Skip to main content
Glama
CyberKnightLabs

vmware-knight

host_investigation_bundle

Read-onlyIdempotent

Investigate an ESXi host's health in one drill-down. Correlate state, cluster, VMs, datastores, alarms, performance, and event timeline to identify root causes after a cluster alert.

Instructions

[READ] "What is happening around this ESXi host?" — one correlated drill-down.

Correlates a host's state (connection, CPU/memory, ESXi version, uptime), its cluster context, a rollup of the VMs it runs, the datastores it mounts, alarms across host/cluster/datastore, live performance, and a merged event timeline. Delegates to the vmware-monitor library (read-only); do not dump the result raw.

Use this AFTER cluster_health_summary flags a host. Point-in-time.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
hoursNoEvent-timeline look-back window in hours (default 24).
targetNoOptional vCenter/ESXi target name from config (default if omitted).
host_nameYesHost name as shown in vCenter/ESXi, in any case, or its short form, or the host's management IP. On a standalone ESXi target, the target's name or tag also works. Unknown names list the hosts that exist.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.12.10

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds useful behavioral context beyond those: it delegates to the vmware-monitor library, instructs the agent not to dump the result raw, and notes the result is point-in-time. This helps set expectations about how the tool behaves and how its output should be consumed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with a clear question and purpose, followed by a compact list of correlated data, then workflow guidance. It is a little list-heavy, but every sentence contributes to either purpose, usage, or safe handling. No filler or tautology.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only investigation bundle with no output schema, the description covers the main data categories returned, the trigger condition, read-only safety, and the point-in-time nature. It does not describe return formatting or potential error behavior, which would make it fully complete, but it gives sufficient context for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema coverage is 100%, with each parameter already described in detail (host_name aliasing, hours look-back, optional target). The description does not add parameter-level semantics beyond what the schema provides, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear, specific question and states the tool correlates a host's state, cluster context, VMs, datastores, alarms, live performance, and a merged event timeline. This clearly identifies the resource (host) and the action (correlated drill-down), and differentiates it from sibling investigation bundles by explicitly centering on the host.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives an explicit usage trigger: 'Use this AFTER cluster_health_summary flags a host.' This names a sibling tool and the condition under which this tool becomes relevant. It does not spell out when-not-to-use alternatives like vm_investigation_bundle or datastore_investigation_bundle, but the workflow guidance is clear and actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.