message : str
        Message describing the event.

Raises
------
K8sConfigError
    If unable to initialize the K8S API.
K8sApiError
    If the API call to list events fails.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
reasonNo
namespaceNo
event_typeNo
involved_kindNo
involved_nameNo

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
resultYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv2.1.0

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries the full burden and does so: it discloses the ~1h event expiry, that `count` aggregates repeats from first_seen to last_seen, the kubelet's 5-minute/25-burst write budget that makes counts and last_seen lag reality, and which alternative sources (get_pod_container_statuses, PodSummary.last_restart) give true restart times. It also documents the raised errors (K8sConfigError, K8sApiError).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose and sibling disambiguation, then clearly sectioned Parameters/Returns/Raises. It is long and partly redundant — the 1-hour expiry is stated twice and the count/rate caveat is re-explained across two paragraphs — and much of the Returns prose restates an output schema that already exists.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 5-optional-param query tool with no annotations, the definition covers everything needed: filtering semantics, retention limits, aggregation/lag pitfalls, error modes, and pointers to better sources for restart timing. Nothing an agent must know before calling it is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it does for all five parameters: types, defaults (None meaning all-namespaces), and concrete accepted values/examples for reason, involved_kind and event_type ("Normal"/"Warning"). This adds meaning entirely absent from the bare anyOf/null schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (lists), resource (cluster- or namespace-wide events) and scope (server-side filtering), then explicitly contrasts with the sibling `get_pod_events` and names the workload types (capacity/storage runbooks) it serves. An agent can pick between the two event tools without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says when to use this vs. `get_pod_events` ("scoped to a single named pod"), gives concrete trigger scenarios (all Evicted / FailedScheduling events where pods have no stable name), and adds a retention caveat (events expire ~1h after last occurrence) that affects whether the query is even worth running.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.