Skip to main content
Glama
perfectra1n

kubesearch-mcp

by perfectra1n

kubesearch-mcp

An MCP server that lets an LLM search kubesearch.dev — a search engine over Flux HelmReleases and Argo Applications across hundreds of public "home-ops" Kubernetes Git repositories.

It reproduces all of kubesearch.dev's search modes as tools, and can temporarily clone a repo so the model can review its actual manifests.

Search tools

Tool

kubesearch.dev equivalent

What it does

kubesearch_search_releases

/#cert-manager

Find charts by name; see who deploys them, ranked by popularity.

kubesearch_get_release

/hr/<id>

One chart's deployments. view: "summary" (default) digests the common spec.values; view: "deployments" paginates the repo list; view: "values" drills into a repo's full config.

kubesearch_search_images

/image#image cert-manager

Container image repositories and the tags used in the wild.

kubesearch_grep_values

/grep#grep cert-manager.io

Full-text grep across real-world Helm values for config examples.

kubesearch_status

Report the cached data's release date and row counts.

All search tools are annotated read-only and return a typed structuredContent payload alongside the equivalent text. They page with limit/offset and report has_more, and their result ordering is global (matches are ranked across the whole result set before the page is cut), so paging never repeats or skips an entry.

In the values view, value_paths accepts the paths printed in the summary view's common_settings verbatim, array forms like route.hostnames[] included. A single deployment whose config is too large for one response is always returned when it is first on the page, so { repo, limit: 1 } reaches any deployment; larger ones later in a page are reported individually via values_omitted and omitted_count.

Repository review tools (enabled by default; set KUBESEARCH_ENABLE_CLONE=false to disable)

Tool

What it does

repo_clone

Temporarily clone a repo (indexed owner/repo or an https Git URL) and return a handle + a curated file tree.

repo_list_files

List files in a clone (optional sub-path + glob).

repo_read_file

Read a text file from a clone (binary refused, large files truncated).

repo_grep

Substring-search a clone's text files; returns path:line matches. Takes limit and case_sensitive.

repo_grep_all

Substring-search the always-warm pool of top repos in one call, no clone step (see below).

repo_cleanup

Delete a clone early (clones also auto-expire; pool members are refused).

Clones are sandboxed: shallow (--depth 1, blob-size filtered), run with git via execFile (no shell) and a scrubbed environment, size/TTL/concurrency-capped, confined to a per-clone temp dir, with path-traversal and symlink-escape protection. By default any public host is allowed but private/loopback/link-local/metadata addresses are blocked (see env vars below).

Lifecycle: a clone is kept while it's being used and auto-deleted after KUBESEARCH_CLONE_TTL_MINUTES of inactivity (the timer resets on every access). Repeat repo_clone calls for the same repo+branch are deduplicated to a single working copy and (by default) refreshed with a shallow git fetch + hard reset to the latest commit, so a long-lived clone never goes stale — set KUBESEARCH_CLONE_REFRESH_ON_CLONE=false to reuse without pulling. Reads (repo_read_file/repo_grep/repo_list_files) are served from the snapshot and do not pull, so an in-progress review stays stable; re-run repo_clone to pull.

Concurrent repo_clone calls for the same repo share a single git invocation, at most KUBESEARCH_CLONE_MAX_CONCURRENT git subprocesses run at once, and clone directories stranded by an ungraceful restart are reaped at startup.

Always-warm pool (repo_grep_all). kubesearch_grep_values only sees Helm spec.values — that is all the upstream dataset contains. To grep across every resource kind (Kustomizations, HTTPRoutes, ExternalSecrets, Talos configs, …) the server keeps the KUBESEARCH_POOL_SIZE (default 15) most-starred indexed repos permanently cloned and repo_grep_all searches them in one call. Ranking by raw stars alone would fill the pool with CLI tools and Argo-only repos that have nothing greppable, so only repos with at least KUBESEARCH_POOL_MIN_RELEASES (default 20) indexed HelmReleases are considered; set KUBESEARCH_POOL_REPOS=onedr0p/home-ops,bjw-s-labs/home-ops,… to pick the membership yourself. Pool clones live under <cloneDir>/pool/<owner>__<repo>, use the indexed repo name as their handle (so repo_read_file can follow a hit directly, and repo_clone of a pool member reuses it), never expire, don't count toward KUBESEARCH_CLONE_MAX_REPOS, and survive shutdown so the next start adopts them with a shallow git fetch instead of re-cloning (~4 MB per repo on disk). Membership is recomputed whenever a new dataset release lands and the copies are refreshed on the KUBESEARCH_REFRESH_HOURS cadence. Warm-up runs in the background and never blocks startup; while it's in progress repo_grep_all reports pool.syncing: true and searches whatever is ready. KUBESEARCH_POOL_SIZE=0 disables the pool and hides the tool.

Prompts (workflow shortcuts)

Server-provided MCP prompts that chain the tools: kubesearch_compare_deployments, kubesearch_adopt_chart, kubesearch_find_config_examples, kubesearch_pick_image, and (when cloning is enabled) kubesearch_review_repo.

How it works

kubesearch.dev has no live API; it publishes its index as SQLite databases on the whazor/k8s-at-home-search GitHub releases (a new date-tagged release daily). This server downloads and caches those databases locally and queries them with SQL — fast, offline-capable, and identical to what the website shows. Two complementary databases are used and joined on the YAML file URL:

  • repos.db (~7 MB) — chart/release/repo metadata.

  • repos-extended.db (~37 MB) — the spec.values JSON (powers grep and image search).

Data is refreshed automatically when a newer daily release appears (see KUBESEARCH_REFRESH_HOURS).

Related MCP server: K8s MCP Server

Quick start (local, stdio)

npm install
npm run build

Add it to Claude Code:

claude mcp add kubesearch -- node /absolute/path/to/kubesearch-mcp/dist/index.js

Or in a Claude Desktop / MCP client config:

{
  "mcpServers": {
    "kubesearch": {
      "command": "node",
      "args": ["/absolute/path/to/kubesearch-mcp/dist/index.js"]
    }
  }
}

The first call downloads the databases into the cache dir (a few seconds); subsequent runs reuse the cache.

Docker deployment (HTTP)

The image defaults to the Streamable HTTP transport, which is what you want for a long-running server that MCP clients connect to over the network.

docker run -d --name kubesearch-mcp \
  -p 3000:3000 \
  -v kubesearch-data:/data \
  -e GITHUB_TOKEN=ghp_xxx \
  ghcr.io/perfectra1n/kubesearch-mcp:latest

Published tags: latest (default branch), vX.Y.Z and X.Y (releases), and sha-<short> for a specific commit. To build it yourself instead, use docker build -t kubesearch-mcp . and substitute that image name.

Mount /data as shown: it holds the cached databases, so without it every restart re-downloads ~44 MB.

Or with Compose:

docker compose up -d

The container runs as the unprivileged node user (uid 1000) and writes cached databases and clones under /data. The named volume in docker-compose.yml is writable out of the box. If you bind-mount a host directory instead, make it writable by uid 1000 (e.g. chown -R 1000:1000 ./data), or repo_clone and refreshes will fail with "Permission denied".

The MCP endpoint is http://<host>:3000/mcp. Two health endpoints are exposed:

  • GET /healthzliveness. Always 200 while the process is up. This is what the image's HEALTHCHECK uses, so a slow initial download can't get the container restarted mid-download.

  • GET /readyzreadiness. 503 until a release is loaded, then 200. Use this for Kubernetes readiness probes and load-balancer checks, so traffic isn't sent to a pod whose first queries would fail.

Point an MCP client at it:

{
  "mcpServers": {
    "kubesearch": {
      "type": "http",
      "url": "http://localhost:3000/mcp",
      "headers": { "Authorization": "Bearer <MCP_AUTH_TOKEN>" }
    }
  }
}

(The Authorization header is only required when MCP_AUTH_TOKEN is set.)

Securing the HTTP transport

The HTTP transport ships open. Out of the box there is no authentication, CORS is *, and the image binds 0.0.0.0. That is fine on a trusted network or behind a reverse proxy that authenticates for you; it is not fine on a public interface. Before exposing the port beyond a network you control:

Variable

Default

What it does

MCP_AUTH_TOKEN

(unset — auth off)

Require Authorization: Bearer <token>. Accepts a comma-separated list, e.g. one token per client.

MCP_ALLOWED_ORIGINS

(unset — any origin)

Comma-separated Origin allowlist. When set, CORS reflects only these origins and other browser callers get 403. Requests with no Origin (normal MCP clients) are unaffected.

MCP_ALLOWED_HOSTS

(unset — any host)

Comma-separated Host allowlist. Guards against DNS rebinding, which matters for an instance reachable from a browser.

MCP_MAX_SESSIONS

100

Refuse new sessions past this many concurrent ones.

MCP_MAX_BODY_BYTES

4194304

Reject larger request bodies with 413.

The server logs a warning at startup if it binds a non-loopback address with authentication disabled. Terminate TLS at a proxy; the server speaks plain HTTP.

Running the container over stdio instead

If you prefer to have a client spawn the container per session:

docker run -i --rm -v kubesearch-data:/data -e MCP_TRANSPORT=stdio kubesearch-mcp

Configuration

All configuration is via environment variables:

Variable

Default

Description

MCP_TRANSPORT

stdio (http in Docker)

stdio or http (streamable-http and streamablehttp are accepted aliases).

MCP_HTTP_HOST

0.0.0.0

HTTP bind host (http transport).

MCP_HTTP_PORT / PORT

3000

HTTP listen port. MCP_HTTP_PORT wins if both are set; the image sets neither, so a PaaS-injected PORT is honoured.

MCP_AUTH_TOKEN

(unset — auth off)

If set, every HTTP request must send Authorization: Bearer <token>. Accepts a single token or a comma-separated list of accepted tokens (e.g. one per client).

MCP_ALLOWED_ORIGINS

(unset — any)

Origin allowlist for /mcp; see Securing the HTTP transport.

MCP_ALLOWED_HOSTS

(unset — any)

Host allowlist for /mcp (DNS-rebinding guard).

MCP_MAX_BODY_BYTES

4194304

Max HTTP request body size; larger bodies get 413.

MCP_MAX_SESSIONS

100

Max concurrent HTTP sessions; further initialize calls get 503.

MCP_SESSION_TTL_MINUTES

30

Close an HTTP session after this long with no requests.

LOG_LEVEL

info

Minimum log severity to emit: debug, info, warn, or error. All logs are unstructured text on stderr.

KUBESEARCH_CACHE_DIR

~/.cache/kubesearch-mcp (/data in Docker)

Where the SQLite databases are cached.

KUBESEARCH_REFRESH_HOURS

24

How often to check for a newer daily release. 0 disables refresh (use cache forever). A failed check retries on a short backoff rather than waiting the full interval.

KUBESEARCH_DOWNLOAD_TIMEOUT_SECONDS

300

Wall-clock limit for downloading one database. Downloads also abort after 30s with no data received.

KUBESEARCH_MAX_DB_MB

512

Reject a database download larger than this.

GITHUB_TOKEN

(unset)

Lifts the GitHub API rate limit (60→5000/hr) used to resolve the latest release. Recommended.

KUBESEARCH_UPSTREAM_REPO

whazor/k8s-at-home-search

Source repo for the databases (override only for forks/testing).

KUBESEARCH_ENABLE_CLONE

true

Enable the repo_* clone/review tools. Set false to hide them entirely.

KUBESEARCH_CLONE_ALLOWED_HOSTS

(any)

Comma-separated host allowlist, e.g. github.com,gitlab.com. Empty = any public host.

KUBESEARCH_CLONE_ALLOW_PRIVATE

false

Permit cloning from private/loopback/link-local/metadata addresses (SSRF guard off).

KUBESEARCH_CLONE_DIR

<cacheDir>/clones

Where ephemeral clones live.

KUBESEARCH_CLONE_TTL_MINUTES

30

Auto-delete a clone after this much inactivity (timer resets on each access).

KUBESEARCH_CLONE_REFRESH_ON_CLONE

true

On a repeat clone of the same repo, git fetch + reset to the latest commit.

KUBESEARCH_CLONE_MAX_REPOS

5

Max concurrent cached clones (LRU-evicted).

KUBESEARCH_CLONE_MAX_CONCURRENT

2

Max git subprocesses running at once.

KUBESEARCH_CLONE_MAX_MB

200

Reject/clean a clone whose tree exceeds this size.

KUBESEARCH_CLONE_TIMEOUT_SECONDS

120

Hard timeout for the git clone subprocess.

KUBESEARCH_POOL_SIZE

15

How many top repos to keep permanently cloned for repo_grep_all. 0 disables the pool and hides the tool.

KUBESEARCH_POOL_MIN_RELEASES

20

Only repos with at least this many indexed HelmReleases are eligible for the star ranking.

KUBESEARCH_POOL_REPOS

(unset)

Comma-separated indexed repo names that replace the star ranking entirely (e.g. onedr0p/home-ops,bjw-s-labs/home-ops).

Development

mise pins the toolchain and owns the dev/release lifecycle, so every command below is the same one CI runs. One-time setup:

mise install    # installs Node, lefthook, shellcheck; also installs the git hooks

Then:

mise tasks            # list every task with a description
mise run dev          # run from source via tsx
mise run test         # vitest (unit + offline integration against a fixture DB)
mise run lint         # typecheck + prettier --check + shellcheck
mise run fmt          # format in place with prettier
mise run build        # bundle to dist/ with tsup
mise run ci           # the full local gate: fmt-check, typecheck, test, build
mise run smoke        # end-to-end against live upstream data (needs network)
mise run image        # build the container image locally

The underlying npm run <script> commands still work if you'd rather not use mise; mise is a thin wrapper plus a pinned toolchain. Exact tool versions live in .mise/config.toml with per-platform checksums in .mise/mise.lock, which CI enforces via mise install --locked; package.json's engines.node records the minimum supported runtime.

A lefthook pre-commit hook formats staged files with prettier and re-stages them, and runs shellcheck on shell scripts. It deliberately doesn't run tests or the typechecker — that's CI's job, so committing stays fast. mise install wires the hook; lefthook install re-syncs it if needed.

Tests run fully offline against a small fixture database that mirrors the real schema. They cover the domain logic, the download/refresh paths (with a stubbed fetch), the HTTP transport end to end, and the tools themselves through an in-memory MCP client — which means the SDK validates every response against its declared outputSchema. The releaseKey/mergeHelmURL slug logic is ported verbatim from upstream and locked with test vectors so generated /hr/<id> links match the real site.

typecheck and test run on every push and pull request, and the container image is only published if they pass.

Renovate keeps dependencies current: .github/workflows/renovate.yml runs it every 12 hours (and on dependency-dashboard or PR checkbox edits) with the policy in .renovaterc.json5, which extends the shared home-operations/renovate-config preset. It authenticates as a GitHub App so that CI runs on the PRs it opens.

Credits

All data comes from kubesearch.dev / whazor/k8s-at-home-search. To include your own cluster, make the repo public and add the k8s-at-home or kubesearch GitHub topic.

License

MIT

Available Tools

11 tools
kubesearch_get_releaseGet HelmRelease detailsA
Read-onlyIdempotent

Get details for one chart by its kubesearch.dev release id (the id from kubesearch_search_releases, e.g. 'ghcr.io-home-operations-charts-mirror-cert-manager'). Three views, controlled by view:

  • summary (default): a compact digest of how the community configures the chart — the most commonly-set spec.values paths with their typical values, plus a couple of full example configs. Start here.

  • deployments: the paginated list of every repo deploying the chart (no values) — use it to find a repo to drill into.

  • values: the full parsed spec.values for selected deployments — narrow with repo and/or value_paths to fetch just the config (or subtree) you care about. This is the drill-down; prefer summary first. Note: chart_source_url is the normalized kubesearch.dev grouping key, not necessarily the pullable chart. For chartRef/OCIRepository releases the real chart is in source_urls (group) and each deployment's source_url + source_tag; resolved_chart surfaces the true chart name when it differs from chart. Confirm by cloning the deployment's repo (repo_clone) and reading its OCIRepository source.yaml.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesThe release id / slug, e.g. 'ghcr.io-home-operations-charts-mirror-cert-manager'.
topNo`summary` view: number of common value paths to return.
repoNo`values` view: restrict to one repo (e.g. 'onedr0p/home-ops').
viewNosummary = community config digest (default); deployments = paginated repo list; values = full config drill-down.summary
limitNoPage size for `deployments`/`values` views.
offsetNoPagination offset for `deployments`/`values` views.
examplesNo`summary` view: number of full example configs to include.
value_pathsNo`values` view: only return these value-path subtrees, e.g. ['server.persistentVolume','server.retentionPeriod']. Paths from the summary view's common_settings work as-is, including array forms like 'route.hostnames[]'.

Output Schema

ParametersJSON Schema
NameRequiredDescription
idYes
viewYes
chartYes
shownNo
offsetNo
has_moreNo
next_stepNo
top_reposNo
deploymentsNo
source_urlsYes
matched_reposNo
omitted_countNo
kubesearch_urlYes
resolved_chartYes
values_summaryNo
chart_source_urlYes
deployment_countYes
chart_source_ambiguousYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnlyHint=true and idempotentHint=true, so the safety profile is covered. The description adds behavioral nuance: the three-view behavior, pagination handling, and the note about `chart_source_url` being a normalized grouping key rather than a pullable chart, plus the `resolved_chart` clarification and the advice to confirm via repo cloning. It does not contradict annotations and enriches the agent's understanding of edge cases.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is longer than average (~180 words) but well-structured with a lead sentence, a three-bullet section, and a note. Every sentence adds functional information; there is no filler. It is front-loaded with the main purpose and then details, which lets the agent quickly grasp the tool's core. It could be slightly tightened but remains efficient for the complexity involved.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 8 parameters, 3 views, and pagination, the description covers all usage aspects: parameter-to-view mapping, defaults, pagination, and the subtlety of `chart_source_url` vs `source_url`s. It even provides a verification step via `repo_clone`. With an output schema present (though not shown here), the return value details are not required, and the description fills all necessary gaps for an agent to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 100% schema description coverage, the baseline is 3. The description adds extra meaning for parameters: it clarifies that `top` and `examples` apply only to `summary`, `repo` and `value_paths` to `values`, and `limit`/`offset` to `deployments`/`values`. It also explains that `value_paths` paths from `summary` work as-is, including array forms like 'route.hostnames[]'. This goes beyond the schema's terse descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Get details for one chart') and the resource (by release id), and explains three distinct views (summary, deployments, values) that give it a precise scope. It references the sibling tool `kubesearch_search_releases` as the source of the id, which differentiates it from search. No ambiguity in what it does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit guidance on when to use each view: 'Start here' for summary, 'use it to find a repo to drill into' for deployments, and 'prefer summary first' for values. It also tells the user to confirm via `repo_clone` when needed. However, it does not explicitly say when to avoid this tool in favor of others (e.g., when to use `kubesearch_grep_values` instead), so it misses a direct exclusion but still offers clear usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

kubesearch_grep_valuesGrep HelmRelease valuesA
Read-onlyIdempotent

Full-text grep across the Helm spec.values of every indexed HelmRelease/Application (substring match). Great for finding real-world examples of a config key or value, e.g. 'cert-manager.io', 'nodeSelector', 'gatus'. Returns the matched key path, a snippet, and the source file. Mirrors the kubesearch.dev /grep search.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMax number of matching files to return.
queryYesSubstring to grep for in values (keys or values), e.g. 'cert-manager.io'.
offsetNoSkip this many matches (results are ranked by repo stars).
case_sensitiveNoMatch case-sensitively.

Output Schema

ParametersJSON Schema
NameRequiredDescription
queryYes
shownYes
offsetYes
resultsYes
grep_urlYes
has_moreYes
total_filesYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish read-only and idempotent behavior. The description adds meaningful context by specifying the scope ('every indexed HelmRelease/Application'), the substring-match nature, and the result shape (matched key path, snippet, source file). No contradictions with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three concise sentences front-load the core operation, provide concrete examples, and mention the output format. Every sentence earns its place without unnecessary detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a straightforward grep tool with full schema coverage, annotations, and an output schema, the description covers scope, semantics, use cases, and result content. Nothing essential is missing for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema fully documents query, limit, offset, and case_sensitive. The description adds useful examples and clarifies the query targets config keys/values, but does not materially expand parameter semantics beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('grep') and resource ('Helm spec.values of every indexed HelmRelease/Application'), clearly distinguishing this from file-based repo grep tools. It also states the substring-match behavior and the return payload, leaving no ambiguity about what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when to use it: finding real-world examples of config keys or values, with concrete examples. It does not explicitly name alternative tools or exclusion cases, but the Helm-values-specific scope makes the intended use obvious.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

kubesearch_search_imagesSearch container imagesA
Read-onlyIdempotent

Search kubesearch.dev for container image repositories used across public home-ops clusters (substring match on the image repository, case-insensitive). Returns each matching image repository, the tags seen in the wild, how many deployments use it, and a few sample repos. Equivalent to the kubesearch.dev /image search.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMax number of image repositories to return.
queryYesImage repository substring, e.g. 'cert-manager', 'ghcr.io/home-operations', 'postgres'.
offsetNoSkip this many results (ranked by usage count).

Output Schema

ParametersJSON Schema
NameRequiredDescription
queryYes
shownYes
offsetYes
resultsYes
has_moreYes
image_urlYes
total_matchesYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only/idempotent behavior, so the description adds value by disclosing the search semantics (substring, case-insensitive), the data source (public home-ops clusters), and the exact return contents (repositories, tags, deployment counts, sample repos). This goes beyond the annotations and enriches the agent's understanding.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two focused sentences with no fluff. The first sentence front-loads the core action and scope, the second describes return values and equivalence. Every clause earns its place, making it easy to parse quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema exists, the description doesn't need to detail return types. It covers the essential context: what the tool does, what data it searches, matching behavior, and result granularity. With annotations handling safety and schema handling parameters, the description is complete for this tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% with clear parameter descriptions, so the baseline is 3. The description adds extra meaning by explaining the query parameter's matching semantics ('substring match, case-insensitive') and what the results represent (tag counts, deployment usage, sample repos), which complements the schema without redundancy.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Search') and resource ('container image repositories'), and adds key semantics like substring match and case-insensitivity. It clearly distinguishes from sibling tools (search_releases, grep_values) by focusing on image repositories, and even references the equivalent kubesearch.dev /image search.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly states the context (searching image repos across public home-ops clusters) and the matching behavior. However, it lacks explicit 'when not to use' or alternative tool references, though sibling names make the distinction obvious. This is close to a 5 but missing an explicit exclusion.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

kubesearch_search_releasesSearch HelmReleasesA
Read-onlyIdempotent

Search kubesearch.dev for Flux HelmReleases / Argo Applications by chart name (substring, case-insensitive). Mirrors the kubesearch.dev homepage search (e.g. 'cert-manager'). Results are grouped by chart source and ranked by how many public home-ops repos deploy them. Each result includes an id you can pass to kubesearch_get_release for full details, plus a kubesearch.dev link. Note: chart_source_url is a NORMALIZED grouping key (it matches kubesearch.dev's /hr/<id> grouping and intentionally collapses related registries, e.g. all bjw-s variants into 'oci://ghcr.io/bjw-s-labs/charts/'). For chartRef/OCIRepository releases the actual pullable chart is in source_urls (group) and each repo's source_url (+ source_tag); resolved_chart flags when the real chart name differs from chart.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMax number of chart groups to return.
queryYesChart name or substring to search for, e.g. 'cert-manager', 'authentik', 'plex'.
offsetNoPagination offset into the ranked results.

Output Schema

ParametersJSON Schema
NameRequiredDescription
queryYes
shownYes
offsetYes
resultsYes
has_moreYes
search_urlYes
total_matchesYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and idempotentHint, so the bar for extra value is high. The description adds substantial behavioral detail beyond annotations: case-insensitive substring matching, grouping by chart source, ranking by public repo usage, normalized `chart_source_url` behavior, and the `resolved_chart` flag. This gives the agent accurate expectations about how results are structured and why grouping keys may differ from actual pullable sources.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The first sentence is front-loaded with the core purpose, followed by result-grouping context and the id-to-detail linkage. The second paragraph is a dense but necessary note about normalization, and every sentence earns its place with no filler. The structure is well organized and appropriately sized for the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is complete for an agent deciding whether to invoke this tool and how to interpret results. It covers search semantics, result grouping, ranking, how to follow up for full details, and the important normalization caveat. The output schema exists, so return-value details do not need to be restated, and annotations already cover safety and idempotency.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds meaning beyond the schema by clarifying that `query` is a case-insensitive substring over chart names, giving concrete examples ('cert-manager', 'authentik'), and explaining that `chart_source_url` is a normalized grouping key rather than a literal registry URL. This supplements the schema's field descriptions usefully.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Search kubesearch.dev for Flux HelmReleases / Argo Applications by chart name.' It clearly differentiates from sibling tools by noting the returned `id` can be passed to `kubesearch_get_release` and by describing the homepage-search mirror, so an agent can distinguish it from `kubesearch_search_images` and other siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when to use the tool: searching chart names/substrings across HelmReleases and Argo Applications. It also names the follow-up tool (`kubesearch_get_release`) for full details, but it does not explicitly state when NOT to use this versus the sibling image-search tool, so it falls just short of full exclusion guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

kubesearch_statusKubesearch data statusA
Read-onlyIdempotent

Report the freshness and size of the locally cached kubesearch.dev data: the release tag (date), when it was loaded, the cache directory, and row counts. Useful to confirm how current the search data is.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
tagYes
cacheDirYes
loadedAtYes
helmReleasesYes
releaseFilesYes
reposIndexedYes
valueDocumentsYes
ociRepositoriesYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and idempotentHint, so the safety profile is covered. The description adds value by disclosing exactly what status information is returned (release tag, load time, cache directory, row counts), which goes beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler. The first sentence front-loads the action and output fields; the second provides a succinct use case. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only status tool with no parameters and an output schema, the description fully covers purpose, output content, and usage context. It is entirely adequate given the tool's low complexity and sibling context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With zero parameters, the baseline for parameter semantics is 4. The description correctly avoids inventing parameter details, and the input schema confirms no parameters exist, so nothing is missing.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool reports freshness and size of cached data, enumerating specific fields (release tag, load time, cache directory, row counts). This unambiguously distinguishes it from sibling search tools, which perform queries rather than status inspection.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly notes the tool is 'useful to confirm how current the search data is', giving a clear use case. However, it doesn't explicitly mention when not to use it or name alternatives, though sibling tools imply those are for searching, not status checking.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

repo_cleanupDelete a cloned repositoryA
Idempotent

Delete a temporary clone created by repo_clone (frees disk before its TTL). Clones are also auto-deleted after inactivity, so this is optional but polite.

ParametersJSON Schema
NameRequiredDescriptionDefault
handleYesThe clone handle from repo_clone.

Output Schema

ParametersJSON Schema
NameRequiredDescription
handleYes
removedYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide idempotentHint=true and readOnlyHint=false. The description adds valuable lifecycle context: clones are temporary, have a TTL, and are auto-deleted. This goes beyond annotations to explain why the tool is optional, and does not contradict destructiveHint=false since the clone is temporary.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the action ('Delete a temporary clone'), and both sentences serve a purpose: the first states the action and rationale, the second clarifies optionality. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with an output schema and strong annotations, the description covers the purpose, usage context, and lifecycle behavior (TTL, auto-deletion). It is fully sufficient for an agent to decide when and why to invoke it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with the parameter 'handle' described as 'The clone handle from repo_clone.' The tool description merely references this relationship without adding new meaning, so the schema carries the full semantic burden.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the verb 'Delete' with a specific resource ('temporary clone created by repo_clone') and clearly distinguishes this from sibling tools like repo_clone, which creates clones. The qualifier 'temporary' adds necessary scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to use it (to free disk before TTL) and when not to (since clones auto-delete after inactivity, making it optional). The alternative is effectively doing nothing, which the description implies by calling it 'polite'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

repo_cloneClone a repository (temporary)A

Temporarily clone a public Git repository so you can review its actual files. Accepts an indexed home-ops repo name (e.g. 'onedr0p/home-ops' — resolved to its real clone URL and branch) or a full https Git URL. The clone is shallow, sandboxed, size/time-limited, and auto-deleted after a TTL. Returns a handle to use with repo_list_files, repo_read_file, and repo_grep, plus a curated file tree to get you started. Call repo_cleanup when done.

ParametersJSON Schema
NameRequiredDescriptionDefault
repoYesAn indexed repo name like 'onedr0p/home-ops', or a full https:// Git URL.

Output Schema

ParametersJSON Schema
NameRequiredDescription
treeYes
branchYes
handleYes
pinnedYes
reusedYes
size_mbYes
updatedYes
file_countYes
resolved_urlYes
expires_in_minutesYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses substantial behavioral details beyond the annotations: the clone is shallow, sandboxed, size/time-limited, auto-deleted after a TTL, resolves indexed names to real clone URLs and branches, and requires eventual cleanup. This is exactly the kind of context an agent needs for a stateful, non-read-only operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose, then adds precise operational details in compact sentences. Every sentence earns its place, covering input format, clone behavior, return value, companion functions, and cleanup without filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is complete for a tool with one parameter, meaningful annotations, and an output schema. It explains what the caller receives, how the temporary resource is governed, and what follow-up actions are expected. Nothing essential for correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 100% schema description coverage, the schema already documents the `repo` parameter, and the description adds meaningful extra context: it gives an example, explains that indexed names are resolved to the real clone URL and branch, and states which URL forms are accepted. This goes beyond the schema without being redundant.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: temporarily clone a public Git repository to review actual files. It clearly distinguishes itself from siblings by explaining that it returns a handle consumed by repo_list_files, repo_read_file, and repo_grep, and that repo_cleanup should be called afterward.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly conveys when to use the tool: when actual repository files need to be inspected, rather than relying only on metadata. It also names the companion tools and cleanup routine, but it does not explicitly state when not to use it or contrast it directly with the kubesearch_* alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

repo_grepGrep a cloned repositoryA
Read-onlyIdempotent

Search the text contents of a previously cloned repository (by handle) for a substring. Optionally restrict to files matching a glob. Returns file paths, line numbers, and matching lines. If truncated is set, narrow the search with a longer query or a glob rather than paging.

ParametersJSON Schema
NameRequiredDescriptionDefault
globNoOptional glob filter, e.g. '**/*.yaml'.
limitNoMax number of matching lines to return.
queryYesSubstring to search for across the repo's text files.
handleYesThe clone handle from repo_clone.
case_sensitiveNoMatch case-sensitively.

Output Schema

ParametersJSON Schema
NameRequiredDescription
queryYes
handleYes
matchesYes
truncatedYes
total_matchesYes

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already signal readOnly, idempotent, and closed-world behavior. The description adds valuable behavioral details: search scope ('text contents'), optional glob filtering, return format ('file paths, line numbers, and matching lines'), and truncation handling. This goes beyond annotation basics and helps the agent predict tool output.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, all informative. The first sentence captures the core action, the second adds an optional parameter, and the third provides practical usage advice. No filler or repetition; front-loaded and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a search tool with output schema and rich annotations, the description covers key contextual aspects: prerequisite (cloned repository), optional filter, return format, and behavior on truncation. It doesn't mention case_sensitive or limit explicitly, but the schema fully documents those, and the truncation guidance substitutes for deeper pagination details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, with each parameter including a description, so the baseline is 3. The description does not significantly expand on parameter meaning beyond what the schema provides—it only restates 'by handle' and 'glob' in narrative form. No new parameter-level insight is added.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Search') and a specific resource ('text contents of a previously cloned repository'), immediately distinguishing it from sibling tools like repo_list_files (list files) and repo_read_file (read one file). It also specifies the output (file paths, line numbers, matching lines), making the tool's purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the prerequisite of a prior repo_clone operation via 'previously cloned repository (by handle)', and offers explicit guidance for handling truncated results: 'narrow the search with a longer query or a glob rather than paging.' It does not explicitly mention when to use this over kubesearch_grep_values, but given sibling list and context, the usage is clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

repo_grep_allGrep the always-warm pool of top reposA
Read-onlyIdempotent

Substring-search the actual files of the most popular indexed home-ops repositories at once — no clone step needed. The server keeps these repos permanently cloned, so this covers every resource kind (Kustomizations, Ingress/HTTPRoute, ExternalSecrets, Talos configs, …), not just Helm values like kubesearch_grep_values. Hits are grouped by repo, most-starred first, and each group carries a handle you can pass straight to repo_read_file / repo_list_files / repo_grep for the follow-up. pool reports which repos were searchable: while pool.syncing is true and ready is below size the pool is still warming up, so an empty result is not final — retry after a short pause.

ParametersJSON Schema
NameRequiredDescriptionDefault
globNoOptional path glob, e.g. '**/*.yaml' or 'kubernetes/apps/**'.
limitNoMax matching lines returned overall.
queryYesSubstring to search for, e.g. 'gatus.io/enabled' or 'kind: HTTPRoute'.
max_per_repoNoMax matching lines returned per repo.
case_sensitiveNoMatch case-sensitively.

Output Schema

ParametersJSON Schema
NameRequiredDescription
poolYes
queryYes
reposYes
truncatedYes
total_matchesYes
repos_searchedYes

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark it read-only, open-world=false, and idempotent, and the description adds several behavioral details beyond those: the server keeps repos permanently cloned, results are grouped by repo and star-ranked, each group carries a handle for follow-up tools, and the pool object's syncing/ready/size indicates warming with non-final empty results. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every sentence adds a distinct operational fact: scope, no-clone behavior, resource coverage, grouping/handle for follow-up, and pool-warming retry semantics. It is front-loaded with the core purpose and remains compact enough for the amount of context it provides.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only search tool with 100% schema parameter coverage, an output schema, and clear annotations, the description covers the key selection and invocation concerns: what it searches, how results are grouped, how to follow up, and when an empty result is not final. No critical operational gap is apparent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3 and the schema already documents query/glob/limit/max_per_repo/case_sensitive. The description reinforces that query is a substring and that grouping is by repo, but it does not add syntax or parameter-format details beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific action ('Substring-search') and resource ('actual files of the most popular indexed home-ops repositories'), and immediately distinguishes it from 'kubesearch_grep_values' by scope. It also notes no clone step is needed, making it clear this is a pre-warmed cross-repo search rather than a repo-local grep.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly contrasts with kubesearch_grep_values ('not just Helm values like...') and tells the agent that returned handles are intended for repo_read_file/repo_list_files/repo_grep follow-ups. It also gives retry guidance while pool.syncing is true. This is clear contextual guidance, though it stops short of an explicit 'use X instead' exclusion statement.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

repo_list_filesList files in a cloned repositoryA
Read-onlyIdempotent

List files in a previously cloned repository (by handle). Optionally scope to a sub-path and/or filter with a glob (e.g. '/*.yaml', 'kubernetes/'). Use the handle returned by repo_clone.

ParametersJSON Schema
NameRequiredDescriptionDefault
globNoOptional glob filter applied to file paths, e.g. '**/*.yaml'.
pathNoSub-path within the repo to list (default: repo root)..
handleYesThe clone handle from repo_clone.

Output Schema

ParametersJSON Schema
NameRequiredDescription
pathYes
handleYes
entriesYes
truncatedYes

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and idempotentHint, covering the safety profile. The description adds useful behavioral context beyond annotations: the handle must come from repo_clone, and listing can be scoped via sub-path and glob. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the core purpose, followed by optional parameters and a necessary prerequisite. Every phrase earns its place with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list files tool with an output schema, the description covers the prerequisite (handle from repo_clone) and options (path, glob). It does not explicitly state whether the listing is recursive, but the glob pattern '**/*.yaml' implies recursive behavior, and the output schema likely clarifies return structure. No major gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with each parameter (handle, path, glob) fully described in the input schema. The description restates these options but adds no new semantic detail beyond examples already present in the schema, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific action and resource: 'List files in a previously cloned repository (by handle)'. This distinguishes it from sibling tools like repo_read_file and repo_grep, which operate on file contents. The optional path and glob filters are additional specificity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a clear prerequisite via 'Use the handle returned by repo_clone' and explains optional scoping/filtering with path and glob. It does not explicitly name alternatives or when-not-to-use conditions, but the context is strong enough for an agent to understand when this tool applies.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

repo_read_fileRead a file from a cloned repositoryA
Read-onlyIdempotent

Read a text file from a previously cloned repository (by handle and relative path). Binary files are refused and large files are truncated. Use the handle returned by repo_clone.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYesRelative path to the file within the repo, e.g. 'kubernetes/apps/cert-manager/helmrelease.yaml'.
handleYesThe clone handle from repo_clone.
max_bytesNoMax bytes to return.

Output Schema

ParametersJSON Schema
NameRequiredDescription
pathYes
bytesYes
handleYes
contentYes
truncatedYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare read-only and idempotent hints. The description adds behavioral details about binary files being refused and large files being truncated, which goes beyond the structured annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the action, and each sentence earns its place without unnecessary elaboration.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With a rich output schema and good annotations, the description covers the key prerequisites and constraints (prerequisite handle, binary refusal, truncation) sufficiently for an agent to use the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers 100% of parameters with descriptions. The description reinforces the handle's origin but doesn't add significant new semantic information beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool reads a text file from a cloned repository using a handle and relative path. It also mentions binary refusal and truncation, which distinguishes it from sibling tools like repo_list_files and repo_grep.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context: it works on previously cloned repos and instructs to use the handle from repo_clone. It doesn't explicitly name alternatives, but the usage context is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 5 tool updatesv1.2.0
    • Changedkubesearch_get_release28 fields changed
      • removedOutput schema / properties / deployments / items / properties / chart_version / anyOf
        Removed value: -[
        -  {
        -    "type": "string"
        -  },
        -  {
        -    "type": "null"
        -  }
        -]
      • addedOutput schema / properties / deployments / items / properties / chart_version / type
        Added value: +[
        +  "string",
        +  "null"
        +]
      • removedOutput schema / properties / deployments / items / properties / namespace / anyOf
        Removed value: -[
        -  {
        -    "type": "string"
        -  },
        -  {
        -    "type": "null"
        -  }
        -]
      • addedOutput schema / properties / deployments / items / properties / namespace / type
        Added value: +[
        +  "string",
        +  "null"
        +]
      • removedOutput schema / properties / deployments / items / properties / repo_url / anyOf
        Removed value: -[
        -  {
        -    "type": "string"
        -  },
        -  {
        -    "type": "null"
        -  }
        -]
      • addedOutput schema / properties / deployments / items / properties / repo_url / type
        Added value: +[
        +  "string",
        +  "null"
        +]
      • removedOutput schema / properties / deployments / items / properties / resolved_chart / anyOf
        Removed value: -[
        -  {
        -    "type": "string"
        -  },
        -  {
        -    "type": "null"
        -  }
        -]
      • addedOutput schema / properties / deployments / items / properties / resolved_chart / type
        Added value: +[
        +  "string",
        +  "null"
        +]
      • removedOutput schema / properties / deployments / items / properties / source_kind / anyOf
        Removed value: -[
        -  {
        -    "type": "string"
        -  },
        -  {
        -    "type": "null"
        -  }
        -]
      • addedOutput schema / properties / deployments / items / properties / source_kind / type
        Added value: +[
        +  "string",
        +  "null"
        +]
      • removedOutput schema / properties / deployments / items / properties / source_tag / anyOf
        Removed value: -[
        -  {
        -    "type": "string"
        -  },
        -  {
        -    "type": "null"
        -  }
        -]
      • addedOutput schema / properties / deployments / items / properties / source_tag / type
        Added value: +[
        +  "string",
        +  "null"
        +]
      • removedOutput schema / properties / resolved_chart / anyOf
        Removed value: -[
        -  {
        -    "type": "string"
        -  },
        -  {
        -    "type": "null"
        -  }
        -]
      • addedOutput schema / properties / resolved_chart / type
        Added value: +[
        +  "string",
        +  "null"
        +]
      • removedOutput schema / properties / top_repos / items / properties / chart_version / anyOf
        Removed value: -[
        -  {
        -    "type": "string"
        -  },
        -  {
        -    "type": "null"
        -  }
        -]
      • addedOutput schema / properties / top_repos / items / properties / chart_version / type
        Added value: +[
        +  "string",
        +  "null"
        +]
      • removedOutput schema / properties / top_repos / items / properties / namespace / anyOf
        Removed value: -[
        -  {
        -    "type": "string"
        -  },
        -  {
        -    "type": "null"
        -  }
        -]
      • addedOutput schema / properties / top_repos / items / properties / namespace / type
        Added value: +[
        +  "string",
        +  "null"
        +]
      • removedOutput schema / properties / top_repos / items / properties / repo_url / anyOf
        Removed value: -[
        -  {
        -    "type": "string"
        -  },
        -  {
        -    "type": "null"
        -  }
        -]
      • addedOutput schema / properties / top_repos / items / properties / repo_url / type
        Added value: +[
        +  "string",
        +  "null"
        +]
      • removedOutput schema / properties / top_repos / items / properties / resolved_chart / anyOf
        Removed value: -[
        -  {
        -    "type": "string"
        -  },
        -  {
        -    "type": "null"
        -  }
        -]
      • addedOutput schema / properties / top_repos / items / properties / resolved_chart / type
        Added value: +[
        +  "string",
        +  "null"
        +]
      • removedOutput schema / properties / top_repos / items / properties / source_kind / anyOf
        Removed value: -[
        -  {
        -    "type": "string"
        -  },
        -  {
        -    "type": "null"
        -  }
        -]
      • addedOutput schema / properties / top_repos / items / properties / source_kind / type
        Added value: +[
        +  "string",
        +  "null"
        +]
      • removedOutput schema / properties / top_repos / items / properties / source_tag / anyOf
        Removed value: -[
        -  {
        -    "type": "string"
        -  },
        -  {
        -    "type": "null"
        -  }
        -]
      • addedOutput schema / properties / top_repos / items / properties / source_tag / type
        Added value: +[
        +  "string",
        +  "null"
        +]
      • removedOutput schema / properties / values_summary / properties / examples / items / properties / chart_version / anyOf
        Removed value: -[
        -  {
        -    "type": "string"
        -  },
        -  {
        -    "type": "null"
        -  }
        -]
      • addedOutput schema / properties / values_summary / properties / examples / items / properties / chart_version / type
        Added value: +[
        +  "string",
        +  "null"
        +]
    • Changedkubesearch_grep_values8 fields changed
      • removedOutput schema / properties / results / items / properties / chart / anyOf
        Removed value: -[
        -  {
        -    "type": "string"
        -  },
        -  {
        -    "type": "null"
        -  }
        -]
      • addedOutput schema / properties / results / items / properties / chart / type
        Added value: +[
        +  "string",
        +  "null"
        +]
      • removedOutput schema / properties / results / items / properties / matched_key / anyOf
        Removed value: -[
        -  {
        -    "type": "string"
        -  },
        -  {
        -    "type": "null"
        -  }
        -]
      • addedOutput schema / properties / results / items / properties / matched_key / type
        Added value: +[
        +  "string",
        +  "null"
        +]
      • removedOutput schema / properties / results / items / properties / repo / anyOf
        Removed value: -[
        -  {
        -    "type": "string"
        -  },
        -  {
        -    "type": "null"
        -  }
        -]
      • addedOutput schema / properties / results / items / properties / repo / type
        Added value: +[
        +  "string",
        +  "null"
        +]
      • removedOutput schema / properties / results / items / properties / stars / anyOf
        Removed value: -[
        -  {
        -    "type": "number"
        -  },
        -  {
        -    "type": "null"
        -  }
        -]
      • addedOutput schema / properties / results / items / properties / stars / type
        Added value: +[
        +  "number",
        +  "null"
        +]
    • Changedkubesearch_search_releases12 fields changed
      • removedOutput schema / properties / results / items / properties / resolved_chart / anyOf
        Removed value: -[
        -  {
        -    "type": "string"
        -  },
        -  {
        -    "type": "null"
        -  }
        -]
      • addedOutput schema / properties / results / items / properties / resolved_chart / type
        Added value: +[
        +  "string",
        +  "null"
        +]
      • removedOutput schema / properties / results / items / properties / top_repos / items / properties / chart_version / anyOf
        Removed value: -[
        -  {
        -    "type": "string"
        -  },
        -  {
        -    "type": "null"
        -  }
        -]
      • addedOutput schema / properties / results / items / properties / top_repos / items / properties / chart_version / type
        Added value: +[
        +  "string",
        +  "null"
        +]
      • removedOutput schema / properties / results / items / properties / top_repos / items / properties / namespace / anyOf
        Removed value: -[
        -  {
        -    "type": "string"
        -  },
        -  {
        -    "type": "null"
        -  }
        -]
      • addedOutput schema / properties / results / items / properties / top_repos / items / properties / namespace / type
        Added value: +[
        +  "string",
        +  "null"
        +]
      • removedOutput schema / properties / results / items / properties / top_repos / items / properties / resolved_chart / anyOf
        Removed value: -[
        -  {
        -    "type": "string"
        -  },
        -  {
        -    "type": "null"
        -  }
        -]
      • addedOutput schema / properties / results / items / properties / top_repos / items / properties / resolved_chart / type
        Added value: +[
        +  "string",
        +  "null"
        +]
      • removedOutput schema / properties / results / items / properties / top_repos / items / properties / source_kind / anyOf
        Removed value: -[
        -  {
        -    "type": "string"
        -  },
        -  {
        -    "type": "null"
        -  }
        -]
      • addedOutput schema / properties / results / items / properties / top_repos / items / properties / source_kind / type
        Added value: +[
        +  "string",
        +  "null"
        +]
      • removedOutput schema / properties / results / items / properties / top_repos / items / properties / source_tag / anyOf
        Removed value: -[
        -  {
        -    "type": "string"
        -  },
        -  {
        -    "type": "null"
        -  }
        -]
      • addedOutput schema / properties / results / items / properties / top_repos / items / properties / source_tag / type
        Added value: +[
        +  "string",
        +  "null"
        +]
    • Changedrepo_clone2 fields changed
      • addedOutput schema / properties / pinned
        Added value: +{
        +  "type": "boolean"
        +}
      • changedOutput schema / required
        Previous value: -[
        -  "handle",
        -  "resolved_url",
        -  "branch",
        -  "file_count",
        -  "size_mb",
        -  "expires_in_minutes",
        -  "reused",
        -  "updated",
        -  "tree"
        -]New value: +[
        +  "handle",
        +  "resolved_url",
        +  "branch",
        +  "file_count",
        +  "size_mb",
        +  "expires_in_minutes",
        +  "reused",
        +  "updated",
        +  "pinned",
        +  "tree"
        +]
    • Addedrepo_grep_all
  2. 10 tool updatesv0.1.0
    • First observedkubesearch_get_release
    • First observedkubesearch_grep_values
    • First observedkubesearch_search_images
    • First observedkubesearch_search_releases
    • First observedkubesearch_status
    • First observedrepo_cleanup
    • First observedrepo_clone
    • First observedrepo_grep
    • First observedrepo_list_files
    • First observedrepo_read_file

TDQS

A4.5/5.0

Scored across 11 tools

Disambiguation5/5

Each tool has a clearly distinct role: kubesearch_* handles index-wide searches and details, while repo_* handles cloned repository file operations. Even the three grep-like tools are cleanly separated by scope (indexed values across all repos, all files in popular repos, and a specific cloned repo).

Naming Consistency4/5

Names largely follow a domain-prefix plus action pattern: kubesearch_search_*, kubesearch_get_*, repo_clone, repo_read_file, repo_grep. Minor deviations exist (repo_cleanup is noun-first, kubesearch_grep_values uses a verb-noun pairing not mirrored elsewhere), but the convention is predictable enough.

Tool Count5/5

Eleven tools is a well-scoped set for the server's purpose: search the kubesearch.dev index, retrieve release details, and inspect real repositories. Each tool covers a distinct operation and none feel redundant or ornamental.

Completeness5/5

The surface covers the full workflow: search releases/images/values, get detailed release information, clone repos, list/read/grep files, and clean up clones. The only minor nicety might be explicit pagination on release search, but detailed deployment pagination is already covered via kubesearch_get_release.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables AI agents to fetch, search, and retrieve markdown content from remote Git repositories. Supports both public and private repositories with authentication, allowing AI assistants to access documentation and notes stored in Git.
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables LLMs like Claude to securely execute Kubernetes CLI tools (kubectl, helm, istioctl, argocd) across multiple clusters through dynamic kubeconfig support, allowing natural language Kubernetes management and operations.
    5
    MIT