cirdan
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| fingerprint_systemB | Detect runtimes, clouds, IaC, and telemetry with confidence and evidence. |
| get_access_contextA | What the current agent/session can access (capability mirror, not permissions). |
| map_infrastructureC | Run full discovery (static + live) and regenerate all cirdan-out artifacts. |
| query_infra_graphC | Ask the graph a question, e.g. 'what depends on postgres?' or 'what broke?'. |
| get_nodeA | Fetch one node (by id or fuzzy name) with evidence, attributes, and edges. |
| get_neighborsC | Neighborhood subgraph around a node. |
| shortest_pathC | Shortest path between two components. |
| list_servicesB | All logical services with state and origin. |
| list_dependenciesC | What a component depends on (transitive). |
| list_dependentsB | What depends on a component (transitive blast radius). |
| list_public_entrypointsD | Everything reachable from outside, with the reasons. |
| list_runtime_workloadsA | Current workloads (services, containers, pods, units) with live state. |
| get_recent_errorsC | Recent error/warning events, clustered by message template. |
| get_logsC | Tail logs for a component through the owning live adapter. |
| get_stateD | Live state of a component through the owning adapter. |
| list_incidentsB | Open (and optionally resolved) incidents. Runs a detection pass by default. |
| explain_incidentC | Evidence-backed markdown explanation of an incident. |
| list_available_actionsC | Actions currently possible against a component with this session's access. |
| execute_actionA | Execute an action id from list_available_actions. Recorded, redacted, audited. |
| verify_actionB | Verify the outcome of a previously executed action (act-… record id). |
| upsert_nodeB | Contribute a node the scanners missed. Evidence quotes required; recorded as INFERRED. |
| upsert_edgeC | Contribute a relationship between existing nodes (ids or names). Evidence required. |
| annotate_nodeA | Attach evidence or attributes to an existing node without changing its confidence. |
| get_enrichment_targetsC | What the deterministic scanners left unconnected: docs to read, isolated nodes, unlinked IaC, uncertain claims. Contribute findings via upsert_edge. |
| generate_viewB | Generate an Agentic UI view ('show me …') and save html/md/json artifacts. |
| generate_reportA | Regenerate INFRA_REPORT.md and return its contents. |
| get_auditC | Recent audit entries: what Cirdan observed, generated, executed, verified. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 27 tools
Each tool targets a distinct operation or query: annotation, actions, incidents, fingerprinting, reports, views, graph queries, state, dependencies, entrypoints, runtime, services, etc. There is no functional overlap, and descriptions clearly differentiate them.
All tool names follow a consistent verb_noun pattern (e.g., annotate_node, get_state, list_services). No mixing of case or style, making the set predictable for an agent.
With 27 tools, the count exceeds the recommended range for a coherent set. While each tool serves a specific purpose, the overall surface is heavy and may overwhelm an agent, suggesting some consolidation is possible.
The tool set covers the full lifecycle of graph management (get, list, upsert, query) and domain-specific tasks (incidents, actions, dependencies). Minor gaps include the absence of delete operations for nodes/edges and limited incident modification tools.