KubeGuard-MCP

Overview Schema Source Related Servers Discussions Admin

Diagnose a failing pod

diagnose_pod

Read-onlyIdempotent

Correlate Pod JSON, events, logs and manifests to diagnose Kubernetes failures and return root cause, evidence, an exact diff patch and a policy-classified, secret-redacted command plan.

Instructions

Deterministically correlate Pod JSON, Events, container logs and Deployment/Service YAML (plus optional Dockerfile, Secrets metadata, Nodes, Endpoints or docker inspect output) to diagnose OOMKilled, CrashLoopBackOff, ImagePullBackOff, CreateContainerConfigError, Unschedulable and Service port mismatches. Returns the root cause, weighted evidence, an exact unified diff patch and a policy-classified command plan. All secrets are redacted. No LLM, no network.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "diagnose_pod"
  }
}

Input Schema

Name	Required	Description	Default
`pod`	No	kubectl get pod <name> -o json (object or JSON/YAML text)
`logs`	No	kubectl logs <pod> [--previous] output
`nodes`	No	kubectl get nodes -o json (for scheduling analysis)
`events`	No	kubectl get events -o json, an event list, or the plain-text table
`format`	No		markdown
`example`	No	Diagnose one of the bundled offline examples.
`secrets`	No	Secret objects; values are redacted automatically
`endpoints`	No	kubectl get endpoints <svc> -o json
`manifests`	No	Workload/Service YAML or JSON (multi-document OK), or {filename: content}
`dockerfile`	No	Dockerfile content (enables Dockerfile patches)
`bundle_path`	No	Directory containing pod.json, events.json, logs.txt, *.yaml (must be under KUBEGUARD_MCP_ROOTS)
`docker_inspect`	No	docker inspect <container> output

Schema Changelog

Changes observed during successful MCP inspections.

First observedv1.0.0Nov 7, 2026

TDQS

A4.1/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish readOnly/idempotent/non-destructive and closed-world, so the safety profile is covered; the description adds genuinely new behavioral facts beyond that: determinism, no LLM, no network, automatic secret redaction, and the shape of the return payload (root cause, weighted evidence, unified diff patch, policy-classified command plan). These are traits an agent could not infer from annotations alone, though nothing is said about failure modes or how partial inputs degrade the diagnosis.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose and trigger symptoms are front-loaded in the first sentence, with output shape and guarantees following, so structure is sound. The parenthetical list of optional inputs and the comma-separated failure-mode enumeration make it dense, but every clause carries information an agent needs.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 12 all-optional parameters and no output schema, the description does the heavy lifting of describing what comes back (root cause, evidence, patch, command plan), which is the critical missing piece. It is nearly complete, with only minor gaps around what happens when required evidence like pod JSON is omitted and how bundle_path interacts with the other inputs.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 92%, so the schema already documents each parameter's kubectl provenance and the description need not repeat it. The description only adds a light grouping hint (Dockerfile, Secrets metadata, Nodes, Endpoints, docker inspect as optional correlating inputs) and does not clarify the enum parameters format or example beyond what the schema states, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb ("Determine... correlate") and enumerates the exact failure modes it resolves (OOMKilled, CrashLoopBackOff, ImagePullBackOff, CreateContainerConfigError, Unschedulable, Service port mismatches), which cleanly separates it from siblings like redact_logs or validate_manifest. An agent can tell at a glance that this is the deep-diagnosis tool rather than a validator or redactor.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The enumerated symptom list effectively tells the agent when to reach for this tool, and the mention of optional Dockerfile/Secrets/Nodes/Endpoints inputs plus the example and bundle_path parameters hints at alternative input modes. There is no explicit when-not-to-use guidance or a named sibling to fall back on for simpler checks, which keeps it short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server