MCP server package version only—not image builds or compose status. Use ONLY if the user asks for the Red Hat Insights MCP server version, or when there is an API or authentication issue. If the latest version check is disabled, return only the current version. Otherwise, present the comparison URL to the user.

🟢 OpenAPI spec. Optional endpoints=GET:/blueprints,POST:/blueprints to shrink payload.

🟢 List blueprints. Use limit/offset from the user. Paging hints in response footer.

🟢 Blueprint details by UUID, name, or reply_id from get_blueprints.

🟢 List image builds (composes) with status; newest first. limit/offset default 7, 0.

🟢 One compose/image build status & details. UUID from get_composes—not "latest" alone.

🟢 List RHEL distributions (latest minor per major). No Fedora/CentOS Stream support.

🟢 RHEL org ID for blueprint registration. Never invent org IDs.

Get the list of activation keys available to the authenticated user.

🟢 CALL IMMEDIATELY - No information gathering required.

This endpoint returns activation keys that can be used for RHEL system registration. Activation keys contain subscription and configuration information needed to register systems with Red Hat Subscription Management.

If the user has more questions about the activation keys, ask the user to go to https://console.redhat.com/insights/connector/activation-keys

Returns: List of activation keys with their details including names, descriptions, and associated subscriptions.

Get a specific activation key by name.

🟢 CALL IMMEDIATELY - No information gathering required.

This endpoint returns details for a specific activation key including its name, description, service level, role, usage, release version, and additional repositories.

Returns: Activation key details including configuration and subscription information.

Get Red Hat Insights Vulnerability OpenAPI specification in JSON format.

Show, list, or display CVEs — account-level or for a specific system — in an interactive dashboard.

PREFER this tool over get_cves and get_system_cves whenever the user wants to see, show, list, or display CVEs, whether for the entire account or for a specific system. Use get_cves or get_system_cves only when you need the raw data for analysis or processing. The dashboard fetches data directly from the server. If system_uuid is provided, it fetches system-level CVEs. Otherwise, it fetches account-level CVEs. All filter parameters are optional.

Get list of CVEs affecting the account.

This provides an overview of vulnerabilities across your entire system inventory. Use this endpoint to get an overview of which CVEs are affecting your account, including some CVE metadata, how many systems are affected by each CVE, and more. For more info refer to OpenAPI spec

Get details about specific CVE.

This endpoint returns the CVE identification number, description, scores and other metadata. The metadata includes the description, CVSS 2/3 Score, CVSS 2/3 attack vector, severity, public date, modified date, business risk, status, a URL to Red Hat web pages, a list of advisories remediating the CVE, and information regarding known exploits for the CVE. For more info refer to OpenAPI spec

Get list of systems affected by a given CVE.

This is a report of affected systems for a given CVE. Use this tool to obtain list of all affected systems for a given CVE. For more info refer to OpenAPI spec

Get list of CVEs affecting a given system.

IMPORTANT: Prefer get_cves as get_cves can filter for CVEs with available advisories.

This is a report of CVEs affecting a given system. Use this tool to obtain list of all CVEs affecting a given system. For more info refer to OpenAPI spec

Get list of systems in Red Hat Insights Vulnerability inventory.

List all systems registered in Red Hat Insights Vulnerability service, including information about their last check-in, system name, workspace name, RHEL version, and number of CVEs affecting them. This tool shows both affected and not affected systems. For more info refer to OpenAPI spec

Explain why CVEs are affecting my environment.

This endpoint returns a detailed explanation of why CVEs are affecting my environment. It uses VMAAS to explain the CVEs, what packages are affected and why. Alongside with the information how this CVE can be fixed. To get the explanation, we need to get the system UUID from the inventory and list of CVEs. 'affected_packages' in 'vmaas' response is a list of packages that are affected by the CVE.

To update affected packages, suggest to use Ansible Remediation Playbook via Remediations MCP tool.

Get active Advisor Recommendations affecting system health, security, or performance.

Lists omit playbooks; use get_rule_details for remediation. impacting=true (default) is usually preferred; impacting=false returns the global catalog.

Find Advisor Recommendations linked to a Knowledge Base article or solution ID.

Get full Advisor Recommendation details including remediation playbooks (resolution_set).

List RHEL systems affected by a specific Advisor Recommendation.

Get paginated detailed information about systems affected by an Advisor Recommendation.

Find Advisor Recommendations containing an exact text substring.

Lists omit playbooks; use get_rule_details for remediation.

Show statistics of recommendations across categories and risks.

Show, list, or display fleet inventory in an interactive dashboard.

PREFER this tool over list_hosts whenever the user wants to see, show, list, or display hosts or fleet inventory. Use list_hosts only when you need the raw data for analysis or processing. The dashboard fetches data directly from the server. All filter parameters are optional.

List hosts with filtering and sorting options. CRITICAL: For the 'per_page' parameter, you MUST use a value of 10 on the first call to avoid performance degradation and context overflow. Only use a larger value if the user explicitly requests to see more systems at once.

Get detailed information for specific hosts by their IDs.

Returns comprehensive host data including identifiers (insights_id, satellite_id, bios_uuid), display names, network info (IP/MAC addresses), cloud provider details, account/org metadata, timestamps (created, updated, stale_timestamp), reporter info, groups, facts, and basic system_profile data.

Get detailed system profile information for specific hosts.

Returns comprehensive hardware and software configuration data including CPU details (model, count, cores per socket), memory info (system_memory_bytes), infrastructure details (type, vendor), network interfaces, disk devices, BIOS information, and various system state data. For RHEL hosts, also includes software information such as enabled repositories, installed packages, and enabled services. This provides the most detailed technical specifications for each host.

Get tags for specific hosts.

Find a host by its hostname/display name.

List Inventory workspaces (console UI name for Inventory groups).

Call this tool whenever the user asks to list, show, or get workspaces. Do not invent workspace names such as Ungrouped Hosts without calling this API. Each result includes id, name, ungrouped, and host_count. Prefer workspace IDs in later calls; names can be duplicated.

Required permission: inventory:groups:read (Workspace viewer).

Get details for one or more workspaces by ID.

Returns id, name, ungrouped, host_count, and timestamps for each workspace. Required permission: inventory:groups:read (Workspace viewer).

List hosts that belong to a workspace.

Use list_workspaces first to obtain the workspace ID. Required permission: inventory:hosts:read (Inventory Hosts viewer).

List repositories with filtering and pagination options.

🟢 CALL IMMEDIATELY - No information gathering required.

Each repository is a summary (identity, URL, origin, distribution, counts, and status). GPG keys, snapshots, and introspection details are omitted. Use get_repository for one UUID.

Get full details for one repository by UUID.

Call only for a single repository UUID from list_repositories or supplied by the user. Returns the complete repository, including the GPG key, snapshot, and introspection fields.

Get OCP Advisor backend health, deployed OCP rules version, and release metadata.

🟢 CALL IMMEDIATELY - No information gathering required.

Returns internal Smart Proxy, Insights Results Aggregator, and Content Service status/build/version metadata from the unauthenticated /info endpoint. This is primarily useful for service diagnostics, release verification, and backend health checks; it does not return Advisor recommendations or cluster findings.

Diagnose a 403 access denial for a specific MCP tool call.

Returns only the console role names the caller is missing. Use this instead of guessing permission or role names.

The authenticated principal is usually the MCP service account when using client ID/secret in the environment—not the console user in chat.

Return the console role names required for an MCP tool.

This reports required roles without checking the authenticated caller's current access. Use explain_access_denied after a 403 response.

Get RBAC access for the authenticated caller for one application.

Returns permissions for the identity used by this MCP server (service account or Bearer token)—not necessarily the human user.

List all RBAC permissions for the authenticated MCP caller (paginated fetch).

Permissions apply to the service account or Bearer identity used by MCP—not your console user unless that identity is what MCP uses.

List upcoming package changes, deprecations, additions and enhancements.

🟢 CALL IMMEDIATELY - No information gathering required.

Use this tool to answer questions about upcoming package changes, deprecations, additions, or enhancements in the roadmap when a full list of upcoming items is acceptable. When the user asks about a specific RHEL version (for example, "What is coming in RHEL 9.4?"), call this tool without parameters and then filter and summarize the entries relevant to that version in your response.

Returns: dict: A response object containing: - meta: Metadata including 'count' and 'total'. - data: A list of package records. Each record contains: - name (str): The package name. - type (str): The change type (e.g., 'addition'). - release (str): The target release version. - details (dict): Detailed info including 'summary' and 'dateAdded'.

Get Application Streams lifecycle information.

🟢 CALL IMMEDIATELY - No information gathering required.

Use this tool when the user asks about Application Streams lifecycle (modules or packages) or wants to understand what streams exist for specific RHEL versions.

Guidance:

• For detailed lifecycle of modules/packages on a specific RHEL major, use mode="raw" and set 'major'.

• For an overview across RHEL generations (e.g. "what nginx streams exist in 8/9/10"), use mode="streams".

• When the user mentions a human-friendly stream name like ".NET 7", use 'application_stream_name'.

• When the user mentions the technical module/package name, use 'name'.

• Only use 'kind' when the user explicitly distinguishes between module and package implementations.

Returns: str: A JSON-encoded response object containing: - meta: Metadata including: - count (int): Number of records returned in this page. - total (int): Total number of matching records. - data: A list of Application Stream lifecycle records. Each record typically contains: - name (str): Technical package or module name (e.g. 'aspnetcore-runtime-8.0'). - display_name (str): Human-friendly display name (e.g. '.NET 8'). - application_stream_name (str): Application Stream name (e.g. '.NET 8', 'PostgreSQL 16', 'container-tools'). - application_stream_type (str | null): Stream type label (e.g. 'Application Stream', 'Full Life Application Stream', 'Rolling Application Stream'). - stream (str): Stream identifier or version (e.g. '8.0.13', '1.24', '1.14.0'). - start_date (str | null): Planned start date for the stream, in ISO format (YYYY-MM-DD). - end_date (str | null): Planned end-of-life date for the stream, in ISO format (YYYY-MM-DD). - impl (str): Implementation kind (e.g. 'package' or 'dnf_module'). - initial_product_version (str | null): First RHEL product version where this stream is available (e.g. '9.4', '10.0'). - support_status (str): Calculated support status (e.g. 'Supported', 'Near retirement', 'Retired'). - os_major (int | null): RHEL major version (e.g. 8, 9, 10). - os_minor (int | null): RHEL minor version where the stream first appears (e.g. 0, 4). - lifecycle (dict | null): Reserved for additional lifecycle metadata (may be null). - rolling (bool): Indicates whether this is a rolling Application Stream (True) or a fixed-lifecycle stream (False).

Returns life cycle dates for all RHEL majors and minors.

🟢 CALL IMMEDIATELY - No information gathering required.

Use this tool when the user asks for RHEL versions and lifecycle timelines, including major versions, minor versions, or extended support types (EUS/E4S/ELS).

For "major-only" versions and timelines (for example, "RHEL 8 lifecycle overview"), call this tool and then focus on rows where minor is null. Filtering is performed by you, not the MCP tool.

For a specific minor (for example, "RHEL 9.2 EUS lifecycle"), call this tool and then focus on entries matching the requested major and minor. Interpretation of date windows or version selection is done by you.

When the user mentions dates or "expiring within N days", call this tool and interpret the start_date / end_date values to identify relevant versions. Interpretation of date windows or version selection is done by you.

Returns: dict: A response object containing: - data: A list of RHEL lifecycle records - name (str): System name - start_date (str): Start date of support - end_date (str): End date of standard support - support_status (str): Status of support, e.g. retired, upcoming_release, supported - display_name (str): How the system should be presented to the customer - major (int): Major system version - minor (int): Minor system version - end_date_e4s (str | null): End date of Update Services for SAP Solutions support - end_date_els (str | null): End date of Extended Life-cycle Support - end_date_eus (str | null): End date of Extended Update Support

List relevant upcoming package changes, deprecations, additions and enhancements to user's systems.

🟢 CALL IMMEDIATELY - No information gathering required.

Use this tool to answer questions about upcoming package changes, deprecations, additions, or enhancements in the roadmap filtered by relevance to the user's systems. Also to plan for future upgrades and mitigate risk. Use this tool over get_upcoming_changes when the user asks about upcoming changes for their systems.

Returns: dict: A response object containing: - meta: Metadata including 'count' and 'total'. A count of 0 means no packages matches for the user's systems. - data: A list of package records. Each record contains: - name (str): The package name. - type (str): The change type (e.g., 'addition'). - release (str): The target release version. - details (dict): Detailed info including 'summary' and 'dateAdded'. - potentiallyAffectedSystemsDetail (list): Systems that might be affected by this change, including system IDs, display names, and OS versions.

Get Application Streams relevant to the requester's inventory (includes lifecycle/support dates).

🟢 CALL IMMEDIATELY - No information gathering required.

Use this tool when the user asks about Application Streams in their environment (inventory, hosts, systems...), such as: "Which app streams are we running on RHEL 9?" "What successor app streams could we move to from our current streams?"

Use this tool over get_appstreams_lifecycle when the user asks about their inventory, hosts, systems...

If the question is scoped to a specific RHEL major or minor, set major (and optionally minor) so that relevance is computed only from systems on that version.

If the user wants only streams currently running (what is installed/in use in inventory), set include_related=false. If the user asks whether newer versions exist, wants upgrade recommendations, or wants successor streams to consider, set include_related=true and review entries where related=true as potential candidates.

If the user needs an exhaustive catalog view of all streams available for a given component (e.g., "list all Node.js streams across RHEL 8/9/10"), use get_appstreams_lifecycle.

The backend computes relevance based on actual host data in the user's inventory. This tool does not perform any client-side filtering; all evaluation is performed by the backend.

Returns: str: A JSON-encoded response object containing: - meta: Metadata including: - count (int): Number of records returned. - total (int): Total number of matching records. - data: A list of Application Stream records relevant to the user's inventory. Each record contains: - name (str): Technical package or module name. - display_name (str): Human-friendly display name. - application_stream_name (str): Application Stream name. - stream (str): Stream identifier or version. - start_date (str | null): Planned start date (ISO format). - end_date (str | null): Planned end-of-life date (ISO format). - support_status (str): Support status (e.g. 'Supported', 'Retired'). - os_major (int | null): RHEL major version. - os_minor (int | null): RHEL minor version. - related (bool): Indicates if this is a related/successor stream (true) or currently in use (false).

Returns RHEL lifecycle information for systems in the requester's inventory.

🟢 CALL IMMEDIATELY - No information gathering required.

Use this tool when the user asks about RHEL lifecycle in their own environment, for example:

• Which RHEL versions are we currently running, and when do they go out of support?

• What future RHEL 8 minor versions could we upgrade to that are still supported?

When the question is scoped to a specific RHEL major (or major/minor), set major (and optionally minor) so relevance is calculated only from systems on that version.

If the user wants only what is currently running, set include_related=False (default, not needed to be specified).

If the user wants upgrade options or newer streams related to what they run today, set include_related=True and look at items where related=true as potential targets.

Response guidance:

• Summarize support status and end dates in plain language.

• If a version is retired or near end-of-support, call out the impact (loss of updates, risk).

• Provide recommended actions (e.g., plan upgrade, evaluate supported minor versions).

Returns: str: A JSON-encoded response object containing: - meta: Metadata including: - count (int): Number of records returned. - total (int): Total number of matching records. - data: A list of RHEL lifecycle records relevant to the user's inventory. Each record contains: - name (str): RHEL version name. - display_name (str): Human-friendly display name. - os_major (int | null): RHEL major version. - os_minor (int | null): RHEL minor version. - start_date (str | null): Planned start date (ISO format). - end_date (str | null): Planned end-of-life date (ISO format). - support_status (str): Support status (e.g. 'Supported', 'Retired'). - count (int): Number of systems running this RHEL version. - lifecycle_type (str): Type of RHEL version (e.g. 'mainline', 'extended update support (EUS)', 'extended life-cycle support (ELS)', 'update services for SAP solutions (E4S)'). - related (bool): True when include_related=true and the version is a suggested upgrade target.