Log10x MCP Server
OfficialLog10x MCP Server gives an AI assistant 60+ tools to analyze, investigate, and cut log costs (and query the 10x platform) in plain English — no key needed to explore a read-only public demo dataset.
Cost intelligence — top patterns, per-service volume/cost, what's new or changing vs a baseline, week-over-week deltas, and pattern set-diffs across a time boundary.
Savings — forecast what a plan would cut, verify realized savings from the
routeStatelabel, pipeline ROI, commitment reports, and cost-reduction option menus.Incident investigation — single-call root-cause analysis with confidence scores, pattern trends and spike detection, plus cross-pillar correlation (metrics that moved, shape-similarity ranking, overlay, raw PromQL).
Pattern identification — resolve a pasted log line or hash to its stable pattern identity, pull live example events from Splunk/Datadog/ES/CloudWatch, and check dashboards/alerts that depend on a pattern before dropping it.
Mitigation — explain, preview, and apply drop/sample/compact/tier-down/offload/observe modes per pattern or service, or set up a recurring autonomous cost-reduction tick.
Retrieval — fetch exact offloaded events back from your own S3 by pattern identity or Bloom-filter search, build archived time series, and diagnose stalled queries.
Local engine runs — templatize pasted batches, extract template libraries, measure compaction ratios, find slot skew, and compile symbol libraries from source, repos, images, charts, or Artifactory.
Evaluation — run POCs from local files, kubectl, or a connected SIEM, including a fenced
--network noneairgapped mode plus a read-only sample-export script generator.Install & ops — discover k8s/AWS infrastructure, wizard-drive Reporter/Receiver/Retriever installs, emit SIEM connectors for offload buckets, validate env config, diff against env vars, and run health checks.
Account — browser or pasted-key sign-in, login status, sign-out, and environment selection; with no key the server boots read-only against the public demo data.
Supported as a bring-your-own metrics backend (LOG10X_CUSTOMER_METRICS_URL / _TYPE / _AUTH) for per-pattern volume and cost series.
Backfills per-pattern log volume and cost metrics into Datadog (configured via DD_API_KEY / DD_APP_KEY / DD_SITE) through the log10x_backfill_metric tool, so cost views light up alongside existing Datadog dashboards.
GitHub sign-in mints and stores a Log10x API key (log10x_signin_start / log10x_signin_complete, log10x_login_status), and a GitHub repo plus local path (LOG10X_GH_REPO / LOG10X_GITOPS_REPO_PATH) can be wired up for GitOps-aware configuration tools.
Grafana Cloud is supported as a bring-your-own metrics backend (LOG10X_CUSTOMER_METRICS_URL / _TYPE / _AUTH) for per-pattern volume and cost series.
Reads and remote-writes per-pattern volume and cost series to a Prometheus backend using PROMETHEUS_REMOTE_WRITE_URL / PROMETHEUS_URL, enabling per-pattern metric backfill and queries.
Supported as a bring-your-own metrics backend (LOG10X_CUSTOMER_METRICS_URL / _TYPE / _AUTH) for per-pattern volume and cost series.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Log10x MCP ServerWhy did our log costs spike this week?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Log10x MCP Server
Ask your AI assistant about log costs, log patterns, and incidents in plain English, and get structured answers backed by per-pattern metrics. "Why did our log costs spike this week?", "what's driving payments-svc volume?", "pull the payment_retry events for acme-corp from Jan 15 to Apr 15." The server exposes the 10x platform to Claude and any MCP-compatible assistant as a set of tools.
10x groups your logs by message type. The same lines repeat over and over with only the timestamp or request ID changing, so 10x collapses each flood of near-identical lines into one message type and ranks them by volume and cost. Names come from symbols compiled from code, so the same line gets the same name on every node under the same engine, library and configuration.
This server is open source under MIT. A Log10x product license (API key) unlocks the account-scoped tools; without one, the server boots read-only against a public demo dataset so the tools can be explored immediately.
What you can ask
You say | What happens |
"Where do I start? Help me cut log costs." | A guided menu asks what you want (cut cost, investigate, install) and routes to the right next step, plus what's new and what changed. |
"Sign me in." / "Who am I connected as?" | GitHub sign-in mints and stores an API key, and shows the environments your account can reach. |
"Show me how to install this on my stack." | Paste-ready setup steps for your own pipeline, fetch-back wiring, and a recommended action per service. A policy ships as a pull request to merge, or, for a ConfigMap, is written only by a second, explicit call. |
"Estimate savings on my data before I deploy." | A no-install savings report from a local log file or your existing log platform. |
"How much can I cut, and how much have I cut?" | Projected and realized savings with the per-pattern math behind every number. |
"What's driving my cost right now?" | The repeating message types and services driving volume and cost, and what moved week over week. |
"Why did payments-svc spike?" | A single-call investigation: timeline, correlated patterns, and the strongest temporal evidence, with confidence shown so nothing is presented as proven cause. |
"This message type is noise, cut it." | Sample, drop, compact, tier down, or offload a chosen message type, with examples and trend so the action is clear. |
"We are 100% Lambda, no cluster. Install there." | The install plan comes back for the serverless estate: the engine as a Lambda extension paired with the function's OTel collector, a CDK construct, and an AWS-native recurring tick over an S3 config plane. |
"Get me the actual events I offloaded." | Fetch the exact events back on demand from your own S3. |
"Recognize more of my message types." | Compile your own source code, binaries and container images into a symbol library so the engine names more of your message types. |
Related MCP server: FOCUS MCP Server
Install
Claude Code
claude mcp add --transport stdio --env LOG10X_API_KEY=your-api-key log10x -- npx -y log10x-mcpVerify with /mcp. Omit the --env flag to run read-only against the public demo dataset.
Claude Desktop
Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"log10x": {
"command": "npx",
"args": ["-y", "log10x-mcp"],
"env": {
"LOG10X_API_KEY": "your-api-key"
}
}
}
}Cursor, Windsurf, and other MCP clients
Add an mcpServers entry of the same shape: "command": "npx", "args": ["-y", "log10x-mcp"], and LOG10X_API_KEY in env. Omit the key to run read-only demo mode.
Full setup walkthrough: https://doc.log10x.com/apps/mcp/
Credentials
Account-scoped tools need a Log10x API key. Two ways to get one:
GitHub sign-in: run
log10x_signin_start, complete the flow, thenlog10x_signin_complete. The key is stored for you.log10x_login_statusshows who you're connected as.Environment variable: set
LOG10X_API_KEYdirectly.
No key? The server boots read-only against the public 10x demo dataset (the same sample data the website console shows), so analysis, discovery, and the install advisors all work out of the box. Mutating tools are disabled in this mode so shared demo state stays untouched. Set LOG10X_DEMO_FALLBACK=off to boot into pure POC mode (savings estimates on your own files, no account). The mode is fixed at startup; restart the server to re-detect.
Environment variables
All optional. The common path is just LOG10X_API_KEY (or no key at all).
Variable | Purpose |
| Your Log10x API key. Omit to boot read-only on the public demo dataset. |
| API base URL override (default |
| Pin a specific environment id instead of autodiscovering from your account. |
| Set to |
| Set to |
| Point at your own metrics backend (Prometheus, Grafana Cloud, Mimir, Thanos, AMP) for BYO-metrics setups. |
| Datadog credentials for backfilling per-pattern metrics into Datadog. |
| Prometheus endpoints for backfilling and reading per-pattern series. |
| Retriever query endpoint and the bucket it indexes, for fetch-back. Both are needed; |
| Default target app prefix for fetch-back queries, e.g. |
| CloudWatch log group the Retriever writes query events to, the value of its |
| Fetch-back query timeout (default 90000) and poll interval (default 1500). |
| Override the fetch-back auth header (defaults derive from the active environment). |
| S3 bucket names the offload tools manage. |
| Engine license key. Passed through to the engine on both the compile path and the local-engine run path ( |
| Path to an engine license file, the alternative to |
|
|
| Path to the local |
| Engine image for the run path in docker mode (default |
| Engine image shared by the run path and, as a fallback, |
| Compiler image for |
| GitHub repo and local path for GitOps-aware config tools. |
Connect your own data (optional)
10x keeps logs queryable without paying to index everything. The Receiver ships budget-overflow noise to your own S3, and the Retriever fetches those exact events back on demand when you need them. log10x_offload_add and log10x_retriever_register wire up the offload-and-fetch path; log10x_backfill_metric pushes per-pattern volume and cost series into your existing Datadog or Prometheus so the cost views light up alongside the rest of your dashboards.
Security
The server runs locally as a subprocess of your AI client. Only pre-aggregated metric queries (per-pattern volume and cost) leave the machine, never raw log content. Local triage with log10x_resolve_batch runs entirely on your machine over stdin and stdout. Connections to your own log platform use read-only credentials. Set LOG10X_MCP_READ_ONLY=true to refuse every mutating tool regardless of mode.
The fenced POC: provably offline
For an evaluation that has to be checkable rather than promised: MCP server and
log engine in one container started with --network none, over a log sample
you exported yourself with your own credentials.
docker run -i --rm --pull=never --network none --hostname localhost \
--cap-drop ALL --security-opt no-new-privileges \
-v "$PWD/poc/logs:/data:ro" -v "$PWD/poc/out:/out" \
-e TENX_LICENSE_KEY -e TENX_AIRGAPPED=true log10x/poc:localThere is no npx variant of this line, and that is not an oversight. npx
resolves and executes a package at run time, and a package's postinstall
script is unconfined code running with whatever network the host has; the
exact thing the fence exists to rule out. Everything in the image is baked at
build time; nothing is installed when the container starts.
The licence is minted by you, with one visible curl, before any log data is
in scope: in this profile the server never mints, and a missing licence fails
with those instructions rather than with a fetch. The log sample is exported
by you: log10x_emit_sample_plan renders a read-only shell script per
analyzer that you read once and run outside the container.
Verify it with one docker inspect line, then settle it by turning Wi-Fi off
and running the analysis again.
Full walkthrough, including what to check in the export script and the residuals we do not paper over: docs/fenced-poc.md.
Open source and license
MIT. Published on npm as log10x-mcp (Node 20+). The source is public so the behavior behind every tool can be read directly. Account-scoped tools require a Log10x product license (API key); the public demo dataset needs none.
MCP clients run the server as a long-lived child process. After upgrading the package, restart the client so the new version takes effect.
Reporting a run
Optional, and there is nothing to sign up for. If you point this at your own logs, open an issue with the platform it read, what the run showed or where it stopped, and whether you want a reply. Say if you do not, and you will not get one.
Documentation
https://doc.log10x.com/apps/mcp/
Why the tools key on a stable pattern ID: blog post.
Available Tools
56 toolslog10x_advise_installInstall wizardARead-onlyIdempotent
Progressive install wizard for the Log10x Reporter / Receiver on Kubernetes. This is the SINGLE entry point for installs: call it first. Do NOT call log10x_doctor or log10x_login_status as a pre-flight; the wizard handles login state, license acquisition, and demo-mode fallback internally, and surfacing the doctor's optional-capability warnings (Retriever, Datadog backfill, cross-pillar metrics) ahead of the install confuses users with concepts that are unrelated to deploying the Reporter/Receiver. Takes a snapshot_id from log10x_discover_env and walks the user through five decisions, asking one at a time and remembering each answer across turns (the snapshot's wizard session): (1) app, reporter (dedicated DaemonSet forwarder, zero-touch) or receiver (sidecar inside the user's existing forwarder); (2) forwarder, Receiver-only, auto-picked when one is detected, asked when multiple; (3) backends, array of metrics destinations, can be multiple (e.g., ["log10x", "datadog"] to report to both SaaS + own backend simultaneously); (4) airgapped, opt-in, conflicts only with "log10x" in backends (engine sends NOTHING to log10x.com); (5) license_jwt, auto-fetched from /api/v1/license/demo if the user is not signed in, or from /api/v1/license with the persisted Auth0 token if they are. Each call merges new args into the session and either asks the next question (returning a markdown prompt) or emits the final install plan once all answers are in. Demo + airgapped surfaces a soft warning (engine downgrades to online mode on demo licenses). Plan is plan-only: emits helm commands + values.yaml; the user runs them. With log_destination: "datadog" a Receiver plan adds the step after the POC: the fleet default for every service with no rule (fleet_default.action tier_down to Flex, or offload to S3), with the Flex index and its @routeState:tier_down filter or the S3 branch, the always-pass sample, and what an error monitor sees. Tier prerequisites: none, this is a pre-install tool.
| Name | Required | Description | Default |
|---|---|---|---|
| app | No | Which Log10x app to install. **reporter** = a dedicated DaemonSet forwarder (zero-touch, runs alongside your existing forwarder); **receiver** = a sidecar plugged into your existing forwarder (filters/samples/compacts events in-flight). When omitted, the wizard asks the user. | |
| action | No | Plan scope when the wizard is ready to emit. Default: `all`. | |
| backends | No | Where the engine emits TenXSummary metrics: the user's own TSDB(s), one or more of **prometheus**, **datadog**, **elastic**, **cloudwatch**. When omitted, the wizard asks, listing any backend whose agent discovery detected first. **log10x** (the Log10x-hosted TSDB) is for the public demo, not customer installs: it is never suggested, and is accepted only when the user explicitly asks for it. It then needs a user licence (`license_source: "signin"` or `"paste"`); on the default built-in evaluation licence it receives nothing. `airgapped: true` + `"log10x"` is rejected. | |
| airgapped | No | When true, the Log10x agents send nothing to log10x.com: engine metrics, license re-validation, and update checks all go silent. Use to reduce CISO friction. Conflicts with `"log10x"` in `backends` (the wizard surfaces the conflict). **Demo licenses cannot actually run airgapped**: the engine downgrades to online mode with a warning. The wizard surfaces this softly when both are picked. | |
| forwarder | No | Receiver-only: which detected forwarder kind to sidecar into. Auto-uses the snapshot's detected forwarder when there's exactly one; the wizard asks when there are multiple. | |
| namespace | No | Target namespace. Default: snapshot.recommendations.suggestedNamespace. | |
| snapshot_id | No | ID returned by `log10x_discover_env`, and the one arg the wizard cannot infer. The snapshot is cached for 30 min. Call `log10x_discover_env` first when there is no snapshot yet. | |
| release_name | No | Helm release name. Default: `my-<app>` (e.g., `my-reporter`). | |
| fleet_default | No | The fleet default for a Datadog Receiver plan (with `log_destination: "datadog"`). The Receiver values are written only on an engine release that reads `rateReceiverDefaultAction`. | |
| k8s_team_label | No | A pod label key whose value names the owning team (e.g. `team`). Receiver plans write `k8sTeamLabel` with it, on an engine release that reads that option, so the metrics carry `tenx_team`. | |
| license_source | No | How the engine is licensed. **Defaults to `"builtin"`** when omitted: the plan carries no licence and the engine runs its built-in evaluation licence (10 nodes, 30 days from each start, airgapped). Nothing is minted or stored, and no licence Secret is created. Pass **`"signin"`** when the user wants their own user-scoped licence: the wizard mints it via the user's Auth0 session and emits `signin_required` mode (chain through `log10x_signin_start`, then re-invoke) when no session exists. Pass **`"paste"`** with `license_jwt_paste: "<jwt>"` when the user already has a JWT. Pass **`"demo"`** only when the user explicitly asks for the anonymous 1-node, 14-day demo JWT. Every choice other than `builtin` adds a step that creates the licence Secret. Omitting this arg on a later call keeps the earlier choice. | |
| log_destination | No | Where the forwarder ships the log events (not the metrics; `backends` is the metrics). `datadog` adds the step after the POC to a Receiver plan: the fleet default for every service the POC report gives no rule, with the Flex index and its `@routeState:tier_down` filter (or the S3 branch for offload), the always-pass sample, and what an error monitor sees. | |
| license_jwt_paste | No | License JWT supplied by the user when `license_source: "paste"` (passing it alone implies `paste`). Minted from `POST /api/v1/license` (signed-in) or `POST /api/v1/license/demo` (anonymous). Maps to the chart's license Secret. | |
| backend_credentials | No | Per-backend credential configuration, keyed by backend kind (one of: datadog, elastic, cloudwatch, prometheus; `log10x` needs none, since it authenticates with the licence JWT). Each entry has a `secretName` (the Kubernetes Secret the user creates out-of-band holding sensitive env vars like `DD_API_KEY`; default per backend is `<backend>-credentials`) and optional `plainValues` (overrides for non-sensitive env vars like `DD_SITE`). Example: `{ "datadog": { "secretName": "datadog-secret", "plainValues": { "DD_SITE": "us5.datadoghq.com" } } }`. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare readOnlyHint/idempotentHint/openWorldHint; the description adds substantial behavior: it merges args into a cached snapshot session across turns, asks one question at a time, auto-infers license from Auth0 state, soft-warns on demo+airgapped, and is plan-only (emits helm commands the user runs). These traits are not recoverable from the annotations or schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the routing directive ('call it first') and the anti-pattern warning, so the most decision-relevant content comes first. It is long, and the log_destination/fleet_default paragraph substantially duplicates the schema text, costing it a point despite the complexity justifying a lengthy definition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 14-param, enum-heavy, nested-object wizard with an output schema already present, the description covers everything the agent needs: entry ordering, conflict rules (airgapped vs log10x), demo downgrade warning, license source modes, session persistence, and plan-only semantics. Return values are correctly left to the output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3, but the description adds workflow-level semantics the schema does not: the order the wizard asks questions, which args are auto-picked vs asked, that snapshot_id is 'the one arg the wizard cannot infer', and that omitting license_source on a later call preserves the earlier choice. Fleet-default and log_destination text largely restates the schema, hence not a 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence states a specific verb+resource (progressive install wizard for Log10x Reporter/Receiver on Kubernetes) and immediately positions it as the single entry point for installs. It explicitly distinguishes itself from siblings log10x_doctor, log10x_login_status, and log10x_discover_env, so an agent can route without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use ('call it first'), explicit when-not-to-use ('Do NOT call log10x_doctor or log10x_login_status as a pre-flight') with the reason why, and the prerequisite chain ('Call log10x_discover_env first when there is no snapshot yet'). It also states tier prerequisites ('none, this is a pre-install tool').
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_advise_retrieverAdvise: Retriever installARead-onlyIdempotent
Given a DiscoverySnapshot (from log10x_discover_env), produce an install/verify/teardown plan for the Log10x Retriever. Unlike Reporter + Receiver, the Retriever has no forwarder choice: it is a standalone set of workloads (indexer + query-handler + stream-worker) that read source logs from object storage through a queue and serve an HTTP query endpoint. Two storage providers, picked by storage_provider: aws (S3 input bucket with an indexing-results/ prefix, four SQS queues, an IRSA-annotated ServiceAccount), auto-detected from the discovery snapshot or supplied explicitly; azure (AKS, Azure Blob containers, four Azure Storage Queues, workload identity), where the chart's own provision-retriever.sh creates the resources and the plan quotes it. blockers carries the inputs a complete plan is still missing and the plan emits no steps while it is non-empty; the preflight table is the state report beside it, and a FAIL row there is reported, not a gate, so read preflight_summary.fail as well as blockers. Verify probes follow the provider: pods Ready, indexer processing, query endpoint responding, then S3 + SQS probes on aws and Blob + Storage Queue probes on azure. Teardown uninstalls the Helm release; on aws the S3 / SQS / IAM lifecycle stays with Terraform, on azure the last step runs the provisioning script with --destroy to delete the resource group it created.
| Name | Required | Description | Default |
|---|---|---|---|
| action | No | Plan scope. Default: `all`. | |
| location | No | Azure region for the provisioning command, e.g. `eastus` (azure only). | |
| namespace | No | Target namespace. Default: snapshot.recommendations.suggestedNamespace. | |
| infra_mode | No | How the customer provisions AWS infra. **terraform** = emit .tf module block. **cli** = emit aws-cli commands. **existing** = infra already provisioned, wizard skips infra steps and jumps to helm values. Auto-detected as "existing" when the snapshot already has all four SQS URLs + IRSA. | |
| destination | No | Destination SIEM for the kept slice (e.g. `datadog`, `cloudwatch`, `splunk`). Gates SIEM down-tier sub-sections in the offload markdown. | |
| snapshot_id | Yes | ID returned by `log10x_discover_env`. The snapshot is cached for 30 min. | |
| azure_queues | No | Azure Storage Queue names on the storage account (azure only). Default: tenx-index / tenx-query / tenx-subquery / tenx-stream, matching the provisioning script. | |
| iam_role_arn | No | IAM role ARN for the Retriever ServiceAccount (IRSA) (module output: iam_role_arn). Auto-detected from snapshot. | |
| index_bucket | No | S3 path for indexed results (include prefix). Default: `<index_source_bucket>/indexing-results/`. | |
| release_name | No | Helm release name. Default: `my-retriever`. | |
| license_source | No | How the engine is licensed. Defaults to `"builtin"`: nothing is minted and no key is written, and the engine runs its built-in evaluation licence (10 nodes, 30 days from each start, airgapped). Pass `"paste"` with `license_jwt_paste` to wire a licence you hold into the values file. `"signin"` mints a user-scoped JWT (emits `signin_required` when no Auth0 session exists) and `"demo"` mints a 1-node, 14-day JWT; a minted JWT is never written to disk, so it is supplied at install time with `--set-string`. Omitting this arg on a later call keeps the earlier choice. | |
| resource_group | No | Azure resource group for the provisioning command and the teardown (azure only). | |
| azure_client_id | No | Client id of the user-assigned managed identity federated to the release ServiceAccount (azure only). The provisioning script writes it into the values file it produces, under `storage.azure.auth.clientId`. | |
| azure_tenant_id | No | Entra tenant id (azure only). The provisioning script writes it into the values file it produces, under `storage.azure.auth.tenantId`. | |
| index_container | No | Blob path for indexed results (azure only), as `account/container/path`. Default: `<storage_account>/tenx-index/tenx`. | |
| index_queue_url | No | SQS URL for index operations (module output: index_queue_url). Auto-detected from snapshot. | |
| input_container | No | Azure Blob container holding source logs (azure only). Bare container name, e.g. `logs`. | |
| query_queue_url | No | SQS URL for query operations (module output: query_queue_url). Auto-detected from snapshot. | |
| storage_account | No | Azure storage account holding the input and index containers (azure only). Flat namespace only: a hierarchical-namespace account reorders listings and is refused by the engine at construction. | |
| aks_cluster_name | No | AKS cluster the release installs into (azure only). Used by the provisioning command (`--create-aks` for a new cluster) and by the `az aks get-credentials` step that points kubectl at it. | |
| storage_provider | No | Which object store the Retriever reads. **aws** (default) = S3 buckets, four SQS queues, IRSA. **azure** = Azure Blob containers, four Azure Storage Queues, AKS workload identity, behind the chart's `storage.provider: azure` block. Auto-selected as "azure" when the resolved env-config offload destination has type `azure_blob`. Azure is read and index side: the Retriever indexes and queries blobs already in the container, and forwarder offload recipes stay S3-shaped. | |
| stream_queue_url | No | SQS URL for stream operations (module output: stream_queue_url). Auto-detected from snapshot. | |
| license_jwt_paste | No | License JWT supplied by the user when `license_source: "paste"`. | |
| subquery_queue_url | No | SQS URL for sub-query operations (module output: subquery_queue_url). Auto-detected from snapshot. | |
| index_source_bucket | No | S3 bucket for source logs (module output: index_source_bucket_name). Auto-filled from snapshot.recommendations.retrieverS3Bucket when present. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds substantial behavior beyond the readOnly/idempotent annotations: `blockers` gating (no steps emitted while non-empty), the preflight table's FAIL row being a report rather than a gate, provider-specific verify probes, and the teardown lifecycle split (Terraform retains S3/SQS/IAM on aws; azure runs `--destroy`). This is exactly the non-obvious signaling an agent needs and is not derivable from annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Despite its length, it is front-loaded with purpose and then ordered by provider, blockers/preflight, verify, and teardown. Some clauses (e.g. quoting the provisioning script, repeating Helm/files mechanics) are dense run-ons, but for a 25-parameter tool the size is proportionate and most sentences carry unique information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need no explanation, and the description still covers the parts an agent cannot infer: what the plan contains, how `blockers`/`preflight_summary.fail` behave, provider-specific probes, and teardown semantics. Nothing essential for correct invocation appears missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description goes further by explaining cross-parameter relationships: how `storage_provider` flips the whole aws/azure resource model, that `blockers` reflect missing inputs, and how auto-detection works. It does not cover every one of the 25 parameters, but it adds relational meaning the schema cannot.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a precise verb+resource: given a DiscoverySnapshot, produce an install/verify/teardown plan for the Log10x Retriever. It explicitly contrasts the Retriever with Reporter + Receiver (no forwarder choice, standalone workloads), so an agent can place it against siblings like log10x_advise_install without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Names the prerequisite input (`snapshot_id` from `log10x_discover_env`) and the selection logic for providers (auto-detected, or overridden via `storage_provider`, auto-azure when offload destination is `azure_blob`). It does not explicitly route between this and the sibling advisories (e.g. `log10x_advise_install`), so it is clear on context but lacks exclusion guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_baselineBaseline readinessARead-onlyIdempotent
Pre-flight readiness gate for cost-reduction tools. Verifies Reporter age (default 7d), pattern-coverage stability, and absence of acute anomalies before configure_engine / estimate_savings should run. Returns structured not_ready with the specific gate(s) that failed.
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | Output format. Always "summary": the typed envelope. Field retained for backward-compat with callers that still pass `view: "summary"`. | summary |
| horizon | No | Lookback window for the baseline. 30d is the default and what `recommended_target_range` is calibrated against; 90d trades freshness for stability on lower-volume tenants. | 30d |
| destination | No | Destination SIEM. Required to project dollar baselines and decide which top contributors are compactable. Auto-detected from `env.analyzer` when omitted; falls back to `not_ready/no_destination` if neither is available. | |
| environment | No | Environment nickname for multi-env setups. | |
| statedDailyGb | No | Customer-stated daily SIEM ingest in GB. When supplied, the coverage gate compares observed bytes against this number; ≥80% passes, <80% returns `not_ready/coverage_low`. Omit to skip the coverage gate (the result still surfaces observed coverage as informational). | |
| monthly_volume_gb | No | What-if volume lens (forecast mode): model the environment at THIS monthly volume (decimal GB/month) instead of its measured volume. The real per-pattern shares and pattern mix are held fixed; only absolute bytes and dollars scale, by one uniform factor. Use it to project a prospect onto their own scale, or to forecast a real env after growth. Pairs with siem_lens. This is a PROJECTION: the envelope stamps volume_actual_gb vs volume_projected_gb and the scale factor, and the note points at the POC for the caller real patterns. | |
| effectiveIngestPerGb | No | Customer-negotiated $/GB for the destination. When supplied, baseline dollar projections use this rate and `rate_source` resolves to `customer_supplied`. Omit to fall back to vendors.json list pricing for the resolved destination (`rate_source: list_price`); omit BOTH this and `destination` to get a percent-first envelope (`rate_source: unset`, dollar fields null). |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover readOnly/idempotent/openWorld, so the bar is lower; the description adds real value by disclosing the three gates it checks, the default 7d Reporter age threshold, and the structured not_ready failure shape with the specific failed gates.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences, front-loaded with the tool's role, then the checks, then the failure contract. No filler and nothing repeated from structured fields.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present and full schema description coverage, the description needn't explain return fields; it still completes the picture by naming the gates and the not_ready envelope. Slightly short on what a passing result yields, but adequate for a read-only gate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and each parameter (horizon, destination, statedDailyGb, monthly_volume_gb, effectiveIngestPerGb) is richly documented in-schema. The description adds no parameter-level meaning beyond that, which is the expected baseline when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource: a 'pre-flight readiness gate' that verifies Reporter age, coverage stability, and anomaly absence. It explicitly positions itself relative to siblings by naming estimate_savings (and configure_engine) as downstream consumers, so an agent can distinguish it without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a clear sequencing rule: run before configure_engine / estimate_savings. It stops short of stating explicit when-not-to-use conditions or what to do when the gate fails beyond returning not_ready, but the usage context is unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_commitment_reportCommitment reportARead-onlyIdempotent
Weekly aggregate against a commitment record opened by log10x_configure_engine. Reports delivered bytes (and dollars at the contract rate where the contract allows), projects the next 90 days from a weak Beta(2,2) prior updated with weekly evidence, and renders a markdown summary suitable for sharing. REQUIRES a commitment record opened by a prior configure_engine apply; without one there is no baseline to report against.
| Name | Required | Description | Default |
|---|---|---|---|
| format | No | cfo_md=executive markdown with weekly chart and forward confidence; summary=typed envelope only; json=full structured data; weekly_digest=7-day operational digest from the recurring tick audit trail. | cfo_md |
| period | No | Reporting window. 30d=last 30 days, 90d=last 90 days, ytd=since Jan 1 of current year. | 90d |
| service | No | Service name to resolve a commitment by: used when commitment_id is omitted. When both are present, commitment_id wins. | |
| environment | No | Environment nickname; defaults to the active env. | |
| history_path | No | Override path to the recurring-tick JSONL audit trail (default: $LOG10X_RECUR_HISTORY_PATH or /tmp/log10x-recur-history.jsonl). Used only when format=weekly_digest. | |
| commitment_id | No | Commitment record id (created by log10x_configure_engine on PR-merge). If omitted, resolves the most recent commitment for the active service. | |
| action_intent_path | No | Override path to data/action-intent.json (relative to the gitops repo root or absolute). Used only when format=weekly_digest. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish read-only, idempotent, closed-world behavior, and the description adds the important non-obvious precondition (the tool is useless without a prior configure_engine apply) and the projection methodology (Beta(2,2) prior updated with weekly evidence). It does not discuss rate limits or output size, but the precondition disclosure is the key behavioral context and it is present.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences with the primary purpose front-loaded, followed by outputs, then the hard precondition. Dense but no filler; the Beta(2,2) methodology detail is arguably more than an agent needs to select the tool, which keeps it just short of a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values need not be explained, and the description covers purpose, outputs, and the critical prerequisite. The only gap is that the one-line summary downplays the format=weekly_digest operational-digest mode, which the schema carries, but nothing required for correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all seven parameters are already documented in the schema, including the format enum variants and the commitment_id-over-service precedence. The description does not add syntax, defaults, or precedence rules beyond what the schema states, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('Weekly aggregate against a commitment record') plus its three concrete outputs (delivered bytes/dollars, 90-day projection, markdown summary). No sibling tool in the list does commitment-relative reporting, and the description makes that scope obvious without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives an explicit precondition ('REQUIRES a commitment record opened by a prior configure_engine apply; without one there is no baseline') and names the sibling that creates it. It does not, however, name an alternative tool for the no-commitment case, so the agent must infer the fallback itself.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_compileCompile symbol libraryAIdempotent
Compile a symbol library from any mix of sources, waiting inline for the result when it is quick and handing back a pollable job_id when it is not. It waits up to max_wait_ms (default 45s): a small compile, and EVERY re-run (which reuses prior units via the pinned output folder), finishes inside that window and returns the finished library plus the full scan/link diagnostics in ONE call; a long first compile of a large tree overruns the wait and returns a running job_id to poll with log10x_compile_status, or just call this tool again later, since the output is pinned and a finished run is returned by the next call. max_wait_ms: 0 returns the job_id immediately (fire-and-forget). Sources combine freely: a local folder of source code / binaries (source_path), GitHub repositories via the GitHub REST API (github_repos, with optional github_branch / github_folders), docker/OCI images (docker_images), Helm charts (helm_charts), and Artifactory artifacts (artifactory_instance + artifactory_repo, with artifactory_files / artifactory_folders). The run scans the sources (Java, Go, Python, JS/TS, Scala, C/C++, C#, plus binaries) and writes per-file .10x.json symbol units plus a single linked .10x.tar library, the AOT artifact the 10x runtime later uses to assign hidden classes (TenXTemplates) to events. GitHub pull REQUIRES a token even for public repos: pass github_token or set GH_TOKEN; without one the tool returns not_configured. Docker-image pull is daemonless (podman bundled in compiler-10x, --cap-add SYS_ADMIN granted automatically) and public images need no credentials. Helm pull is a meta-source (renders the chart, by default also pulls the images it references); OCI/URL chart refs resolve standalone while a bare repo/chart needs a matching helm_repos entry. Artifactory pull needs a token (artifactory_token or ARTIFACTORY_TOKEN). REQUIRES the COMPILER flavor: runs log10x/compiler-10x @apps/compiler by default, or a local compiler-flavor tenx with mode="local". An engine that reports the compiler flavor as cloud is accepted; the native runtime build has no generate pipeline unit and is refused. No Kubernetes or Log10x account needed. .jar files are not scanned directly; provide extracted .class.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | Execution backend. `auto` (default) prefers Docker (the compiler image, guaranteed compiler flavor) and falls back to a local compiler-flavor tenx; the backend is chosen once, before the output folder is keyed. `docker` forces the image (LOG10X_COMPILER_IMAGE or LOG10X_TENX_IMAGE, default log10x/compiler-10x:1.1.136 pinned by digest, so every run goes through the same compiler). `local` forces the binary (LOG10X_TENX_PATH or `tenx` on PATH) and refuses it unless its version banner reports the compiler flavor (`compiler`, or `cloud` on an engine built before the flavor rename). Of the three shipped flavors only `compiler` can compile: `runtime` (native binary) and `runtime-jvm` (JVM-packaged runtime, the only runtime available on Windows) are both refused, since neither carries the `generate` pipeline unit. With a local install, local-folder compilation and GitHub pull (REST API + token) work out of the box; docker_images pull additionally needs a container engine (podman or docker) on the host. The docker `compiler-10x` image bundles all of those (podman included, daemonless), which is why Docker is the default. | auto |
| helm_repos | No | Helm chart repositories to register before resolving helm_charts, each as "name=url" (e.g. ["ingress-nginx=https://kubernetes.github.io/ingress-nginx"]). Required for bare "repo/chart" names; unnecessary for OCI/URL refs. Added via `helm repo add` in pre-step containers (docker mode only; in mode=local the host helm config is used as-is). url must be an http(s):// chart-repo index URL; for an OCI registry, put the oci://… ref directly in helm_charts (`helm repo add` does not support oci://). | |
| timeout_ms | No | Hard cap on compile wall time in milliseconds. Default 1,800,000 (30 min). The engine's own whole-scan cap (scanOperationTimeout, bundled default 10 min) is raised to 90% of this value on the command line, so the engine cap follows this value (needs compiler 1.1.89+; the pinned default is 1.1.136; an older local engine keeps its 10 min cap). A re-run over unchanged local sources skips every file whose checksum already has a unit and finishes in seconds. Pulled sources (GitHub, images, Artifactory) are re-checked remotely each run and downloaded again only when the remote changed; Helm charts are rendered again every run. | |
| helm_charts | No | Helm charts to render and scan, as chart refs. A meta-source: the compiler runs `helm template` / `helm show chart` to extract the docker images and GitHub source repos the chart references, then (by default) pulls those too. OCI refs (e.g. "oci://ghcr.io/nginxinc/charts/nginx-ingress") and full URLs resolve standalone; a bare "repo/chart" (e.g. "ingress-nginx/ingress-nginx") needs a matching helm_repos entry. Combines freely with the other sources. In mode=local the host needs the helm CLI and must have the repos already `helm repo add`-ed. | |
| max_wait_ms | No | How long to wait inline (ms) for the compile to finish before handing back a job_id to poll. Default 45,000 (45s): small compiles, and re-runs over unchanged local sources (the engine skips files whose checksum already has a unit), finish inside this and return the library + diagnostics in ONE call. A long first compile returns a running job_id to poll with log10x_compile_status; calling this tool again with the same arguments joins the running job instead of starting a second one. Re-runs that pull remote sources are not instant: GitHub, images and Artifactory are re-checked remotely each run and Helm charts re-rendered. 0 = fire-and-forget (return the job_id immediately). | |
| output_path | No | Absolute path where the symbol library is written (the .10x.json units and the linked .10x.tar). Defaults to a fresh temp directory, returned in the result as data.payload.output.folder. | |
| source_path | No | Absolute path to a local folder of source code / binaries to scan, traversed recursively. Parsed with a grammar or AST: Java, Scala, Python, Go, C/C++, C#, JavaScript, TypeScript (.ts; .tsx goes through the text scanner), Rust, and JVM .class bytecode. Other languages in the pattern scanner's file list (Kotlin, Ruby, PHP, Lua, Groovy, Swift, bash) get quoted-string extraction only. Archives (.jar, .war, .ear, .zip, .gz, .tar and compressed tarballs) are expanded and their entries scanned; .json/.yaml/.xml/.properties/.csv/.txt and similar config/text files go through the text scanner; .so/.dylib (and .dll on Windows hosts) through `strings`. Optional when any other source is given; at least one source (source_path, github_repos, docker_images, helm_charts, or artifactory_instance + artifactory_repo) is required. | |
| docker_token | No | Registry token/password for docker_images (fed to `docker login --password-stdin` against the default registry, Docker Hub). Falls back to DOCKER_TOKEN from the MCP server environment. Omit for public images; pair with docker_username. Reaches the compiler as process environment only. | |
| github_repos | No | GitHub repositories to pull (via the GitHub REST API) and scan, each as owner/repo (e.g. ["apache/commons-cli"]). REQUIRES a GitHub token, even for public repos: pass github_token, or have GH_TOKEN / GITHUB_TOKEN set in the MCP server environment. Combines freely with source_path. | |
| github_token | No | GitHub access token for github_repos (a fine-grained token with read-only Contents access to the target repos suffices). Falls back to GH_TOKEN / GITHUB_TOKEN from the MCP server environment. Reaches the compiler as process environment only; never written to disk or argv. When docker_images are given too, this same token additionally lets the compiler pull + scan each image's source repo (the org.opencontainers.image.source annotation); without it that extra scan is skipped silently. | |
| library_name | No | Base name for the linked .10x.tar library file and the compile runtimeName. Sanitized to [A-Za-z0-9_.-]. | symbols |
| docker_images | No | Docker/OCI images to pull and scan for symbols, as image refs, fully-qualified recommended (e.g. ["docker.io/grafana/grafana:11.1.0"]; a port-bearing host like "harbor.corp:8443/team/app:2.1" is fine, and a bare "alpine" resolves against the engine default registry). The pull is daemonless (podman inside the compiler-10x image, no host docker socket), and the tool automatically grants the compile container `--cap-add SYS_ADMIN` (needed by podman; only when this arg is used). Public images need no credentials. docker_username + docker_token `docker login` to the DEFAULT registry (Docker Hub), so they cover private Docker Hub repos; images on a different private registry must be pre-authenticated on the host/engine. In mode=local the host needs a docker/podman CLI with a working engine, and pulled images are left in its store (remove:false). Combines freely with source_path and github_repos. | |
| github_branch | No | Branch to pull for ALL github_repos. Omit to pull each repo's default branch. | |
| github_folders | No | Folders within each GitHub repo to pull (e.g. ["src/main/java"]). Omit to pull entire repos. Narrowing this speeds up both the pull and the scan. | |
| docker_username | No | Registry username for docker_images login, also used for private images a Helm chart references (helm_pull_images). Authenticates the default registry (Docker Hub). Falls back to DOCKER_USERNAME from the MCP server environment. Omit for public images. The engine logs in only when BOTH username and token are non-blank. Reaches the compiler as process environment only. | |
| helm_pull_repos | No | Whether to pull + scan the GitHub source repos a chart references (via org.opencontainers.image.source annotations). Default false because it REQUIRES a GitHub token (engine refuses an empty token); enabling it without github_token / GH_TOKEN returns not_configured. | |
| artifactory_repo | No | Artifactory repository key to pull from, e.g. "libs-release-local". Required when artifactory_instance is given. Scope the pull with artifactory_files and/or artifactory_folders. | |
| helm_pull_images | No | Whether to pull + scan the docker images a chart references (the richest symbol source for a chart). Default true. When true the tool grants the compile container `--cap-add SYS_ADMIN` (daemonless podman), same as docker_images. Set false to scan only the chart template/values text. | |
| artifactory_files | No | Specific files within artifactory_repo to pull, each a repo-relative path (e.g. ["dist/app-1.0.0.tar.gz"]). Combine with artifactory_folders; at least one of the two is required when pulling from Artifactory. | |
| artifactory_token | No | Artifactory API access token for artifactory_instance. Falls back to ARTIFACTORY_TOKEN from the MCP server environment. Required when pulling from Artifactory. Reaches the compiler as process environment only; never written to disk or argv. | |
| artifactory_folders | No | Folder paths within artifactory_repo to pull (e.g. ["com/acme/app"]). Traversed recursively unless artifactory_recursive is false. At least one of artifactory_files / artifactory_folders is required when pulling from Artifactory. | |
| artifactory_instance | No | Base URL of an Artifactory instance to pull artifacts (Java archives, .NET assemblies, etc.) from and scan, e.g. "https://demo.jfrog.io/artifactory". Requires artifactory_repo and a token (artifactory_token or ARTIFACTORY_TOKEN). Pull is via the Artifactory REST API, no extra host privilege. Combines freely with the other sources. | |
| artifactory_recursive | No | Whether artifactory_folders are pulled recursively (sub-folders too). Default true. Ignored when only artifactory_files are given. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover safety (readOnly=false, idempotent=true, destructive=false), but the description adds substantial context beyond them: token requirements per source and the not_configured outcome, the compiler-flavor gate that refuses runtime/runtime-jvm engines, the automatic `--cap-add SYS_ADMIN` grant, output pinning/idempotency semantics, and the .jar-not-scanned caveat. This is unusually rich behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The most decision-relevant behavior (inline wait vs pollable job_id) is front-loaded in sentence one, and nearly every sentence carries operational detail. It is a dense single block though, and a few token/credential points (e.g. the GitHub token requirement) restate what the schema property descriptions already say.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 23-parameter tool with no required fields, the description supplies the missing decision context: source combination rules, credential prerequisites, backend/flavor eligibility, and the wait/poll lifecycle. An output schema exists, so the description only needs to signal that results include the library plus diagnostics, which it does.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is already met; the description still adds cross-parameter meaning the schema can't express, notably the 'at least one source is required' constraint and the combinability rules among source_path, github_repos, docker_images, helm_charts and Artifactory. It does not add much per-parameter syntax beyond what the schema already documents.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb+resource ('Compile a symbol library from any mix of sources') and immediately names the sibling it hands off to (log10x_compile_status) as well as the polling alternative. An agent can distinguish this from log10x_compile_status, log10x_compile_link and log10x_extract_templates without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when the call returns inline (small compiles, every re-run reusing the pinned output folder) versus when it returns a job_id, and names the fallback path (poll log10x_compile_status, or re-call this tool). It also flags the special `max_wait_ms: 0` fire-and-forget mode and the token prerequisites that gate each source type.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_compile_linkLink symbol unitsAIdempotent
Link an existing folder of .10x.json symbol units (from a prior compile) into a single .10x.tar library, with NO source scan. This is the same compiler-flavor Compiler app invoked with link-only arguments: the units folder is the outputSymbolFolder and no source is mounted, so the engine reuses the units already on disk (scans 0 new files) and merges them into the library, which is written into that same folder. Like log10x_compile it waits inline up to max_wait_ms (default 45s; linking is usually fast, so it normally returns the linked library in ONE call) and otherwise hands back a job_id to poll with log10x_compile_status. Use it to re-link after editing or pruning units, to assemble a library from a units tree built piecemeal, or to rebuild a library from the output folder of a prior log10x_compile. REQUIRES the COMPILER flavor (runs log10x/compiler-10x @apps/compiler by default, or a local compiler-flavor tenx with mode="local"; an engine reporting the flavor as cloud is accepted, the native runtime build is refused). No Kubernetes or Log10x account needed.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | Execution backend, same contract as log10x_compile's `mode`: `auto` prefers the compiler image, `docker` forces it, `local` uses a compiler-flavor tenx. Only the compiler flavor can link; see log10x_compile `mode` for the three flavors and which are refused. | auto |
| timeout_ms | No | Hard cap on link wall time in ms. Default 600,000 (10 min). Linking is much faster than scanning, but a very large units tree can still take minutes. | |
| units_path | Yes | Absolute path to a folder of .10x.json symbol units (produced by a prior compile) to link into a single .10x.tar library. Traversed recursively; the existing units are merged with NO source re-scan, and the .10x.tar is written into this same folder. | |
| max_wait_ms | No | How long to wait inline (ms) for the link to finish before handing back a job_id to poll. Default 45,000 (45s). Linking usually finishes inside this and returns the library in ONE call. A very large units tree returns a running job_id you poll with log10x_compile_status. 0 = fire-and-forget. | |
| library_name | No | Base name for the linked .10x.tar and the runtimeName. Sanitized to [A-Za-z0-9_.-]. | symbols |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark it as a non-read-only, idempotent, non-destructive write; the description adds substantial context beyond that: it scans 0 new files, merges on-disk units into the library written to the same folder, waits inline up to max_wait_ms (typically returning in one call) and otherwise hands back a job_id, and requires the compiler flavor while refusing the native build. No contradiction with the write/idempotent annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The purpose, scope, and key constraint are front-loaded in the first sentence, and each subsequent sentence carries real information. It is dense and long for a single paragraph, but there is little filler to cut.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with an output schema present, the description covers purpose, prerequisites, execution semantics, timing, and fallback behavior. Nothing an agent needs in order to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents all five parameters (baseline 3). The description goes further by tying units_path to the compiler's outputSymbolFolder and explaining max_wait_ms's inline-vs-job_id behavior, adding cross-parameter context on top of the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening sentence states a specific verb (Link), resource (existing folder of .10x.json symbol units), and output (.10x.tar library), plus a distinguishing constraint (NO source scan). It explicitly contrasts with log10x_compile, so an agent can tell them apart without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives three concrete when-to-use scenarios (re-link after editing/pruning units, assemble from a piecemeal units tree, rebuild from a prior compile's output folder) and names log10x_compile_status as the polling alternative. Restrictions (compiler flavor required, native runtime refused) are stated up front.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_compile_statusCompile statusARead-onlyIdempotent
Poll an asynchronous compile started by log10x_compile (or a link started by log10x_compile_link), by its job_id. Returns job_status (running / completed / failed / timed_out), the units produced so far + the linked .10x.tar (path + size), elapsed time, the engine exit code, and a credential-redacted tail of the engine log. Crucially, it promotes the engine's scan/link DIAGNOSTICS into the envelope so the compiler is not a black box at 100k to 500k file scale: per-language scan-failure counts with capped failure samples (which files failed to parse and why), and the link report (units merged / skipped, files excluded by folder/name filter, and the symbol-type histogram: class / enum / log / exec). Those appear once the compiler-10x image carries the engine diagnostics change; on an older image the tool degrades to unit counts + the log tail. The first terminal poll captures the exit code into the job record and frees the container; later polls stay readable and the compiled library is never removed.
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | summary returns the typed envelope (data.payload.job_status, .loss_markers, .diagnostics, .output, .log_tail). | summary |
| job_id | Yes | The job id returned by log10x_compile (data.payload.job_id). | |
| log_lines | No | How many trailing engine-log lines to include in data.payload.log_tail (credential-redacted). 0 to omit. Raise it when diagnosing a failed or incomplete run. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnly/idempotent annotations, the description discloses substantial behavior: the four job_status states, that the first terminal poll captures the exit code and frees the container while the library is never removed, and that diagnostics degrade on an older engine image. This is exactly the lifecycle context an agent needs and cannot get from structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The purpose is front-loaded in the first clause and each sentence carries real content (states, diagnostics, degradation, lifecycle). It is dense and longer than necessary — the diagnostics sentence is heavy — but almost nothing is padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a job-polling tool with an output schema present, the description covers the full lifecycle: what is returned, terminal-state side effects, degraded behavior on old images, and post-completion readability. Nothing needed to poll correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the schema already documents view, job_id, and log_lines (including raising log_lines for diagnosis). The description restates that job_id originates from compile and that the log tail is credential-redacted, but adds little parameter-level meaning beyond what the schema provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb+resource (poll an async compile) and immediately scopes it to jobs produced by log10x_compile / log10x_compile_link, distinguishing it from those producer siblings. An agent can tell exactly what this tool returns (job_status, units, diagnostics) without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It clearly states the usage context: poll a job started by log10x_compile or log10x_compile_link, keyed by job_id, and it explains that later polls stay readable after the container is freed. It stops short of an explicit when-not condition, but the polling lifecycle is unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_cost_optionsCost reduction optionsARead-onlyIdempotent
CALL THIS after the user picks 'show me what cutting costs would look like' from log10x_start. At Receiver/Retriever tier returns the 6-mode outcome-first menu (drop / sample / compact / tier_down / offload / observe_only), each gated by the customer's detected capabilities (receiver tier, SIEM type, offload bucket). At Reporter-only or Dev tier, collapses to 2 entries: observe_only + install_receiver (with prose explaining that the full 6-mode menu requires the Receiver in-path). All non-observe modes route to log10x_explain_mode. The envelope carries must_render_verbatim (show to user as-is), must_ask_user (numbered question), and forbidden_next_actions (do not call estimate_savings, configure_engine, or pattern_mitigate until the user picks). Accepts siem_lens (what-if destination): keeps the measured volumes, prices + gates for that destination at list rates, and stamps siem_actual vs siem_lens in the envelope.
| Name | Required | Description | Default |
|---|---|---|---|
| service | No | Scope to a service. Passed forward to estimate_savings when the user picks a mode. | |
| siem_lens | No | What-if destination lens (alias of `destination` with provenance stamping): gate the 6-mode menu and downstream pricing for THIS destination while the connected pipeline keeps its actual one. The envelope stamps siem_actual vs siem_lens so receipts show the lens. | |
| destination | No | Destination stack. When set, routes_to.args carries THIS destination forward to estimate_savings: overrides the env-auto-detected SIEM. Pass when the upstream tool (baseline / configure_engine) already established a destination that differs from the env default; without it, cost_options falls back to siem_detected and routes_to may carry a destination the upstream chain did not pick. | |
| pattern_hash | No | Optional pattern hash to scope the cost option menu to a single pattern. When present, routes_to.args will include a proposed_config row for this hash. | |
| target_percent | No | % reduction goal carried from log10x_start pick, pre-filled when the user stated a target. | |
| monthly_volume_gb | No | What-if volume lens (forecast mode), forwarded to the estimate_savings this menu routes to. cost_options scales nothing itself; it carries this value into routes_to.args so the projection survives the hop. See log10x_estimate_savings for the projection semantics. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover read-only/idempotent/open-world, but the description adds substantial behavioral context beyond them: capability gating (receiver tier, SIEM type, offload bucket), the non-observe routing to log10x_explain_mode, the envelope contract (must_render_verbatim, must_ask_user, forbidden_next_actions), and siem_lens provenance stamping (siem_actual vs siem_lens). None of this is in the structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A dense, front-loaded block with no filler sentences – every clause (tier variants, routing, envelope, lens) carries operational weight. It runs long, but the length is justified by the branching behavior; slightly tighter grouping of the envelope and lens clauses would read better.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Complete for a branching menu tool: entry condition, tier-dependent output shapes, downstream routing, envelope fields, and forbidden actions are all present, and an output schema exists so return-value enumeration is unnecessary. Nothing an agent needs to call it correctly is omitted.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% so the baseline is 3, but the description meaningfully amplifies it: siem_lens is framed as a what-if lens that keeps measured volumes but re-gates and re-prices at list rates for the lens destination, and destination is described as an override of env-autodetected SIEM carried forward in routes_to.args. That is semantics the schema text alone implies but does not spell out.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific resource (the cost-reduction option menu) with tier-conditional content, and explicitly distinguishes itself from siblings by naming log10x_start as the trigger and log10x_explain_mode / log10x_estimate_savings / configure_engine / pattern_mitigate as downstream or forbidden tools. An agent can place this tool in the flow without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit when-to-use ('CALL THIS after the user picks show me what cutting costs would look like from log10x_start'), variant behavior per tier (6-mode menu at Receiver/Retriever, 2-entry collapse at Reporter-only/Dev), and explicit exclusions ('forbidden_next_actions ... do not call estimate_savings, configure_engine, or pattern_mitigate until the user picks').
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_customer_metrics_queryCustomer metrics queryARead-onlyIdempotent
Low-level PromQL passthrough to the customer metric backend configured via LOG10X_CUSTOMER_METRICS_URL. Returns the raw Prometheus response shape plus metadata about which backend served the query. This is the escape hatch for cross-pillar investigations the higher-level primitives don't cover: use it to explore the customer backend's label universe, run a one-off PromQL expression, or verify that a specific metric exists before correlating against it. For typical cross-pillar workflows, compose the deterministic primitives: log10x_metrics_that_moved → log10x_rank_by_shape_similarity → log10x_metric_overlay.
| Name | Required | Description | Default |
|---|---|---|---|
| end | No | End of the range window. Required when mode=range. | |
| mode | No | `instant` runs a point-in-time query; `range` runs over a time window with a bucket step. | instant |
| step | No | Bucket step for range queries, in seconds. Required when mode=range. | |
| start | No | Start of the range window: ISO8601 or UNIX seconds. Required when mode=range. | |
| promql | Yes | PromQL expression to execute against the customer metric backend. Example: `apm_request_duration_p99{service="payments-svc"}`. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint and openWorldHint, so the safety profile is covered. The description adds genuine context beyond that: the backend is env-var configured and the response is the raw Prometheus shape plus backend metadata. It omits auth requirements and rate limits, keeping it short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with what the tool is, then when to use it, then the alternative. Dense but every sentence carries weight; slightly longer than strictly necessary but no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present the description needn't explain return values, yet it helpfully notes the raw Prometheus shape plus backend metadata. Combined with the routing guidance, an agent has enough to invoke it correctly; only permission/limit specifics are absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents promql, mode, step, start and end including the mode=range requirements. The description adds only an example PromQL expression and does not clarify parameter semantics beyond the schema, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('PromQL passthrough to the customer metric backend') and pins the backend to the LOG10X_CUSTOMER_METRICS_URL configuration. It distinguishes itself from siblings by framing its role as 'the escape hatch' vs the deterministic primitives it names.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use cases (explore the label universe, run a one-off PromQL expression, verify a metric exists) and names the exact alternative chain (`log10x_metrics_that_moved` → `log10x_rank_by_shape_similarity` → `log10x_metric_overlay`) that should be preferred for typical workflows.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_datadog_change_reportDatadog change report and spike monitorsARead-onlyIdempotent
Weekly change report for a Datadog install, read from the per-pattern series the engine's Datadog metric output publishes (emitted_events_summaryVolume, tagged message_pattern, tenx_hash, k8s_container, tenx_user_service, routeState, and tenx_team once the team label ships). Lists the statements new in a service since since (a duration like 7d or a date; stateless, so pass the previous report's next_since to continue), each with lines a day, estimated Standard indexing cost a month at Datadog list price, whether a rule held it, and the rule that did (the container's row and action in caps.csv / actions.csv, read from the gitops repo or the policy ConfigMap). Ends with proposed per-service rows in the plan's form: ": any statement above N lines a day goes to Flex. Today that is these K statements, about $X a month." view: "monitors" instead renders two Datadog monitor definitions as JSON for the account owner to apply: a metric monitor that fires when a statement's route turns tier_down or offload, and an anomaly monitor with weekly seasonality that fires when a statement's volume rises above its weekly baseline. Read-only: Datadog's query API with DD_API_KEY / DD_APP_KEY / DD_SITE (GET only), and the engine files. Writes nothing.
| Name | Required | Description | Default |
|---|---|---|---|
| site | No | Datadog site (e.g. `us5.datadoghq.com`). Defaults to DD_SITE, then `datadoghq.com`. | |
| view | No | `markdown` (default): the weekly change report. `summary`: the same data without the rendered page. `monitors`: two Datadog monitor definitions as JSON (a statement turning tier_down or offload; a statement above its weekly baseline), for the account owner to apply. `monitors` reads nothing. | markdown |
| limit | No | Most new statements listed. Default 25. | |
| since | No | Start of the report: a duration back from now (`7d`, `36h`) or a date or ISO timestamp (`2026-10-06`). A statement is new when it had no line in its service in the `lookback` before this point. Pass the previous report's `next_since` to continue where it ended. Default `7d`. | 7d |
| action | No | Where a proposed row sends a statement: `tier_down` (Flex, the default) or `offload` (S3) for an account without Flex. | tier_down |
| notify | No | Notification handles for the monitors view (e.g. `@slack-log-cost`). | |
| headroom | No | Multiplier on the fleet's largest kept statement, for a service with no history of its own. Default 2. | |
| lookback | No | How far before `since` to look for earlier lines of a statement. Default `28d`, at most `90d`. | 28d |
| team_tag | No | Team tag key on the series (e.g. `tenx_team`). Omit to detect `tenx_team` on the series; the team is shown only when present. | |
| tenx_env | No | `tenx_env` tag value to scope the series to. Omit for every environment. | |
| environment | No | MCP environment nickname, used to find the gitops repo holding caps.csv and actions.csv. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint/idempotentHint/openWorldHint, yet the description adds real operational context: the Datadog query API is GET-only with DD_API_KEY/DD_APP_KEY/DD_SITE, the engine files are also read, nothing is written, and the tool is stateless so `next_since` carries continuity. It also discloses the source series' tag set and notes the team label appears only once shipped.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose and modes are front-loaded, and the closing sentence covers auth and safety. The middle is a dense, heavily parenthesized run-on describing fields and data sources that takes effort to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 11-parameter, zero-required, multi-mode tool with an output schema, the description covers mode selection, the parameter interactions that matter (since/lookback, team_tag detection, environment for gitops lookup), data provenance, and auth. Return values are delegated correctly to the output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds semantics the schema does not: the exact definition of 'new' relative to `lookback`, the continuation contract for `since`/`next_since`, and the meaning of `view: "monitors"` as producing applyable definitions. This meaningfully exceeds the schema text.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource up front: a weekly change report read from the engine's Datadog metric output, plus a `view: "monitors"` mode that emits two Datadog monitor definitions as JSON. The three output modes and the fields each statement carries are spelled out, so an agent can tell this apart from reporting siblings like log10x_commitment_report or log10x_whats_changing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear when-to-use context: continuation via the previous report's `next_since`, `view: "monitors"` for the account owner to apply, and `monitors` reading nothing. It does not, however, name or exclude any sibling tool, so the agent must infer which of the many reporting tools to prefer.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_dependency_checkDependency check commandARead-onlyIdempotent
Given a pattern identity, generate commands to scan the user's SIEM/observability stack (Datadog monitors, Splunk saved searches, Grafana dashboards, Prometheus alert rules) for anything that depends on that pattern. Call this before any mute, drop, or source-code deletion: deleting a log line that feeds a live alert silently breaks the alert. Also call when a developer asks "am I allowed to delete this log.info() call" or "what references this pattern".
| Name | Required | Description | Default |
|---|---|---|---|
| vendor | No | SIEM vendor to scan. Omit to auto-detect from ambient credentials (DD_API_KEY+DD_APP_KEY → datadog; SPLUNK_HOST+SPLUNK_TOKEN → splunk; ELASTIC_URL → elasticsearch; AWS chain → cloudwatch). When multiple SIEMs are configured, the tool returns an "ambiguous" error listing them: pass vendor= to disambiguate. When the resolved SIEM has live credentials the scan runs in-process and returns actual dashboard/alert/saved-search names + URLs; otherwise the tool falls back to a paste-ready bash command. | |
| pattern | Yes | Pattern name (e.g., "Payment_Gateway_Timeout") | |
| service | No | Service name to scope the scan | |
| severity | No | Severity level |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and openWorldHint=false, so the safety profile is covered. The description adds meaningful behavioral context beyond that: the consequence of skipping the check (silently breaking a live alert). The credential-dependent in-process vs. bash-command fallback behavior lives in the schema rather than the description, so a higher score is not warranted.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads purpose, then a bolded imperative warning and additional trigger examples. Every sentence adds decision-relevant information with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema exists, so return values need not be described, and the schema covers the credential/fallback mechanics. The description says 'generate commands' but the schema reveals it may also run in-process and return live names/URLs; that nuance is not mirrored in the description, though the schema compensates.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all four parameters are already documented in the schema. The description only restates the pattern input ('Given a pattern identity') and adds nothing on vendor, service, or severity. Baseline 3 is correct when the schema carries the parameter burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (generate commands to scan) plus the resource (SIEM/observability stack dependencies for a given pattern) and enumerates the concrete targets (Datadog monitors, Splunk saved searches, Grafana dashboards, Prometheus alert rules). An agent can distinguish this from sibling tools like log10x_pattern_mitigate without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit trigger conditions: call before any mute, drop, or source-code deletion, and call when a developer asks whether a log line is safe to delete or what references a pattern. It names the risk that motivates the call rather than leaving usage to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_discover_envDiscover env (k8s + AWS)ARead-onlyIdempotent
Read-only discovery of the caller's Kubernetes cluster + AWS account: i.e. the customer's INFRASTRUCTURE environment, NOT their Log10x account. When the user wants to install Log10x: call this tool FIRST and then log10x_advise_install, that's the whole pre-flight. Do NOT call log10x_doctor / log10x_login_status / log10x_savings / etc. before the install; the wizard handles all login + license logic internally, and surfacing those tools' optional-capability warnings (Retriever, Datadog backfill, cross-pillar metrics) makes the install feel more complicated than it is. Probes kubectl (workloads, DaemonSets, Helm releases, service-account IRSA annotations, metrics-backend agents) and AWS (EKS, S3, SQS, CloudWatch log groups) to detect: which forwarder is running (Fluent Bit, Fluentd, Filebeat, Logstash, OTel Collector, Vector), which log10x apps are already installed (Reporter, Receiver, Retriever), and which metrics backends are already deployed (Datadog Agent, Prometheus, Elastic, CloudWatch Agent, etc.). Returns a terse markdown report + a snapshot_id (cached 30 min) the advisor tools consume. Do NOT call this tool to answer "which Log10x environments do I have access to" / "list my envs" / "switch envs": those are about the user's Log10x ACCOUNT environments, use log10x_login_status for that. Call THIS tool only when the question is about k8s workloads, AWS infra, or "what's deployed in my cluster". Every shell call is logged in the snapshot's probeLog for audit. No writes, no state mutation: only kubectl get and aws ... describe/list verbs. Tier prerequisites: none, this is a pre-install tool and runs against any customer environment.
| Name | Required | Description | Default |
|---|---|---|---|
| region | No | AWS region to probe. If omitted, uses the region from your AWS CLI profile. | |
| skip_aws | No | Skip all AWS probes (for cluster-only discovery). | |
| namespaces | No | Explicit list of Kubernetes namespaces to probe. If omitted, the tool auto-picks up to 5 likely candidates (demo, logging, observability, otel-demo, default) plus kube-system. | |
| bucket_hint | No | Substring to match against S3 bucket names. Defaults to "retriever"; also matches "log10x" and "tenx" out of the box. | |
| skip_kubectl | No | Skip all kubectl probes (for AWS-only discovery or when cluster access is restricted). | |
| forwarder_hint | No | Override forwarder detection. Use this if multiple forwarders are running and you want the advisor to target a specific one. | |
| namespace_hint | No | Preferred namespace for new installs. Defaults to "logging" unless an existing forwarder namespace is found. | |
| eks_cluster_name | No | EKS cluster to describe. If omitted and exactly one cluster exists in the account/region, that one is auto-selected. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover readOnly/idempotent/openWorld, and the description adds genuine context beyond them: the snapshot is cached 30 minutes, every shell call is logged in probeLog for audit, only kubectl get and aws describe/list verbs are used, and there are no tier prerequisites. These are behavioral facts an agent cannot infer from the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose is front-loaded, but the body is bloated with three separate bolded 'do NOT' warnings and repeated restatement of the account-vs-infra distinction. Each block has routing value, yet the formatting and redundancy cost readability rather than adding information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values are covered, and the tool's complexity (8 optional params, open-world probes, cache TTL) is fully addressed: the description explains probe scope, caching, audit logging, and prerequisites. Nothing an agent needs to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 8 parameters including defaults and auto-selection behavior. The description adds only the snapshot_id caching detail, which is a return value rather than a parameter. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Read-only discovery of the caller's Kubernetes cluster + AWS account') and explicitly disambiguates from the Log10x ACCOUNT, which is the most likely confusion. An agent can distinguish this from log10x_login_status without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use ('when the user wants to install Log10x: call this FIRST then log10x_advise_install'), explicit when-not-to-use (do not call doctor/login_status/savings before install), and names the alternative tool for account-env questions. This is a textbook routing definition.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_discover_joinDiscover join labelARead-onlyIdempotent
Auto-discover the structural join label between Log10x pattern metrics and the customer metric backend. Runs Jaccard similarity on label value sets across candidate label pairs, returns the best pair above the 0.7 threshold plus runner-ups above 0.5. The result is cached per-session keyed by (environment, customer-backend-endpoint) so the cross-pillar primitives (metrics_that_moved, rank_by_shape_similarity, metric_overlay) can auto-run this once at session start and reuse the cached join without re-probing. Agents should normally NOT need to call this tool directly: the primitives call it internally. The explicit tool exists for power users who want to inspect the join universe or force a re-discovery after backend changes. When no pair crosses the threshold, returns a structured no_join_available response with the full probed-label matrix and recommended next actions.
| Name | Required | Description | Default |
|---|---|---|---|
| window | No | Time window for label value enumeration (e.g., "10m", "1h", "30m"). When set, both the Log10x and customer backends are queried with [now - window, now] filtering, excluding stale label values from series that stopped emitting samples. CRITICAL for environments with historical replay data, decommissioned pods, or otherwise orphan label values: stale values drag Jaccard down and cause false `no_join_available` refusals. Recommended: "10m" for steady-state clusters, "1h" for bursty traffic. Omit to include all-time values (default Prometheus behavior). Alias: `timeRange`. | |
| timeRange | No | Alias for `window` for consistency with other Log10x tools. | |
| environment | No | Environment nickname (for multi-env setups). | |
| force_refresh | No | When true, bypass the session cache and re-run the Jaccard pass against the live backends. | |
| minimum_jaccard | No | Minimum Jaccard similarity to accept as a primary join. Default 0.7. Lower to 0.5 for exploratory discovery, 0.3 for noisy environments with historical stale values. | |
| candidate_labels | No | Optional subset of customer-side labels to probe (max 100). An AI caller reasoning over results can't meaningfully digest more than a few dozen; the cap reflects that, not a backend constraint. When omitted, all labels from the customer backend are probed in preferred-first order. | |
| customer_metrics_url | No | Per-call override for the customer metrics backend URL. Wins over LOG10X_CUSTOMER_METRICS_URL env var. Use this when the MCP server was launched with an empty/stale URL and you want to redirect to a reachable Prometheus without restarting the server. | |
| customer_metrics_auth | No | Per-call override for the customer metrics auth credential (bearer token, API key, or apiKey/envId for log10x type). | |
| customer_metrics_type | No | Per-call override for the customer metrics backend type. Defaults to generic_prom if customer_metrics_url is supplied without a type. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover the safety profile (readOnly, idempotent, openWorld), and the description adds substantial context beyond them: per-session caching keyed by (environment, customer-backend-endpoint), the 0.7/0.5 accept and runner-up thresholds, the orchestration role, and the structured `no_join_available` failure shape. This is exactly the cross-cutting behavior annotations cannot express.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core purpose and mechanism, then the caching rationale and the usage directive. It is dense and slightly long, but nearly every sentence (thresholds, caching key, no_join_available) earns its place; minor redundancy in restating the 0.7 threshold already implied elsewhere.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 9-param, zero-required tool with an output schema and full annotation coverage, the description supplies everything an agent needs: purpose, mechanism, caching semantics, orchestration position, and failure behavior. Nothing material is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the parameter docs are already rich (window, force_refresh, minimum_jaccard, overrides), so the schema carries the semantics. The description restates the 0.7/0.5 threshold behavior but adds no syntax or format detail beyond the schema; baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a precise verb+resource: 'Auto-discover the structural join label between Log10x pattern metrics and the customer metric backend.' It names the mechanism (Jaccard on label value sets) and distinguishes itself from the sibling primitives that consume its result, so an agent can place it without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly routes the agent: 'Agents should normally NOT need to call this tool directly: the primitives call it internally,' then names the exception cases (inspecting the join universe, forcing re-discovery after backend changes). This is a textbook when/when-not statement.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_discover_labelsDiscover labelsARead-onlyIdempotent
List the labels Log10x metrics can be filtered or grouped by. Call at the start of a session, or before calling any tool that takes a label/filter argument: stops the model from guessing label names like "namespace" when the label is "k8s_namespace". Pass a label name to get its distinct values.
| Name | Required | Description | Default |
|---|---|---|---|
| label | No | If set, return distinct values for this label (e.g., "tenx_user_service" returns every service). If omitted, return the full label name list. | |
| limit | No | Max values to return when a label is specified. | |
| environment | No | Environment nickname (for multi-env setups). |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, and openWorld, so the safety profile is covered. The description adds real value beyond that: it discloses the dual behavior (full label list vs. distinct values when a label is passed) and the motivating failure mode (guessing "namespace" instead of "k8s_namespace").
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with purpose, then usage, then the mode switch. The concrete "namespace" vs "k8s_namespace" example earns its place by making the anti-guessing rationale vivid, and nothing is padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema exists, so return formats need no explanation, and annotations carry the safety profile. Purpose, session-start usage, and the label-mode distinction are all present – an agent has everything needed to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the properties already document label, limit (default/max), and environment in detail. "Pass a label name to get its distinct values" largely restates the schema's own text, so the description adds little beyond the structured fields – baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: "List the labels Log10x metrics can be filtered or grouped by." The resource (labels for metric filtering/grouping) is precise and clearly distinct from the other discover_* siblings (discover_env, discover_join), and it also reveals the second mode (distinct values per label).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a concrete trigger: "Call at the start of a session, or before calling any tool that takes a label/filter argument," which is exactly the context an agent needs. It does not name when-not-to-use or explicitly route to an alternative tool, so it falls just short of the 5 bar.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_doctorDoctor (health check)ARead-onlyIdempotent
Run a startup health check on the Log10x MCP installation. Probes: environment configuration validity, prometheus.log10x.com reachability and auth, Reporter tier detection (Edge / Cloud / none), Retriever endpoint configuration (informational), Datadog destination credentials (informational), paste endpoint reachability, cross-pillar enrichment floor (v1.4, when LOG10X_CUSTOMER_METRICS_URL is set). Returns a markdown report with pass / warn / fail per check and remediation hints. Call this once at the start of a session to verify the install, or any time a tool returns an unexpected error to isolate whether the problem is configuration or transient.
| Name | Required | Description | Default |
|---|---|---|---|
| environment | No | Optional environment nickname to probe. In multi-env setups, omit to run the checks against ALL configured environments; pass a specific nickname to check only that one. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/openWorld, and the description adds substantial behavior beyond them: the specific external endpoint probed (prometheus.log10x.com) including auth, which checks are informational (Retriever endpoint, Datadog credentials) versus gating, and the pass/warn/fail output with remediation hints. It also discloses the LOG10X_CUSTOMER_METRICS_URL precondition for the enrichment-floor check, with no contradiction of the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose and usage, then a probe list that is dense but each clause names a real check rather than padding. It is on the longer side and reads as a run-on enumeration, but nearly every phrase carries information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only diagnostic with an output schema, the description is thorough: probes covered, output format, and usage timing. The one gap is routing against the several overlapping diagnostic siblings (env_validate, dependency_check, login_status), which an agent must resolve on its own.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is a single optional parameter at 100% schema description coverage, and the schema already explains the multi-env omit-vs-nickname behavior in full. The description adds no further parameter semantics beyond what the schema provides, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Run a startup health check on the Log10x MCP installation') and enumerates the exact probes performed, so the agent knows precisely what it does. However, it never differentiates from overlapping siblings that also perform validation, such as log10x_env_validate or log10x_dependency_check, so sibling disambiguation is left to inference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives two concrete trigger conditions: 'once at the start of a session to verify the install' and 'any time a tool returns an unexpected error to isolate whether the problem is configuration or transient.' That is clear context for when to reach for it, but no explicit when-not or named alternative (e.g., a narrower env-only check) is offered.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_emit_sample_planEmit a sample-export script for the fenced POCARead-only
Render a read-only shell script that exports a log sample out of the user's OWN log analyzer, with the user's OWN credentials, on a machine the user chooses: and then stop. This server does not run the script and, in the fenced profile, could not: it runs inside a container started with --network none. That split is the point. Code that sees log data has no network; code that has network is the user's own aws / curl driven by a script short enough to read once. Use this as step 2 of the fenced POC (step 1 is minting the licence with one visible curl, step 3 is running log10x_poc_from_local inside the fenced container over the exported files, step 4 is verifying the fence with docker inspect and by turning Wi-Fi off). Also use it whenever the credentials live somewhere this process does not: a jump host, a locked-down laptop, another team. Args: siem (required: cloudwatch / splunk / elasticsearch / opensearch / datadog), window (default 14d), target_event_count (default 1,000,000, the same default log10x_poc_from_siem_submit uses, so both paths sample the same size), scope, query, output_dir (default ./poc/logs), write_script (default true, writes export-sample.sh mode 0755 in the working directory). Returns the script text, the read-only API operations and credential variables it touches, a review checklist, and the exact log10x_poc_from_local arguments to call next. The sampling matches log10x_poc_from_siem_submit bucket for bucket (same stratified sub-windows, same per-bucket cap) so a fenced POC and a credentialed POC over the same window differ because the logs differ. Emitted scripts contain no log10x hostname; the server refuses to return one that does. Read-only: it renders text and writes one script file; it contacts nothing.
| Name | Required | Description | Default |
|---|---|---|---|
| siem | Yes | Which log analyzer to export the sample from. One script per analyzer: `cloudwatch` (aws CLI: DescribeLogGroups + FilterLogEvents), `splunk` (search/jobs/export), `elasticsearch` and `opensearch` (_cat/indices + _search), `datadog` (v2 logs search). ClickHouse, Azure Monitor, Coralogix, GCP Logging and Sumo Logic are follow-up work: for those, export plain text yourself, one log message per line, and run the POC over it. | |
| query | No | Analyzer-native filter layered on top of `scope`: a CloudWatch filter pattern, an SPL fragment, a Lucene query_string for Elasticsearch, a Datadog query. Narrowing here narrows what the savings projection covers, so say so in the report if you use it. | |
| scope | No | Analyzer-native scope. CloudWatch: log group name or prefix (`/aws/ecs/*`, the asterisks are stripped, CloudWatch matches on prefix). Splunk: index name. Elasticsearch / OpenSearch: index pattern (default `logs-*`). Datadog: index name. Omitted means everything the credentials can read. | |
| window | No | How far back to sample. Accepts `1h`, `24h`, `7d`, `14d`, `30d`. Default `14d`, matching `log10x_poc_from_siem`: a wide window is what makes first-seen, growth and stable-versus-new readable at all. | 14d |
| output_dir | No | Where the script writes the exported sample, relative to wherever the user runs it. Default `./poc/logs`, which is the directory the documented `docker run` line mounts read-only at /data. | |
| write_script | No | Default true: also write the script next to the working directory as `export-sample.sh` (mode 0755) so the user can read it in an editor rather than out of a chat transcript. Set false to get the text back and nothing on disk. | |
| target_event_count | No | Target event count for the export. Default 1,000,000 (~500 MB at 500 B average): the same default `log10x_poc_from_siem` uses, so a fenced POC and a credentialed one see samples of the same size. Lower it when the export has to fit a laptop or a coffee break. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well past the annotations (readOnlyHint/openWorldHint/idempotentHint): it explains the `--network none` container fence, that the emitted script carries no log10x hostname and the server refuses otherwise, the sampling equivalence to the SIEM path, and the exact return payload. It also discloses the only side effect, one 0755 script file, which is the sole tension with a strict reading of readOnlyHint, and the description surfaces it rather than hiding it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded correctly: the read-only/renders-not-runs split comes first, then the POC step map, then args, then returns. It is dense and information-rich rather than padded, though the POC step enumeration and repeated 'same default as log10x_poc_from_siem_submit' refrains run longer than strictly necessary.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values are covered structurally, and the description still tells the agent what comes back (script text, read-only API operations/credential variables, review checklist, exact next `log10x_poc_from_local` arguments). For a 7-param tool embedded in a multi-step workflow, nothing needed to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all seven parameters in detail, and the description's inline arg list largely restates defaults. It does add cross-tool meaning the schema lacks, notably that `window`/`target_event_count` defaults deliberately match `log10x_poc_from_siem_submit` so both POC paths sample the same size, and the ./poc/logs mount rationale. That is real added value, but it is incremental over an already-excellent schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb+resource ('Render a read-only shell script that exports a log sample') and immediately delimits scope: it renders, it does not run, and it contacts nothing. It separates itself from the credentialed path (`log10x_poc_from_siem_submit`) and names the follow-on tool (`log10x_poc_from_local`), so an agent can place it among 50+ siblings without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit when-to-use: 'step 2 of the fenced POC' with steps 1/3/4 enumerated, plus a second trigger condition ('whenever the credentials live somewhere this process does not: a jump host, a locked-down laptop, another team'). The alternative path and the condition that selects it are both stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_env_diff_vs_envvarsDiff env doc vs LOG10X_* env varsARead-onlyIdempotent
Compare the stored env-config document against the LOG10X_* environment variables the env-var bridge would have produced, and report per-field disagreements with remediation recommendations. Call this when the user says "but I set the env var" or downstream tools report a value the user thinks they overrode: the on-prem store wins over env vars per resolver precedence, and silent-override is the most common boot-time surprise. Args: env_id (required, env_id UUID or nickname). For each disagreeing field (env_id, nickname, cluster., destination., streamer., retriever., offload_destinations[0].), returns { field, stored, envvar, recommendation }. The recommendation tells the user to either unset the LOG10X_ env var (preferred: on-prem store is the source of truth) or to update the stored doc via the matching setter (log10x_dest_set for destination, log10x_set_gitops_repo for gitops). Pure-on-prem-store configs (no LOG10X_* env vars set) return ok:true with an empty diff and a note that no ambiguity is possible.
| Name | Required | Description | Default |
|---|---|---|---|
| env_id | Yes | Env identifier: either the `env_id` UUID or the `nickname` from the env-config document. Resolved by walking the store chain (k8s → aws_ssm → gcp_sm → azure_ac → local). |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover safety (readOnly, idempotent, not open-world), but the description adds real behavioral context: the resolver precedence rule (on-prem store wins over env vars), the silent-override failure mode, and the edge case where a pure on-prem config returns ok:true with an empty diff. This is well beyond what annotations convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose then an explicit when-to-call clause, followed by args, return shape, and the empty-diff edge case. Slightly dense, but each sentence (precedence rule, remediation routing, edge case) carries distinct value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter read tool with an output schema, the description is complete: it explains the comparison, the precedence semantics, the trigger scenario, the return field shape, and the no-ambiguity edge case. Nothing needed to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single env_id parameter, and the description only restates that it is required and accepts a UUID or nickname — the same information the schema already provides. Baseline 3 applies since the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a precise verb+resource: compare the stored env-config document against the LOG10X_* env vars the env-var bridge would have produced, and report per-field disagreements. This is clearly distinguishable from sibling tools like log10x_env_validate or the setters it references.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives an explicit trigger: 'Call this when the user says "but I set the env var" or downstream tools report a value the user thinks they overrode.' It also names the alternative remediation paths (unset the env var, or use log10x_dest_set / log10x_set_gitops_repo to update the stored doc).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_env_validateValidate env config docARead-onlyIdempotent
Run schema validation + cross-field sanity checks on a stored env-config document at ~/.log10x/envs/<env_id>.json. Call this after any edit to the env doc (via log10x_dest_set / hand-edit / restore) or pre-flight before downstream tools that need a coherent config (commitment_report, configure_engine, offload-recipe emitters). Args: env_id (required, env_id UUID or nickname). Returns the canonical zod schema parse result PLUS findings across: destination.region required for vendors that need it (cloudwatch / datadog / azure-monitor / gcp-logging); ingest_url shape sanity (http(s):// prefix, splunk /services/collector suffix); streamer.url / retriever.url shape; cluster cloud type vs offload destination type alignment (eks↔s3, gke↔gcs, aks↔azure_blob); at-least-one active offload destination; SIEM region vs offload destination region (cross-region egress warning). Each finding carries severity (error / warning / info) and a remediation recommendation. Errors block downstream actions; warnings/info surface for the user.
| Name | Required | Description | Default |
|---|---|---|---|
| env_id | Yes | Env identifier: either the `env_id` UUID or the `nickname` from the env-config document. Resolved by walking the store chain (k8s → aws_ssm → gcp_sm → azure_ac → local). |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint/idempotent/openWorld=false, and the description adds substantial context beyond them: the exact validation categories checked (region requirements, URL shape, cluster-to-destination alignment, region egress), that findings carry severity, and critically that errors block downstream actions while warnings surface to the user. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Dense but front-loaded: the action and the file path come first, then call triggers, then a structured list of findings. The findings enumeration is long but each item earns its place by telling the agent what will be reported; a slight trim of the parenthetical examples would improve it.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return format need not be explained, yet the description still characterizes the result shape (parse result plus severity-tagged findings with remediation). For a read-only validation tool with annotations covering safety, nothing an agent needs to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the single parameter is fully documented there, so the baseline is 3. The description restates 'env_id (required, env_id UUID or nickname)', adding no semantics beyond what the schema already says about resolution order and accepted formats.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (validate) and resource (stored env-config document at a concrete path), plus the exact scope: zod schema parse plus cross-field sanity checks. An agent can distinguish it from siblings like log10x_doctor or log10x_env_diff_vs_envvars without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says when to call it ('after any edit to the env doc' via named tools, or 'pre-flight before downstream tools') and names the downstream consumers that need a coherent config. Provides both trigger conditions and the consequence of ignoring results.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_estimate_savingsEstimate savingsARead-onlyIdempotent
[FRESH-SESSION ROUTING: if this is the user first cost question of the session, call log10x_start first instead, it returns the orientation menu the user needs before any per-tool action.] Two-mode savings estimator with percent-first reporting and a dollar overlay. forecast projects bytes_in -> bytes_out and percent reduction for a proposed plan; pass effective_ingest_per_gb (or rely on the account profile list-price rate) to overlay $/mo per pattern and in totals. verify counts realized savings from the engine routeState label over a window with cap-hit / drift / new-patterns / leakage attribution, leading with percent and adding the dollar overlay only when a rate is set. Without a rate, dollar fields are emitted as null (never as a fabricated $1/GB number); the envelope carries rate_source: list_price | customer_supplied | unset so callers can show how the overlay was derived. Accepts siem_lens (what-if destination): keeps the measured volumes, prices + gates for that destination at list rates, and stamps siem_actual vs siem_lens in the envelope. REQUIRES Reporter-tier cost attribution (per-pattern bytes in the metrics backend). Before anything is deployed, use log10x_poc_from_local or log10x_poc_from_siem_submit instead.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | forecast: project savings of a proposed per-pattern policy (or a target_percent). verify: measure realized savings from a deployed policy by comparing baseline vs post-merge windows. | forecast |
| service | No | Scope the target_percent greedy solver and coverage_pct to a single service. When present, only patterns from that service are candidates; coverage_of_env_pct and dollar totals reflect that service only. pattern_limit is ignored (all service patterns are returned). If omitted, runs across all services. | |
| es_pruned | No | Elasticsearch only: are compactable fields excluded from _source? Default false: the unpruned ratio band is used. | |
| siem_lens | No | What-if destination lens (alias of `destination` with provenance stamping): price the projection for THIS destination while the pipeline keeps its actual one. Envelope stamps siem_actual vs siem_lens. | |
| timeRange | No | forecast mode: alias for `observation_window` for consistency with other Log10x tools. If both are set, `observation_window` wins. | |
| deployment | No | How the customer RUNS the destination, which decides whether compaction is available at all: the expander is software they install (the l1es Elasticsearch/OpenSearch plugin, the 10x Splunk app), so a managed or serverless platform can carry compacted bytes but has nowhere to expand them. Set only from what the user actually said: absent means unknown, and an unknown deployment prices only the levers that hold either way. Irrelevant on destinations whose levers do not depend on it (Datadog, CloudWatch, Azure, Coralogix). | |
| allow_lossy | No | Permit the ladder solver to close a keep-everything shortfall with sample/drop (lossy, opt-in). Default false: the plan stops at the keep-everything ceiling and reports the gap instead of silently discarding events. Only set after the user explicitly chooses loss. | |
| destination | No | Destination stack. Required for both modes (used to look up ingest $/GB + compact ratio band). | |
| environment | No | Environment nickname; routes to the right metrics backend. | |
| post_window | No | verify mode: PromQL range expression for the post-merge window, e.g. "7d". | |
| commitment_id | No | verify mode: when present, the verify output is shaped as a commitment delta (used by log10x_commitment_report). | |
| contract_type | No | verify mode: shapes the dollar projection (committed vs on-demand renewal math). | |
| pattern_limit | No | forecast mode: maximum number of per_pattern rows returned. Default 50 when service is omitted; ignored (unlimited) when service is set. Totals and coverage_pct are always computed over the full solver result before slicing. | |
| default_action | No | forecast mode, OPTIONAL: force one action onto every solver-selected pattern (a mode choice, "cut 50% via drop"). Hard constraint when present, subject to destination compatibility (compact is replaced by the destination canonical action when compact_mode=no-op). OMIT for the product default: the ladder solver picks the destination's keep-everything lever per pattern (compact -> tier_down -> offload-with-retriever), never lossy unless allow_lossy. | |
| target_percent | No | forecast mode: % volume reduction goal. Tool runs the same greedy solver as configure_engine on observed 30d bytes. | |
| tier_down_plan | No | Which tier_down plan to price when the action is tier_down. Matches the plan name (case-insensitive substring): omit for the destination default (e.g. Azure Basic Logs), or pass e.g. "auxiliary" to price the aggressive alternative (Azure Auxiliary Logs). No effect on destinations without an alternative tier. | |
| baseline_window | No | verify mode: PromQL range expression for the pre-merge window, e.g. "7d", "168h". | |
| proposed_config | No | forecast mode: explicit per-pattern (action, optional cap) rows. Either this OR target_percent is required. | |
| enforcement_mode | No | forecast mode: when manual_report, reframes the headline as a potential-savings estimate under external enforcement rather than engine enforcement. Headline reads 'If you enforce externally: X savings potential. Enforcement choice is yours.' instead of the standard forecast headline. | |
| retention_months | No | Retention window for storage cost. Default 1 month. | |
| budget_gb_monthly | No | forecast mode: VOLUME BUDGET, keep monthly ingest toward the destination at or under this many GB/mo. BYTE accounting: tier_down keeps every byte in the destination, so it cannot serve this target and is excluded from the ladder (compact only where it lands on the billed wire, then offload with the retriever, then lossy on allow_lossy). Mutually exclusive with target_percent, budget_usd_monthly, default_action, and proposed_config. | |
| monthly_volume_gb | No | What-if volume lens (forecast mode): model the environment at THIS monthly volume (decimal GB/month) instead of its measured volume. The real per-pattern shares and pattern mix are held fixed; only absolute bytes and dollars scale, by one uniform factor. Use it to project a prospect onto their own scale, or to forecast a real env after growth. Pairs with `siem_lens`. This is a PROJECTION: the envelope stamps volume_actual_gb vs volume_projected_gb and the scale factor, and the note points at the POC for the caller's real patterns. | |
| budget_usd_monthly | No | forecast mode: DOLLAR BUDGET, keep the (service-scoped or whole) destination bill at or under this $/mo. The ladder solver derives the reduction: max(0, bill - budget). Idempotent: already under budget returns an empty plan with the headroom stated. Mutually exclusive with target_percent, budget_gb_monthly, default_action, and proposed_config. | |
| check_dependencies | No | Ladder-plan path only: scan the destination (read-only) for dashboards, alerts, and saved searches that reference the top planned message types, and attach the result as plan_dependencies. Runs only when credentials for the destination are present in the session environment; otherwise the plan carries a one-line note saying it was not checked. Set false to skip the scan for speed. | |
| exception_services | No | Ladder-plan path only: services pinned at pass, their patterns stay in the bill but are never planned, exactly like protected severities. The SOC-owned or compliance-bound slice of the estate, stated as a hard exclusion. Case-insensitive. | |
| include_referenced | No | Ladder-plan path only: message types LITERALLY referenced by a monitor, alert, saved search, or dashboard (found by the dependency scan) are EXCLUDED from the plan by default: they stay exactly as they are, and the plan re-solves around them. Pass true only after the user explicitly chooses to include them (the render shows what including them adds). | |
| observation_window | No | forecast mode: PromQL range expression for the observation window the solver/projection runs over. Default `30d`. Accepts `1h`, `24h`, `7d`, `30d`, etc. Alias: `timeRange`. | |
| unprotect_patterns | No | Ladder-plan path only: pattern hashes the user EXPLICITLY unpinned from the severity floor (a warn-level retry storm they chose to act on). Bypasses severity protection for the listed hashes only; hard exclusions still win. Set only after the user names the type and chooses this: never inferred. The render flags these rows with their severity. | |
| retriever_installed | No | Whether the S3 retriever is installed (or the user has agreed to install it). Gates the offload rung of the ladder solver: without it, offloaded events would be unreachable, so the plan stops at the in-SIEM levers and the gap names "install the retriever" as the keep-everything remedy. Set from conversation; log10x_advise_retriever is the install path. | |
| current_compute_units | No | forecast mode, compute-billed destinations only (ClickHouse): the service's current compute unit count. Turns the modeled compute saving in totals.compute_saving from a fraction into dollars. | |
| effective_ingest_per_gb | No | forecast and verify mode: override the destination default rate with the customer's contracted $/GB. When supplied, dollar projections use this rate and surface rate_source='customer_supplied'. | |
| monthly_compute_spend_usd | No | forecast mode, compute-billed destinations only (ClickHouse): the service's current monthly compute spend in dollars. Converted to units at the destination's unit price; ignored when current_compute_units is supplied. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only cover the safety profile (read-only, idempotent, closed-world); the description goes well beyond them, disclosing that dollar fields are emitted as null rather than fabricated, that the envelope carries rate_source (list_price | customer_supplied | unset), and that siem_lens stamps siem_actual vs siem_lens. These are behavioral traits an agent cannot infer from the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The routing note is front-loaded and the two modes are laid out in sequence, so the reader gets orientation first. It is dense and long, with several clauses packing multiple facts per sentence, but nearly every sentence carries distinct information rather than restating the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 32-parameter, two-mode estimator, the description covers the mode split, the rate/overlay semantics, the siem_lens provenance, and the tier prerequisite. With an output schema present it need not explain return values, and it keeps envelope-field context to the pieces (rate_source, volume stamps) that affect correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 32 parameters in depth. The description adds framing (percent-first reporting, the null-rate rule, the siem_lens provenance behavior) but no per-parameter syntax or format detail beyond what the schema supplies; the baseline 3 is correct when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource (estimate savings) and then precisely delineates the two modes: forecast projects bytes_in -> bytes_out reduction, verify counts realized savings from the routeState label. It differentiates itself from the deployment/POC siblings by scoping its own boundary ('before anything is deployed, use ... instead'), so an agent can place it without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit precondition (Reporter-tier cost attribution required) and an explicit alternative for the deployment case (log10x_poc_from_local / log10x_poc_from_siem_submit), plus a fresh-session routing rule to log10x_start. It does not, however, distinguish itself from the similarly named log10x_savings sibling, leaving one obvious selection ambiguity unaddressed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_event_lookupEvent lookupARead-onlyIdempotent
Resolve a raw log line or pattern name to its pattern hash, which is the same for the same line under the same engine, symbol library and configuration, then return byte volume + share per service (with cost overlay when $/GB is set), before→after delta, first-seen timestamp within the observation window, and the current offload disposition (pass / sample / compact / drop) read from the Reporter routeState label; only when LOG10X_AI_SUMMARY=true, an AI category for the pattern (error/debug/info/metric/health) with a one-line explanation. Call this first whenever a user pastes a SINGLE log line and asks "what is this", "is this new", "is this safe to drop", or "is this being dropped / offloaded". The lookup is structural, not byte-exact: different timestamps/request IDs/user IDs on the same underlying pattern resolve to the same hash. If no match is returned, say so. Use log10x_resolve_batch instead when the user pastes MULTIPLE events, a SIEM dump, or a batch to triage.
| Name | Required | Description | Default |
|---|---|---|---|
| pattern | No | Pattern name or search term to look up (e.g., "Payment_Gateway_Timeout"). Omit when passing `pattern_hash` / `tenxHash` instead. | |
| service | No | Service to scope the lookup | |
| tenxHash | No | Legacy alias of `pattern_hash`. Both are accepted. Pass either the canonical `pattern_hash` form or this legacy form: they are treated identically. | |
| siemScope | No | SIEM scope for the live sample line on a tenxHash reverse lookup: a CloudWatch log group (`/aws/ecs/my-svc`), ES index, or Splunk index. When omitted, the detected SIEM connector uses its own default scope. Only consulted when `tenxHash` was passed (the cross-pillar correlation case). | |
| timeRange | No | Time range. Sub-day values for incident-window lookups. '24h' and '1d' are equivalent. | 7d |
| environment | No | Environment nickname | |
| analyzerCost | No | SIEM ingestion cost in $/GB (deprecated alias of `effective_ingest_per_gb`) | |
| pattern_hash | No | Canonical 11-char hash seen on a SIEM / CloudWatch Logs event (e.g. "03ndjreM-sU"). Alias of `tenxHash`; both are accepted. Resolved against the 10x metrics to recover the pattern, then the normal cost/services breakdown is shown. | |
| effective_ingest_per_gb | No | Customer-supplied SIEM ingest cost in $/GB. When set, dollar fields populate with rate_source=customer_supplied; when absent and no default rate is detected, dollar fields collapse to null and rate_source=unset. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover readOnly/idempotent/openWorld, yet the description adds substantial non-obvious behavior: hashes are stable per engine/symbol library/config, the lookup is structural rather than byte-exact, offload disposition comes from the Reporter routeState label, AI category is gated on LOG10X_AI_SUMMARY=true, cost overlay only appears when $/GB is set, and it advises saying so when no match returns.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core resolve-and-return purpose before the routing directive and the anti-pattern exclusion, so the critical part is read first. The opening sentence is a long, dense run-on enumerating many return fields, which slightly hurts scannability but earns its space.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present and rich annotations plus 100% schema coverage, the description need not explain return values, yet it still frames them usefully. For a 9-parameter, 0-required tool with multiple aliases and conditional behavior, nothing an agent needs to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the schema itself thoroughly documents every parameter (including aliases and the siemScope cross-pillar case), so the baseline of 3 applies. The description reinforces the meaning of pattern_hash/tenxHash stability and the $/GB cost overlay but largely restates what the schema already carries.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource pair: resolve a raw log line or pattern name to its pattern hash, then return byte volume, share per service, delta, first-seen timestamp, and offload disposition. It explicitly distinguishes itself from the sibling log10x_resolve_batch by input cardinality, so an agent can route without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a bolded 'Call this first' trigger naming the exact user intents ('what is this', 'is this new', 'is this safe to drop') and the input shape (a SINGLE log line). It also names the alternative sibling log10x_resolve_batch and the condition (MULTIPLE events / SIEM dump / batch triage) that selects it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_explain_modeExplain enforcement modeARead-onlyIdempotent
CALL THIS AFTER log10x_cost_options when the user picks a mode. Explains the chosen enforcement mode (drop / sample / compact / tier_down / offload / observe_only) in service-level plain language, with dollar math when byte metrics are available. Returns must_render_verbatim (plain-text three-section card, no markdown), must_ask_user (Apply or Preview choice), and forbidden_next_actions (locks apply tools and log10x_preview_filter until the user picks). routes_to.apply routes all non-observe modes to log10x_configure_engine; observe_only has routes_to.apply === null (no enforcement step). routes_to.preview routes to log10x_preview_filter with { service, mode }.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Which enforcement mode to explain. Keep-everything levers come first, then the lossy opt-ins. `compact` = keeps everything: engine minifies events; all events still reach the stack, and the destination's expander rebuilds them (how exactly, and which searches see the full text, is per destination). `offload` = keeps everything: engine diverts matched events to a customer-owned S3 bucket; readable via log10x_retriever_query. `tier_down` = keeps everything: engine stamps the routeState marker; a routing rule moves those events to a cheaper tier in the same destination (Datadog Flex / CloudWatch IA / Azure Monitor Basic or Auxiliary Logs). `sample` = lossy opt-in: engine passes 1-in-N events through to the stack; the rest are discarded. `drop` = lossy opt-in: engine hard-drops matched patterns at the Receiver before delivery. `observe_only` = engine observes and fingerprints but does not act; use to baseline volume before committing. | |
| service | Yes | Service name to personalize the explanation with service-level volume and cost figures. | |
| destination | No | Auto-detected destination stack or forwarder. When omitted the tool infers from envs.json / env vars. Used to name the specific vendor in the explanation ("your Datadog workspace", "your Splunk index", etc.). | |
| effective_ingest_per_gb | No | Customer-supplied $/GB rate used for the dollar overlay. When set, source_disclosure.rate_source='customer_supplied'. When absent, the shared rate resolver falls back to envs.json analyzerCost → LOG10X_ANALYZER_COST → the destination default rate (a list price where the vendor sells logs per GB) → unset (no dollar overlay). |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint and openWorldHint, but the description adds real behavioral context: must_render_verbatim (plain text, no markdown), must_ask_user, and forbidden_next_actions that lock apply tools and log10x_preview_filter until the user picks. This is unusually rich disclosure, though much of it describes return fields that the output schema may already carry.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the ordering precondition and information-dense throughout. However, the extended enumeration of return fields (must_render_verbatim, must_ask_user, forbidden_next_actions, routes_to.*) partially duplicates what the output schema should convey, adding some bulk.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With annotations, a full output schema, and 100% param coverage already present, the description supplies exactly the missing orchestration layer: when to call it, what it returns semantically, and where it routes. Nothing needed to invoke it correctly appears to be missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the mode enum documents each lever in depth, so the schema does the heavy lifting. The description restates the mode list but adds no syntax or format meaning beyond what the schema provides, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (explain a chosen enforcement mode) and enumerates the exact modes covered. It clearly differentiates itself from siblings by naming log10x_cost_options as its predecessor and log10x_configure_engine / log10x_preview_filter as downstream routes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit trigger ('CALL THIS AFTER log10x_cost_options when the user picks a mode'), plus routing rules that tell the agent which sibling to invoke next for each mode. The observe_only null-routes case is called out, removing the main ambiguity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_extract_templatesExtract templatesARead-onlyIdempotent
Extract the structural template library from a set of log lines by running a local Log10x pipeline on the user's machine. Returns per-template records (the engine-internal templateHash + the template body with variable slots) and event count. Companion to log10x_resolve_batch: both tools answer 'can you run log10x locally / templatize these events'. Does NOT need Kubernetes, a deployed Reporter, or a Log10x account; the pipeline runs in-process on the host via either a locally-installed tenx binary or a docker run log10x/pipeline-10x container. Use for: (a) bootstrapping a pattern catalog before wiring up a Reporter, (b) offline auditing of stored log files, (c) validating that a config change produces expected template identities. Validation mode: pass expected.min_templates, expected.required_patterns, and/or expected.forbidden_merges to turn extraction into assertion-checked validation, each assertion reports PASS/FAIL in the output. REQUIRES a local engine: the tenx binary on PATH, or Docker with LOG10X_TENX_MODE=docker. No preflight checks for it: log10x_doctor does not probe the engine.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Local file path or glob when source=file. | |
| text | No | Raw text blob when source=text. | |
| view | No | summary returns the typed envelope (data.templates[], data.event_count, data.assertions, data.human_summary). The deprecated markdown view was removed; data.human_summary carries the prose distillation for chat rendering. | summary |
| top_n | No | Max templates to return. | |
| events | No | Inline log lines when source=events. | |
| source | Yes | Input mode. `file`: read from a local path/glob. `events`: array of raw log lines. `text`: newline-separated log events as a single string. | |
| expected | No | Optional assertions: turns extraction into validation. Each assertion reports pass/fail in the output. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover the safety profile (readOnly, idempotent, openWorld), and the description adds substantial context beyond them: no Kubernetes, deployed Reporter, or account required; execution is in-process via a tenx binary or docker container; and a REQUIRES-a-local-engine constraint with a warning that log10x_doctor does not preflight it. That missing-preflight disclosure is genuinely non-obvious and actionable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Long but front-loaded and dense with zero filler: core action first, then companion relationship, then environment requirements, then use cases, then validation mode and the engine constraint. Every sentence carries distinct, decision-relevant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present and 100% param coverage, the description supplies what structured fields cannot: the local-engine requirement, the no-preflight caveat, validation semantics, and the sibling relationship. Nothing needed to invoke this correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3; the description still adds value by explaining the expected.min_templates / required_patterns / forbidden_merges block as an assertion mechanism whose results surface as PASS/FAIL in output, and by clarifying that each view yields a typed envelope. It stops short of explaining every parameter, but covers the semantically tricky one.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb+resource: 'Extract the structural template library from a set of log lines', plus the mechanism (local Log10x pipeline) and the exact return shape (per-template records with templateHash + body, event count). It explicitly names its sibling log10x_resolve_batch and the shared question both answer, so an agent can distinguish it without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Enumerates three concrete use cases: (a) bootstrapping a pattern catalog, (b) offline auditing of stored logs, (c) validating config changes. It also states the precondition that turns extraction into validation (pass expected.*) and names log10x_resolve_batch as the companion. When-to-use and how-to-select are both explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_find_skewFind skewARead-onlyIdempotent
Identify patterns where one slot value dominates the field (>= 60% of events by default). Surfaces sampling opportunities: "slot verb is get 78% of events, sample the get case at 1/10 to cut its volume." Sampling is lossy: the other 9 in 10 of those events are discarded. Differentiated against analyzer field histograms because the engine groups by per-pattern field-set, so dominance is measured within the structural pattern, not globally. Stage 1: accepts events as a paste array (same shape as log10x_resolve_batch). Calibration: the 60% concentration floor and 1/10 sampling rate are hand-picked defaults tagged unvalidated_default in the output. The envelope surfaces the empirical observed_dominant_pct_distribution across all candidate slots so the agent can judge whether 0.6 is well above or below the noise floor for this dataset. See docs/cross-pillar-primitives.md for the agent behavior contract.
| Name | Required | Description | Default |
|---|---|---|---|
| top_n | No | Number of findings to return. Default 20. | |
| events | Yes | Events to analyze for slot skew. Same shape as log10x_resolve_batch: raw strings or JSON objects. Each event is templated locally; skew is computed across the resulting patterns. | |
| sample_n | No | Sampling rate N for the savings projection (1/N of the dominant case kept). Default 10. Same calibration caveat: sample_n=10 is a defensible starting point but not validated for any specific cost target. | |
| min_events | No | Minimum events per pattern to bother checking. Default 10 (filters low-sample noise). | |
| min_concentration | No | Minimum dominant-value fraction for a slot to be flagged as skewed. Default 0.6 (a slot is "skewed" when one value is 60%+ of events). Hand-picked default tagged as `unvalidated_default` in the output. Compare against the `observed_dominant_pct_distribution` in `threshold_audit` to judge whether 0.6 is well above or below this dataset's noise. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent, and the description adds substantial extra behavior: sampling is lossy (9 of 10 dominant events discarded), default thresholds are tagged unvalidated_default, and the output envelope surfaces observed_dominant_pct_distribution so the agent can judge calibration. This is exactly the kind of beyond-annotation disclosure that earns top marks.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the purpose, then layers differentiation, the Stage 1 input contract, and calibration caveats. It is dense and somewhat long, with a quoted example that is illustrative but adds bulk; still, nearly every sentence carries information, so only minor trimming is warranted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, the description need not restate returns, yet it still explains the key envelope field (observed_dominant_pct_distribution) and references the agent behavior contract doc. Given a 5-param tool with a required events array and calibration-heavy defaults, everything an agent needs to call it correctly is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline would be 3, but the description adds meaning: it explains the calibration caveat behind min_concentration (0.6 floor) and sample_n (1/10), and points the agent to threshold_audit for judging whether the defaults fit the dataset. That is genuine added value over the schema text.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific behavior: identify patterns where one slot value dominates a field (>=60% by default), with a concrete example of the finding it produces. It explicitly differentiates itself from analyzer field histograms, explaining that dominance is measured within the structural pattern rather than globally, so an agent can tell it apart from siblings without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear usage context (surface sampling opportunities, Stage 1 accepts events as a paste array shaped like log10x_resolve_batch) and contrasts the mechanism against analyzer field histograms. It does not state an explicit when-not or name a preferred alternative for overlapping cases, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_investigateInvestigateARead-onlyIdempotent
Single-call root-cause investigation for any log line, pattern, service, or environment. Returns a complete causal chain (for acute spikes) or co-drifter cohort (for gradual drift) with confidence scores derived mechanically from data signal quality, plus ready-to-run verification commands. Per-pattern blocks include offload_status (pass / sample / compact / drop) so the narrative reflects whether the receiver is admitting or dropping the implicated patterns, matching top_patterns and pattern_trend. Call whenever the user asks 'what is going on with X', 'why is X spiking', 'investigate X', or pastes a log line / alert and asks for diagnosis. Input is the user's natural-language target: pass their words verbatim. The tool detects whether the input is a raw log line, pattern identity, service name, or 'environment' and runs the appropriate flow. It also detects whether the trajectory is acute or gradual drift and renders a different report shape for each. Confidence percentages decompose into named sub-scores (stat × lag × chain for acute; slope_sig × cohort for drift): walk the user through the decomposition when asked. Show the entire markdown report to the user without modification.
| Name | Required | Description | Default |
|---|---|---|---|
| depth | No | `shallow`: anchor service only. `normal` (default): anchor service + immediate dependencies. `deep`: full environment-wide. | normal |
| window | No | Analysis window. Defaults to `1h` for acute-spike cases; `30d` recommended for drift cases. Accepts any PromQL-style duration string (`15m`, `1h`, `6h`, `24h`, `1d`, `7d`). Alias: `timeRange`. If neither is set, defaults to `1h`; if both are set, `window` wins. | |
| timeRange | No | Alias for `window` for consistency with other Log10x tools. If both are set, `window` wins. | |
| use_bytes | No | Use byte-based rate instead of event-count. Event-count is strongly preferred; use only if the Reporter does not emit the count metric. | |
| environment | No | Environment nickname: required in multi-env setups. | |
| starting_point | Yes | The user's target, verbatim. Can be a raw log line, a pattern identity (symbolMessage or tenx_hash), a service name, or the literal string "environment"/"all"/"audit". The tool detects the mode automatically. | |
| baseline_offset | No | Offset for the baseline comparison. Defaults to `24h` for short windows (acute-spike cases) and to the same value as `window` for long windows (≥7d, drift cases). Override only if you need a non-standard comparison. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only cover safety (readOnly, idempotent, openWorld), and the description adds substantial behavior: dual output shapes (causal chain vs co-drifter cohort), automatic input-mode detection, acute-vs-drift trajectory detection, confidence decomposition into named sub-scores, and offload_status semantics tied to top_patterns/pattern_trend. It even instructs the agent to present the markdown report unmodified, which is real operational context beyond the structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is long but front-loaded: the first sentence delivers the core purpose and deliverable before expanding into triggers, mode detection, and output morphology. Most sentences earn their place, though the confidence-decomposition and report-presentation instructions are somewhat stacked and could be tightened.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's high complexity, a rich 7-param schema, and an existing output schema (so return values need no explanation here), the description covers mode detection, output shapes, confidence mechanics, and usage triggers. An agent has everything needed to select and invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description meaningfully clarifies the required starting_point ('pass their words verbatim', auto-detected mode) and explains what the tool does with it, adding intent the schema alone does not convey. The optional params (depth, window, etc.) are already fully documented in the schema and get no extra treatment here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Single-call root-cause investigation for any log line, pattern, service, or environment') and immediately names the deliverable ('complete causal chain ... or co-drifter cohort ... plus ready-to-run verification commands'). It also carves out a distinct role as a single-call orchestrator that internally runs the appropriate flow, setting it apart from narrower siblings like log10x_pattern_trend or log10x_top_patterns.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit trigger phrases ('what is going on with X', 'why is X spiking', 'investigate X', pasting a log line/alert) which tells the agent precisely when to reach for it. However, it offers no when-not-to-use guidance and never names an alternative sibling for cases the agent might prefer (e.g., a single-trend lookup).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_login_statusLogin statusARead-onlyIdempotent
List the user's Log10x ACCOUNT environments and report credential / login state. Call this, and ONLY this, for any of these phrasings: 'which Log10x environments do I have', 'which environments are available to me', 'list my envs', 'what tenants/accounts can I query', 'am I logged in', 'switch envs'. For 'log me in' / 'sign me up' / 'create a Log10x account' / 'use my real account': call log10x_signin_start (browser Auth0 device flow; the model chains to log10x_signin_complete automatically), or call log10x_signin_complete directly with { api_key: "<key>" } if the user already has a key. Do NOT call log10x_discover_env for these questions: that tool scans the user's Kubernetes/AWS infrastructure, unrelated to Log10x account environments. In demo mode (no key set, or key failed validation), the response is a step-by-step config guide. In signed-in mode, lists the user's identity, every env they can reach with permissions (OWNER/WRITE/READ), the default env, and the most-recently used env this session. Read-only, takes no args.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and openWorldHint=false, so the safety profile is covered. The description adds genuinely useful behavior beyond that: demo-mode fallback returns a step-by-step config guide versus signed-in mode returning identity, per-env permissions, default env, and last-used env. Some of this return detail overlaps the output schema, keeping it from a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose and the primary routing rule are front-loaded, and every sentence carries actionable routing or mode information. The dense list of synonym phrasings and the parenthetical detail on the Auth0 device flow are slightly verbose, but nothing is wasted given 57 sibling tools.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With annotations carrying safety and an output schema carrying return shape, the description only needs to cover purpose, routing, and mode behavior — all of which it does. An agent has everything required to select and call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Zero parameters, so the baseline is 4. The description explicitly confirms 'takes no args,' which is consistent with the empty schema and removes any doubt about argument shape.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('List the user's Log10x ACCOUNT environments') plus secondary purpose ('report credential / login state'), and explicitly excludes the look-alike sibling log10x_discover_env. An agent can distinguish it from signin/signout/discover tools without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit trigger phrasings ('which environments do I have', 'am I logged in'), names the correct alternatives for adjacent intents (log10x_signin_start / log10x_signin_complete for login/signup), and states an explicit when-NOT rule for log10x_discover_env. Routing is fully specified.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_measure_compactionMeasure compactionARead-onlyIdempotent
Measure per-pattern compact ratios (bytes before and after encoding) on a sample pulled from the customer's SIEM and run through a local engine; a ratio on that sample, not a SIEM meter reading. Pulls sample_size events for a service over timeRange, runs them through the local tenx engine, and returns per-pattern compaction_ratio_x (original bytes / encoded bytes) derived from that sample. Use this to replace the destination's default compact ratio in log10x_estimate_savings (one measured capture per destination, named in compact_ratio_basis) with ratios measured on this customer's sample. Requires: tenx CLI installed locally (LOG10X_TENX_PATH or tenx on PATH) AND SIEM credentials (same as log10x_poc_from_siem_submit). Confidence tiers: high (>=50 events), medium (10-49), low (<10). Results flow into log10x_estimate_savings to improve savings projections. REQUIRES a local engine: the tenx binary on PATH, or Docker with LOG10X_TENX_MODE=docker.
| Name | Required | Description | Default |
|---|---|---|---|
| service | Yes | Service name to scope the stack sample to. Used as the query filter (e.g., Datadog `service:<name>`, Splunk `sourcetype=<name>`, CloudWatch stream prefix). | |
| timeRange | No | Lookback window for the stack pull. Format: <N><unit> where unit is m (minutes), h (hours), or d (days). Default "24h". | 24h |
| environment | No | Log10x environment id. Omit to use the default environment. | |
| sample_size | No | Number of events to pull from the stack for measurement. Default 500. Larger samples improve confidence (high confidence requires >=50 events per pattern) but take longer to pull and process. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint/idempotentHint, but the description adds substantial context beyond them: the result is a sample-derived ratio, not a SIEM meter reading; it requires a local tenx binary with the LOG10X_TENX_PATH/PATH resolution order; and it discloses confidence tiers keyed to event counts. These are real behavioral traits an agent cannot learn from the structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Dense and front-loaded, leading with the measurement semantics before prerequisites. It repeats the local-engine requirement twice (the 'tenx CLI installed locally OR SIEM credentials' list and the trailing 'REQUIRES a local engine' sentence), which is the main waste, and the final sentence is redundant emphasis.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be re-explained, yet the description still names `compaction_ratio_x` and its numerator/denominator for clarity. For a tool with credential, local-engine and sampling caveats, it covers everything an agent needs to call it correctly or route elsewhere.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3, but the description adds interpretive meaning: `sample_size` events are pulled over `timeRange`, and larger samples map to the stated confidence tiers. It also clarifies that each measured capture corresponds to one destination named in `compact_ratio_basis`, which is useful framing beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Measure per-pattern compact ratios (bytes before and after encoding)') and scopes it precisely to a sample pulled from the customer's SIEM. It explicitly distinguishes itself from the default-ratio path by naming `log10x_estimate_savings` as the downstream consumer, so an agent can separate it from siblings like `log10x_savings` without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use ('Use this to replace the destination's default compact ratio in log10x_estimate_savings') plus hard prerequisites: tenx CLI locally or Docker, and SIEM credentials matching `log10x_poc_from_siem_submit`. It also states the outcome ('Results flow into log10x_estimate_savings to improve savings projections'), leaving nothing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_metric_overlayMetric overlayARead-onlyIdempotent
Third step of cross-pillar investigation: return aligned anchor + candidate timeseries plus deterministic facts (peak_at, peak_offset_seconds, n_buckets_aligned). No Pearson, no tier: pure raw data for the agent to interpret. Use this once log10x_rank_by_shape_similarity has narrowed to a single suspect, or to manually verify any anchor/candidate pair side-by-side. Bucket size auto-selected from window length; both series are right-aligned to the same trailing bucket grid so a sparse anchor and dense candidate compare on the same chaos window.
| Name | Required | Description | Default |
|---|---|---|---|
| step | No | Bucket step. Smaller = more samples + more cost. Default 30s. | 30s |
| anchor | Yes | The anchor identity. For `log10x_pattern`: the pattern symbol_message (e.g. `error_processing_payment_$`). For `customer_metric`: a PromQL expression (e.g. `apm_request_duration_p99{service="payments"}`). | |
| window | No | Time window. PromQL-style duration: `15m`, `1h`, `6h`, `24h`. Alias: `timeRange`. | 1h |
| candidate | No | The candidate metric to overlay against the anchor. Must be a customer-side PromQL expression that returns a single series. Alias of `candidates[0]`: pass either form (sibling tools metrics_that_moved and rank_by_shape_similarity use `candidates` array; this tool accepts both for consistency). | |
| timeRange | No | Alias for `window`. | |
| candidates | No | Candidates array. Accepted for parity with metrics_that_moved + rank_by_shape_similarity. Only the first element is overlaid (metric_overlay is single-candidate by design: use rank_by_shape_similarity to rank N first, then overlay the winner). | |
| anchor_type | Yes | Which side the anchor comes from. `log10x_pattern`: anchor is a 10x pattern symbol_message. `customer_metric`: anchor is a customer PromQL expression. | |
| environment | No | Environment nickname (for multi-env setups). | |
| max_buckets | No | Max buckets to return in the aligned output. Pre-truncates from the most recent end if window/step exceeds this. | |
| customer_metrics_url | No | Per-call override for the customer metrics backend URL. Wins over LOG10X_CUSTOMER_METRICS_URL env var. Use when MCP was launched with an empty/stale URL. | |
| customer_metrics_auth | No | ||
| customer_metrics_type | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover read-only/idempotent/open-world safety, and the description adds meaningful behavior: it deliberately computes no Pearson and no tier ('pure raw data'), auto-selects bucket size from window length, and right-aligns both series to a shared trailing bucket grid. That is real disclosure beyond the structured fields, though cost/rate behavior and error handling are left unstated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three dense sentences, front-loaded with the pipeline position and the return shape before the usage and alignment notes. Every sentence carries information, though the alignment clause is tightly packed and takes a second read.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, the description needn't spell out return values, and it appropriately names only the salient facts. It gives enough workflow context (single-candidate by design, step position) for an agent to invoke it correctly, despite 12 parameters.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 83%, so the schema already documents most parameters, including aliases like `window`/`timeRange` and `candidate`/`candidates[0]`. The description adds only the bucket auto-selection and alignment semantics, which is marginal over the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a precise verb+resource: return aligned anchor + candidate timeseries with named deterministic facts (`peak_at`, `peak_offset_seconds`, `n_buckets_aligned`). It also positions itself explicitly as the third step in a pipeline, distinguishing it from `log10x_rank_by_shape_similarity`, which ranks rather than overlays.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit when-to-use: 'Use this once `log10x_rank_by_shape_similarity` has narrowed to a single suspect, or to manually verify any anchor/candidate pair side-by-side.' This names both the alternative tool and the condition that selects this one, leaving nothing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_metrics_that_movedMetrics that movedARead-onlyIdempotent
First step of cross-pillar investigation: deterministic filter on which customer metrics moved while an anchor was active. Anchor is either a Log10x pattern (anchor_type: "log10x_pattern") OR a customer metric expression (anchor_type: "customer_metric"); candidates are all sibling series from the OTHER pillar. Partitions the anchor's window into high-phase / low-phase buckets by median rate and keeps only candidates whose mean value differs ≥15% between the two phases. Returns moved[], not_moved[], evaluation_failed[]: no Pearson, no tier, no causal framing. This is the cheap deterministic cut that pares the candidate set before the more expensive shape-similarity pass. Compose with log10x_rank_by_shape_similarity and log10x_metric_overlay.
| Name | Required | Description | Default |
|---|---|---|---|
| step | No | Bucket step. | 30s |
| anchor | Yes | Anchor identity. For `anchor_type=log10x_pattern`: the pattern Symbol Message NAME or its 11-char `pattern_hash` (= `tenx_hash`), the tool detects shape and queries the correct PromQL label (`message_pattern` vs `tenx_hash`). For `anchor_type=customer_metric`: a customer PromQL expression. | |
| window | No | Time window. Alias: `timeRange`. | 1h |
| timeRange | No | ||
| candidates | Yes | Customer-side PromQL expressions to evaluate (max 100). An AI caller reasoning over results can't meaningfully digest more than a few dozen; the cap reflects that, not a backend constraint. Pre-filter with `metrics_sharing_resource` or label-scoped `customer_metrics_query` queries. | |
| anchor_type | Yes | Anchor side. `log10x_pattern` = anchor is a 10x pattern. `customer_metric` = anchor is a customer PromQL. | |
| environment | No | ||
| phase_gap_floor | No | Relative gap floor between anchor-high and anchor-low phase means. Candidate is "moved" iff its gap ≥ this. Default 0.15 (=15%) is an uncalibrated default: output is tagged `unvalidated_default` until a caller-side calibration overrides it. See `docs/cross-pillar-primitives.md` for the calibration playbook. | |
| customer_metrics_url | No | Per-call override for the customer metrics backend URL. Wins over LOG10X_CUSTOMER_METRICS_URL env var. Use when MCP was launched with an empty/stale URL. | |
| customer_metrics_auth | No | ||
| customer_metrics_type | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only cover read-only/idempotent/open-world, so the description carries the algorithmic burden and does: it discloses the median-rate phase partitioning, the ≥15% mean-difference rule, the three return buckets (`moved[]`, `not_moved[]`, `evaluation_failed[]`), and critically that the default threshold is uncalibrated and outputs are tagged `unvalidated_default`. That last point is a behavioral caveat an agent cannot get from the schema and would otherwise misread as a validated result.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose and scope are front-loaded and the composition guidance closes it out, so ordering is good. It is a single dense block with several layered parentheticals, which slightly taxes readability, but every clause carries information an agent needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return-value explanation isn't owed, yet the description still enumerates the result partitions. Combined with the anchor semantics, candidate-set guidance, calibration caveat, and sibling hand-off, this is complete for an 11-parameter analytical primitive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 64%, and the description reinforces the two tricky parameters (anchor identity semantics, and the phase_gap_floor threshold with its calibration caveat) plus the rationale for the 100-candidate cap. It does not cover `step`, `environment`, or the three `customer_metrics_*` override parameters, which fall back to the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence gives a specific verb and resource ('deterministic filter on which customer metrics moved while an anchor was active') and immediately scopes it to the cross-pillar investigation flow. It names the sibling tools it composes with (`log10x_rank_by_shape_similarity`, `log10x_metric_overlay`), so an agent can tell it apart from the shape-similarity pass without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit positioning: 'First step of cross-pillar investigation' and 'the cheap deterministic cut that pares the candidate set before the more expensive shape-similarity pass', with a direct compose-with instruction. The agent knows both when to use it and what to call next, and the phrase 'no Pearson, no tier, no causal framing' rules out the things this tool is not for.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_overflow_contentsOverflow contentsARead-onlyIdempotent
The contents view of the customer-owned offload S3 bucket: per-pattern bytes, event count, time-first-seen, time-last-seen, and growth rate. Filtered to action=offload via the cap-CSV the MCP wrote (drop patterns are NOT in S3; compact and tier_down route elsewhere). Call this as the maintenance-loop review: "what's accumulating in my overflow queue?" Routes the agent to log10x_retriever_query to fetch the offloaded events when an incident or audit needs them.
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | Output format. Always "summary": the typed envelope (data.patterns[], data.totals). | summary |
| limit | No | Cap on the number of per-pattern rows returned. Total bytes always reflect the full overflow, even when rows are truncated. | |
| service | No | Filter to a single service. Omit for the full overflow queue across every service that routes to S3. | |
| timeRange | No | Window over which to compute overflow contents. 30d matches the maintenance-loop cadence; sub-30d windows for incident-window probes. '24h' and '1d' are equivalent. | 30d |
| environment | No | Environment nickname |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish readOnly, idempotent, and openWorld behavior. The description adds valuable provenance: it is a customer-owned S3 bucket, the data is filtered by a cap-CSV the MCP wrote, and only action=offload patterns appear here. It does not discuss auth or rate limits, but it meaningfully extends what the annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three tightly written sentences with no filler. It moves from return contents to filtering/routing, then to the maintenance-loop usage pattern and the downstream retriever_query alternative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present and rich annotations, the description does not need to explain return values. It completely covers what the tool shows, when to call it, what it excludes, and where to go for raw events, leaving no material gap for an agent to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all five parameters, including the view const, limit behavior, service filter, timeRange enum, and environment. The description does not add syntax or format details beyond the schema, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific resource (customer-owned offload S3 bucket contents view) and enumerates exactly what it returns: per-pattern bytes, event count, first/last seen, and growth rate. It also distinguishes the tool from sibling data paths by noting that drop, compact, and tier_down patterns are not in this S3 overflow view.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly frames the tool as the maintenance-loop review for 'what's accumulating in my overflow queue?' and routes the agent to log10x_retriever_query when offloaded events are needed for an incident or audit. It also states what is excluded and where those excluded actions route, giving clear when-to-use and when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_pattern_detailPattern detailARead-onlyIdempotent
CALL THIS AFTER log10x_preview_filter when the user drills into a specific pattern by number. Returns a full single-pattern view: 24h line chart (up to 12 rows, 72 chars wide), ASCII horizontal bar chart for cross-service byte distribution (top 8 services), severity breakdown, and up to 5 sample events truncated to 120 chars each. Requires pattern_hash (tenx_hash from preview_filter.data.patterns[].tenx_hash). must_ask_user: Back to preview list, or Apply with this in the picture. actions[]: log10x_preview_filter (back) and log10x_configure_engine (apply).
| Name | Required | Description | Default |
|---|---|---|---|
| pattern | No | Pattern name (Symbol Message, e.g. "Payment_Gateway_Timeout") as an alias for pattern_hash. Resolved to hash via metrics lookup. Provide either pattern or pattern_hash. | |
| timeRange | No | Time window for the volume trend and sample events lookback. Default 7d. Pattern: ^\d+[mhd]$. | 7d |
| environment | No | Environment nickname for multi-env setups. | |
| pattern_hash | No | The tenx_hash of the pattern to drill into. Obtained from log10x_preview_filter data.patterns[].tenx_hash. Preferred over pattern when available (skips a metrics lookup). | |
| include_samples | No | When true (default), attempts to fetch up to 3 full sample events from your stack. Set false to skip the stack round-trip. | |
| monthly_volume_gb | No | What-if volume lens (forecast mode): model the environment at THIS monthly volume (decimal GB/month) instead of its measured volume. The real per-pattern shares and pattern mix are held fixed; only absolute bytes and dollars scale, by one uniform factor. Use it to project a prospect onto their own scale, or to forecast a real env after growth. Pairs with siem_lens. This is a PROJECTION: the envelope stamps volume_actual_gb vs volume_projected_gb and the scale factor, and the note points at the POC for the caller real patterns. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover the safety profile (readOnly, idempotent, openWorld), and the description layers on behavior they cannot express: the stack round-trip that include_samples controls, the fact that output is deliberately truncated (12 rows, 72 chars, top 8 services, 5 samples at 120 chars), and the projection semantics of monthly_volume_gb including the volume_actual_gb vs volume_projected_gb envelope stamp. This is real disclosure beyond structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the call trigger and purpose, then the payload, then the required input and routing. Most sentences earn their place, but the chart-dimension minutiae ('72 chars wide', '120 chars each') is cosmetic detail that competes with the routing information an agent actually needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so explaining return contents was optional, yet the workflow routing and the must_ask_user/actions contract are exactly what an agent needs and are present. The one gap is that it asserts 'Requires pattern_hash' while the schema marks zero required parameters and offers pattern as an equivalent alias — a minor inconsistency that could mislead an agent about hard requirements.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so every parameter is already documented, including the pattern/pattern_hash precedence and the projection caveat. The description restates the pattern_hash sourcing (tenx_hash from preview_filter.data.patterns[]) and little else about the remaining params (timeRange, environment, include_samples), so it sits at the baseline for a fully-covered schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Returns a full single-pattern view') and enumerates the concrete payload: 24h line chart, cross-service bar chart, severity breakdown, sample events. It also names its position in the workflow relative to log10x_preview_filter, so an agent can distinguish it from pattern_trend, pattern_examples, and pattern_diff without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit trigger ('CALL THIS AFTER log10x_preview_filter when the user drills into a specific pattern by number') plus named alternatives for both directions: log10x_preview_filter (back) and log10x_configure_engine (apply). It even specifies the must_ask_user prompt, so the agent knows the required interaction loop, not just when to call.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_pattern_diffPattern diff (set diff across a time boundary)ARead-onlyIdempotent
Compare which log patterns are new, gone, persistent or back again between two adjacent time windows. Compares pattern presence in two windows (the most recent timeRange window as "after" vs the immediately preceding timeRange window as "before") and returns four sets: new (present after, absent before), retired (present before, absent after), persistent (present in both), and re_emerged (flagged as new but existed prior to the before-window, the "the bug we thought we fixed is back" case, derived by checking first_seen against the before-window boundary). Plus co_emergence_clusters: groups of 3+ patterns whose first_seen timestamps cluster within ±co_emergence_window_seconds (default 60s). That cluster is a deploy fingerprint: no CI/CD integration required; the agent can then query the customer's deploy system externally with the cluster timestamp. The two windows compare because a pattern's hash comes from the line, the symbol library and the engine configuration, not from what a query saw: under the same engine, library and configuration the same line carries the same hash in both windows. Use for "what changed since last deploy", "which patterns disappeared this week", "did the rollback bring back the old errors", or paired with log10x_pattern_examples on a flagged hash to see slot distribution. Scoping: service and severity narrow the universe; limit caps rows per category. Returns structured envelope under data.diff with the four sets plus an incidents block when co_emergence clusters are detected. An engine upgrade that changes the naming rules renames the patterns it affects once: across that boundary they show as new and their old names as retired, and the frequent ones form a co-emergence cluster at the upgrade time.
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | Output format. | summary |
| limit | No | Max rows per category (new / retired / persistent / re_emerged). Default 20. | |
| service | No | Service name to scope. Omit for all services. | |
| severity | No | Severity to scope (e.g. `ERROR`, `CRITICAL`). | |
| timeRange | No | Window size on both sides of the boundary. The tool compares the most recent `timeRange` ("after") against the immediately preceding `timeRange` ("before"). Example: `timeRange: "1d"` compares today vs yesterday. | 1d |
| environment | No | Environment nickname (for multi-env setups). | |
| analyzerCost | No | stack ingestion cost in $/GB. Auto-detected from profile. | |
| co_emergence_window_seconds | No | Time spread for clustering co-emergent patterns. Default 60s: tight enough to fingerprint a single deploy. | |
| min_co_emergence_cluster_size | No | Minimum cluster size to emit. Default 3: 2 patterns sharing a timestamp is often coincidence. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations (readOnly/openWorld/idempotent) cover the safety profile, but the description goes well beyond them: it explains the hash stability premise that makes window comparison valid, how re_emerged is derived from first_seen vs the boundary, what co_emergence clusters represent (deploy fingerprint), and the engine-upgrade rename edge case. That is unusually rich behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose and set definitions, and nearly every sentence carries non-obvious information. It is long and there is mild redundancy between the opening sentence and the second sentence restating the window comparison, which keeps it from a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 9-parameter, zero-required, output-schema-backed tool, it covers scoping, the boundary definition, cluster output structure, and a genuine operational edge case (engine upgrade renaming). Nothing an agent needs to invoke or interpret it is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3, but the description adds semantic framing: service/severity "narrow the universe", limit caps rows per category, and it explains why the co-emergence knobs matter (60s tight enough to fingerprint a single deploy; 2 patterns sharing a timestamp is coincidence). This gives meaning beyond the field-level schema text for the clustering parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: it computes a set diff of log patterns (new/retired/persistent/re_emerged) across a time boundary. It explicitly distinguishes itself from the sibling log10x_pattern_examples by naming it as a paired tool, so an agent can tell these apart without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete triggers: "what changed since last deploy", "which patterns disappeared this week", "did the rollback bring back the old errors", plus pairing with log10x_pattern_examples. It stops short of explicitly excluding near neighbors like log10x_pattern_trend or log10x_whats_changing, so sibling differentiation is mostly implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_pattern_examplesPattern examplesARead-onlyIdempotent
Pull recent live events for a pattern from the customer's log analyzer (Splunk, Datadog, Elasticsearch, CloudWatch) and return them grouped by templateHash with template-extracted slot values per match. Bounded to a 24-hour window (live log analyzer retention); for older history use log10x_retriever_query. Input is either a Symbol Message (pattern name like Payment_Gateway_Timeout) or a pasted raw log line; pasted lines resolve via the same templater path as log10x_resolve_batch. The tool runs a SIEM phrase-search probe, runs returned events through the local templater, groups by templateHash (one bucket per template variant of the pattern; each bucket carries the pattern hash, tenx_hash), applies a content-token Jaccard similarity threshold (≥0.85) to discriminate the matching pattern's events from look-alikes, and returns the top buckets by event count. Output marks partial extractions: per-bucket templateHash labels, recall counts, and explicit parseFailed markers when slot extraction fails. Multi-line group templates report head-line-only with an explicit warning. Designed as an orchestration primitive called by log10x_investigate when the chain needs concrete event evidence after a metric-tier identification. Direct user-facing use is fine but rare; prefer log10x_event_lookup + log10x_pattern_trend for single-line inspection.
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | Response shape. `summary` (default) returns slim top-3 buckets (rank, template_hash, tenx_hash, event_count, jaccard, severity, service, recommended_action, headline, ~200-char sample_event preview) plus pattern-level counts. No raw_events, no full sample_event, no slot_distribution, no rationale prose. Target: under 8K tokens. `detail` returns one fully-hydrated bucket (requires bucket_id); pair with retriever_query for raw events. | summary |
| limit | No | Maximum number of sample events per templateHash bucket. 1-50, default 10. | |
| scope | No | Vendor-specific scope (Splunk index, Datadog index, ES index pattern, CloudWatch log group). Defaults to a sensible per-vendor value when omitted. | |
| vendor | No | Log analyzer to search. Auto-detected when exactly one of the supported vendors has credentials in the env; pass explicitly when multiple are configured. | |
| pattern | No | Pattern name (e.g. `Payment_Gateway_Timeout`) or a pasted raw log line. Pasted lines resolve to the matching pattern via the same pattern-extraction path as log10x_resolve_batch. Either pattern or pattern_hash must be provided; pattern_hash is preferred when available. | |
| service | No | Optional service-name scope. Translated to the vendor-specific service filter. | |
| severity | No | Optional severity scope (e.g., `ERROR`, `WARN`). | |
| bucket_id | No | Bucket identifier to fully hydrate. Accepts either the `template_hash` or the `tenx_hash` returned in a prior `view=summary` call. When supplied, the response carries one bucket with full sample_event, full slot_distribution (un-cropped sample_values), bucket_interpretation.rationale, and human_summary. Other buckets are omitted. | |
| timeRange | No | Window for the live SIEM probe. Capped at 24h. To sample a pattern's offloaded cohort (events the Receiver routed to the overflow bucket, which the SIEM never received), use log10x_retriever_query. '1d' is a legacy alias for '24h'. | 1h |
| environment | No | Environment nickname. | |
| slot_filter | No | Optional slot-value filter. When provided, only buckets whose slot_distribution carries the given slot value pass through. Useful for drilling into a single dominant value from a previous pattern_examples call. | |
| pattern_hash | No | Canonical 11-char hash. Either pattern (Symbol Message name) or pattern_hash must be provided; pattern_hash is preferred when available. Resolved to the pattern name via the 10x metrics (same path pattern_detail uses). |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/openWorld/idempotent, and the description adds substantial behavioral context beyond that: the 24-hour retention cap, the SIEM phrase-search probe plus local templater pipeline, the 0.85 Jaccard discrimination threshold, per-bucket parseFailed markers, and head-line-only reporting with a warning for multi-line templates.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core purpose and the 24-hour bound in the opening sentences, and every subsequent sentence carries real routing or behavioral information. It is dense and long, but given the 12-parameter surface and orchestration role most of the length is earned rather than padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return shapes need not be described, and the description still covers windowing, discrimination logic, partial-extraction markers, and sibling routing. For a tool of this complexity, an agent has everything needed to select and invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 12 parameters thoroughly (view, bucket_id, timeRange, slot_filter, etc.), establishing the baseline of 3. The description adds little parameter-level detail beyond what the schema provides, aside from reinforcing that input can be a pattern name or a pasted raw log line resolved via the templater path.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (pull recent live events for a pattern, grouped by templateHash with slot values) and explicitly names the vendor sources. It distinguishes itself from siblings by the 24-hour live-window bound and by naming log10x_retriever_query and log10x_event_lookup/log10x_pattern_trend as the alternatives for other cases.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly gives when-to-use and when-not-to-use: bounded to a 24-hour window, use log10x_retriever_query for older/offloaded history, and prefer log10x_event_lookup + log10x_pattern_trend for single-line inspection. It also frames the tool as an orchestration primitive invoked by log10x_investigate, telling the agent its intended call context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_pattern_mitigatePattern mitigateARead-onlyIdempotent
[FRESH-SESSION ROUTING: if this is the user first cost question of the session, call log10x_start first instead, it returns the orientation menu the user needs before any per-tool action.] Given one pattern (symbolMessage identity or tenx_hash), return the env-gated CAPABILITY MENU of which mitigation paths are reachable: drop_at_analyzer, drop_at_forwarder, mute_at_10x, compact_at_10x. Each option carries enabled (true/false), label, and disabled_reason when not reachable. This is a REACHABILITY-FIRST router: it answers "which of the four tiers can I use right now given my env wiring", NOT "how much would each save". Per-option estimated savings (% reduction, $/mo) and paste-ready config snippets are surfaced by the next-tool chain (log10x_cost_options for the action menu, then the specific action tool for the snippet): NOT this envelope. The agent surfaces the menu to the user; the user picks; chain to log10x_cost_options for the action-level breakdown. Action-shaped tool: calibration honesty: the envelope's recommendation_basis tells the agent WHERE the capability detection came from (envs.json, snapshot, env vars, or unknown). recommendation_audit.capability_sources carries the per-field source, and snapshot_age_seconds carries snapshot staleness. The agent SHOULD NOT auto-route to the chosen sub-tool until the user picks an option, and SHOULD verify the basis before treating capability detection as authoritative (e.g., a stale snapshot may mis-flag mute as enabled when the receiver was uninstalled). See docs/cross-pillar-primitives.md for the agent behavior contract. Call this when a previous tool surfaced a high-cost pattern and the user asks 'what should I do' / 'how do I drop this' / 'how do I reduce this'.
| Name | Required | Description | Default |
|---|---|---|---|
| pattern | Yes | The pattern identity to mitigate. Pass the canonical name from a prior log10x_top_patterns / log10x_event_lookup row. | |
| service | No | Optional service scope. When set, options that target a single service (forwarder drop, exclusion filter) are scoped to it. | |
| snapshot_id | No | Snapshot from log10x_discover_env. Used to detect which 10x components are deployed in the active env (receiver, retriever, GitOps wiring). When passed, the envelope's `recommendation_audit.capability_sources` reflects which capabilities came from the snapshot vs envs.json. Without it, the tool still works but may dim PR-based options if the active env's envs.json does not list a gitops repo. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover safety (readOnly, idempotent, closed-world), and the description adds substantial context beyond them: each option carries enabled/label/disabled_reason, the envelope carries recommendation_basis and recommendation_audit.capability_sources with snapshot_age_seconds staleness, and the agent is warned not to auto-route until the user picks and to distrust a stale snapshot that may mis-flag mute as enabled.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The content is dense but the structure is flawed: a bracketed FRESH-SESSION ROUTING block about a different tool is front-loaded ahead of this tool's actual purpose, and multiple bolded asides add bulk. Nearly every sentence carries information, but the ordering buries the primary purpose and makes the entry point hard to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists and the description still explains the meaningful return fields (enabled, label, disabled_reason, recommendation_basis, capability_sources, snapshot_age_seconds), covers the mutation-exclusion behavior (agent surfaces menu, user picks), and supplies the agent behavior contract. Nothing an agent needs to invoke and interpret this correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents pattern, service, and snapshot_id thoroughly (including that snapshot_id affects capability_sources). The description's restatement of pattern identity (symbolMessage / tenx_hash) and the service-scoping effect largely duplicates the schema, adding only marginal value. Baseline 3 is correct.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource: given one pattern, return an env-gated capability menu of four named mitigation tiers (drop_at_analyzer, drop_at_forwarder, mute_at_10x, compact_at_10x). It explicitly carves out what it is NOT ("how much would each save") and names the sibling that answers that instead (log10x_cost_options), so an agent can separate it from neighbors without opening schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit triggering conditions ("when a previous tool surfaced a high-cost pattern and the user asks 'what should I do'"), a routing rule to log10x_start for a fresh session's first cost question, and the downstream chain (log10x_cost_options for the action breakdown, then the specific action tool for snippets). When-to-use and alternatives are both spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_pattern_trendPattern trendARead-onlyIdempotent
Return the volume history for a single pattern over a chosen window (e.g. 1h, 24h, 7d, 30d), with a sparkline and spike detection: ranked by byte volume (with cost overlay when $/GB is set). Call this after log10x_event_lookup when the user asks "is this getting worse", "has it been louder before", "when did it start", or wants temporal context on a pattern surfaced in an earlier step. Always state the observation window explicitly in the reply: "flat at 2/h for the last 6 months of observation, spiked at 13:58 today", and never claim history older than the window. Pass include to select the cohort: kept (default), dropped (offloaded-only trend, useful for "is the receiver dropping more of this lately"), or both (total ingest). The envelope reports which cohort the series represents so the agent never conflates kept-only with total volume.
| Name | Required | Description | Default |
|---|---|---|---|
| step | No | Data point interval. Default `auto` sizes the step to give about 12 to 30 buckets per window (1h→5m, 6h→15m, 1d/24h→1h, 7d→6h, 30d→1d). Override only when a specific resolution is required; an over-coarse step (e.g. 1h on a 1h window) produces a 2-point series with no usable trend shape. | auto |
| view | No | Output format. Always "summary": the structured envelope. Field retained for backward-compat. | summary |
| include | No | Which engine-decision cohort to scope the trend to. `kept` (default) = events that actually reached the destination (routeState=~"pass|", absence-tolerant). `dropped` = everything the receiver acted on, so everything the destination did NOT receive (offload | compact | tier_down | drop | sample). Pass `drop` for the literal hard-drop cohort alone. `both` = the pre-decision union; envelope adds a parallel `dropped_time_series` and `dropped_share_pct` so one call shows offload share over time. Use `dropped` to verify post-deploy realised savings or to chart "what we are offloading right now". Use `both` to overlay kept vs dropped on the same window. | kept |
| pattern | No | Pattern name (e.g., "Payment_Gateway_Timeout"). Provide either pattern or pattern_hash: pattern_hash is preferred when available (skips a metrics lookup). | |
| timeRange | No | Time range. '24h' and '1d' are equivalent (one-day window). Sub-day values show fine-grained trajectory around an incident. | 7d |
| environment | No | Environment nickname | |
| analyzerCost | No | SIEM ingestion cost in $/GB | |
| pattern_hash | No | The tenx_hash of the pattern (the 11-character pattern hash from top_patterns / preview_filter). Preferred over pattern when available. | |
| include_chart | No | Set include_chart=true to embed the rendered chart inline (large; default false to avoid response truncation). | |
| monthly_volume_gb | No | What-if volume lens (forecast mode): model the environment at THIS monthly volume (decimal GB/month) instead of its measured volume. The real per-pattern shares and pattern mix are held fixed; only absolute bytes and dollars scale, by one uniform factor. Use it to project a prospect onto their own scale, or to forecast a real env after growth. Pairs with siem_lens. This is a PROJECTION: the envelope stamps volume_actual_gb vs volume_projected_gb and the scale factor, and the note points at the POC for the caller real patterns. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnly, idempotent, openWorld), so the bar is lower. The description adds genuinely new behavioral context: the envelope reports which cohort the series represents, `both` adds a parallel dropped_time_series and dropped_share_pct, and the reporting discipline about stating the observation window. It stops short of describing pagination or response size limits beyond the include_chart caveat.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose and trigger conditions are front-loaded before the cohort details, and most sentences carry actionable content. It is long, and the include-cohort explanation partially duplicates the schema's own enum descriptions, which is the only real inefficiency.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 10-parameter read-only analytics tool with a full output schema, the description covers what the schema cannot: sequencing relative to a sibling, the natural-language triggers, cohort-scoping intent, and the reporting constraint against over-claiming history. Return-value detail is correctly delegated to the output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents all ten parameters in depth (including the auto-step sizing, cohort enums, and the projection semantics of monthly_volume_gb). The description restates the include cohort meanings and the analyzerCost cost overlay, adding framing but little syntax or meaning the schema lacks. Baseline 3 is appropriate when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb and resource — returns volume history for a single pattern over a chosen window — plus the value-adds (sparkline, spike detection, byte-volume ranking, cost overlay). It distinguishes itself from log10x_event_lookup by naming the sequencing ('Call this after log10x_event_lookup'), so an agent can route correctly without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit triggers are quoted ('is this getting worse', 'has it been louder before', 'when did it start'), an ordering constraint is stated (after log10x_event_lookup), and each `include` cohort is tied to a use case ('verify post-deploy realised savings', 'chart what we are offloading right now', overlay kept vs dropped). When-not-to-claim guidance ('never claim history older than the window') is also present.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_poc_from_localPOC from local logs (kubectl)ARead-only
Run a log-cost-optimization POC entirely from local log sources: pass path for one log file (wrapper-normalized) or paths for files, directories and globs; kubectl samples pod logs; docker and journald to follow. No log-analyzer credentials required. Use when the prospect has no SIEM connection or has not yet shared API keys. Returns a synchronous markdown report with: (a) sample composition table, top-N pods by byte volume; the prospect must confirm the sample looks like their production mix, (b) industry-pricing matrix, projected savings at Datadog / Splunk / CloudWatch / Sumo / Elastic / OpenSearch list prices, NOT a prediction of any specific bill, (c) top patterns in the kubectl-sourced sample. For native exclusion configs, paste-ready Receiver YAML, and the full 9-section report tied to a specific log analyzer's GB-billed volume, run log10x_poc_from_siem_submit once credentials are available. No automatic fallthrough: this tool is invoked explicitly. If log10x_poc_from_siem_submit failed on missing credentials, the calling LLM should ask the user before re-invoking with this tool: local-source framing differs from SIEM-attached framing and silent fallthrough would be a bait-and-switch. REQUIRES a local engine: the tenx binary on PATH, or Docker with LOG10X_TENX_MODE=docker. No log-analyzer credentials and no deployment are needed, but without an engine this returns an error rather than a report. Pass target_percent_reduction as a whole-number percent (e.g. 40 for 40%) to get a feasibility verdict against that target. Two modes, and the agent should name whichever the user's phrasing invites. Run normally, this tool reads local files but the server around it still has network. Run inside the FENCED profile (TENX_AIRGAPPED=true, --network none, the log10x/poc image) it is the same analysis with no network at all, and its output carries its own docker inspect proof. log10x_emit_sample_plan produces the sample for that mode from the user's own analyzer. Offer it; do not ask which one first.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | One local log file to analyse (source=`file`). Wrapped JSONL is normalized so the engine patterns payloads, not wrappers. For many files or globs use `paths` instead. | |
| siem | No | The destination SIEM, used for the report header chip and command selection. When absent the analysis assumes CloudWatch and the report labels the assumption. | |
| paths | No | Required for `source: file`: files, directories, or glob patterns (`*`, `**`, `?`) to sample, e.g. `["/var/log/app/*.log", "./bundle/**"]`. A directory is read one level deep; use `dir/**` for the tree. | |
| source | No | Where to pull log lines from. `kubectl` samples pod logs; `file` samples local logs: pass `paths` (files, directories, globs) or `path` (one file; fluentd/k8s/docker-wrapped JSONL is detected and normalized before the engine sees it). `docker` and `journald` are follow-up work. | kubectl |
| window | No | How far back to read per pod (`source: kubectl`, default `1h`). For `source: file`, the time span the files cover: read from the first and last record timestamps when the records carry them, and from `window` when they do not. With neither, a file run refuses rather than assume a span. Accepts `30m`, `10h`, `7d`, etc. | |
| max_pods | No | Cap on number of pods sampled. Default 20. | |
| workload | No | Forwarder workload name (daemonset/deployment) for the apply commands. Not guessed when absent. | |
| forwarder | No | Forwarder in the pipeline (fluentd, fluent-bit, filebeat, logstash, otel-collector, vector, hec). Used to pick verified apply/undo commands. Not guessed when absent: the report says commands are unavailable. | |
| namespace | No | Kubernetes namespace to sample from (`source: kubectl` only). Pass `*` to sample across all namespaces. Default `default`. | default |
| allow_lossy | No | Permit sample/drop (lossy) to close a keep-everything shortfall. Default false: the plan stops at the keep-everything ceiling and reports the gap. Only set after the user explicitly chooses loss. | |
| pin_patterns | No | Advanced: most customers will not need this. Map of pattern_hash to action for rare per-pattern overrides within a pod / source. Applied AFTER pin_services. | |
| pin_services | No | Primary per-pod/source override surface. Map of pod / source name to action. Pins are applied AFTER the destination default and AFTER exception_services. Feasibility reruns with the pins; max_achievable shifts and reason cites the pins. | |
| fleet_default | No | Set the fleet default from this capture: the limit for every service the plan gives no row, the largest statement the plan keeps per node times the headroom. The report states it in lines a day, and `fleet_default.cap_bytes_per_window_per_node` in the result is the value `log10x_advise_install` writes. On Datadog, the dependency check also lists the log monitors and log-based metrics of the services it covers, error monitors included. | |
| per_pod_limit | No | Cap on log lines pulled per pod. Default 5000. | |
| budget_gb_monthly | No | VOLUME BUDGET: keep projected monthly ingest at or under this many GB/mo. BYTE accounting: tier_down keeps every byte and is excluded from the ladder for this target. Sample scaled to a 30-day month before solving. Mutually exclusive with target_percent_reduction and budget_usd_monthly. | |
| budget_usd_monthly | No | DOLLAR BUDGET: keep the projected monthly bill on the assumed SIEM at or under this $/mo. The sample is scaled to a 30-day month (kubectl window, or the file span) before solving, so the budget and the bill share a denominator. Mutually exclusive with target_percent_reduction and budget_gb_monthly. | |
| check_dependencies | No | Datadog only, default true: before the plan moves statements off Standard, read the account's log monitors and log-based metrics (read-only GETs, needs DD_API_KEY + DD_APP_KEY in the session) and print beside each service line the ones whose query reads its moved lines. Set false to skip the read. | |
| exception_services | No | Services / pods flagged by the customer to stay in the log analyzer with full retention (action=pass). Their bytes are subtracted from the achievable reduction pool used for the feasibility verdict. Matched case-insensitively against the pod / source name. | |
| report_annotations | No | Optional one-sentence annotations keyed by evidence statement identifier, rendered under the matching action. Hard cap 140 chars each; over-cap or unknown-hash input refuses the render (nothing is truncated). | |
| retriever_installed | No | Whether the prospect will install the S3 retriever. Gates the offload rung of the plan ladder: without it offloaded events would be unreachable, so the plan stops at the in-SIEM levers and the gap names "install the retriever" as the keep-everything remedy. Set from conversation. | |
| record_overhead_bytes | No | Bytes of forwarder metadata per record, for a capture that carries the log text only (a kubectl sample or plain lines). The Receiver counts each record as the forwarder sends it, metadata included, so the caps add this to every line. Default 760, the median of a Fluent Bit kubernetes record on an EKS capture. A file of the forwarder's own JSON records is measured instead. | |
| target_percent_reduction | No | Customer-specified target reduction percent. If absent, POC produces a recommendation-only output. If present, POC produces a feasibility verdict + a pre-deploy commitment artifact stub the agent can surface alongside the per-pod savings matrix. The cap CSV is attached by a later change. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only give readOnly/openWorld/idempotent; the description adds the real operational burden: a local engine is REQUIRED (tenx on PATH or Docker with LOG10X_TENX_MODE=docker) and its absence returns an error rather than a report, no credentials or deployment are needed, and the fenced mode has no network and carries `docker inspect` proof. It also discloses that output is a synchronous markdown report with a specific three-part structure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core purpose and the required-engine caveat early; most sentences carry distinct operational facts (credentials, error behavior, fallthrough policy, two modes). It is dense and long for a single tool, with some repetition about credentials and engine requirements, but little is pure filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 22-parameter tool with nested objects, it covers prerequisites, error behavior, alternatives, mode selection, and the report's shape. An output schema exists so return values needn't be explained (though the description does anyway). Minor gap: it doesn't clarify engine-selection precedence or how conflicts among the mutually exclusive budget parameters surface.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and every parameter is already documented inline, so the schema does the heavy lifting. The description restates the `path` vs `paths` distinction already in the schema and adds a small usage note for `target_percent_reduction` (whole-number percent, e.g. 40). Marginal value beyond the schema — baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource+scope: 'Run a log-cost-optimization POC entirely from local log sources', and immediately distinguishes itself from the SIEM-attached sibling `log10x_poc_from_siem_submit`. An agent can tell which POC path applies without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use ('no SIEM connection or has not yet shared API keys'), names the alternative and the credentials condition that selects it, and even prescribes the no-fallthrough behavior (ask the user before switching from a failed `log10x_poc_from_siem_submit`). Covers both the regular and fenced/airgapped modes and names `log10x_emit_sample_plan` for the latter.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_poc_from_siem_statusPOC from SIEM (status)ARead-onlyIdempotent
Retrieve progress or a view of the report from a log10x_poc_from_siem_submit run. Pass snapshot_id; optionally view to select the level of detail. In-progress responses report status (pulling / templatizing / rendering), progress_pct, step_detail, and elapsed_seconds: poll every ~30s until done. Complete responses render one of six views: summary (default, ~30 lines, exec banner + top-5 wins + views CTA), full (complete 9-section report, ~300 lines), yaml (paste-ready Receiver mute-file for the top N patterns), configs (native SIEM exclusion configs, Datadog exclusion filter / Splunk props.conf / etc.), top (expanded N-row drivers table), pattern (deep-dive on one identity, requires pattern arg). Failures include partial_report_markdown when any events were successfully pulled before the error. The full report is also written to ${LOG10X_REPORT_DIR:-/tmp/log10x-reports}/poc_from_siem-.md regardless of which view the caller requested. Snapshots live in-memory per MCP process; a restart clears them, so persist the final report path to keep it. Unified envelope: response carries status, query_count, total_latency_ms, backend_pressure_hint, human_summary, plus the existing snapshot-lifecycle fields. Errors (unknown snapshot_id, render failure) come back as status: 'error' with a structured PrimitiveError envelope. See docs/cross-pillar-primitives.md for the agent behavior contract. Two modes, and the agent should name whichever the user's phrasing invites. This tool is the NETWORKED one: it reads the analyzer directly over the network with the caller's credentials, and the MCP mints one licence. The FENCED mode runs the same POC with no network at all: log10x_emit_sample_plan renders a read-only export script the user runs themselves, and the analysis happens in a container started with --network none, so 'cannot exfiltrate' is a kernel fact the user checks with one docker inspect rather than a claim we make. Offer it; do not ask which one first.
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | How to surface the report. Default `summary` returns the v2 structured envelope (`data.result` carries the full JSON: input section with scale + methodology + coverage, output section with aggregates, incidents, per-pattern actions). The agent reads this directly and writes prose in its own voice: no rendered markdown is included in the summary path. Use `markdown` to receive the rendered 9-section markdown report (legacy / human-readable surface). `yaml` returns paste-ready receiver mute-file entries; `configs` returns native SIEM exclusion configs; `top` returns an expanded N-row drivers markdown; `pattern` deep-dives on one identity (requires `pattern` arg). `full` is kept as an alias for `markdown`. | summary |
| top_n | No | Number of rows for views that accept it (`top`, `yaml`, `configs`, `summary`). Defaults: summary=5, top=20, yaml/configs=5. | |
| pattern | No | Required when view="pattern". The snake_case pattern identity to expand. Pass the raw identity as printed in prior views. | |
| snapshot_id | Yes | Snapshot id returned by log10x_poc_from_siem_submit. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the readOnly/idempotent annotations: snapshots live in-memory and are cleared on restart, the full report is written to ${LOG10X_REPORT_DIR}/... regardless of view, failures may carry partial_report_markdown, errors surface as status:'error' with a PrimitiveError envelope, and the response carries a unified envelope. This is exactly the lifecycle/auth/persistence context annotations can't convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Roughly 400 words for a status/polling endpoint. The purpose is front-loaded, but large blocks — the fenced-vs-networked mode pitch, the docs reference, the behaviour-contract pointer — don't serve this tool's invocation and read as promotional payload. Multiple sentences don't earn their place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values needn't be explained, yet it still covers progress state, all six views, failure partials, persistence, and error shape. For a polled status tool of this complexity, nothing an agent needs to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3; the description mostly restates what the schema already documents (view levels, pattern requirement, top_n defaults). It adds little semantic detail the schema lacks.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb + resource: 'Retrieve progress or a view of the report from a log10x_poc_from_siem_submit run.' That immediately distinguishes it from the submit sibling and from other report tools. An agent can tell what it does without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Clear when-to-use context: poll every ~30s while in-progress, and each view is enumerated with its use (summary for structured data, markdown for legacy, yaml/configs for pastes). Some of the guidance (networked vs fenced mode, 'call this; do not ask which one first') concerns the POC flow broadly rather than selecting this tool, so it's not pure when/when-not for this endpoint.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_poc_from_siem_submitPOC from SIEM (submit)A
Kick off a full log-cost-optimization POC against the user's SIEM. Pulls a representative event sample, groups the events into log patterns, each with its pattern hash, and renders a 9-section markdown report covering top cost drivers, Receiver recommendations, ready-to-paste native SIEM exclusion configs, Compact mode potential, risk/dependency checks, and deployment paths. Supported SIEMs: cloudwatch (AWS CloudWatch Logs via IAM credential chain), datadog (DD_API_KEY + DD_APP_KEY), sumo (Sumo Logic), gcp-logging (GCP Cloud Logging), elasticsearch (Elastic Cloud / self-hosted), azure-monitor (Azure Monitor / Log Analytics), splunk (SPLUNK_HOST + SPLUNK_TOKEN), clickhouse (OpenObserve / SigNoz / custom schemas). Auto-detects the SIEM from env vars when siem omitted: explicitly pass siem if multiple credential sets exist. scope and query are SIEM-specific: CloudWatch (log group + filter pattern), Datadog (index + query), Sumo (_sourceCategory + query), GCP (project id + filter), Elasticsearch (index pattern + KQL), Azure (workspace id + KQL), Splunk (index + SPL), ClickHouse (database + SQL WHERE). For ClickHouse, also pass clickhouse_table (required) and column-mapping args for custom schemas (OpenObserve/SigNoz auto-detected). Returns a snapshot_id: poll via log10x_poc_from_siem_status to retrieve progress and the final report. Report is also written to ${LOG10X_REPORT_DIR:-/tmp/log10x-reports}/poc_from_siem-<timestamp>.md. Default window is 7d, default target event count is 250k, default max pull time is 5 min: the pull stops at whichever of the two ceilings hits first. Tier prerequisites: none. No log10x API key required. Templating defaults to privacy_mode=true: events are templated by a local Log10x engine, either a native tenx CLI (install for macOS/Linux/Windows: https://doc.log10x.com/install/) or a local Docker container (set LOG10X_TENX_MODE=docker, auto-detected and preferred when the mode is unset), and never leave the machine. Set privacy_mode: false to route through the public Log10x paste endpoint, demo use only, not production log content. Two modes, and the agent should name whichever the user's phrasing invites. This tool is the NETWORKED one: it reads the analyzer directly over the network with the caller's credentials, and the MCP mints one licence. The FENCED mode runs the same POC with no network at all: log10x_emit_sample_plan renders a read-only export script the user runs themselves, and the analysis happens in a container started with --network none, so 'cannot exfiltrate' is a kernel fact the user checks with one docker inspect rather than a claim we make. Offer it; do not ask which one first.
| Name | Required | Description | Default |
|---|---|---|---|
| siem | No | Which SIEM to pull from. Omit to auto-detect from ambient credentials. Valid values: cloudwatch, datadog, sumo, gcp-logging, elasticsearch, azure-monitor, splunk, clickhouse. | |
| query | No | SIEM-native filter expression layered on top of `scope`. Syntax per SIEM (CloudWatch filter pattern; Datadog query; KQL for ES/Azure; SPL for Splunk; SQL WHERE for ClickHouse; Sumo query). | |
| scope | No | SIEM-specific resource scope. CloudWatch: log group name or wildcard (`/aws/ecs/*`). Datadog: index name. Sumo: `_sourceCategory`. GCP: project id. Elasticsearch: index pattern. Azure Monitor: workspace id. Splunk: index name. ClickHouse: database name. | |
| window | No | Window to pull over. Accepts "1h", "24h", "7d", "14d", "30d". Default "14d": wide windows unlock the differentiated longitudinal signals (first-seen, growth, stable-vs-new) that the agent cannot compute from a small sample. Pull pacing is automatic; long windows take minutes but the snapshot continues in the background. | 14d |
| ai_prettify | No | Default true: use MCP sampling to ask the host LLM (the same model the user is already chatting with: Claude Desktop, Claude Code, Cursor, etc.) to batch-generate 3-5-word human-readable names for the top patterns. No Log10x-side endpoint, no extra API key: the host uses whatever model + credentials the user already has. Sends only templated pattern identities (no variable values, no raw log content). Skipped automatically when the host does not advertise the `sampling` capability; the report falls back to raw snake_case identities plus a note. Set false to skip unconditionally. | |
| environment | No | Optional environment nickname: cosmetic only, for the report header. | |
| pin_patterns | No | Advanced: most customers will not need this. Map of pattern_hash to action for rare per-pattern overrides within a service. Applied AFTER pin_services. Use only when a single pattern inside an otherwise-reducible service must be excepted (e.g., audit-trail log line inside a chatty service). | |
| pin_services | No | Primary per-service override surface. Map of service name to action. "Pin payment-svc to pass" → {"payment-svc":"pass"}. Pins are applied AFTER the destination default and AFTER exception_services. Feasibility math reruns with the pins; max_achievable_percent may shift and reason cites the pins. | |
| total_daily_gb | No | Customer's total daily log volume in GB/day. Pick any one of total_daily_gb / total_monthly_gb / total_annual_gb: whichever unit the user naturally thinks in. The tool normalizes to daily internally. When any is provided (or auto_detect_volume succeeds), per-pattern costs are extrapolated from the pulled sample to the full volume, producing meaningful annual-savings figures instead of sub-cent numbers. Priority: daily > monthly > annual. If the pull was narrowed via `query` to one service, this overstates cost: only a fraction of daily volume matches the filter. | |
| total_annual_gb | No | Customer's total annual log volume in GB/year. See total_daily_gb for semantics. | |
| clickhouse_table | No | [ClickHouse] Required: table name holding log events. | |
| max_pull_minutes | No | Hard cap on pull wall-time. Default 30. The pull stops at whichever of target_event_count, max_pull_minutes, or saturation-detected hits first. Long pulls run in the background; poll status while the user does other things. | |
| total_monthly_gb | No | Customer's total monthly log volume in GB/month. See total_daily_gb for semantics. | |
| enrich_max_tokens | No | Output token cap for the host-agent enrichment call. Default 8000. | |
| auto_detect_volume | No | Default true: when no total_*_gb arg is provided, probe the SIEM's usage/metrics API to auto-detect daily ingest volume. Per-SIEM best-effort: CloudWatch (describeLogGroups ÷ retention), Datadog (Usage API), Elasticsearch (_stats), Azure (Usage KQL table), GCP (Cloud Monitoring byte_count), ClickHouse (system.parts), Splunk (license API), Sumo (Account Usage API). Fails silently and falls back to scenario brackets if the current creds lack the required scope. Set false to skip the probe and go straight to manual args or scenarios. | |
| exception_services | No | Services flagged by the customer to stay in the SIEM with full retention (action=pass). Typically 1-3 services for audit, compliance, or executive dashboards. Patterns whose service is in this list are pinned to pass on the envelope outputs and their bytes are subtracted from the achievable reduction pool used for the feasibility verdict. | |
| target_event_count | No | Target event count for the pull. Default 1,000,000 (~500 MB at 500B avg, tokenizes in 5-10 min). The pull self-terminates earlier on saturation: when new patterns per 100k events drops below 2%, the long tail has been covered and the report is generated. This default is intentionally two orders of magnitude beyond what an unaided agent can fit in context. | |
| analyzer_cost_per_gb | No | Override the $/GB rate for cost calculations. Default is read from vendors.json per detected SIEM. | |
| record_overhead_bytes | No | Bytes of forwarder metadata per record. The Receiver counts each record as the forwarder sends it, metadata included, and events read back from a SIEM's API seldom carry that record, so the caps add this to every event. Default 760, the median of a Fluent Bit kubernetes record on an EKS capture. | |
| enrich_with_host_agent | No | Default true: after the engine produces measured findings (per-pattern $/mo, growth, incident clusters), ask the MCP host LLM via sampling to contribute operational context the engine cannot see: kubectl events / deploys correlating with GROWING patterns, alert / dashboard dependencies before recommending mute, code-level root-cause refinement on code_fix patterns, and prioritization based on customer context. Single round-trip, capped at 8000 output tokens. Skipped automatically when the host does not advertise sampling; the v2 envelope still ships without enrichment. Contributions land in output.agent_enrichment.contributions with an audit trail (tools_inspected) so the customer sees what the agent says it looked at. | |
| target_percent_reduction | No | Customer-specified target reduction percent. If absent, POC produces a recommendation-only output. If present, POC produces a feasibility verdict (`output.feasibility`) plus a pre-deploy commitment artifact stub (`output.commitment_artifact`) the agent can surface alongside the per-pattern actions. The cap CSV ready to commit is attached by a later change. | |
| clickhouse_message_column | No | [ClickHouse] Column holding the message body. Default auto-detected. | |
| clickhouse_service_column | No | [ClickHouse] Optional column for service name. | |
| clickhouse_severity_column | No | [ClickHouse] Optional column for severity. | |
| clickhouse_timestamp_column | No | [ClickHouse] Column holding the timestamp. Default auto-detected. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds rich context well beyond the annotations: privacy_mode default and data-egress implications, licence minting, background execution with a snapshot_id to poll, report file path, pull ceilings, and tier prerequisites. This tells the agent what happens to data and how long the operation runs, which the annotations (openWorldHint/idempotentHint) do not.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded and organized with bolded sections, but it is far longer than necessary and includes promotional framing ('cannot exfiltrate is a kernel fact the user checks with one docker inspect') and direct coaching ('Offer it; do not ask which one first') that do not help invocation. Several sentences duplicate schema-level detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Very complete for a 25-parameter, zero-required tool: it covers supported SIEMs, per-SIEM credentials, ClickHouse extras, and the two operating modes. An output schema exists so return values needn't be restated, but the internal default mismatch with the schema keeps it from a 5.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, and the description does add per-SIEM `scope`/`query` syntax mappings. However, it states defaults that conflict with the schema ('default window is 7d, default target event count is 250k, default max pull time is 5 min' versus schema defaults of 14d, 1000000, and 30), which is actively misleading for an agent relying on the prose.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('kick off a full log-cost-optimization POC against the user's SIEM') and enumerates exactly what it produces: an event sample, pattern grouping with hashes, and a 9-section markdown report. It explicitly distinguishes itself from siblings by naming log10x_poc_from_siem_status (polling) and log10x_emit_sample_plan (the fenced alternative).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use context: 'This tool is the NETWORKED one' versus the FENCED mode, and instructs the agent to name whichever mode the user's phrasing invites. It also covers auto-detect behavior and when to pass `siem` explicitly, leaving little to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_preview_filterPreview filter patternsARead-only
CALL THIS AFTER log10x_explain_mode when the user picks Preview. Shows the list of patterns that would be affected by applying a given enforcement mode to a service, before any action is taken. Returns a fixed-width plain-text table (no markdown pipes) with columns: rank, descriptor, volume, %, service, severity, first seen, trend sparkline. Writes a CSV to /tmp/log10x-preview--.csv. must_ask_user offers: drill into pattern #N (calls log10x_pattern_detail), Apply, or go back to pick a different mode. forbidden_next_actions locks log10x_configure_engine, log10x_pattern_mitigate, and log10x_advise_retriever until the user commits.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | The enforcement mode being previewed. Controls which patterns are highlighted as affected. | |
| top_n | No | Number of patterns to surface. Default 20. | |
| service | Yes | Service to scope the preview to. | |
| environment | No | Environment nickname for multi-env setups. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint/openWorldHint/idempotentHint, but the description adds behavior they cannot: a filesystem side effect (CSV written to /tmp/log10x-preview-<mode>-<service>.csv), the exact return rendering (fixed-width text, no markdown pipes), and an interaction contract (must_ask_user options, forbidden_next_actions locking configure/mitigate/advise_retriever). This is genuinely additive context beyond structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the activation condition and every sentence carries distinct actionable content (trigger, scope, return shape, side effect, allowed next actions, blocked actions). It is dense and slightly run-on toward the end, but there is no filler or repetition of the title/name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a workflow-gated preview tool with an output schema, four documented params, and annotations, the description covers the missing pieces an agent needs: precondition, consumed output format, the CSV artifact, and the permitted follow-up actions. Nothing required to invoke or follow up correctly is absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and every parameter carries its own description including the mode enum values, so the schema already does the heavy lifting. The description only implicitly echoes the service+mode pairing ('applying a given enforcement mode to a service') and says nothing about top_n or environment semantics, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (preview) and resource (the patterns a given enforcement mode would affect, scoped to a service) and explicitly frames it as a no-side-effect dry run. The sequencing cue referencing log10x_explain_mode and the drill-down reference to log10x_pattern_detail lets an agent distinguish it from the ~50 sibling tools without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit trigger ('CALL THIS AFTER log10x_explain_mode when the user picks Preview'), an explicit scope caveat ('before any action is taken'), a named alternative next step ('drill into pattern #N calls log10x_pattern_detail'), and locks three specific sibling tools until the user commits. There is essentially nothing left to infer about when to select this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_product_qaProduct Q&A from shipped docsARead-onlyIdempotent
Answer Log10x product questions from the docs that ship inside the MCP build (chunked + indexed at install time). Use whenever the user asks a factual product question: "what is the Receiver", "how is pattern_hash computed", "what data leaves my network", "does the Reporter modify data", instead of answering from training data. Inputs: topic for an exact docs-slug lookup (e.g. faq/security/data-protection), or query for natural-language TF-IDF search across those docs. category narrows search to one of faq / apps / engine / api / config / manage. max_results caps the result count (default 3). Output is a standard chassis envelope with found, ranked results (each carrying matched chunks + canonical_url), and similar_topics as a did-you-mean fallback. Link the canonical_url of each result used in the answer. The docs are shipped from config/mksite/docs at build time; in development the loader also honors LOG10X_PRODUCT_KB_PATH.
| Name | Required | Description | Default |
|---|---|---|---|
| depth | No | Response detail. "short" (default) returns a tight grounded answer plus citation metadata (topic + canonical_url, no section bodies) and offers a chained learn_more action per citation. "full" returns the matched section bodies for one specific page and is requested via the learn_more action the short response hands back (pass that action verbatim: `topic` + `depth: "full"`). | |
| query | No | Natural-language query: prefer this for how-to / content questions. Examples: "what does the kustomize overlay patch", "how is pattern_hash computed". When `topic` is also set, ranks that page's sections by this query. | |
| topic | No | Exact docs slug to fetch a known page. Example: "faq/security/data-protection" or "apps/receiver/deploy". For a multi-section page, ALSO pass `query` to get the asked-about section instead of the page intro. | |
| category | No | Restrict results to one category. One of: faq, apps, engine, api, config, manage. Combines with `query`. | |
| max_results | No | Cap on the number of results returned. Default 3. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, openWorldHint=false, and idempotentHint=true, so the safety profile is covered. The description adds useful behavioral context: docs are shipped and indexed at install time (static, not live), search is TF-IDF based, and results include a fallback via `similar_topics`. It doesn't contradict annotations and provides extra operational detail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with purpose and usage, and every sentence contributes something. However, it includes some implementation details (e.g., `config/mksite/docs`, `LOG10X_PRODUCT_KB_PATH`) that are not essential for an agent to invoke the tool, making it slightly longer than necessary.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (5 parameters, output schema, multiple modes), the description covers purpose, usage, parameter roles, output structure, and data source. It is self-contained and leaves no critical gaps for correct invocation, even though the output schema exists.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema already documents every parameter with examples and interactions. The description mostly repeats those details (topic vs. query, category, max_results), adding little new meaning beyond what the schema provides. Baseline 3 is appropriate for high-coverage schemas.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Answer') and resource ('Log10x product questions from the docs that ship inside the MCP build'), and distinguishes itself from other tools by focusing on factual Q&A rather than diagnostics or configuration. An agent can easily tell this is for product documentation questions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Use whenever the user asks a factual product question' and gives multiple examples, plus an alternative ('instead of answering from training data'). It does not state when *not* to use it (e.g., for non-product questions), but the context is clear enough for selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_rank_by_shape_similarityRank by shape similarityARead-onlyIdempotent
Second step of cross-pillar investigation: Pearson correlation + signed lag on a pre-filtered candidate set (typically the moved[] output of log10x_metrics_that_moved). Returns per-candidate: pearson_magnitude, pearson_signed (direction preserved), lag_seconds (signed: negative = candidate leads anchor, positive = candidate lags), lag_at_bound (flag: peak landed at search-window boundary), lag_tightness (how sharply the Pearson surface peaks), anchor_phase_gap, anchor_phase_aligned (flag: candidate value differs ≥15% between anchor's high-phase and low-phase buckets), n_buckets. No tier, no causal label: the agent reads the flags and decides. Compose with log10x_metric_overlay for the final per-candidate aligned-timeseries view.
| Name | Required | Description | Default |
|---|---|---|---|
| step | No | 30s | |
| anchor | Yes | Anchor identity. For `anchor_type=log10x_pattern`: the pattern Symbol Message NAME or its 11-char `pattern_hash` (= `tenx_hash`), the tool detects shape and queries the correct PromQL label (`message_pattern` vs `tenx_hash`). For `anchor_type=customer_metric`: a customer PromQL expression. | |
| window | No | 1h | |
| timeRange | No | ||
| candidates | Yes | Customer-side PromQL expressions to rank (max 100). An AI caller reasoning over results can't meaningfully digest more than a few dozen; the cap reflects that, not a backend constraint. | |
| anchor_type | Yes | ||
| environment | No | ||
| lag_search_max_abs | No | Maximum absolute lag in seconds to scan. Default 1800s: uncalibrated. Output is tagged `unvalidated_default` when used as-is. Narrow it when the use case has a known tighter upper bound on cascade latency (e.g. 300 for sub-5-min cascades). See `docs/cross-pillar-primitives.md` for the calibration playbook. | |
| customer_metrics_url | No | Per-call override for the customer metrics backend URL. Wins over LOG10X_CUSTOMER_METRICS_URL env var. Use when MCP was launched with an empty/stale URL. | |
| customer_metrics_auth | No | ||
| customer_metrics_type | No | ||
| anchor_phase_aligned_floor | No | Relative phase-gap floor for the `anchor_phase_aligned` flag. Default 0.15: uncalibrated, same provenance caveat as lag_search_max_abs. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover safety (readOnlyHint, idempotentHint, openWorldHint), so the bar is lower, yet the description adds real behavioral context: it discloses that there is 'no tier, no causal label' and that the agent must interpret the returned flags itself, which sets expectations about the tool's epistemic limits. It also explains what each returned flag means (lag sign convention, boundary flag, phase-alignment threshold).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The workflow position is front-loaded in the first clause, followed by the mechanics and then the output contract. The long enumeration of returned flags is dense but each item carries distinct meaning; only minor trimming is possible.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present it did not need to explain return values, yet the flag semantics it provides are genuinely useful for interpretation. The main gap is the unlabeled parameters (step, window, timeRange), which an agent must infer, but for the intended workflow the description is otherwise complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 42%, and several parameters (step, window, timeRange, environment, customer_metrics_auth, customer_metrics_type) are undocumented anywhere. The description adds meaning for `candidates` ('pre-filtered candidate set') and the lag search window implicitly through `lag_at_bound` and `lag_seconds` semantics, but it does not compensate for the full coverage gap, so the baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific operation (Pearson correlation + signed lag ranking) on a specific resource (a pre-filtered candidate set) and explicitly positions it as the 'second step of cross-pillar investigation' after log10x_metrics_that_moved. This lets an agent distinguish it from siblings like log10x_metric_overlay and log10x_metrics_that_moved without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It clearly states when to use it (on the `moved[]` output of log10x_metrics_that_moved) and how to compose it (with log10x_metric_overlay for the aligned-timeseries view). It stops short of an explicit when-not or naming an alternative ranking path, so it is strong context rather than full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_resolve_batchTriageARead-onlyIdempotent
Templatize a batch of log events and return per-pattern triage. This is one of two tools that run a local Log10x pipeline on the user's machine (the other is log10x_extract_templates): call this whenever the user asks 'can you run log10x locally', 'do a local pipeline run', 'templatize these events', or supplies any batch to analyze (Datadog/Splunk/Elastic query results, Slack incident attachments, kubectl logs, raw text). Does NOT need Kubernetes, a deployed Reporter, or a Log10x account: the pipeline runs in-process on the host. Output structures the batch by a paste-local templateHash with per-pattern frequency + severity + full template structure + per-slot variable distribution. Each top pattern carries actions[] chaining to log10x_investigate (historical correlation) and log10x_retriever_query (offload retrieval). Do NOT call for single-line resolution: use log10x_event_lookup for that. REQUIRES a local engine: the tenx binary on PATH, or Docker with LOG10X_TENX_MODE=docker.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Local file path when source=file. Required for file mode. | |
| text | No | Raw text blob when source=text: newline-separated log events. | |
| events | No | Inline log lines: an array of lines, or a single newline-separated string (both accepted). `source` need not be set. | |
| source | No | Optional: auto-inferred from whichever of `events` / `text` / `path` you actually provide, so you normally do not set it. Provide explicitly only to disambiguate when more than one is present. | |
| environment | No | Environment nickname: used to build next_actions that call log10x_investigate. | |
| top_n_patterns | No | How many patterns to return in the ranked triage. | |
| include_next_actions | No | Whether to generate next_action suggestions for each top pattern. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare readOnly/openWorld/idempotent; the description adds substantive context the annotations cannot: the pipeline runs in-process on the host, requires no Kubernetes/Reporter/account, and depends on the tenx binary or Docker via LOG10X_TENX_MODE. It also describes the output shape and the actions[] chaining to other tools, well beyond the structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core purpose before layering triggers, exclusions, requirements, and output structure, and every segment carries information. It is dense with parenthetical asides, which slightly taxes readability but avoids filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 7-param, zero-required tool with an output schema and safety annotations, the description covers purpose, invocation triggers, exclusions, runtime prerequisites, and cross-tool chaining. Nothing an agent needs to select or correctly invoke it appears missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so per-parameter semantics are already documented at the baseline 3. The description adds genuine meaning by enumerating accepted input kinds (Datadog/Splunk/Elastic results, Slack attachments, kubectl logs, raw text), which contextualizes the events/text/path parameters and the auto-inferred source behavior.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb+resource ('Templatize a batch of log events and return per-pattern triage') and immediately distinguishes itself from siblings by naming the other local-pipeline tool (log10x_extract_templates) and the single-line alternative (log10x_event_lookup). The resource, scope, and mode of operation are unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit trigger phrases ('can you run log10x locally', 'templatize these events'), enumerates the accepted input sources, and states an explicit exclusion with the correct alternative ('Do NOT call for single-line resolution: use log10x_event_lookup'). When-to-use, when-not, and alternatives are all present.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_retriever_probeRetriever e2e probeARead-only
End-to-end probe of the deployed Retriever chain. Fires a synthetic query at the picked top-volume tenx_hash (or an explicit target_hash) and asserts every stage in order: offload bucket has recent data, indexer pipeline is running (kubectl logs grep for 'starting pipeline - Tenx: @/apps/retriever/index'), SQS subquery + stream queues drained (depth ≤ 10), retriever pod containers all ready, then submits the query and asserts CloudWatch scan complete events have matched>0, CloudWatch stream worker complete events exist, S3 qr//*.jsonl files were written, and the MCP returned events_matched>0 AND events_returned>0. Returns a structured verdict (green / broken / unknown) with per-assert observed + remedy. Call this as the post-install verify step (chained from log10x_advise_retriever step_verify) OR as a deep doctor diagnostic when log10x_retriever_query returns 0 events and the cause is unclear. Catches the silent-failure shapes that take hours to debug manually: indexer not booted, stream pipeline launch failures, IRSA s3:PutObject misconfigured, MCP input_bucket misaligned with engine write location.
| Name | Required | Description | Default |
|---|---|---|---|
| namespace | No | Kubernetes namespace where the retriever pod runs. Default: "log10x". | log10x |
| target_hash | No | Pre-picked tenx_hash to query for. When omitted, the probe queries the metric backend for the top-volume hash over the last 5 min. | |
| input_bucket | No | S3 bucket where the retriever WRITES qr/<id>/*.jsonl result objects. Default: read from the resolved env-config's `retriever.input_bucket` (walking K8s ConfigMap → AWS SSM → GCP Secret Manager → Azure App Config → local file in that order). Falls back to LOG10X_RETRIEVER_INPUT_BUCKET / __SAVE_LOG10X_RETRIEVER_BUCKET__ env vars and the helm-release probe when no env-config is reachable. | |
| offload_bucket | No | S3 bucket the receiver offloads data to (the bucket the retriever indexer reads from). Default: pick the `status="active"` entry from the resolved env-config's `offload_destinations[]` (walking K8s ConfigMap → AWS SSM → GCP Secret Manager → Azure App Config → local file in that order). Falls back to the LOG10X_STREAMER_BUCKET / LOG10X_OFFLOAD_BUCKET env var when no env-config is reachable. When the env var disagrees with the resolved value, the env var is ignored AND a stale-env-var warning is emitted on `envelope.warnings`. | |
| window_minutes | No | Query window size in minutes. Default: 5. | |
| query_log_group | No | CloudWatch log group the retriever writes per-query execution events to. | log10x-retriever-query-events |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Far exceeds what the annotations convey: it enumerates the exact ordered assertions (offload bucket freshness, kubectl grep for the indexer pipeline launch, SQS depth <= 10, pod readiness, CloudWatch scan/stream events, S3 qr/*.jsonl writes, MCP events_matched>0), the verdict shape, and remedies. It also discloses the side effect ('fires a synthetic query') and the silent-failure classes it catches, which the readOnlyHint/openWorldHint/idempotentHint flags cannot express.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the purpose and the two invocation contexts, and every clause is informative rather than filler. The long assertion enumeration is dense but arguably earns its place for a diagnostic tool; it is borderline verbose for a selection-time description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value explanation is not required, yet the description still summarizes the verdict structure. Combined with the invocation guidance, side effects, and failure modes covered, an agent has everything needed to call this correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents all six parameters in depth. The description adds only a restatement of target_hash behavior ('or an explicit target_hash') that the schema also states, so it neither compensates for nor extends the schema meaningfully.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a precise verb+resource ('End-to-end probe of the deployed Retriever chain') and immediately names the mechanism (synthetic query at the top-volume tenx_hash). It is unmistakably distinct from siblings like log10x_retriever_query and log10x_doctor.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly gives two use cases: post-install verify chained from log10x_advise_retriever step_verify, or a deep doctor diagnostic when log10x_retriever_query returns 0 events and the cause is unclear. Alternatives and the selecting condition are both named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_retriever_queryRetriever queryARead-onlyIdempotent
Fetch offloaded log events from the customer's own S3 bucket by pattern hash or by a variable value, reading only the byte ranges whose Bloom filters can hold a match, without a full scan. The use case: events the Receiver offloaded to the customer's S3 bucket instead of the SIEM, over any window the bucket holds. The Bloom filters cover each event's template hash and variable values. Matched events land as a list of *.jsonl objects in the customer's S3; the tool returns an in-context preview (capped by limit) PLUS data.results_location (the S3 bucket + prefix holding the full object set). A capable agent reads those objects directly to answer, or hands the S3 object list to the customer's own S3-to-SIEM path. No re-ingestion pipeline, no proprietary format. The envelope additionally carries per-pattern offload_status so retrieval results agree with the live metric-surface disposition (pass / sample / compact / drop) without a second tool call. Call for: offloaded events of a pattern; events filtered by a variable value that is not a faceted SIEM dimension (e.g. 'all payment_retry events for customer acme-corp 90 days ago'); compliance / audit / forensic exact retrieval; confirming what the Receiver offloaded for a given pattern. Optional JavaScript filters refine over payloads after the Bloom-scoped fetch. For a time-bucketed series instead of raw events, use log10x_retriever_series. The envelope carries by_severity / by_service / by_day rollups with a rollup_basis provenance stamp (qrs_summaries = whole-match from engine summaries; events_capped = derived from the capped download).
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End of the query window. Same grammar as `from`. Default `now`. | now |
| from | Yes | Start of the query window. Accepts ISO8601 (`2026-01-15T00:00:00Z`), epoch millis, or relative (`now-1h`, `now-24h`, `now-7d`). Normalized to the engine's `now("-1h")` form before dispatch. | |
| view | No | summary returns the typed envelope (data.events_matched, data.events[], data.query_id, data.diagnostics, data.human_summary). The deprecated markdown view was removed; data.human_summary carries the prose distillation for chat rendering. | summary |
| debug | No | Escalate the CloudWatch log level to DEBUG for THIS query only: per-blob Bloom decisions, per-fetch S3 reads, per-event results-writer samples. Use only when normal-run diagnostics cannot explain a 0-result or truncated outcome (volume is ~100x higher). Default false. | |
| limit | No | Hard cap on events returned after merging per-worker result files. Default 500. Typical conversational queries want 10-100; the LLM will render only the first 50. | |
| format | No | `events` (default: raw events), `count` (total + severity/service rollups, no event bodies), `aggregated` (events bucketed into a time series, use with bucket_size), `ephemeral_series` (bucketed series in Prometheus range-query shape for cross-pillar correlation). All four formats are rolled up client-side from the same events stream. | events |
| search | No | Bloom-filter search expression using the TenX subset: `==`, `||`, `&&`, `includes(field, "substr")`. Example: `severity_level=="ERROR" && includes(text, "ECONNREFUSED")`. Selective values are dramatically cheaper than open-ended scans. REQUIRED unless `pattern_hash` is given: the engine rejects a blank search, so there is no unscoped full-window scan. To scope to one pattern pass `pattern_hash`, which is matched as a text token; a Reporter-named `pattern` cannot be matched against the archive at all and is refused with a remedy. | |
| target | No | Target app/service prefix to scope the index scan. Defaults to __SAVE_LOG10X_RETRIEVER_TARGET__ (env var). Required if no default is configured. | |
| filters | No | JavaScript filter expressions evaluated in-memory against each decoded event after the Bloom-scoped fetch. Full TenX JS API: `this.customer_id === "acme-corp"`, `this.http_code.startsWith("5")`. Filters are AND-combined. | |
| pattern | No | Reporter-named pattern (Symbol Message). NOT SUPPORTED against the offload bucket: passing it returns an error naming the remedy, rather than a silent empty result. A Symbol Message is a label DERIVED from the event, so it is never a token in the offloaded bytes, and the Bloom index holds only text tokens plus template hashes. (The field this once queried, `tenx_user_pattern`, does not exist in the engine at all, which is why name-scoped queries returned BLOOM_REJECTED_ALL.) Pass `pattern_hash` instead: top_patterns returns it on the same row as the name, and event_lookup resolves a name to a hash. | |
| bucket_size | No | Bucket size when format=aggregated or ephemeral_series. Examples: `1m`, `5m`, `1h`, `1d`. | 5m |
| environment | No | Environment nickname: required if multi-env. | |
| pattern_hash | No | Canonical pattern_hash from top_patterns / event_lookup. When provided, search is auto-built as `includes(text, "<hash>")` and no name resolution runs. It matches the stamped hash as a TEXT TOKEN because the offloaded events carry their own `tenx_hash` field, re-derived per multi-line group, so a field equality against a metrics-side hash matches nothing. This is the pattern hash emitted by top_patterns.payload.patterns[].pattern_hash: bypasses the name→hash resolver entirely. Precedence: `search` > `pattern_hash` > `pattern`. Example: `pattern_hash: "4Kjc7PHLWqY"`. | |
| result_target | No | Tier-1 result-sink redirect: write this query OUTPUT (events, summaries, markers) under tenx/<result_target>/ in the same bucket instead of the default target, e.g. to a prefix a SIEM connector watches. Omit to keep results under the scan target (default). Bare token [A-Za-z0-9_-]+. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark this read-only, idempotent, open-world, but the description goes well beyond: it discloses the Bloom-filter byte-range scan (no full scan), the capped preview plus data.results_location handoff, and the per-pattern offload_status agreement with the metric surface. These are behavioral traits not derivable from the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core action and scoping, then adds usage, alternative routing, and envelope notes. Dense and slightly run-on, but nearly every sentence carries actionable information for a 14-parameter tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex, high-parameter retrieval tool with an output schema, the description supplies the operational context an agent needs (Bloom-scoped fetch, preview+location split, offload_status, rollup_basis provenance) without redundantly explaining raw return values.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description ties parameters to workflow meaning (e.g., filters run in-memory after the Bloom-scoped fetch, limit caps the preview versus the full object set). It largely reinforces rather than exceeds the schema, which already documents precedence and formats.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Fetch offloaded log events from the customer's own S3 bucket') and the two retrieval modes (pattern hash, variable value). It explicitly distinguishes itself from the sibling log10x_retriever_series by use case, so an agent can tell them apart without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides an explicit 'Call for:' list of scenarios (offloaded events of a pattern, non-faceted variable filtering, compliance/audit/forensic retrieval, confirming offload disposition) and names the alternative tool for time-bucketed series. Clear when-to-use with a named alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_retriever_query_statusRetriever query statusARead-onlyIdempotent
Post-hoc diagnostic surface for a specific retriever query, addressed by queryId (returned from log10x_retriever_query or recovered from the S3 results prefix). Pulls the coordinator's _DONE.json stats (scanned / matched / streamRequests / streamBlobs / submittedTasks / expectedMarkers), counts per-worker byte-count markers under q/<queryId>/, lists result JSONL files under qr/<queryId>/, optionally filters CloudWatch events from the queryLogGroup for the queryId substring (when the chart's queryLogGroup is configured), and runs a diagnostics engine that classifies the run into states like dispatcher_failure (scanned=0 with submittedTasks>0), results_not_uploaded, or observability_disabled. When pod logs are reachable from the MCP host, fetches a tail and greps for the cloud/streamer/subquery include-resolution signature to confirm the dispatcher-failure category. Call this whenever log10x_retriever_query returns 0 events but the wall-clock implies scan work, or whenever an offline post-mortem needs the structured timeline for a specific queryId. Pass fetch_results: true to ALSO recover the completed results from S3 (10-event preview + counts + results_location) after a partial or timed-out query, without resubmitting.
| Name | Required | Description | Default |
|---|---|---|---|
| target | No | Target app/service prefix used when the original query was submitted. Defaults to "app". Must match the target that was passed to the original query. | app |
| query_id | Yes | UUID of a previously-submitted retriever query. Returned as data.query_id from log10x_retriever_query. | |
| fetch_results | No | When true and the query has completed, ALSO recover the results from S3: a 10-event preview, counts, and the results_location pointer, same core fields as a completed log10x_retriever_query. Use after a partial/timed-out query to recover stranded events without resubmitting. | |
| include_pod_logs | No | When true and a dispatcher_failure is suspected (scanned=0 + submittedTasks>0), attempt kubectl logs on the retriever pod to confirm the chart 1.0.20 include-resolution error. Requires kubectl access from the MCP process. Set false to skip the kubectl call. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover read-only/idempotent/open-world, but the description adds substantial behavioral context beyond them: the diagnostic state taxonomy (`dispatcher_failure`, `results_not_uploaded`, `observability_disabled`), the classification heuristic (scanned=0 with submittedTasks>0), the kubectl dependency and its host-reachability caveat, and the CloudWatch filter gated on a configured `queryLogGroup`. It also discloses the side effect of `fetch_results` pulling data from S3.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is one very long paragraph, which is dense but unstructured, and reads as a wall of text. It is front-loaded well with the core purpose, and nearly every clause carries operational information, so the length is largely earned rather than padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a post-hoc diagnostic tool with an output schema covering return values, the description supplies everything an agent needs: when to call it, how to obtain the required id, the diagnostic categories it produces, and the optional kubectl/S3 dependencies. No meaningful gap remains.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds meaning beyond it: how `query_id` is obtained (returned from `log10x_retriever_query` or recovered from the S3 results prefix), what `fetch_results` actually returns (10-event preview, counts, results_location), and that `include_pod_logs` triggers a kubectl call requiring host access.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Post-hoc diagnostic surface for a specific retriever query, addressed by queryId" gives a precise verb, resource, and addressing key, and the enumeration of what it pulls (coordinator `_DONE.json` stats, byte-count markers, result JSONL, CloudWatch events, diagnostics engine) makes the scope unmistakable. It is clearly differentiated from the submit-side sibling `log10x_retriever_query` and from `log10x_retriever_probe`/`log10x_retriever_series`.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit trigger conditions are given: "Call this whenever `log10x_retriever_query` returns 0 events but the wall-clock implies scan work, or whenever an offline post-mortem needs the structured timeline for a specific queryId." It also states when to flip `fetch_results: true` (recover stranded results after a partial/timed-out query without resubmitting) and when `include_pod_logs` applies.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_retriever_seriesRetriever time seriesARead-onlyIdempotent
Materialize a fidelity-aware time series from the customer's S3 offload bucket over an arbitrary window, with optional group-by on enrichment fields. Auto-selects between exact full aggregation (Strategy A) and per-window-sampled fan-out (Strategy B) based on Reporter pattern volume: small/moderate-volume queries get exact counts; high-volume / long-window queries get a sampled series with time-distribution + group-ranking fidelity preserved and tail caveats reported. Pathological volume is refused with structured narrowing guidance, never silently truncated. Call when: (a) the user wants a 'rate of pattern X over the last 30 days, broken down by tenant' answer that exceeds SIEM retention/budget, (b) a baseline needs building from cost-driver patterns where Prometheus has continuous metrics but the grouped breakdown lives only in the offload bucket. Use log10x_retriever_query instead for the event payloads (not aggregates).
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End of the query window. Same grammar as `from`. Default `now`. | now |
| from | Yes | Start of the query window. ISO8601, epoch millis, or relative (`now-1h`, `now-7d`, `now-30d`). | |
| view | No | summary returns the typed envelope (data.mode, data.bucket_seconds, data.series_count, data.points_returned, data.top_groups, data.caveats, data.human_summary). The deprecated markdown view was removed; data.human_summary carries the prose distillation for chat rendering. | summary |
| search | No | Bloom-filter search expression using the TenX subset. Tightly bound queries (e.g., `includes(text, "<pattern_hash>")`, `severity_level == "ERROR"`) are dramatically cheaper. (legacy example removed: `tenx_user_pattern == "PaymentRetry"`) get the cheapest fetch path. Pattern-bound expressions are also what unlocks the Reporter-driven cost heuristic: without one, mode selection falls back to window-length only. Pass `pattern` instead for the common case of scoping to one Reporter-named pattern. | |
| target | No | Target app prefix. Defaults to __SAVE_LOG10X_RETRIEVER_TARGET__. | |
| filters | No | In-memory JS filters applied after the Bloom-scoped fetch (AND-combined). | |
| pattern | No | Reporter-named pattern (Symbol Message). NOT SUPPORTED against the offload bucket: passing it returns an error naming the remedy, rather than a silent empty result. A Symbol Message is a label DERIVED from the event, so it is never a token in the offloaded bytes, and the Bloom index holds only text tokens plus template hashes. (The field this once queried, `tenx_user_pattern`, does not exist in the engine at all, which is why name-scoped queries returned BLOOM_REJECTED_ALL.) Pass `pattern_hash` instead: top_patterns returns it on the same row as the name, and event_lookup resolves a name to a hash. | |
| fidelity | No | `auto` (tool decides via Reporter volume + window length), `full` (force exact aggregation: may exceed Lambda budget), `per_window_sampled` (force sampling, default K=1000 per sub-window), or `per_window_sampled:K` (custom K). | auto |
| group_by | No | Optional enrichment field to group the series by: e.g., `tenx_user_service`, `severity_level`, `k8s_namespace`. Top-1000 group values are retained; tail collapsed to `_other_`. | |
| bucket_size | No | Time bucket granularity (`1m`, `5m`, `1h`, `1d`). Determines the resolution of the output series. | 5m |
| environment | No | Environment nickname: required if multi-env. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint/idempotentHint/openWorldHint, but the description adds substantial context beyond them: automatic Strategy A/B selection driven by volume, sampled-series tail caveats being reported, and pathological volume being refused with structured narrowing guidance rather than silently truncated. This is exactly the behavioral disclosure an agent needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose and the key behavioral contract before detailed rationale; the parenthetical volume-heuristic explanation is dense but earns its place. Slightly long, but no true filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists and the view parameter documents the returned envelope, so return values need not be re-explained. Given complexity (mode auto-selection, sampling fidelity, refusal semantics), the description covers everything an agent needs to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 11 parameters (fidelity modes, group_by top-1000/_other_, search grammar, etc.). The description adds only a light gesture toward group-by-on-enrichment-fields and the fidelity heuristic, which is already in the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Materialize a fidelity-aware time series from the customer's S3 offload bucket over an arbitrary window') and explicitly distinguishes itself from the sibling log10x_retriever_query. An agent can tell what this produces (aggregated series) versus event payloads without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit when-to-call scenarios (a) and (b) with concrete user intents, plus a named alternative ('Use log10x_retriever_query instead for the event payloads'). Both the triggering cases and the exclusion are spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_savingsPipeline savingsARead-onlyIdempotent
Show pipeline savings: the bytes the Receiver keeps out of the SIEM (filtering and compact) and the bytes the Retriever indexed in the customer's bucket (priced at the SIEM rate, less storage, less what was streamed back), with a dollar overlay when an analyzer $/GB rate is set (account profile list price, or per-call effective_ingest_per_gb override). Without a rate, the headline is percent-and-bytes only: never a fabricated $1/GB number. Use for "how much are we saving", "pipeline ROI", or "what is the Log10x stack worth financially". Accepts siem_lens (what-if destination): keeps the measured volumes, prices + gates for that destination at list rates, and stamps siem_actual vs siem_lens in the envelope.
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | Output format. Always "summary": the typed envelope (data.totals, data.edge, data.retriever, data.run_rate). Field retained for backward-compat. | summary |
| siem_lens | No | What-if destination lens: price the SAME real volumes at this destination's default rates instead of the connected pipeline's. Dollars switch to the lens destination default rate (env-configured rates never leak across destinations); the envelope stamps siem_actual vs siem_lens. Volumes/patterns are unaffected. | |
| timeRange | No | Time range. '24h' and '1d' are equivalent. | 7d |
| environment | No | Environment nickname | |
| storageCost | No | S3 storage cost in $/GB/month. Defaults to $0.023 (S3 Standard). | |
| analyzerCost | No | DEPRECATED alias for effective_ingest_per_gb. stack ingestion cost in $/GB. | |
| effective_ingest_per_gb | No | Customer-supplied stack ingestion cost in $/GB. When provided, rate_source=customer_supplied and dollars are populated. When omitted and no profile rate is available, rate_source=unset and the headline reports percent + bytes only (no dollars). |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnly/idempotent/openWorld annotations, the description discloses the critical fallback behavior (no fabricated $1/GB when no rate is set; headline degrades to percent-and-bytes), the rate_source states, and the cross-destination isolation rule (env-configured rates never leak, envelope stamps siem_actual vs siem_lens). That is substantive behavioral context an agent could not infer from annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The output content is front-loaded, then use cases, then the siem_lens clause, which is the right ordering. It is dense in places (nested parentheticals about pricing arithmetic) but every sentence carries information relevant to invocation; nothing is filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need no narrative, and the description covers the rate-absent and lens paths thoroughly for a 7-parameter read-only tool. The one real omission is disambiguation from the sibling savings/cost tools, which matters for correct tool selection in this crowded namespace.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is already 100%, so the baseline is 3, but the description adds genuine meaning: it explains siem_lens as a re-pricing lens that leaves volumes untouched, clarifies the effective_ingest_per_gb override precedence against the account profile rate, and ties a missing rate to the percent-and-bytes headline. It stops short of explaining view, timeRange, or storageCost, which remain schema-only.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific resource (pipeline savings) and spells out exactly which quantities are returned: bytes the Receiver keeps out of the SIEM and bytes the Retriever indexed, with an optional dollar overlay. It is far more than a restatement of the name. It does not, however, distinguish itself from the sibling log10x_estimate_savings or log10x_cost_options, leaving an agent to guess which savings tool to pick.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Clear usage triggers are given verbatim: 'how much are we saving', 'pipeline ROI', 'what is the Log10x stack worth financially', plus the specific condition for siem_lens (what-if destination pricing). No explicit when-not guidance or named alternative tool is provided, so an agent facing the savings/estimate_savings overlap gets no routing rule.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_servicesServicesARead-onlyIdempotent
[FRESH-SESSION ROUTING: if this is the user first cost question of the session, call log10x_start first instead, it returns the orientation menu the user needs before any per-tool action.] List every service the Log10x pipeline is watching, ranked by byte volume (with cost overlay when $/GB is set) plus per-service share of total AND the four action-axis columns (bytes_passed / bytes_offloaded / bytes_compacted / bytes_dropped) derived by joining routeState="drop" events against the cap-CSV. Pass exception_services to mark customer-flagged services as current_mode=pass: their next_action points at log10x_pattern_mitigate instead of log10x_configure_engine.
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | Output format. Always "summary": the typed envelope (data.services[], data.totals). Field retained for backward-compat. | summary |
| siem_lens | No | What-if destination lens: price the per-service $/mo columns at this destination's default rates instead of the connected pipeline's (env-configured rates never cross destinations). Volumes/patterns are unaffected; the envelope stamps siem_actual vs siem_lens. | |
| timeRange | No | Time range. Sub-day values available for incident-window service ranking. '24h' and '1d' are equivalent. | 7d |
| environment | No | Environment nickname | |
| analyzerCost | No | SIEM ingestion cost in $/GB | |
| monthly_volume_gb | No | What-if volume lens (forecast mode): model the environment at THIS monthly volume (decimal GB/month) instead of its measured volume. The real per-pattern shares and pattern mix are held fixed; only absolute bytes and dollars scale, by one uniform factor. Use it to project a prospect onto their own scale, or to forecast a real env after growth. Pairs with siem_lens. This is a PROJECTION: the envelope stamps volume_actual_gb vs volume_projected_gb and the scale factor, and the note points at the POC for the caller real patterns. | |
| exception_services | No | Customer-flagged services that must stay in the SIEM with full retention (audit / regulatory / executive). Per row, marks current_mode="pass" and points next_action at pattern_mitigate instead of the configure_engine bulk path. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/openWorld, yet the description goes further: it discloses that action-axis columns are derived by joining routeState="drop" events against the cap-CSV, that the envelope stamps siem_actual vs siem_lens, and that projection mode stamps volume_actual_gb vs volume_projected_gb plus a scale factor. This is rich internal behavior not recoverable from annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The routing directive is front-loaded ahead of the functional description, and nearly every sentence carries distinct information. It is dense and somewhat run-on, but not padded with filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, the description needn't explain return values, yet it usefully names the resulting columns and envelope stamps. It covers the what-if/projection modes and the exception path; only pagination/limit behavior is unaddressed, a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all seven parameters, and the description's exception_services explanation largely restates the schema's own wording. Baseline 3 is appropriate since the description adds only marginal semantics beyond what the structured fields provide.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource — 'List every service the Log10x pipeline is watching, ranked by byte volume' — and enumerates the exact output columns (per-service share plus the four action-axis columns). An agent can distinguish it from siblings like log10x_top_patterns or log10x_savings without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly routes the agent to log10x_start when this is the first cost question of the session, and explains that when exception_services is supplied the downstream next_action points at log10x_pattern_mitigate rather than log10x_configure_engine. It gives clear context but does not contrast this tool against the other listing siblings (e.g., top_patterns) in the negative case.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_setup_recurringSet up recurring cost-reductionARead-onlyIdempotent
Conversational wizard that configures a scheduled cost-reduction tick (tenx-recur): each run clones the policy repo, recomputes the plan and pushes the changes. Walks the user through seven decisions: target services, savings target (%), tick schedule, scheduler runtime, gitops config repo, exception services, and final confirm, then emits two ready-to-commit artifacts: policy.yaml (the declarative policy the tick CLI consumes) and a scheduler manifest (Kubernetes CronJob YAML, GitHub Actions workflow, or crontab entry + wrapper script depending on the chosen scheduler). Each call merges the latest answer into the wizard session and either asks the next missing question or emits the artifacts once all answers are present. Re-invoke with the same session_id on every subsequent turn; sessions live 30 minutes. To skip interactive Q&A, supply all fields (target_services, target_percent, schedule, scheduler, config_plane, confirm: true) in a single call. Optional overrides: exceptions (services never touched), min_delta_pp (minimum savings delta before committing a new CSV, default 2pp), env_id, namespace, secret_name. Apply instructions for the chosen scheduler are in data.apply_instructions. After the first tick runs, call log10x_commitment_report to verify realized savings. REQUIRES nothing deployed to ASK: it renders manifests from the user's answers and writes to no account. The emitted tick needs a scheduler runtime (k8s CronJob, GitHub Actions, crontab, EventBridge, Container Apps job) and a policy repo or S3 prefix that the customer controls before it runs.
| Name | Required | Description | Default |
|---|---|---|---|
| env_id | No | Log10x environment ID. Auto-detected from LOG10X_ENV_ID when absent. | |
| confirm | No | Set to true to confirm the configuration and emit the artifacts. The wizard asks for confirmation interactively when omitted. | |
| schedule | No | Tick schedule. Presets: daily-03utc (default), every-6h, every-12h, every-24h-localtz. Or pass a raw 5-field cron expression (e.g. "0 5 * * 1"). | |
| namespace | No | Kubernetes namespace for the CronJob. Default: log10x. Only used when scheduler=k8s_cron. | |
| scheduler | No | Where the recurring tick runs. k8s_cron = Kubernetes CronJob (default when kubectl reachable), github_actions = GHA workflow, crontab = crontab + wrapper script, eventbridge = AWS-native (EventBridge Scheduler + CodeBuild, S3 config plane: no cluster, no GitHub; the fit for AWS serverless estates), container_apps_job = Azure-native (Container Apps scheduled Job, git config plane; the fit for Azure serverless estates). | |
| exceptions | No | Service names the policy must never touch (audit / regulatory / executive). Optional: defaults to empty. Pass [] to explicitly clear all exceptions. | |
| session_id | No | Wizard session handle. Omit on the first call: a new session is minted and returned. Pass it back unchanged on every subsequent call. | |
| secret_name | No | Name of the Kubernetes Secret holding LOG10X_API_KEY. Default: log10x-secret. Only used when scheduler=k8s_cron. | |
| config_plane | No | Where the recurring CLI reads policy.yaml and writes updated cap CSVs: a gitops repo URL (e.g. https://github.com/acme/log10x-config), a local path, or (required when scheduler=eventbridge) an S3 prefix (e.g. s3://acme-logs/log10x-config). | |
| min_delta_pp | No | Minimum change in savings percentage points required before the tick commits a new CSV. Default: 2. Set to 0 to commit on every tick. | |
| target_percent | No | Desired savings target, as a percentage of current log volume (1-95). Default: 30. The CLI's per-pattern planner works backward from this target. | |
| target_services | No | Services the policy targets. Empty array = all services. Use service names from `log10x_services`. The wizard asks if omitted. | |
| budget_gb_monthly | No | VOLUME BUDGET: keep monthly ingest for the targeted services at or under this many GB/mo. A standing line, not a one-shot cut: each tick scales the budget to its lookback window and cuts only the overage: already under budget means every pattern passes. Replaces target_percent in policy.yaml (mutually exclusive). Dollar budgets are a one-shot answer via log10x_estimate_savings (budget_usd_monthly); the recurring tick is byte-denominated. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds substantial context beyond the annotations: it clarifies that asking requires nothing deployed and "writes to no account" (reconciling cleanly with readOnlyHint=true), describes the per-call merge semantics of the wizard session, the 30-minute session lifetime, and the interactive-vs-batch confirmation behavior. No contradiction with the read-only/idempotent hints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core purpose, then layers session mechanics, batch mode, overrides, and prerequisites. It is dense and long with heavy parentheticals, but nearly every sentence carries actionable information; only minor trimming would help.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 13-parameter wizard with an output schema, this covers the session lifecycle, artifact emission, scheduler-specific behavior, and where apply instructions live (`data.apply_instructions`). Nothing an agent needs to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% so the baseline is 3, but the description adds genuine meaning: it identifies which six fields let the caller bypass the wizard, groups the optional overrides, and calls out defaults (min_delta_pp 2pp) and the target_percent/budget_gb_monthly mutual exclusivity. Some content is redundant with the schema, keeping it just below the top mark.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb+resource ("configures a scheduled cost-reduction tick") and enumerates the seven decisions it walks through, so an agent knows exactly what the tool produces. It also names adjacent tools (`log10x_commitment_report`, `log10x_estimate_savings`) and the artifacts (`policy.yaml`, scheduler manifest), clearly separating it from siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit operating instructions: re-invoke with the same `session_id` each turn, sessions live 30 minutes, and supply all six fields with `confirm: true` to skip Q&A. It also states prerequisites (scheduler runtime + customer-controlled policy repo/S3 prefix) and a follow-up step (call `log10x_commitment_report` after the first tick).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_siem_connectorEmit SIEM connector for an offload bucketARead-onlyIdempotent
Generate the customer-applied SIEM-side connector config (Datadog Forwarder Lambda, or the Splunk Add-on for AWS SQS-based S3 input) that makes a SIEM pull log10x's offload output from the customer's own S3 bucket. Call this when the user has offloaded a pattern's data to S3 (the offload action / a log10x_offload_add destination) and asks how to get Datadog or Splunk to ingest it, e.g. 'ship my offload bucket to Splunk' or 'wire Datadog to read these logs'. The MCP does not push offloaded events into a SIEM: the offload lands NDJSON in the customer's bucket, and this tool emits the pull-side connector the SIEM reads it with. Args: siem (required: datadog / splunk / both), bucket (required: the offload bucket), account_id (required), region (default us-east-1), prefix (optional, default app/), plus per-SIEM options (datadog_forwarder_arn, sqs_queue_name, sourcetype, index). Returns, per target: the discovery model, ordered setup steps, paste-ready terraform (an SNS fan-out plus IAM, and for Splunk the SQS queue and the S3-to-SNS-to-SQS notification), the SIEM-native config (the Splunk inputs.conf aws_sqs_based_s3 stanza), and verified caveats. Recipes are matched to log10x's offload output (uncompressed NDJSON, one event per line, Hive-partitioned keys) and encode the key gotcha: the offload bucket usually already notifies the 10x indexer's SQS, and S3 allows only one notification config per overlapping prefix, so both recipes fan out via SNS rather than a second raw bucket notification. Caveats: Datadog is logs-only (use log10x_backfill_metric for per-pattern metrics), and the Splunk SQS-based input collects only objects created after setup (backfill older data with a Generic S3 input). Read-only: it generates config and does not create AWS resources or mutate any env document.
| Name | Required | Description | Default |
|---|---|---|---|
| siem | Yes | Which SIEM should pull the offload: datadog (Forwarder Lambda), splunk (Add-on SQS-based S3 input), or both. | |
| index | No | Splunk index for the input. Default "main". | |
| bucket | Yes | The offload bucket the SIEM should read (where 10x writes the NDJSON). | |
| prefix | No | Offload key prefix the SIEM should watch. Default "app/". | |
| region | No | AWS region of the bucket. | us-east-1 |
| account_id | Yes | AWS account ID that owns the bucket (same account the SIEM connector runs in). | |
| sourcetype | No | Splunk sourcetype for the input. Default "log10x:offload". | |
| sqs_queue_name | No | Name for the SQS queue the Splunk input drains (splunk only). | |
| datadog_forwarder_arn | No | ARN of an already-deployed Datadog Forwarder Lambda (datadog only). Omit to leave a placeholder. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and openWorldHint=false, yet the description adds substantial context beyond them: it does not create AWS resources or mutate any env document, per-SIEM output contents, the SNS fan-out workaround for S3's single-notification-per-prefix limit, and caveats (Datadog logs-only, Splunk input only collecting newly created objects). This is rich, decision-relevant disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One dense block, but the information is front-loaded (purpose, then when-to-use, then args, returns, caveats) and every sentence is substantive for a tool this complex. It would be easier to scan with light formatting or line breaks between args/returns/caveats, and the arg restatement partly duplicates the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema and full annotations available, the description need only add context, and it does: it explains what gets generated per target, the discovery model and ordered steps, and the operational caveats an agent needs to set expectations. Nothing a caller needs is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3; the description still adds value by explaining per-SIEM option pairing (datadog_forwarder_arn for datadog, sqs_queue_name/sourcetype/index for splunk), the placeholder behavior when the forwarder ARN is omitted, and the meaning of bucket/prefix as the offload destination. It mostly restates documented params, so it lands just above baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: generates the customer-applied SIEM-side connector config (Datadog Forwarder Lambda / Splunk Add-on SQS-based S3 input) for pulling log10x offload output from S3. It explicitly contrasts itself with siblings, including log10x_backfill_metric and the offload action, so an agent can distinguish it without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit trigger conditions ('when the user has offloaded a pattern's data to S3 and asks how to get Datadog or Splunk to ingest it') plus concrete example utterances. It also states the negative boundary clearly ('The MCP does not push offloaded events into a SIEM') and routes metrics needs elsewhere (log10x_backfill_metric, Generic S3 input for older Splunk data).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_signin_completeSign in (complete)AIdempotent
Step 2 of the Log10x sign-in chain. Two mutually-exclusive paths controlled by which argument is passed. (a) { device_code: "<...>" }: finishes the browser flow that log10x_signin_start began. The model should call this AUTOMATICALLY right after log10x_signin_start returns, passing back the opaque device_code from that response unchanged. Polls Auth0's /oauth/token until the user confirms the device authorization in their browser, then exchanges the Auth0 access token for a long-lived Log10x API key. (b) { api_key: "<key>" }: pasted-key path, no browser. Validates the key against /api/v1/user and saves it. Pass exactly one of device_code or api_key; both or neither is rejected with a clear error. Either path writes the resolved API key to ~/.log10x/credentials (mode 0600), hot-reloads the MCP's env list in-process, and (if LOG10X_API_KEY is set in the host config and would override the new file) clears that env var in-process and tells the user to remove it from their host config to make the change permanent.
| Name | Required | Description | Default |
|---|---|---|---|
| api_key | No | Log10x API key to sign in with directly (no browser). Validated against /api/v1/user before saving. Use this when the user already has a key from console.log10x.com → Profile → API Settings, or when issued out-of-band by a workspace admin. Mutually exclusive with `device_code`. | |
| device_code | No | The opaque device_code returned by `log10x_signin_start`. Pass it back unchanged. The tool polls Auth0 for the access token, then exchanges it for a long-lived Log10x API key. Mutually exclusive with `api_key`. | |
| wait_seconds | No | Max seconds to poll for browser confirmation (only used when device_code is passed). Default 600. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare readOnlyHint=false, openWorldHint=true, idempotentHint=true. The description adds substantial behavior beyond that: polling Auth0's /oauth/token, token exchange for a long-lived key, writing credentials to ~/.log10x/credentials at mode 0600, in-process env hot-reload, and clearing an overriding LOG10X_API_KEY with a user instruction. That is a rich disclosure of side effects and auth mechanics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the chain position, then cleanly split into (a)/(b) paths with a closing statement of shared side effects. Dense and long for one paragraph, but nearly every clause carries distinct behavioral information rather than restating the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described; the description instead covers the things that matter for a stateful auth tool: which argument selects which flow, error on invalid argument combinations, and the persistent/hot-reload consequences. Nothing an agent needs to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3, but the description adds real value: it states the mutual-exclusion contract and its enforcement ('both or neither is rejected with a clear error'), and clarifies that device_code must be passed back unchanged and that wait_seconds only applies to the device_code path. This goes beyond the per-field schema text.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource (complete the Log10x sign-in) and immediately positions itself as 'Step 2 of the Log10x sign-in chain', explicitly naming the sibling log10x_signin_start it follows. The two-path structure (device_code vs api_key) makes the tool's scope unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-call guidance ('call this AUTOMATICALLY right after log10x_signin_start returns') and routes each path precisely: browser flow vs pasted-key. It also names the rejection condition ('pass exactly one... both or neither is rejected'), so there is no inference required.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_signin_startSign in (start browser flow)ARead-only
Step 1 of the Log10x browser sign-in chain. Call this for any of these phrasings: 'sign me up for Log10x', 'create a Log10x account', 'log me in to Log10x', 'set up my Log10x account', 'switch from demo to my own data'. Requests an Auth0 device code, opens the user's browser to auth.log10x.com with the user_code pre-embedded, and returns IMMEDIATELY (no polling). Response carries user_code, verification_uri_complete, and the opaque device_code. What the model MUST do after this returns: (1) show the user the user_code and verification_uri_complete so they can verify the code in their browser matches, then (2) AUTOMATICALLY call log10x_signin_complete with { device_code: "<the device_code from this response>" } as the next tool call. The user does NOT need to ask for that second step. For pasted-key sign-in instead of browser: skip this tool and call log10x_signin_complete directly with { api_key: "<key>" }.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the readOnly/openWorld/idempotent profile, and the description adds substantially more: it returns IMMEDIATELY with no polling, it opens the user's browser to auth.log10x.com with user_code pre-embedded, it returns user_code/verification_uri_complete/device_code, and it mandates the automatic follow-up call with the device_code. That is rich, non-obvious behavioral context an agent would otherwise have to guess.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the chain-step identity and well-organized into when-to-call, what-it-returns, and required-next-step sections. It is long, and the enumerated phrasing list plus bold emphasis is somewhat repetitive, but each section carries actionable information for a multi-step auth flow.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, yet the description still clarifies the immediate-return semantics and the mandatory second call, closing the loop between the two sibling tools. Nothing an agent needs to invoke this correctly or route the chain is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Zero input parameters, so the baseline is 4; there is nothing to disambiguate beyond the empty object schema. The description instead details response fields, which is useful but not parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (initiate the Log10x browser sign-in) and explicitly positions itself as 'Step 1 of the Log10x browser sign-in chain,' naming the sibling log10x_signin_complete as the follow-on step. An agent can distinguish it from signin_complete and login_status without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Lists the triggering phrasings ('sign me up', 'log me in', 'switch from demo to my own data') and gives an explicit exclusion + alternative: for pasted-key sign-in, skip this tool and call log10x_signin_complete directly. When-to-use, when-not-to-use, and the alternative are all stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_signoutSign outAIdempotent
Wipe the persistent credentials file at ~/.log10x/credentials and reload envs so subsequent calls fall back to demo mode (or whichever lower-priority configuration source picks up). Call this for: "sign me out of Log10x", "log out", "remove my Log10x credentials", "stop using my Log10x account", "go back to demo mode". Idempotent: running it without saved credentials is a no-op. Does NOT revoke the API key on the BE; the user must do that from console.log10x.com → Profile → API Settings if they want to invalidate the key everywhere (mirrors gh auth logout and aws sso logout). If the user has LOG10X_API_KEY set in their MCP host config, that env var will still be active after sign-out: the tool result will flag this so the LLM can tell the user to also unset it and restart.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare idempotentHint=true and readOnlyHint=false, and the description reinforces this with an explicit no-op guarantee plus context beyond the schema: the BE-side API key is NOT revoked, the user must do that in the console, and a lingering LOG10X_API_KEY env var will still be active and is flagged in the result. This is far richer than the structured fields alone.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Opens with the concrete action, then a bolded trigger list, then edge-case behavior in short declarative sentences. Each sentence carries distinct information (idempotency, non-revocation, env-var caveat) with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-format explanation is unnecessary, and the description still notes that the result flags a lingering env var. For a zero-parameter, idempotent auth tool, nothing an agent needs to call it correctly or warn the user is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes no parameters, which is the baseline-4 case; there is nothing for the description to disambiguate. The trigger-phrase list is about intent, not parameters, so no additional credit is warranted here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: wipes the credentials file at `~/.log10x/credentials` and reloads envs to fall back to demo mode. An agent can distinguish this from siblings like log10x_login_status or log10x_signin_start without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides an explicit 'Call this for' list of user phrasings ('sign me out', 'log out', 'remove my credentials', 'go back to demo mode'), which maps intent directly to the tool. It also states the boundary against alternatives by naming the higher-priority env-var source that survives sign-out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_startLog10x orientationARead-onlyIdempotent
CALL THIS FIRST whenever the user asks any open-ended cost question, says save X%, asks where do I start, what should I do, how can you help: before any other tool. Detects the customer's tier (Dev CLI / Reporter / Receiver / Retriever) via three live probes (gateway auth, Reporter metric counts, Retriever resolution), detects the SIEM, and returns a structured orientation envelope with three fields the agent follows: must_render_verbatim (markdown to show the user as is, without summarising), must_ask_user (a numbered question to ask before any follow-up tool call) and forbidden_next_actions (tools not to call until the user has picked an option). Also returns a 5-phase journey (Visibility → Attribution → Mitigation → Forensic → Commitment) showing where the customer is, an action menu gated by available capabilities (compact_installable, tier_down_available, offload_ready, forensic_query_available), and the resolved tier. The tool is read-only, takes an optional intent_hint (cost / forensic / install / orient), and is safe to call on any boot state: including when no env is configured yet (skips gateway/Reporter probes and treats the customer as Dev CLI tier). Accepts siem_lens (what-if destination): keeps the measured volumes, prices + gates for that destination at list rates, and stamps siem_actual vs siem_lens in the envelope.
| Name | Required | Description | Default |
|---|---|---|---|
| siem_lens | No | What-if destination lens: orient pricing/applicability for THIS destination while the pipeline keeps its actual one (the user's stack differs from the connected demo/env). Carry the same siem_lens onto cost_options / estimate_savings / top_patterns / savings calls that follow. | |
| intent_hint | No | Optional hint at what brought the user here. `cost` = wants to cut/save bill; `forensic` = wants to read back the offloaded cohort from the overflow bucket; `install` = wants to deploy; `orient` = first-time session, open-ended. When omitted, the tool treats it as `orient`. | |
| session_state | No | Optional caller hint at where the user is in the session. `fresh` (default when omitted) = first message of a new chat, emit the full orientation envelope. `midway` = the agent has already surfaced the orientation envelope this session and the user is mid-flow, emit a short "already oriented, proceeding" envelope. `returning` = treated as `fresh` because the menu / journey phase may have shifted since the last session. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint/idempotentHint/openWorldHint, but the description adds substantial context beyond them: it runs three live probes, is safe on any boot state including an unconfigured env (skips probes, assumes Dev CLI tier), and defines the envelope contract (must_render_verbatim, must_ask_user, forbidden_next_actions). It also explains the siem_lens what-if behavior and how siem_actual vs siem_lens are stamped. No contradiction with the read-only annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The critical directive ('CALL THIS FIRST') is front-loaded, and almost every clause carries real information (probes, tier detection, envelope fields, gating). It is dense and delivered as one long run-on paragraph with nested parentheses, which hurts scannability, but little content is genuinely wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex orchestrator that gates all downstream tool calls, the description covers edge cases (unconfigured env, session_state midway/returning) and the envelope contract. An output schema exists, yet the description still names the key return fields the agent must honor, so nothing needed to invoke and act on it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents all three enum parameters; the baseline is 3. The description adds genuine value on top by stating the default when intent_hint is omitted ('treated as orient') and by instructing the agent to carry siem_lens onto follow-up cost/forensic calls, which is cross-tool semantic guidance the schema does not provide.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific function: it orients a session by detecting tier via three live probes and the SIEM, then returns a structured orientation envelope. It clearly positions itself as the entry point ('CALL THIS FIRST ... before any other tool') and distinguishes itself from the many sibling analysis/action tools by being the read-only orientation step rather than a data query.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use triggers ('open-ended cost question', 'save X%', 'where do I start'), an explicit ordering rule ('before any other tool'), and exclusions via `forbidden_next_actions`. It also names the alternatives the agent should carry forward to (cost_options, estimate_savings, top_patterns, savings) and describes session_state fresh/midway/returning semantics, so routing is unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_top_patternsTop patternsARead-onlyIdempotent
Rank log patterns by byte volume and cost per pattern (bytes priced at the destination's $/GB rate when one is set), over a time range, for one service or all. Each row carries a trajectory badge (NEW, ACUTE, GROWING, STABLE or SHRINKING) read against 7, 14 and 21 day baselines. Use for "what is expensive right now", "what are the noisy patterns in this hour", "give me a snapshot of my loudest events". For "what changed this week" or "did the deploy add cost", use log10x_whats_changing, which ranks patterns by change against a comparison_window baseline. Can be scoped by service label. timeRange accepts free-form <n><m|h|d> durations (e.g., 48h, 3d, 15m): there's no enum snap. Pass include to choose which cohort to rank: kept (default, what the Receiver forwarded), dropped (the offloaded / overflow cohort alone), or both (total ingest pre-receiver). Use dropped for "what is the receiver throwing away" and both for an apples-to-apples pre/post comparison. Accepts siem_lens (what-if destination): keeps the measured volumes, prices + gates for that destination at list rates, and stamps siem_actual vs siem_lens in the envelope. REQUIRES Reporter-tier metrics. Before anything is deployed, the POC tools answer the same question from the user's own logs.
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | Output format. Always "summary": the structured JSON envelope with patterns, incidents, totals, and chained-tool action hints. Field retained for backward-compat with callers that still pass `view: "summary"`. | summary |
| limit | No | Number of patterns to return. Default 10. | |
| offset | No | Skip the first N patterns of the ranked result (for pagination). Default 0. | |
| include | No | Which engine-decision cohort to scope to. `kept` (default) = events the engine forwarded as-is (routeState!="drop"): the pre-PL-12 behavior. `dropped` = events stamped routeState="drop" by the engine (the offload/down-tier cohort). `both` = the pre-decision union; per-row output adds kept_bytes / dropped_bytes / dropped_share_pct. Use `dropped` to verify post-deploy realised savings or to answer "which patterns are we offloading right now". Use `both` to compute the offload share denominator in a single call. | kept |
| service | No | Service name to scope the result. Omit for all services. | |
| verbose | No | When true, every card carries the full forwarder snippet inline, every CTA renders unconditionally, and the volume-trend chart shows on every top-3 card. Default: compact mode (snippet templated once at top, CTAs gated to where they earn their line, chart only on ACUTE/NEW patterns). | |
| severity | No | Severity level to scope the result (e.g., `ERROR`, `CRITICAL`, `DEBUG`). | |
| siemScope | No | Ignored: the summary envelope carries no verbatim sample line. Accepted so existing callers still validate. | |
| siem_lens | No | What-if destination lens: keep the measured volumes, price the $/mo columns at this destination's default rates (env-configured rates never cross destinations). Envelope stamps siem_actual vs siem_lens. | |
| timeRange | No | Time range to aggregate over. Default 1h. | 1h |
| environment | No | Environment nickname (for multi-env setups). | |
| analyzerCost | No | DEPRECATED: use effective_ingest_per_gb. stack ingestion cost in $/GB. Auto-detected from profile if omitted. | |
| include_chart | No | Set include_chart=true to embed the rendered chart inline (large; default false to avoid response truncation). | |
| monthly_volume_gb | No | What-if volume lens (forecast mode): model the environment at THIS monthly volume (decimal GB/month) instead of its measured volume. The real per-pattern shares and pattern mix are held fixed; only absolute bytes and dollars scale, by one uniform factor. Use it to project a prospect onto their own scale, or to forecast a real env after growth. Pairs with siem_lens. This is a PROJECTION: the envelope stamps volume_actual_gb vs volume_projected_gb and the scale factor, and the note points at the POC for the caller real patterns. | |
| effective_ingest_per_gb | No | Customer-supplied $/GB rate used for the dollar overlay. When set, headline tags `rate_source=customer_supplied`. When absent, falls back to the destination default rate (`rate_source=list_price`; a list price only where the vendor sells logs per GB) or omits dollars entirely (`rate_source=unset`). |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover the safety profile (readOnly, idempotent, openWorld), but the description adds substantive behavior beyond them: the Reporter-tier metrics requirement, the siem_lens keep-volumes/price-at-destination behavior and siem_actual vs siem_lens envelope stamping, and the POC-tools fallback before deployment. These are real operational constraints not present in annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the purpose then routing, cohort, and lens guidance in logical order. It is dense and long, with a few clauses that restate schema descriptions (timeRange format appears in both), but nearly every sentence carries actionable information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema exists so return values needn't be explained. Given 15 parameters and the multi-mode nature (cost ranking, cohort scoping, siem lens, volume projection), the description covers the decision-relevant context, prerequisites, and alternatives thoroughly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds interpretive value beyond the schema: it explains the intent behind include=kept/dropped/both (e.g., use `dropped` for 'what is the receiver throwing away', `both` for a pre/post comparison) and clarifies that timeRange has no enum snap. Some text duplicates schema wording, holding it below 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (rank log patterns by byte volume and cost), the scope (time range, one service or all), and explicitly names the sibling it is not (log10x_whats_changing) with the condition that selects it. An agent can disambiguate from siblings without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit when-to-use examples ('what is expensive right now', 'noisy patterns this hour'), an explicit when-not with the named alternative (log10x_whats_changing for 'what changed this week'/'did the deploy add cost'), plus cohort-selection guidance for include=kept/dropped/both and the siem_lens what-if path.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_whats_changingWhat's changing: patterns ranked by delta vs baselineARead-onlyIdempotent
Patterns ranked by delta vs a baseline window: the "what grew (or shrank) the most since X" question. Distinct from log10x_top_patterns which ranks by current cost; this tool ranks by delta and applies gates (min_delta_usd, min_delta_contribution_pct) that drop noise-level changes. comparison_window: "auto" (default) averages three offsets (1×, 2×, 3× the timeRange) for noise smoothing; specific offsets like "7d" compare to a single anchor, e.g. {timeRange: "1d", comparison_window: "1d"} is today vs yesterday (deploy-delta), {timeRange: "7d", comparison_window: "7d"} is this week vs last week. Brand-new patterns (no baseline samples) are EXCLUDED: they go to log10x_whats_new for clean separation of stories. Use for "what grew most this week", "which patterns regressed after the deploy", "what's driving cost up since yesterday". Returns patterns with per-row delta_usd, baseline_usd, current_usd, delta_pct, and a flag for whether each row crossed the contribution gate.
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | Output format. `summary` returns the structured envelope; `markdown` returns a rendered table. | summary |
| limit | No | Max patterns to return. Default 10. | |
| service | No | Service name to scope the result. Omit for all services. | |
| severity | No | Severity level to scope (e.g. `ERROR`, `CRITICAL`). | |
| timeRange | No | Current window to evaluate. Day-level only: delta math requires day-aligned baseline offsets. For sub-day spike investigation use `log10x_pattern_trend` or `log10x_investigate`. | 7d |
| environment | No | Environment nickname (for multi-env setups). | |
| analyzerCost | No | SIEM ingestion cost in $/GB. Auto-detected from profile if omitted. | |
| min_delta_usd | No | Dollar floor for delta. Rows with delta < min_delta_usd are dropped. Default $500/wk scaled to the selected timeRange window. Set to 0 to disable. | |
| comparison_window | No | Baseline window to compare against. `"auto"` (default) averages three offsets (1×, 2×, 3× the timeRange) for noise smoothing. A specific offset like `"7d"` compares to that single anchor: e.g. `{timeRange: "1d", comparison_window: "1d"}` = today vs yesterday (deploy-delta); `{timeRange: "7d", comparison_window: "7d"}` = this week vs last week. | auto |
| min_delta_contribution_pct | No | Contribution gate as a percentage. A row's delta must be at least this fraction of total positive delta to be surfaced. Default 5. Set to 0 to disable. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnly/idempotent/openWorld annotations, the description discloses real behavior: noise-level deltas are dropped by gates, brand-new patterns are EXCLUDED and shunted elsewhere, and each returned row carries delta_usd/baseline_usd/current_usd/delta_pct plus a gate-crossed flag. It does not contradict the annotations; it mainly stops short of describing pagination/ordering beyond `limit`.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Dense but front-loaded: the core ranking semantics and sibling distinction come first, then gates, then window semantics, then use cases. Slightly long with some duplication of the schema's window examples, but nearly every sentence carries routing or behavioral value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 10-param, 0-required read tool with an output schema and safety annotations, the description covers the decision-relevant gaps: what it ranks, how it differs from siblings, gating behavior, and where excluded patterns go. Nothing an agent needs to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all ten parameters are already documented. The description's treatment of `comparison_window` (auto = averaged offsets vs single anchor) and `timeRange` is nearly verbatim from the schema, so it adds little beyond repetition. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource with a precise ranking semantics: patterns ranked by delta vs a baseline window. It explicitly distinguishes itself from `log10x_top_patterns` (ranks by current cost) and `log10x_whats_new` (brand-new patterns), so an agent can pick it apart from siblings without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Names concrete when-to-use triggers ("what grew most this week", "which patterns regressed after the deploy", "what's driving cost up since yesterday") and routes excluded cases explicitly to `log10x_whats_new`, plus sub-day work to `log10x_pattern_trend`/`log10x_investigate` via the schema. Both positive and negative routing are covered.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_whats_newWhat's new: patterns by first_seen recencyARead-onlyIdempotent
Patterns whose first_seen timestamp falls inside a recency window: the "what showed up recently" question. Distinct from log10x_top_patterns (current cost ranking) and log10x_whats_changing (delta vs baseline). New patterns have no baseline, so delta math is meaningless; this tool exists so they get a clean home and don't pollute the changing-vs-baseline surface. Implementation: queries bytes_per_pattern in the current timeRange window to find candidate hashes, then for each hash queries the 30-day history to find the earliest non-zero datapoint via fetchFirstSeenBatch. A pattern is "new" when its first_seen timestamp is younger than first_seen_within (default 1d). Default sort: by first_seen recency descending (most recent first). Use first_seen_within: "1h" for incident triage, "1d" for daily-deploy review, "7d"+ for weekly observability hygiene. Returns patterns with first_seen, age, cost_now_usd, bytes_now, events_now, and the service + severity attribution. An engine upgrade that changes the naming rules renames the patterns it affects once, so the first windows after it list those patterns here as new, first seen from the upgrade on.
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | Output format. | summary |
| limit | No | Max patterns to return. Default 10. | |
| service | No | Service name to scope the result. Omit for all services. | |
| severity | No | Severity level to scope (e.g. `ERROR`, `CRITICAL`). | |
| timeRange | No | Time range used to score current cost. Default 1h. | 1h |
| environment | No | Environment nickname (for multi-env setups). | |
| analyzerCost | No | SIEM ingestion cost in $/GB. Auto-detected from profile if omitted. | |
| first_seen_within | No | Patterns whose first-seen timestamp is younger than this are "new." Default `1d`. Use `1h` for incident triage, `1d` for daily-deploy review, `7d`+ for weekly observability hygiene. | 1d |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint/idempotentHint/openWorldHint, so safety is covered. Beyond that, the description adds real behavioral context: the query strategy (candidate hashes from bytes_per_pattern, then 30-day history via fetchFirstSeenBatch) and, most valuably, the engine-upgrade caveat that renamed patterns will appear as 'new' once. That caveat is a genuine gotcha not derivable from structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose, sibling differentiation, and the triage/review usage mapping are front-loaded before the implementation detail. It is a single dense paragraph and the fetchFirstSeenBatch internal is arguably expendable, but nearly every sentence carries actionable information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
All eight parameters are covered by the schema, an output schema exists, and the description still supplies selection guidance, newness definition, default sort, and edge-case behavior. An agent has everything needed to call and interpret this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter is already documented, including the `first_seen_within` triage/review/hygiene guidance the description repeats. The description clarifies the definition of 'new' and the default sort, but adds little parameter meaning beyond the schema, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific resource and scope ("patterns whose first_seen timestamp falls inside a recency window") and explicitly names the two siblings it is not (`log10x_top_patterns`, `log10x_whats_changing`), with the reason for the split. An agent can distinguish it from alternatives without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use mapping: `first_seen_within: "1h"` for incident triage, `"1d"` for daily-deploy review, `"7d"+` for weekly hygiene. It also explains when NOT to use it (new patterns have no baseline, so delta math is meaningless), routing those cases to the delta sibling.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
40 tool updates
v1.30.8- Changed
log10x_advise_install12 fields changed- changed
Input schema / properties / airgapped / descriptionPrevious value: -"When true, the Log10x agents send nothing to log10x.com — engine metrics, license re-validation, and update checks all go silent. Use to reduce CISO friction. Conflicts with `\"log10x\"` in `backends` (the wizard surfaces the conflict). **Demo licenses cannot actually run airgapped** — the engine downgrades to online mode with a warning. The wizard surfaces this softly when both are picked."New value: +"When true, the Log10x agents send nothing to log10x.com: engine metrics, license re-validation, and update checks all go silent. Use to reduce CISO friction. Conflicts with `\"log10x\"` in `backends` (the wizard surfaces the conflict). **Demo licenses cannot actually run airgapped**: the engine downgrades to online mode with a warning. The wizard surfaces this softly when both are picked." - changed
Input schema / properties / backend_credentials / descriptionPrevious value: -"Per-backend credential configuration, keyed by backend kind (must be one of: log10x, datadog, elastic, cloudwatch, prometheus). **Only set for non-`log10x` backends** — `log10x` SaaS uses the license JWT and needs no extra credentials. Each entry has a `secretName` (the Kubernetes Secret the user creates out-of-band holding sensitive env vars like `DD_API_KEY`; default per backend is `<backend>-credentials`) and optional `plainValues` (overrides for non-sensitive env vars like `DD_SITE`). Example: `{ \"datadog\": { \"secretName\": \"datadog-secret\", \"plainValues\": { \"DD_SITE\": \"us5.datadoghq.com\" } } }`."New value: +"Per-backend credential configuration, keyed by backend kind (one of: datadog, elastic, cloudwatch, prometheus; `log10x` needs none, since it authenticates with the licence JWT). Each entry has a `secretName` (the Kubernetes Secret the user creates out-of-band holding sensitive env vars like `DD_API_KEY`; default per backend is `<backend>-credentials`) and optional `plainValues` (overrides for non-sensitive env vars like `DD_SITE`). Example: `{ \"datadog\": { \"secretName\": \"datadog-secret\", \"plainValues\": { \"DD_SITE\": \"us5.datadoghq.com\" } } }`." - changed
Input schema / properties / backends / descriptionPrevious value: -"Where the engine emits TenXSummary metrics. Multi-destination — a user can report to log10x SaaS AND their own backend simultaneously, e.g. `[\"log10x\", \"datadog\"]`. Choices: **log10x** (optional Log10x-hosted backend, for evaluation), **datadog**, **elastic**, **cloudwatch**, **prometheus** (customer-owned). The wizard pre-fills detected backends from the snapshot. The only mutual exclusion is `airgapped: true` + `\"log10x\"` in this list."New value: +"Where the engine emits TenXSummary metrics: the user's own TSDB(s), one or more of **prometheus**, **datadog**, **elastic**, **cloudwatch**. When omitted, the wizard asks, listing any backend whose agent discovery detected first. **log10x** (the Log10x-hosted TSDB) is for the public demo, not customer installs: it is never suggested, and is accepted only when the user explicitly asks for it. It then needs a user licence (`license_source: \"signin\"` or `\"paste\"`); on the default built-in evaluation licence it receives nothing. `airgapped: true` + `\"log10x\"` is rejected." - added
Input schema / properties / fleet_defaultAdded value: +{ + "additionalProperties": false, + "description": "The fleet default for a Datadog Receiver plan (with `log_destination: \"datadog\"`). The Receiver values are written only on an engine release that reads `rateReceiverDefaultAction`.", + "properties": { + "action": { + "description": "Where a statement above the fleet limit goes: `tier_down` (Flex, the default where the account has Flex) or `offload` (S3).", + "enum": [ + "tier_down", + "offload" + ], + "type": "string" + }, + "cap_bytes_per_window_per_node": { + "description": "The limit in the engine's unit, as `log10x_configure_engine` or `log10x_poc_from_local` with `fleet_default` returns it (`fleet_default.cap_bytes_per_window_per_node`). Without it the plan writes no fleet default.", + "exclusiveMinimum": 0, + "type": "number" + }, + "error_floor": { + "description": "Share of ERROR and CRITICAL lines above the limit that stay in Standard. Default 0.5 with offload, 0 with tier_down.", + "maximum": 1, + "minimum": 0, + "type": "number" + } + }, + "type": "object" +} - added
Input schema / properties / k8s_team_labelAdded value: +{ + "description": "A pod label key whose value names the owning team (e.g. `team`). Receiver plans write `k8sTeamLabel` with it, on an engine release that reads that option, so the metrics carry `tenx_team`.", + "type": "string" +} - changed
Input schema / properties / license_jwt_paste / descriptionPrevious value: -"License JWT supplied by the user when `license_source: \"paste\"`. Mints from `POST /api/v1/license` (signed-in) or `POST /api/v1/license/demo` (anonymous). Maps to the chart's license Secret."New value: +"License JWT supplied by the user when `license_source: \"paste\"` (passing it alone implies `paste`). Minted from `POST /api/v1/license` (signed-in) or `POST /api/v1/license/demo` (anonymous). Maps to the chart's license Secret." - removed
Input schema / properties / license_source / defaultRemoved value: -"signin" - changed
Input schema / properties / license_source / descriptionPrevious value: -"How the wizard should acquire the engine's license JWT. **Defaults to `\"signin\"`** when omitted — the wizard tries to mint a user-scoped license via the user's Auth0 session, and emits `signin_required` mode (chain through `log10x_signin_start` then re-invoke) when no session exists. Pass **`\"demo\"`** ONLY when the user explicitly asks for a quick 14-day anonymous demo (transient, can't run airgapped). Pass **`\"paste\"`** with `license_jwt_paste: \"<jwt>\"` when the user already has a JWT."New value: +"How the engine is licensed. **Defaults to `\"builtin\"`** when omitted: the plan carries no licence and the engine runs its built-in evaluation licence (10 nodes, 30 days from each start, airgapped). Nothing is minted or stored, and no licence Secret is created. Pass **`\"signin\"`** when the user wants their own user-scoped licence: the wizard mints it via the user's Auth0 session and emits `signin_required` mode (chain through `log10x_signin_start`, then re-invoke) when no session exists. Pass **`\"paste\"`** with `license_jwt_paste: \"<jwt>\"` when the user already has a JWT. Pass **`\"demo\"`** only when the user explicitly asks for the anonymous 1-node, 14-day demo JWT. Every choice other than `builtin` adds a step that creates the licence Secret. Omitting this arg on a later call keeps the earlier choice." - changed
Input schema / properties / license_source / enumPrevious value: -[ - "signin", - "demo", - "paste" -]New value: +[ + "builtin", + "signin", + "demo", + "paste" +] - added
Input schema / properties / log_destinationAdded value: +{ + "description": "Where the forwarder ships the log events (not the metrics; `backends` is the metrics). `datadog` adds the step after the POC to a Receiver plan: the fleet default for every service the POC report gives no rule, with the Flex index and its `@routeState:tier_down` filter (or the S3 branch for offload), the always-pass sample, and what an error monitor sees.", + "enum": [ + "datadog" + ], + "type": "string" +} - changed
Input schema / properties / snapshot_id / descriptionPrevious value: -"ID returned by `log10x_discover_env`. The snapshot is cached for 30 min."New value: +"ID returned by `log10x_discover_env`, and the one arg the wizard cannot infer. The snapshot is cached for 30 min. Call `log10x_discover_env` first when there is no snapshot yet." - removed
Input schema / requiredRemoved value: -[ - "snapshot_id" -]
- Changed
log10x_advise_retriever13 fields changed- added
Input schema / properties / aks_cluster_nameAdded value: +{ + "description": "AKS cluster the release installs into (azure only). Used by the provisioning command (`--create-aks` for a new cluster) and by the `az aks get-credentials` step that points kubectl at it.", + "type": "string" +} - added
Input schema / properties / azure_client_idAdded value: +{ + "description": "Client id of the user-assigned managed identity federated to the release ServiceAccount (azure only). The provisioning script writes it into the values file it produces, under `storage.azure.auth.clientId`.", + "type": "string" +} - added
Input schema / properties / azure_queuesAdded value: +{ + "additionalProperties": false, + "description": "Azure Storage Queue names on the storage account (azure only). Default: tenx-index / tenx-query / tenx-subquery / tenx-stream, matching the provisioning script.", + "properties": { + "index": { + "type": "string" + }, + "query": { + "type": "string" + }, + "stream": { + "type": "string" + }, + "subquery": { + "type": "string" + } + }, + "type": "object" +} - added
Input schema / properties / azure_tenant_idAdded value: +{ + "description": "Entra tenant id (azure only). The provisioning script writes it into the values file it produces, under `storage.azure.auth.tenantId`.", + "type": "string" +} - added
Input schema / properties / index_containerAdded value: +{ + "description": "Blob path for indexed results (azure only), as `account/container/path`. Default: `<storage_account>/tenx-index/tenx`.", + "type": "string" +} - added
Input schema / properties / input_containerAdded value: +{ + "description": "Azure Blob container holding source logs (azure only). Bare container name, e.g. `logs`.", + "type": "string" +} - removed
Input schema / properties / license_source / defaultRemoved value: -"signin" - changed
Input schema / properties / license_source / descriptionPrevious value: -"How the wizard acquires the engine license JWT. Defaults to `\"signin\"` — emits `signin_required` mode when no Auth0 session exists. Pass `\"demo\"` for a 14-day anonymous JWT. Pass `\"paste\"` with `license_jwt_paste` to supply an existing JWT."New value: +"How the engine is licensed. Defaults to `\"builtin\"`: nothing is minted and no key is written, and the engine runs its built-in evaluation licence (10 nodes, 30 days from each start, airgapped). Pass `\"paste\"` with `license_jwt_paste` to wire a licence you hold into the values file. `\"signin\"` mints a user-scoped JWT (emits `signin_required` when no Auth0 session exists) and `\"demo\"` mints a 1-node, 14-day JWT; a minted JWT is never written to disk, so it is supplied at install time with `--set-string`. Omitting this arg on a later call keeps the earlier choice." - changed
Input schema / properties / license_source / enumPrevious value: -[ - "signin", - "demo", - "paste" -]New value: +[ + "builtin", + "signin", + "demo", + "paste" +] - added
Input schema / properties / locationAdded value: +{ + "description": "Azure region for the provisioning command, e.g. `eastus` (azure only).", + "type": "string" +} - added
Input schema / properties / resource_groupAdded value: +{ + "description": "Azure resource group for the provisioning command and the teardown (azure only).", + "type": "string" +} - added
Input schema / properties / storage_accountAdded value: +{ + "description": "Azure storage account holding the input and index containers (azure only). Flat namespace only: a hierarchical-namespace account reorders listings and is refused by the engine at construction.", + "type": "string" +} - added
Input schema / properties / storage_providerAdded value: +{ + "description": "Which object store the Retriever reads. **aws** (default) = S3 buckets, four SQS queues, IRSA. **azure** = Azure Blob containers, four Azure Storage Queues, AKS workload identity, behind the chart's `storage.provider: azure` block. Auto-selected as \"azure\" when the resolved env-config offload destination has type `azure_blob`. Azure is read and index side: the Retriever indexes and queries blobs already in the container, and forwarder offload recipes stay S3-shaped.", + "enum": [ + "aws", + "azure" + ], + "type": "string" +}
- Changed
log10x_baseline1 field changed- changed
Input schema / properties / view / descriptionPrevious value: -"Output format. Always \"summary\" — the typed envelope. Field retained for backward-compat with callers that still pass `view: \"summary\"`."New value: +"Output format. Always \"summary\": the typed envelope. Field retained for backward-compat with callers that still pass `view: \"summary\"`."
- Changed
log10x_commitment_report1 field changed- changed
Input schema / properties / service / descriptionPrevious value: -"Service name to resolve a commitment by — used when commitment_id is omitted. When both are present, commitment_id wins."New value: +"Service name to resolve a commitment by: used when commitment_id is omitted. When both are present, commitment_id wins."
- Changed
log10x_compile5 fields changed- changed
Input schema / properties / github_branch / descriptionPrevious value: -"Branch to pull for ALL github_repos. Omit to pull each repo’s default branch."New value: +"Branch to pull for ALL github_repos. Omit to pull each repo's default branch." - changed
Input schema / properties / max_wait_ms / descriptionPrevious value: -"How long to wait inline (ms) for the compile to finish before handing back a job_id to poll. Default 45,000 (45s): small compiles and re-runs (which reuse prior units) finish inside this and return the library + diagnostics in ONE call. A long first compile of a large tree returns a running job_id you poll with log10x_compile_status, or just call this tool again later, since the output is pinned and a finished run is collected near-instantly. 0 = fire-and-forget (return the job_id immediately)."New value: +"How long to wait inline (ms) for the compile to finish before handing back a job_id to poll. Default 45,000 (45s): small compiles, and re-runs over unchanged local sources (the engine skips files whose checksum already has a unit), finish inside this and return the library + diagnostics in ONE call. A long first compile returns a running job_id to poll with log10x_compile_status; calling this tool again with the same arguments joins the running job instead of starting a second one. Re-runs that pull remote sources are not instant: GitHub, images and Artifactory are re-checked remotely each run and Helm charts re-rendered. 0 = fire-and-forget (return the job_id immediately)." - changed
Input schema / properties / mode / descriptionPrevious value: -"Execution backend. `auto` (default) prefers Docker (the compiler image, guaranteed compiler flavor) and falls back to a local compiler-flavor tenx. `docker` forces the image (LOG10X_COMPILER_IMAGE or LOG10X_TENX_IMAGE, default log10x/compiler-10x:1.1.39, a pinned tag rather than :latest so the same sources compile through the same engine every time). `local` forces the binary (LOG10X_TENX_PATH or `tenx` on PATH) and refuses it unless its version banner reports the compiler flavor (`compiler`, or `cloud` on an engine built before the flavor rename). Of the three shipped flavors only `compiler` can compile: `runtime` (native binary) and `runtime-jvm` (JVM-packaged runtime, the only runtime available on Windows) are both refused, since neither carries the `generate` pipeline unit. With a local install, local-folder compilation and GitHub pull (REST API + token) work out of the box; docker_images pull additionally needs a container engine (podman or docker) on the host. The docker `compiler-10x` image bundles all of those (podman included, daemonless), which is why Docker is the default."New value: +"Execution backend. `auto` (default) prefers Docker (the compiler image, guaranteed compiler flavor) and falls back to a local compiler-flavor tenx; the backend is chosen once, before the output folder is keyed. `docker` forces the image (LOG10X_COMPILER_IMAGE or LOG10X_TENX_IMAGE, default log10x/compiler-10x:1.1.136 pinned by digest, so every run goes through the same compiler). `local` forces the binary (LOG10X_TENX_PATH or `tenx` on PATH) and refuses it unless its version banner reports the compiler flavor (`compiler`, or `cloud` on an engine built before the flavor rename). Of the three shipped flavors only `compiler` can compile: `runtime` (native binary) and `runtime-jvm` (JVM-packaged runtime, the only runtime available on Windows) are both refused, since neither carries the `generate` pipeline unit. With a local install, local-folder compilation and GitHub pull (REST API + token) work out of the box; docker_images pull additionally needs a container engine (podman or docker) on the host. The docker `compiler-10x` image bundles all of those (podman included, daemonless), which is why Docker is the default." - changed
Input schema / properties / source_path / descriptionPrevious value: -"Absolute path to a local folder of source code / binaries to scan. The compiler recursively traverses it for supported languages (Java, Go, Python, JS/TS, Scala, C/C++, C#) and binaries. Note: .jar files are not scanned directly; provide extracted .class files. Optional when github_repos is given; at least one source (source_path and/or github_repos) is required."New value: +"Absolute path to a local folder of source code / binaries to scan, traversed recursively. Parsed with a grammar or AST: Java, Scala, Python, Go, C/C++, C#, JavaScript, TypeScript (.ts; .tsx goes through the text scanner), Rust, and JVM .class bytecode. Other languages in the pattern scanner's file list (Kotlin, Ruby, PHP, Lua, Groovy, Swift, bash) get quoted-string extraction only. Archives (.jar, .war, .ear, .zip, .gz, .tar and compressed tarballs) are expanded and their entries scanned; .json/.yaml/.xml/.properties/.csv/.txt and similar config/text files go through the text scanner; .so/.dylib (and .dll on Windows hosts) through `strings`. Optional when any other source is given; at least one source (source_path, github_repos, docker_images, helm_charts, or artifactory_instance + artifactory_repo) is required." - changed
Input schema / properties / timeout_ms / descriptionPrevious value: -"Hard cap on compile wall time in milliseconds. Default 1,800,000 (30 min). The first compile of a large codebase typically runs 10–30 min; subsequent runs are near-instant via checksum reuse."New value: +"Hard cap on compile wall time in milliseconds. Default 1,800,000 (30 min). The engine's own whole-scan cap (scanOperationTimeout, bundled default 10 min) is raised to 90% of this value on the command line, so the engine cap follows this value (needs compiler 1.1.89+; the pinned default is 1.1.136; an older local engine keeps its 10 min cap). A re-run over unchanged local sources skips every file whose checksum already has a unit and finishes in seconds. Pulled sources (GitHub, images, Artifactory) are re-checked remotely each run and downloaded again only when the remote changed; Helm charts are rendered again every run."
- Changed
log10x_compile_link1 field changed- changed
Input schema / properties / mode / descriptionPrevious value: -"Execution backend, same contract as log10x_compile: `auto` prefers the compiler image, `docker` forces it, `local` uses a compiler-flavor tenx (an engine built before the flavor rename reports that flavor as `cloud`; both are accepted). Both runtime flavors are refused, `runtime` (native binary) and `runtime-jvm` (JVM-packaged, the only runtime on Windows), neither carries the `generate` pipeline unit."New value: +"Execution backend, same contract as log10x_compile's `mode`: `auto` prefers the compiler image, `docker` forces it, `local` uses a compiler-flavor tenx. Only the compiler flavor can link; see log10x_compile `mode` for the three flavors and which are refused."
- Changed
log10x_compile_status2 fields changed- changed
Input schema / properties / log_lines / descriptionPrevious value: -"How many trailing engine-log lines to include in data.payload.log_tail (credential-redacted). 0 to omit. Raise it when diagnosing a failed run."New value: +"How many trailing engine-log lines to include in data.payload.log_tail (credential-redacted). 0 to omit. Raise it when diagnosing a failed or incomplete run." - changed
Input schema / properties / view / descriptionPrevious value: -"summary returns the typed envelope (data.payload.job_status, .diagnostics, .output, .log_tail)."New value: +"summary returns the typed envelope (data.payload.job_status, .loss_markers, .diagnostics, .output, .log_tail)."
- Changed
log10x_cost_options1 field changed- changed
Input schema / properties / destination / descriptionPrevious value: -"Destination stack. When set, routes_to.args carries THIS destination forward to estimate_savings — overrides the env-auto-detected SIEM. Pass when the upstream tool (baseline / configure_engine) already established a destination that differs from the env default; without it, cost_options falls back to siem_detected and routes_to may carry a destination the upstream chain did not pick."New value: +"Destination stack. When set, routes_to.args carries THIS destination forward to estimate_savings: overrides the env-auto-detected SIEM. Pass when the upstream tool (baseline / configure_engine) already established a destination that differs from the env default; without it, cost_options falls back to siem_detected and routes_to may carry a destination the upstream chain did not pick."
- Changed
log10x_customer_metrics_query1 field changed- changed
Input schema / properties / start / descriptionPrevious value: -"Start of the range window — ISO8601 or UNIX seconds. Required when mode=range."New value: +"Start of the range window: ISO8601 or UNIX seconds. Required when mode=range."
- Added
log10x_datadog_change_report - Changed
log10x_dependency_check1 field changed- changed
Input schema / properties / vendor / descriptionPrevious value: -"SIEM vendor to scan. Omit to auto-detect from ambient credentials (DD_API_KEY+DD_APP_KEY → datadog; SPLUNK_HOST+SPLUNK_TOKEN → splunk; ELASTIC_URL → elasticsearch; AWS chain → cloudwatch). When multiple SIEMs are configured, the tool returns an \"ambiguous\" error listing them — pass vendor= to disambiguate. When the resolved SIEM has live credentials the scan runs in-process and returns actual dashboard/alert/saved-search names + URLs; otherwise the tool falls back to a paste-ready bash command."New value: +"SIEM vendor to scan. Omit to auto-detect from ambient credentials (DD_API_KEY+DD_APP_KEY → datadog; SPLUNK_HOST+SPLUNK_TOKEN → splunk; ELASTIC_URL → elasticsearch; AWS chain → cloudwatch). When multiple SIEMs are configured, the tool returns an \"ambiguous\" error listing them: pass vendor= to disambiguate. When the resolved SIEM has live credentials the scan runs in-process and returns actual dashboard/alert/saved-search names + URLs; otherwise the tool falls back to a paste-ready bash command."
- Changed
log10x_discover_join1 field changed- changed
Input schema / properties / window / descriptionPrevious value: -"Time window for label value enumeration (e.g., \"10m\", \"1h\", \"30m\"). When set, both the Log10x and customer backends are queried with [now - window, now] filtering, excluding stale label values from series that stopped emitting samples. CRITICAL for environments with historical replay data, decommissioned pods, or otherwise orphan label values — stale values drag Jaccard down and cause false `no_join_available` refusals. Recommended: \"10m\" for steady-state clusters, \"1h\" for bursty traffic. Omit to include all-time values (default Prometheus behavior). Alias: `timeRange`."New value: +"Time window for label value enumeration (e.g., \"10m\", \"1h\", \"30m\"). When set, both the Log10x and customer backends are queried with [now - window, now] filtering, excluding stale label values from series that stopped emitting samples. CRITICAL for environments with historical replay data, decommissioned pods, or otherwise orphan label values: stale values drag Jaccard down and cause false `no_join_available` refusals. Recommended: \"10m\" for steady-state clusters, \"1h\" for bursty traffic. Omit to include all-time values (default Prometheus behavior). Alias: `timeRange`."
- Changed
log10x_emit_sample_plan4 fields changed- changed
Input schema / properties / scope / descriptionPrevious value: -"Analyzer-native scope. CloudWatch: log group name or prefix (`/aws/ecs/*` — the asterisks are stripped, CloudWatch matches on prefix). Splunk: index name. Elasticsearch / OpenSearch: index pattern (default `logs-*`). Datadog: index name. Omitted means everything the credentials can read."New value: +"Analyzer-native scope. CloudWatch: log group name or prefix (`/aws/ecs/*`, the asterisks are stripped, CloudWatch matches on prefix). Splunk: index name. Elasticsearch / OpenSearch: index pattern (default `logs-*`). Datadog: index name. Omitted means everything the credentials can read." - changed
Input schema / properties / siem / descriptionPrevious value: -"Which log analyzer to export the sample from. One script per analyzer: `cloudwatch` (aws CLI: DescribeLogGroups + FilterLogEvents), `splunk` (search/jobs/export), `elasticsearch` and `opensearch` (_cat/indices + _search), `datadog` (v2 logs search). ClickHouse, Azure Monitor, Coralogix, GCP Logging and Sumo Logic are follow-up work — for those, export plain text yourself, one log message per line, and run the POC over it."New value: +"Which log analyzer to export the sample from. One script per analyzer: `cloudwatch` (aws CLI: DescribeLogGroups + FilterLogEvents), `splunk` (search/jobs/export), `elasticsearch` and `opensearch` (_cat/indices + _search), `datadog` (v2 logs search). ClickHouse, Azure Monitor, Coralogix, GCP Logging and Sumo Logic are follow-up work: for those, export plain text yourself, one log message per line, and run the POC over it." - changed
Input schema / properties / target_event_count / descriptionPrevious value: -"Target event count for the export. Default 1,000,000 (~500 MB at 500 B average) — the same default `log10x_poc_from_siem` uses, so a fenced POC and a credentialed one see samples of the same size. Lower it when the export has to fit a laptop or a coffee break."New value: +"Target event count for the export. Default 1,000,000 (~500 MB at 500 B average): the same default `log10x_poc_from_siem` uses, so a fenced POC and a credentialed one see samples of the same size. Lower it when the export has to fit a laptop or a coffee break." - changed
Input schema / properties / window / descriptionPrevious value: -"How far back to sample. Accepts `1h`, `24h`, `7d`, `14d`, `30d`. Default `14d`, matching `log10x_poc_from_siem` — a wide window is what makes first-seen, growth and stable-versus-new readable at all."New value: +"How far back to sample. Accepts `1h`, `24h`, `7d`, `14d`, `30d`. Default `14d`, matching `log10x_poc_from_siem`: a wide window is what makes first-seen, growth and stable-versus-new readable at all."
- Changed
log10x_env_diff_vs_envvars1 field changed- changed
Input schema / properties / env_id / descriptionPrevious value: -"Env identifier — either the `env_id` UUID or the `nickname` from the env-config document. Resolved by walking the store chain (k8s → aws_ssm → gcp_sm → azure_ac → local)."New value: +"Env identifier: either the `env_id` UUID or the `nickname` from the env-config document. Resolved by walking the store chain (k8s → aws_ssm → gcp_sm → azure_ac → local)."
- Changed
log10x_env_validate1 field changed- changed
Input schema / properties / env_id / descriptionPrevious value: -"Env identifier — either the `env_id` UUID or the `nickname` from the env-config document. Resolved by walking the store chain (k8s → aws_ssm → gcp_sm → azure_ac → local)."New value: +"Env identifier: either the `env_id` UUID or the `nickname` from the env-config document. Resolved by walking the store chain (k8s → aws_ssm → gcp_sm → azure_ac → local)."
- Changed
log10x_estimate_savings13 fields changed- changed
Input schema / properties / budget_gb_monthly / descriptionPrevious value: -"forecast mode: VOLUME BUDGET — keep monthly ingest toward the destination at or under this many GB/mo. BYTE accounting: tier_down keeps every byte in the destination, so it cannot serve this target and is excluded from the ladder (compact only where it lands on the billed wire, then offload with the retriever, then lossy on allow_lossy). Mutually exclusive with target_percent, budget_usd_monthly, default_action, and proposed_config."New value: +"forecast mode: VOLUME BUDGET, keep monthly ingest toward the destination at or under this many GB/mo. BYTE accounting: tier_down keeps every byte in the destination, so it cannot serve this target and is excluded from the ladder (compact only where it lands on the billed wire, then offload with the retriever, then lossy on allow_lossy). Mutually exclusive with target_percent, budget_usd_monthly, default_action, and proposed_config." - changed
Input schema / properties / budget_usd_monthly / descriptionPrevious value: -"forecast mode: DOLLAR BUDGET — keep the (service-scoped or whole) destination bill at or under this $/mo. The ladder solver derives the reduction: max(0, bill - budget). Idempotent: already under budget returns an empty plan with the headroom stated. Mutually exclusive with target_percent, budget_gb_monthly, default_action, and proposed_config."New value: +"forecast mode: DOLLAR BUDGET, keep the (service-scoped or whole) destination bill at or under this $/mo. The ladder solver derives the reduction: max(0, bill - budget). Idempotent: already under budget returns an empty plan with the headroom stated. Mutually exclusive with target_percent, budget_gb_monthly, default_action, and proposed_config." - added
Input schema / properties / current_compute_unitsAdded value: +{ + "description": "forecast mode, compute-billed destinations only (ClickHouse): the service's current compute unit count. Turns the modeled compute saving in totals.compute_saving from a fraction into dollars.", + "exclusiveMinimum": 0, + "type": "number" +} - changed
Input schema / properties / default_action / descriptionPrevious value: -"forecast mode, OPTIONAL: force one action onto every solver-selected pattern (a mode choice — \"cut 50% via drop\"). Hard constraint when present, subject to destination compatibility (compact is replaced by the destination canonical action when compact_mode=no-op). OMIT for the product default: the ladder solver picks the destination's keep-everything lever per pattern (compact -> tier_down -> offload-with-retriever), never lossy unless allow_lossy."New value: +"forecast mode, OPTIONAL: force one action onto every solver-selected pattern (a mode choice, \"cut 50% via drop\"). Hard constraint when present, subject to destination compatibility (compact is replaced by the destination canonical action when compact_mode=no-op). OMIT for the product default: the ladder solver picks the destination's keep-everything lever per pattern (compact -> tier_down -> offload-with-retriever), never lossy unless allow_lossy." - changed
Input schema / properties / deployment / descriptionPrevious value: -"How the customer RUNS the destination, which decides whether compaction is available at all: the expander is software they install (the l1es Elasticsearch/OpenSearch plugin, the 10x Splunk app), so a managed or serverless platform can carry compacted bytes but has nowhere to expand them. Set only from what the user actually said — absent means unknown, and an unknown deployment prices only the levers that hold either way. Irrelevant on destinations whose levers do not depend on it (Datadog, CloudWatch, Azure, Coralogix)."New value: +"How the customer RUNS the destination, which decides whether compaction is available at all: the expander is software they install (the l1es Elasticsearch/OpenSearch plugin, the 10x Splunk app), so a managed or serverless platform can carry compacted bytes but has nowhere to expand them. Set only from what the user actually said: absent means unknown, and an unknown deployment prices only the levers that hold either way. Irrelevant on destinations whose levers do not depend on it (Datadog, CloudWatch, Azure, Coralogix)." - changed
Input schema / properties / effective_ingest_per_gb / descriptionPrevious value: -"forecast and verify mode: override the destination list-price rate with the customer's contracted $/GB. When supplied, dollar projections use this rate and surface rate_source='customer_supplied'."New value: +"forecast and verify mode: override the destination default rate with the customer's contracted $/GB. When supplied, dollar projections use this rate and surface rate_source='customer_supplied'." - changed
Input schema / properties / es_pruned / descriptionPrevious value: -"Elasticsearch only: are compactable fields excluded from _source? Default false — the unpruned ratio band is used."New value: +"Elasticsearch only: are compactable fields excluded from _source? Default false: the unpruned ratio band is used." - changed
Input schema / properties / exception_services / descriptionPrevious value: -"Ladder-plan path only: services pinned at pass — their patterns stay in the bill but are never planned, exactly like protected severities. The SOC-owned or compliance-bound slice of the estate, stated as a hard exclusion. Case-insensitive."New value: +"Ladder-plan path only: services pinned at pass, their patterns stay in the bill but are never planned, exactly like protected severities. The SOC-owned or compliance-bound slice of the estate, stated as a hard exclusion. Case-insensitive." - changed
Input schema / properties / include_referenced / descriptionPrevious value: -"Ladder-plan path only: message types LITERALLY referenced by a monitor, alert, saved search, or dashboard (found by the dependency scan) are EXCLUDED from the plan by default — they stay exactly as they are, and the plan re-solves around them. Pass true only after the user explicitly chooses to include them (the render shows what including them adds)."New value: +"Ladder-plan path only: message types LITERALLY referenced by a monitor, alert, saved search, or dashboard (found by the dependency scan) are EXCLUDED from the plan by default: they stay exactly as they are, and the plan re-solves around them. Pass true only after the user explicitly chooses to include them (the render shows what including them adds)." - added
Input schema / properties / monthly_compute_spend_usdAdded value: +{ + "description": "forecast mode, compute-billed destinations only (ClickHouse): the service's current monthly compute spend in dollars. Converted to units at the destination's unit price; ignored when current_compute_units is supplied.", + "exclusiveMinimum": 0, + "type": "number" +} - changed
Input schema / properties / proposed_config / items / properties / pattern_hash / descriptionPrevious value: -"Stable pattern identity (tenx_hash)."New value: +"Pattern hash (tenx_hash)." - changed
Input schema / properties / retriever_installed / descriptionPrevious value: -"Whether the S3 retriever is installed (or the user has agreed to install it). Gates the offload rung of the ladder solver: without it, offloaded events would be unreachable, so the plan stops at the in-SIEM levers and the gap names \"install the retriever\" as the lossless remedy. Set from conversation; log10x_advise_retriever is the install path."New value: +"Whether the S3 retriever is installed (or the user has agreed to install it). Gates the offload rung of the ladder solver: without it, offloaded events would be unreachable, so the plan stops at the in-SIEM levers and the gap names \"install the retriever\" as the keep-everything remedy. Set from conversation; log10x_advise_retriever is the install path." - changed
Input schema / properties / unprotect_patterns / descriptionPrevious value: -"Ladder-plan path only: pattern hashes the user EXPLICITLY unpinned from the severity floor (a warn-level retry storm they chose to act on). Bypasses severity protection for the listed hashes only; hard exclusions still win. Set only after the user names the type and chooses this — never inferred. The render flags these rows with their severity."New value: +"Ladder-plan path only: pattern hashes the user EXPLICITLY unpinned from the severity floor (a warn-level retry storm they chose to act on). Bypasses severity protection for the listed hashes only; hard exclusions still win. Set only after the user names the type and chooses this: never inferred. The render flags these rows with their severity."
- Changed
log10x_event_lookup2 fields changed- changed
Input schema / properties / effective_ingest_per_gb / descriptionPrevious value: -"Customer-supplied SIEM ingest cost in $/GB. When set, dollar fields populate with rate_source=customer_supplied; when absent and no list rate is detected, dollar fields collapse to null and rate_source=unset."New value: +"Customer-supplied SIEM ingest cost in $/GB. When set, dollar fields populate with rate_source=customer_supplied; when absent and no default rate is detected, dollar fields collapse to null and rate_source=unset." - changed
Input schema / properties / tenxHash / descriptionPrevious value: -"Legacy alias of `pattern_hash`. Both are accepted. Pass either the canonical `pattern_hash` form or this legacy form — they are treated identically."New value: +"Legacy alias of `pattern_hash`. Both are accepted. Pass either the canonical `pattern_hash` form or this legacy form: they are treated identically."
- Changed
log10x_explain_mode2 fields changed- changed
Input schema / properties / effective_ingest_per_gb / descriptionPrevious value: -"Customer-supplied $/GB rate used for the dollar overlay. When set, source_disclosure.rate_source='customer_supplied'. When absent, the shared rate resolver falls back to envs.json analyzerCost → LOG10X_ANALYZER_COST → destination list price → unset (no dollar overlay)."New value: +"Customer-supplied $/GB rate used for the dollar overlay. When set, source_disclosure.rate_source='customer_supplied'. When absent, the shared rate resolver falls back to envs.json analyzerCost → LOG10X_ANALYZER_COST → the destination default rate (a list price where the vendor sells logs per GB) → unset (no dollar overlay)." - changed
Input schema / properties / mode / descriptionPrevious value: -"Which enforcement mode to explain. Keep-everything levers come first, then the lossy opt-ins. `compact` = keeps everything: engine minifies events ~50-80% losslessly; all events still reach the stack. `offload` = keeps everything: engine diverts matched events to a customer-owned S3 bucket; readable via log10x_retriever_query. `tier_down` = keeps everything: engine stamps the routeState marker; a routing rule moves those events to a cheaper storage tier (Datadog Flex / CloudWatch IA / Azure Monitor Basic or Auxiliary Logs). `sample` = lossy opt-in: engine passes 1-in-N events through to the stack; the rest are discarded. `drop` = lossy opt-in: engine hard-drops matched patterns at the Receiver before delivery. `observe_only` = engine observes and fingerprints but does not act; use to baseline volume before committing."New value: +"Which enforcement mode to explain. Keep-everything levers come first, then the lossy opt-ins. `compact` = keeps everything: engine minifies events; all events still reach the stack, and the destination's expander rebuilds them (how exactly, and which searches see the full text, is per destination). `offload` = keeps everything: engine diverts matched events to a customer-owned S3 bucket; readable via log10x_retriever_query. `tier_down` = keeps everything: engine stamps the routeState marker; a routing rule moves those events to a cheaper tier in the same destination (Datadog Flex / CloudWatch IA / Azure Monitor Basic or Auxiliary Logs). `sample` = lossy opt-in: engine passes 1-in-N events through to the stack; the rest are discarded. `drop` = lossy opt-in: engine hard-drops matched patterns at the Receiver before delivery. `observe_only` = engine observes and fingerprints but does not act; use to baseline volume before committing."
- Changed
log10x_extract_templates1 field changed- changed
Input schema / properties / expected / descriptionPrevious value: -"Optional assertions — turns extraction into validation. Each assertion reports pass/fail in the output."New value: +"Optional assertions: turns extraction into validation. Each assertion reports pass/fail in the output."
- Changed
log10x_find_skew2 fields changed- changed
Input schema / properties / events / descriptionPrevious value: -"Events to analyze for slot skew. Same shape as log10x_resolve_batch — raw strings or JSON objects. Each event is templated locally; skew is computed across the resulting patterns."New value: +"Events to analyze for slot skew. Same shape as log10x_resolve_batch: raw strings or JSON objects. Each event is templated locally; skew is computed across the resulting patterns." - changed
Input schema / properties / sample_n / descriptionPrevious value: -"Sampling rate N for the savings projection (1/N of the dominant case kept). Default 10. Same calibration caveat — sample_n=10 is a defensible starting point but not validated for any specific cost target."New value: +"Sampling rate N for the savings projection (1/N of the dominant case kept). Default 10. Same calibration caveat: sample_n=10 is a defensible starting point but not validated for any specific cost target."
- Changed
log10x_investigate1 field changed- changed
Input schema / properties / environment / descriptionPrevious value: -"Environment nickname — required in multi-env setups."New value: +"Environment nickname: required in multi-env setups."
- Changed
log10x_metric_overlay2 fields changed- changed
Input schema / properties / candidate / descriptionPrevious value: -"The candidate metric to overlay against the anchor. Must be a customer-side PromQL expression that returns a single series. Alias of `candidates[0]` — pass either form (sibling tools metrics_that_moved and rank_by_shape_similarity use `candidates` array; this tool accepts both for consistency)."New value: +"The candidate metric to overlay against the anchor. Must be a customer-side PromQL expression that returns a single series. Alias of `candidates[0]`: pass either form (sibling tools metrics_that_moved and rank_by_shape_similarity use `candidates` array; this tool accepts both for consistency)." - changed
Input schema / properties / candidates / descriptionPrevious value: -"Candidates array. Accepted for parity with metrics_that_moved + rank_by_shape_similarity. Only the first element is overlaid (metric_overlay is single-candidate by design — use rank_by_shape_similarity to rank N first, then overlay the winner)."New value: +"Candidates array. Accepted for parity with metrics_that_moved + rank_by_shape_similarity. Only the first element is overlaid (metric_overlay is single-candidate by design: use rank_by_shape_similarity to rank N first, then overlay the winner)."
- Changed
log10x_metrics_that_moved2 fields changed- changed
Input schema / properties / anchor / descriptionPrevious value: -"Anchor identity. For `anchor_type=log10x_pattern`: the pattern Symbol Message NAME or its 11-char `pattern_hash` (= `tenx_hash`) — the tool detects shape and queries the correct PromQL label (`message_pattern` vs `tenx_hash`). For `anchor_type=customer_metric`: a customer PromQL expression."New value: +"Anchor identity. For `anchor_type=log10x_pattern`: the pattern Symbol Message NAME or its 11-char `pattern_hash` (= `tenx_hash`), the tool detects shape and queries the correct PromQL label (`message_pattern` vs `tenx_hash`). For `anchor_type=customer_metric`: a customer PromQL expression." - changed
Input schema / properties / phase_gap_floor / descriptionPrevious value: -"Relative gap floor between anchor-high and anchor-low phase means. Candidate is \"moved\" iff its gap ≥ this. Default 0.15 (=15%) is an uncalibrated default — output is tagged `unvalidated_default` until a caller-side calibration overrides it. See `docs/cross-pillar-primitives.md` for the calibration playbook."New value: +"Relative gap floor between anchor-high and anchor-low phase means. Candidate is \"moved\" iff its gap ≥ this. Default 0.15 (=15%) is an uncalibrated default: output is tagged `unvalidated_default` until a caller-side calibration overrides it. See `docs/cross-pillar-primitives.md` for the calibration playbook."
- Changed
log10x_overflow_contents1 field changed- changed
Input schema / properties / view / descriptionPrevious value: -"Output format. Always \"summary\" — the typed envelope (data.patterns[], data.totals)."New value: +"Output format. Always \"summary\": the typed envelope (data.patterns[], data.totals)."
- Changed
log10x_pattern_diff2 fields changed- changed
Input schema / properties / co_emergence_window_seconds / descriptionPrevious value: -"Time spread for clustering co-emergent patterns. Default 60s — tight enough to fingerprint a single deploy."New value: +"Time spread for clustering co-emergent patterns. Default 60s: tight enough to fingerprint a single deploy." - changed
Input schema / properties / min_co_emergence_cluster_size / descriptionPrevious value: -"Minimum cluster size to emit. Default 3 — 2 patterns sharing a timestamp is often coincidence."New value: +"Minimum cluster size to emit. Default 3: 2 patterns sharing a timestamp is often coincidence."
- Changed
log10x_pattern_trend4 fields changed- changed
Input schema / properties / pattern / descriptionPrevious value: -"Pattern name (e.g., \"Payment_Gateway_Timeout\"). Provide either pattern or pattern_hash — pattern_hash is preferred when available (skips a metrics lookup)."New value: +"Pattern name (e.g., \"Payment_Gateway_Timeout\"). Provide either pattern or pattern_hash: pattern_hash is preferred when available (skips a metrics lookup)." - changed
Input schema / properties / pattern_hash / descriptionPrevious value: -"The tenx_hash of the pattern (11-char stable identity from top_patterns / preview_filter). Preferred over pattern when available."New value: +"The tenx_hash of the pattern (the 11-character pattern hash from top_patterns / preview_filter). Preferred over pattern when available." - changed
Input schema / properties / step / descriptionPrevious value: -"Data point interval. Default `auto` sizes the step to give ~12–30 buckets per window (1h→5m, 6h→15m, 1d/24h→1h, 7d→6h, 30d→1d). Override only when a specific resolution is required; an over-coarse step (e.g. 1h on a 1h window) produces a 2-point series with no usable trend shape."New value: +"Data point interval. Default `auto` sizes the step to give about 12 to 30 buckets per window (1h→5m, 6h→15m, 1d/24h→1h, 7d→6h, 30d→1d). Override only when a specific resolution is required; an over-coarse step (e.g. 1h on a 1h window) produces a 2-point series with no usable trend shape." - changed
Input schema / properties / view / descriptionPrevious value: -"Output format. Always \"summary\" — the structured envelope. Field retained for backward-compat."New value: +"Output format. Always \"summary\": the structured envelope. Field retained for backward-compat."
- Changed
log10x_poc_from_local10 fields changed- changed
Input schema / properties / budget_usd_monthly / descriptionPrevious value: -"DOLLAR BUDGET: keep the projected monthly bill on the assumed SIEM at or under this $/mo. The sample is scaled to a 30-day month (kubectl window, or file timestamp span) before solving, so the budget and the bill share a denominator. Mutually exclusive with target_percent_reduction and budget_gb_monthly."New value: +"DOLLAR BUDGET: keep the projected monthly bill on the assumed SIEM at or under this $/mo. The sample is scaled to a 30-day month (kubectl window, or the file span) before solving, so the budget and the bill share a denominator. Mutually exclusive with target_percent_reduction and budget_gb_monthly." - added
Input schema / properties / check_dependenciesAdded value: +{ + "description": "Datadog only, default true: before the plan moves statements off Standard, read the account's log monitors and log-based metrics (read-only GETs, needs DD_API_KEY + DD_APP_KEY in the session) and print beside each service line the ones whose query reads its moved lines. Set false to skip the read.", + "type": "boolean" +} - added
Input schema / properties / fleet_defaultAdded value: +{ + "additionalProperties": false, + "description": "Set the fleet default from this capture: the limit for every service the plan gives no row, the largest statement the plan keeps per node times the headroom. The report states it in lines a day, and `fleet_default.cap_bytes_per_window_per_node` in the result is the value `log10x_advise_install` writes. On Datadog, the dependency check also lists the log monitors and log-based metrics of the services it covers, error monitors included.", + "properties": { + "action": { + "description": "Where a statement above the limit goes: `tier_down` (Flex on Datadog, the default) or `offload` (S3).", + "enum": [ + "tier_down", + "offload" + ], + "type": "string" + }, + "error_floor": { + "description": "Share of ERROR and CRITICAL lines above the limit kept in Standard. Default 0.5 with offload, 0 with tier_down.", + "maximum": 1, + "minimum": 0, + "type": "number" + }, + "headroom": { + "description": "Multiplier on the largest kept per-node cell of the capture. Default 2.", + "maximum": 10, + "minimum": 1, + "type": "number" + } + }, + "type": "object" +} - changed
Input schema / properties / forwarder / descriptionPrevious value: -"Forwarder in the pipeline (fluentd, fluent-bit, filebeat, logstash, otel-collector, vector, hec). Used to pick verified apply/undo commands. Not guessed when absent — the report says commands are unavailable."New value: +"Forwarder in the pipeline (fluentd, fluent-bit, filebeat, logstash, otel-collector, vector, hec). Used to pick verified apply/undo commands. Not guessed when absent: the report says commands are unavailable." - changed
Input schema / properties / pin_patterns / descriptionPrevious value: -"Advanced — most customers will not need this. Map of pattern_hash to action for rare per-pattern overrides within a pod / source. Applied AFTER pin_services."New value: +"Advanced: most customers will not need this. Map of pattern_hash to action for rare per-pattern overrides within a pod / source. Applied AFTER pin_services." - added
Input schema / properties / record_overhead_bytesAdded value: +{ + "description": "Bytes of forwarder metadata per record, for a capture that carries the log text only (a kubectl sample or plain lines). The Receiver counts each record as the forwarder sends it, metadata included, so the caps add this to every line. Default 760, the median of a Fluent Bit kubernetes record on an EKS capture. A file of the forwarder's own JSON records is measured instead.", + "maximum": 100000, + "minimum": 0, + "type": "integer" +} - changed
Input schema / properties / retriever_installed / descriptionPrevious value: -"Whether the prospect will install the S3 retriever. Gates the offload rung of the plan ladder: without it offloaded events would be unreachable, so the plan stops at the in-SIEM levers and the gap names \"install the retriever\" as the lossless remedy. Set from conversation."New value: +"Whether the prospect will install the S3 retriever. Gates the offload rung of the plan ladder: without it offloaded events would be unreachable, so the plan stops at the in-SIEM levers and the gap names \"install the retriever\" as the keep-everything remedy. Set from conversation." - changed
Input schema / properties / source / descriptionPrevious value: -"Where to pull log lines from. `kubectl` samples pod logs; `file` samples local logs — pass `paths` (files, directories, globs) or `path` (one file; fluentd/k8s/docker-wrapped JSONL is detected and normalized before the engine sees it). `docker` and `journald` are follow-up work."New value: +"Where to pull log lines from. `kubectl` samples pod logs; `file` samples local logs: pass `paths` (files, directories, globs) or `path` (one file; fluentd/k8s/docker-wrapped JSONL is detected and normalized before the engine sees it). `docker` and `journald` are follow-up work." - removed
Input schema / properties / window / defaultRemoved value: -"1h" - changed
Input schema / properties / window / descriptionPrevious value: -"How far back to read per pod (`source: kubectl`). For `source: file` this is the time span you declare the sampled file tails to cover — it drives the daily projection, so set it if you know it. Accepts `1h`, `24h`, etc. Default `1h`."New value: +"How far back to read per pod (`source: kubectl`, default `1h`). For `source: file`, the time span the files cover: read from the first and last record timestamps when the records carry them, and from `window` when they do not. With neither, a file run refuses rather than assume a span. Accepts `30m`, `10h`, `7d`, etc."
- Changed
log10x_poc_from_siem_status1 field changed- changed
Input schema / properties / view / descriptionPrevious value: -"How to surface the report. Default `summary` returns the v2 structured envelope (`data.result` carries the full JSON: input section with scale + methodology + coverage, output section with aggregates, incidents, per-pattern actions). The agent reads this directly and writes prose in its own voice — no rendered markdown is included in the summary path. Use `markdown` to receive the rendered 9-section markdown report (legacy / human-readable surface). `yaml` returns paste-ready receiver mute-file entries; `configs` returns native SIEM exclusion configs; `top` returns an expanded N-row drivers markdown; `pattern` deep-dives on one identity (requires `pattern` arg). `full` is kept as an alias for `markdown`."New value: +"How to surface the report. Default `summary` returns the v2 structured envelope (`data.result` carries the full JSON: input section with scale + methodology + coverage, output section with aggregates, incidents, per-pattern actions). The agent reads this directly and writes prose in its own voice: no rendered markdown is included in the summary path. Use `markdown` to receive the rendered 9-section markdown report (legacy / human-readable surface). `yaml` returns paste-ready receiver mute-file entries; `configs` returns native SIEM exclusion configs; `top` returns an expanded N-row drivers markdown; `pattern` deep-dives on one identity (requires `pattern` arg). `full` is kept as an alias for `markdown`."
- Changed
log10x_poc_from_siem_submit8 fields changed- changed
Input schema / properties / ai_prettify / descriptionPrevious value: -"Default true: use MCP sampling to ask the host LLM (the same model the user is already chatting with — Claude Desktop, Claude Code, Cursor, etc.) to batch-generate 3-5-word human-readable names for the top patterns. No Log10x-side endpoint, no extra API key — the host uses whatever model + credentials the user already has. Sends only templated pattern identities (no variable values, no raw log content). Skipped automatically when the host does not advertise the `sampling` capability; the report falls back to raw snake_case identities plus a note. Set false to skip unconditionally."New value: +"Default true: use MCP sampling to ask the host LLM (the same model the user is already chatting with: Claude Desktop, Claude Code, Cursor, etc.) to batch-generate 3-5-word human-readable names for the top patterns. No Log10x-side endpoint, no extra API key: the host uses whatever model + credentials the user already has. Sends only templated pattern identities (no variable values, no raw log content). Skipped automatically when the host does not advertise the `sampling` capability; the report falls back to raw snake_case identities plus a note. Set false to skip unconditionally." - changed
Input schema / properties / clickhouse_table / descriptionPrevious value: -"[ClickHouse] Required — table name holding log events."New value: +"[ClickHouse] Required: table name holding log events." - changed
Input schema / properties / environment / descriptionPrevious value: -"Optional environment nickname — cosmetic only, for the report header."New value: +"Optional environment nickname: cosmetic only, for the report header." - changed
Input schema / properties / pin_patterns / descriptionPrevious value: -"Advanced — most customers will not need this. Map of pattern_hash to action for rare per-pattern overrides within a service. Applied AFTER pin_services. Use only when a single pattern inside an otherwise-reducible service must be excepted (e.g., audit-trail log line inside a chatty service)."New value: +"Advanced: most customers will not need this. Map of pattern_hash to action for rare per-pattern overrides within a service. Applied AFTER pin_services. Use only when a single pattern inside an otherwise-reducible service must be excepted (e.g., audit-trail log line inside a chatty service)." - added
Input schema / properties / record_overhead_bytesAdded value: +{ + "description": "Bytes of forwarder metadata per record. The Receiver counts each record as the forwarder sends it, metadata included, and events read back from a SIEM's API seldom carry that record, so the caps add this to every event. Default 760, the median of a Fluent Bit kubernetes record on an EKS capture.", + "maximum": 100000, + "minimum": 0, + "type": "integer" +} - changed
Input schema / properties / target_event_count / descriptionPrevious value: -"Target event count for the pull. Default 1,000,000 (~500 MB at 500B avg, tokenizes in 5-10 min). The pull self-terminates earlier on saturation — when new patterns per 100k events drops below 2%, the long tail has been covered and the report is generated. This default is intentionally two orders of magnitude beyond what an unaided agent can fit in context."New value: +"Target event count for the pull. Default 1,000,000 (~500 MB at 500B avg, tokenizes in 5-10 min). The pull self-terminates earlier on saturation: when new patterns per 100k events drops below 2%, the long tail has been covered and the report is generated. This default is intentionally two orders of magnitude beyond what an unaided agent can fit in context." - changed
Input schema / properties / total_daily_gb / descriptionPrevious value: -"Customer's total daily log volume in GB/day. Pick any one of total_daily_gb / total_monthly_gb / total_annual_gb — whichever unit the user naturally thinks in. The tool normalizes to daily internally. When any is provided (or auto_detect_volume succeeds), per-pattern costs are extrapolated from the pulled sample to the full volume, producing meaningful annual-savings figures instead of sub-cent numbers. Priority: daily > monthly > annual. If the pull was narrowed via `query` to one service, this overstates cost — only a fraction of daily volume matches the filter."New value: +"Customer's total daily log volume in GB/day. Pick any one of total_daily_gb / total_monthly_gb / total_annual_gb: whichever unit the user naturally thinks in. The tool normalizes to daily internally. When any is provided (or auto_detect_volume succeeds), per-pattern costs are extrapolated from the pulled sample to the full volume, producing meaningful annual-savings figures instead of sub-cent numbers. Priority: daily > monthly > annual. If the pull was narrowed via `query` to one service, this overstates cost: only a fraction of daily volume matches the filter." - changed
Input schema / properties / window / descriptionPrevious value: -"Window to pull over. Accepts \"1h\", \"24h\", \"7d\", \"14d\", \"30d\". Default \"14d\" — wide windows unlock the differentiated longitudinal signals (first-seen, growth, stable-vs-new) that the agent cannot compute from a small sample. Pull pacing is automatic; long windows take minutes but the snapshot continues in the background."New value: +"Window to pull over. Accepts \"1h\", \"24h\", \"7d\", \"14d\", \"30d\". Default \"14d\": wide windows unlock the differentiated longitudinal signals (first-seen, growth, stable-vs-new) that the agent cannot compute from a small sample. Pull pacing is automatic; long windows take minutes but the snapshot continues in the background."
- Changed
log10x_product_qa1 field changed- changed
Input schema / properties / query / descriptionPrevious value: -"Natural-language query — prefer this for how-to / content questions. Examples: \"what does the kustomize overlay patch\", \"how is pattern_hash computed\". When `topic` is also set, ranks that page's sections by this query."New value: +"Natural-language query: prefer this for how-to / content questions. Examples: \"what does the kustomize overlay patch\", \"how is pattern_hash computed\". When `topic` is also set, ranks that page's sections by this query."
- Changed
log10x_rank_by_shape_similarity3 fields changed- changed
Input schema / properties / anchor / descriptionPrevious value: -"Anchor identity. For `anchor_type=log10x_pattern`: the pattern Symbol Message NAME or its 11-char `pattern_hash` (= `tenx_hash`) — the tool detects shape and queries the correct PromQL label (`message_pattern` vs `tenx_hash`). For `anchor_type=customer_metric`: a customer PromQL expression."New value: +"Anchor identity. For `anchor_type=log10x_pattern`: the pattern Symbol Message NAME or its 11-char `pattern_hash` (= `tenx_hash`), the tool detects shape and queries the correct PromQL label (`message_pattern` vs `tenx_hash`). For `anchor_type=customer_metric`: a customer PromQL expression." - changed
Input schema / properties / anchor_phase_aligned_floor / descriptionPrevious value: -"Relative phase-gap floor for the `anchor_phase_aligned` flag. Default 0.15 — uncalibrated, same provenance caveat as lag_search_max_abs."New value: +"Relative phase-gap floor for the `anchor_phase_aligned` flag. Default 0.15: uncalibrated, same provenance caveat as lag_search_max_abs." - changed
Input schema / properties / lag_search_max_abs / descriptionPrevious value: -"Maximum absolute lag in seconds to scan. Default 1800s — uncalibrated. Output is tagged `unvalidated_default` when used as-is. Narrow it when the use case has a known tighter upper bound on cascade latency (e.g. 300 for sub-5-min cascades). See `docs/cross-pillar-primitives.md` for the calibration playbook."New value: +"Maximum absolute lag in seconds to scan. Default 1800s: uncalibrated. Output is tagged `unvalidated_default` when used as-is. Narrow it when the use case has a known tighter upper bound on cascade latency (e.g. 300 for sub-5-min cascades). See `docs/cross-pillar-primitives.md` for the calibration playbook."
- Changed
log10x_resolve_batch3 fields changed- changed
Input schema / properties / environment / descriptionPrevious value: -"Environment nickname — used to build next_actions that call log10x_investigate."New value: +"Environment nickname: used to build next_actions that call log10x_investigate." - changed
Input schema / properties / source / descriptionPrevious value: -"Optional — auto-inferred from whichever of `events` / `text` / `path` you actually provide, so you normally do not set it. Provide explicitly only to disambiguate when more than one is present."New value: +"Optional: auto-inferred from whichever of `events` / `text` / `path` you actually provide, so you normally do not set it. Provide explicitly only to disambiguate when more than one is present." - changed
Input schema / properties / text / descriptionPrevious value: -"Raw text blob when source=text — newline-separated log events."New value: +"Raw text blob when source=text: newline-separated log events."
- Changed
log10x_retriever_query5 fields changed- changed
Input schema / properties / debug / descriptionPrevious value: -"Escalate the CloudWatch log level to DEBUG for THIS query only — per-blob Bloom decisions, per-fetch S3 reads, per-event results-writer samples. Use only when normal-run diagnostics cannot explain a 0-result or truncated outcome (volume is ~100x higher). Default false."New value: +"Escalate the CloudWatch log level to DEBUG for THIS query only: per-blob Bloom decisions, per-fetch S3 reads, per-event results-writer samples. Use only when normal-run diagnostics cannot explain a 0-result or truncated outcome (volume is ~100x higher). Default false." - changed
Input schema / properties / environment / descriptionPrevious value: -"Environment nickname — required if multi-env."New value: +"Environment nickname: required if multi-env." - changed
Input schema / properties / format / descriptionPrevious value: -"`events` (default: raw events), `count` (total + severity/service rollups, no event bodies), `aggregated` (events bucketed into a time series — use with bucket_size), `ephemeral_series` (bucketed series in Prometheus range-query shape for cross-pillar correlation). All four formats are rolled up client-side from the same events stream."New value: +"`events` (default: raw events), `count` (total + severity/service rollups, no event bodies), `aggregated` (events bucketed into a time series, use with bucket_size), `ephemeral_series` (bucketed series in Prometheus range-query shape for cross-pillar correlation). All four formats are rolled up client-side from the same events stream." - changed
Input schema / properties / pattern / descriptionPrevious value: -"Reporter-named pattern (Symbol Message). NOT SUPPORTED against the offload archive: passing it returns an error naming the remedy, rather than a silent empty result. A Symbol Message is a label DERIVED from the event, so it is never a token in the archived bytes, and the Bloom index holds only text tokens plus template hashes. (The field this once queried, `tenx_user_pattern`, does not exist in the engine at all, which is why name-scoped queries returned BLOOM_REJECTED_ALL.) Pass `pattern_hash` instead: top_patterns returns it on the same row as the name, and event_lookup resolves a name to a hash."New value: +"Reporter-named pattern (Symbol Message). NOT SUPPORTED against the offload bucket: passing it returns an error naming the remedy, rather than a silent empty result. A Symbol Message is a label DERIVED from the event, so it is never a token in the offloaded bytes, and the Bloom index holds only text tokens plus template hashes. (The field this once queried, `tenx_user_pattern`, does not exist in the engine at all, which is why name-scoped queries returned BLOOM_REJECTED_ALL.) Pass `pattern_hash` instead: top_patterns returns it on the same row as the name, and event_lookup resolves a name to a hash." - changed
Input schema / properties / pattern_hash / descriptionPrevious value: -"Canonical pattern_hash from top_patterns / event_lookup. When provided, search is auto-built as `includes(text, \"<hash>\")` and no name resolution runs. It matches the stamped hash as a TEXT TOKEN because the archive re-derives its own `tenx_hash` field per multi-line group, so a field equality against a metrics-side hash matches nothing. This is the chain-stable identity emitted by top_patterns.payload.patterns[].pattern_hash — bypasses the name→hash resolver entirely. Precedence: `search` > `pattern_hash` > `pattern`. Example: `pattern_hash: \"4Kjc7PHLWqY\"`."New value: +"Canonical pattern_hash from top_patterns / event_lookup. When provided, search is auto-built as `includes(text, \"<hash>\")` and no name resolution runs. It matches the stamped hash as a TEXT TOKEN because the offloaded events carry their own `tenx_hash` field, re-derived per multi-line group, so a field equality against a metrics-side hash matches nothing. This is the pattern hash emitted by top_patterns.payload.patterns[].pattern_hash: bypasses the name→hash resolver entirely. Precedence: `search` > `pattern_hash` > `pattern`. Example: `pattern_hash: \"4Kjc7PHLWqY\"`."
- Changed
log10x_retriever_query_status1 field changed- changed
Input schema / properties / fetch_results / descriptionPrevious value: -"When true and the query has completed, ALSO recover the results from S3: a 10-event preview, counts, and the results_location pointer — same core fields as a completed log10x_retriever_query. Use after a partial/timed-out query to recover stranded events without resubmitting."New value: +"When true and the query has completed, ALSO recover the results from S3: a 10-event preview, counts, and the results_location pointer, same core fields as a completed log10x_retriever_query. Use after a partial/timed-out query to recover stranded events without resubmitting."
- Changed
log10x_retriever_series5 fields changed- changed
Input schema / properties / environment / descriptionPrevious value: -"Environment nickname — required if multi-env."New value: +"Environment nickname: required if multi-env." - changed
Input schema / properties / fidelity / descriptionPrevious value: -"`auto` (tool decides via Reporter volume + window length), `full` (force exact aggregation — may exceed Lambda budget), `per_window_sampled` (force sampling, default K=1000 per sub-window), or `per_window_sampled:K` (custom K)."New value: +"`auto` (tool decides via Reporter volume + window length), `full` (force exact aggregation: may exceed Lambda budget), `per_window_sampled` (force sampling, default K=1000 per sub-window), or `per_window_sampled:K` (custom K)." - changed
Input schema / properties / group_by / descriptionPrevious value: -"Optional enrichment field to group the series by — e.g., `tenx_user_service`, `severity_level`, `k8s_namespace`. Top-1000 group values are retained; tail collapsed to `_other_`."New value: +"Optional enrichment field to group the series by: e.g., `tenx_user_service`, `severity_level`, `k8s_namespace`. Top-1000 group values are retained; tail collapsed to `_other_`." - changed
Input schema / properties / pattern / descriptionPrevious value: -"Reporter-named pattern (Symbol Message). NOT SUPPORTED against the offload archive: passing it returns an error naming the remedy, rather than a silent empty result. A Symbol Message is a label DERIVED from the event, so it is never a token in the archived bytes, and the Bloom index holds only text tokens plus template hashes. (The field this once queried, `tenx_user_pattern`, does not exist in the engine at all, which is why name-scoped queries returned BLOOM_REJECTED_ALL.) Pass `pattern_hash` instead: top_patterns returns it on the same row as the name, and event_lookup resolves a name to a hash."New value: +"Reporter-named pattern (Symbol Message). NOT SUPPORTED against the offload bucket: passing it returns an error naming the remedy, rather than a silent empty result. A Symbol Message is a label DERIVED from the event, so it is never a token in the offloaded bytes, and the Bloom index holds only text tokens plus template hashes. (The field this once queried, `tenx_user_pattern`, does not exist in the engine at all, which is why name-scoped queries returned BLOOM_REJECTED_ALL.) Pass `pattern_hash` instead: top_patterns returns it on the same row as the name, and event_lookup resolves a name to a hash." - changed
Input schema / properties / search / descriptionPrevious value: -"Bloom-filter search expression using the TenX subset. Tightly bound queries (e.g., `includes(text, \"<pattern_hash>\")`, `severity_level == \"ERROR\"`) are dramatically cheaper. (legacy example removed: `tenx_user_pattern == \"PaymentRetry\"`) get the cheapest fetch path. Pattern-bound expressions are also what unlocks the Reporter-driven cost heuristic — without one, mode selection falls back to window-length only. Pass `pattern` instead for the common case of scoping to one Reporter-named pattern."New value: +"Bloom-filter search expression using the TenX subset. Tightly bound queries (e.g., `includes(text, \"<pattern_hash>\")`, `severity_level == \"ERROR\"`) are dramatically cheaper. (legacy example removed: `tenx_user_pattern == \"PaymentRetry\"`) get the cheapest fetch path. Pattern-bound expressions are also what unlocks the Reporter-driven cost heuristic: without one, mode selection falls back to window-length only. Pass `pattern` instead for the common case of scoping to one Reporter-named pattern."
- Changed
log10x_savings2 fields changed- changed
Input schema / properties / siem_lens / descriptionPrevious value: -"What-if destination lens: price the SAME real volumes at this destination's list rates instead of the connected pipeline's. Dollars switch to the lens list price (env-configured rates never leak across destinations); the envelope stamps siem_actual vs siem_lens. Volumes/patterns are unaffected."New value: +"What-if destination lens: price the SAME real volumes at this destination's default rates instead of the connected pipeline's. Dollars switch to the lens destination default rate (env-configured rates never leak across destinations); the envelope stamps siem_actual vs siem_lens. Volumes/patterns are unaffected." - changed
Input schema / properties / view / descriptionPrevious value: -"Output format. Always \"summary\" — the typed envelope (data.totals, data.edge, data.retriever, data.run_rate). Field retained for backward-compat."New value: +"Output format. Always \"summary\": the typed envelope (data.totals, data.edge, data.retriever, data.run_rate). Field retained for backward-compat."
- Changed
log10x_services2 fields changed- changed
Input schema / properties / siem_lens / descriptionPrevious value: -"What-if destination lens: price the per-service $/mo columns at this destination's list rates instead of the connected pipeline's (env-configured rates never cross destinations). Volumes/patterns are unaffected; the envelope stamps siem_actual vs siem_lens."New value: +"What-if destination lens: price the per-service $/mo columns at this destination's default rates instead of the connected pipeline's (env-configured rates never cross destinations). Volumes/patterns are unaffected; the envelope stamps siem_actual vs siem_lens." - changed
Input schema / properties / view / descriptionPrevious value: -"Output format. Always \"summary\" — the typed envelope (data.services[], data.totals). Field retained for backward-compat."New value: +"Output format. Always \"summary\": the typed envelope (data.services[], data.totals). Field retained for backward-compat."
- Changed
log10x_setup_recurring5 fields changed- changed
Input schema / properties / budget_gb_monthly / descriptionPrevious value: -"VOLUME BUDGET: keep monthly ingest for the targeted services at or under this many GB/mo. A standing line, not a one-shot cut: each tick scales the budget to its lookback window and cuts only the overage — already under budget means every pattern passes. Replaces target_percent in policy.yaml (mutually exclusive). Dollar budgets are a one-shot answer via log10x_estimate_savings (budget_usd_monthly); the recurring tick is byte-denominated."New value: +"VOLUME BUDGET: keep monthly ingest for the targeted services at or under this many GB/mo. A standing line, not a one-shot cut: each tick scales the budget to its lookback window and cuts only the overage: already under budget means every pattern passes. Replaces target_percent in policy.yaml (mutually exclusive). Dollar budgets are a one-shot answer via log10x_estimate_savings (budget_usd_monthly); the recurring tick is byte-denominated." - changed
Input schema / properties / config_plane / descriptionPrevious value: -"Where the recurring CLI reads policy.yaml and writes updated cap CSVs: a gitops repo URL (e.g. https://github.com/acme/log10x-config), a local path, or — required when scheduler=eventbridge — an S3 prefix (e.g. s3://acme-logs/log10x-config)."New value: +"Where the recurring CLI reads policy.yaml and writes updated cap CSVs: a gitops repo URL (e.g. https://github.com/acme/log10x-config), a local path, or (required when scheduler=eventbridge) an S3 prefix (e.g. s3://acme-logs/log10x-config)." - changed
Input schema / properties / exceptions / descriptionPrevious value: -"Service names the policy must never touch (audit / regulatory / executive). Optional — defaults to empty. Pass [] to explicitly clear all exceptions."New value: +"Service names the policy must never touch (audit / regulatory / executive). Optional: defaults to empty. Pass [] to explicitly clear all exceptions." - changed
Input schema / properties / scheduler / descriptionPrevious value: -"Where the recurring tick runs. k8s_cron = Kubernetes CronJob (default when kubectl reachable), github_actions = GHA workflow, crontab = crontab + wrapper script, eventbridge = AWS-native (EventBridge Scheduler + CodeBuild, S3 config plane — no cluster, no GitHub; the fit for AWS serverless estates), container_apps_job = Azure-native (Container Apps scheduled Job, git config plane; the fit for Azure serverless estates)."New value: +"Where the recurring tick runs. k8s_cron = Kubernetes CronJob (default when kubectl reachable), github_actions = GHA workflow, crontab = crontab + wrapper script, eventbridge = AWS-native (EventBridge Scheduler + CodeBuild, S3 config plane: no cluster, no GitHub; the fit for AWS serverless estates), container_apps_job = Azure-native (Container Apps scheduled Job, git config plane; the fit for Azure serverless estates)." - changed
Input schema / properties / session_id / descriptionPrevious value: -"Wizard session handle. Omit on the first call — a new session is minted and returned. Pass it back unchanged on every subsequent call."New value: +"Wizard session handle. Omit on the first call: a new session is minted and returned. Pass it back unchanged on every subsequent call."
- Changed
log10x_top_patterns6 fields changed- changed
Input schema / properties / analyzerCost / descriptionPrevious value: -"DEPRECATED — use effective_ingest_per_gb. stack ingestion cost in $/GB. Auto-detected from profile if omitted."New value: +"DEPRECATED: use effective_ingest_per_gb. stack ingestion cost in $/GB. Auto-detected from profile if omitted." - changed
Input schema / properties / effective_ingest_per_gb / descriptionPrevious value: -"Customer-supplied $/GB rate used for the dollar overlay. When set, headline tags `rate_source=customer_supplied`. When absent, falls back to the profile list rate (`rate_source=list_price`) or omits dollars entirely (`rate_source=unset`)."New value: +"Customer-supplied $/GB rate used for the dollar overlay. When set, headline tags `rate_source=customer_supplied`. When absent, falls back to the destination default rate (`rate_source=list_price`; a list price only where the vendor sells logs per GB) or omits dollars entirely (`rate_source=unset`)." - changed
Input schema / properties / include / descriptionPrevious value: -"Which engine-decision cohort to scope to. `kept` (default) = events the engine forwarded as-is (routeState!=\"drop\") — the pre-PL-12 behavior. `dropped` = events stamped routeState=\"drop\" by the engine (the offload/down-tier cohort). `both` = the pre-decision union; per-row output adds kept_bytes / dropped_bytes / dropped_share_pct. Use `dropped` to verify post-deploy realised savings or to answer \"which patterns are we offloading right now\". Use `both` to compute the offload share denominator in a single call."New value: +"Which engine-decision cohort to scope to. `kept` (default) = events the engine forwarded as-is (routeState!=\"drop\"): the pre-PL-12 behavior. `dropped` = events stamped routeState=\"drop\" by the engine (the offload/down-tier cohort). `both` = the pre-decision union; per-row output adds kept_bytes / dropped_bytes / dropped_share_pct. Use `dropped` to verify post-deploy realised savings or to answer \"which patterns are we offloading right now\". Use `both` to compute the offload share denominator in a single call." - changed
Input schema / properties / siemScope / descriptionPrevious value: -"stack scope for the verbatim sample line on the top rows."New value: +"Ignored: the summary envelope carries no verbatim sample line. Accepted so existing callers still validate." - changed
Input schema / properties / siem_lens / descriptionPrevious value: -"What-if destination lens: keep the real volumes, price the $/mo columns at this destination's list rates (env-configured rates never cross destinations). Envelope stamps siem_actual vs siem_lens."New value: +"What-if destination lens: keep the measured volumes, price the $/mo columns at this destination's default rates (env-configured rates never cross destinations). Envelope stamps siem_actual vs siem_lens." - changed
Input schema / properties / view / descriptionPrevious value: -"Output format. Always \"summary\" — the structured JSON envelope with patterns, incidents, totals, and chained-tool action hints. Field retained for backward-compat with callers that still pass `view: \"summary\"`."New value: +"Output format. Always \"summary\": the structured JSON envelope with patterns, incidents, totals, and chained-tool action hints. Field retained for backward-compat with callers that still pass `view: \"summary\"`."
- Changed
log10x_whats_changing2 fields changed- changed
Input schema / properties / comparison_window / descriptionPrevious value: -"Baseline window to compare against. `\"auto\"` (default) averages three offsets (1×, 2×, 3× the timeRange) for noise smoothing. A specific offset like `\"7d\"` compares to that single anchor — e.g. `{timeRange: \"1d\", comparison_window: \"1d\"}` = today vs yesterday (deploy-delta); `{timeRange: \"7d\", comparison_window: \"7d\"}` = this week vs last week."New value: +"Baseline window to compare against. `\"auto\"` (default) averages three offsets (1×, 2×, 3× the timeRange) for noise smoothing. A specific offset like `\"7d\"` compares to that single anchor: e.g. `{timeRange: \"1d\", comparison_window: \"1d\"}` = today vs yesterday (deploy-delta); `{timeRange: \"7d\", comparison_window: \"7d\"}` = this week vs last week." - changed
Input schema / properties / timeRange / descriptionPrevious value: -"Current window to evaluate. Day-level only — delta math requires day-aligned baseline offsets. For sub-day spike investigation use `log10x_pattern_trend` or `log10x_investigate`."New value: +"Current window to evaluate. Day-level only: delta math requires day-aligned baseline offsets. For sub-day spike investigation use `log10x_pattern_trend` or `log10x_investigate`."
55 tool updates
v1.30.7- First observed
log10x_advise_install - First observed
log10x_advise_retriever - First observed
log10x_baseline - First observed
log10x_commitment_report - First observed
log10x_compile - First observed
log10x_compile_link - First observed
log10x_compile_status - First observed
log10x_cost_options - First observed
log10x_customer_metrics_query - First observed
log10x_dependency_check - First observed
log10x_discover_env - First observed
log10x_discover_join - First observed
log10x_discover_labels - First observed
log10x_doctor - First observed
log10x_emit_sample_plan - First observed
log10x_env_diff_vs_envvars - First observed
log10x_env_validate - First observed
log10x_estimate_savings - First observed
log10x_event_lookup - First observed
log10x_explain_mode - First observed
log10x_extract_templates - First observed
log10x_find_skew - First observed
log10x_investigate - First observed
log10x_login_status - First observed
log10x_measure_compaction - First observed
log10x_metric_overlay - First observed
log10x_metrics_that_moved - First observed
log10x_overflow_contents - First observed
log10x_pattern_detail - First observed
log10x_pattern_diff - First observed
log10x_pattern_examples - First observed
log10x_pattern_mitigate - First observed
log10x_pattern_trend - First observed
log10x_poc_from_local - First observed
log10x_poc_from_siem_status - First observed
log10x_poc_from_siem_submit - First observed
log10x_preview_filter - First observed
log10x_product_qa - First observed
log10x_rank_by_shape_similarity - First observed
log10x_resolve_batch - First observed
log10x_retriever_probe - First observed
log10x_retriever_query - First observed
log10x_retriever_query_status - First observed
log10x_retriever_series - First observed
log10x_savings - First observed
log10x_services - First observed
log10x_setup_recurring - First observed
log10x_siem_connector - First observed
log10x_signin_complete - First observed
log10x_signin_start - First observed
log10x_signout - First observed
log10x_start - First observed
log10x_top_patterns - First observed
log10x_whats_changing - First observed
log10x_whats_new
TDQS
Scored across 56 tools
Many tools share closely overlapping purposes: top_patterns / whats_changing / whats_new / pattern_diff / pattern_trend all answer 'what are my patterns doing over time', resolve_batch and extract_templates both run local templatization, and the three retriever_query/series/query_status and three poc_* tools require careful reading to distinguish. The descriptions compensate heavily with explicit 'call this first', 'do NOT call for X, use Y' routing cues, which keeps it workable but demonstrates the boundaries are genuinely fuzzy.
Every tool carries the log10x_ prefix and uses snake_case throughout with a mostly predictable verb_noun pattern (resolve_batch, discover_env, configure_engine, retriever_query). A few noun-only names (doctor, start, baseline, savings) are minor deviations that don't break readability.
56 tools is far beyond what a coherent set should expose; many are narrow single-purpose helpers (env_validate, env_diff_vs_envvars, compile_status, query_status, retriever_probe) that could be consolidated into parameterized tools. The sheer breadth makes the surface hard to navigate even though each tool is individually motivated.
Coverage is impressively broad for the domain: discovery, install, POC (networked/local/fenced), pattern analytics, mitigation, retrieval, cross-pillar correlation, and auth are all present. Gaps are minor, e.g. there is no obvious tool for deleting/cleaning up an offload bucket or revoking credentials, but agents can work around these.
Maintenance
Related MCP Connectors
Query cloud, AI and SaaS spend across 25+ providers: costs, budgets, anomalies, unit economics.
Query OneLens cloud-cost data in natural language: breakdowns, trends, cost centers. Read-only.
- mcpOAuthcom.vibgrate
Query your team's drift, vulnerability, and upgrade data from any AI assistant. OAuth 2.1, 51 tools.
Ask your AI assistant a cost question. Get allocation, correlation, and explanation in one response. Costory connects Claude, Codex, or Cursor to normalized cost data across AWS, GCP, Azure, Datadog, OpenAI, and Anthropic. https://costory.io Free trial 14 days, 250 USD / month up to 10M Spend
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceProvides seamless access to Kibana and Periscope logs through a unified API with KQL and SQL querying, AI-powered log analysis, and support for searching across 1.3+ billion logs in 9 indexes.1-
- AlicenseNot gradedqualityAmaintenanceEnables AI assistants to analyze cloud billing data in FOCUS format through natural language queries. Provides 36+ predefined cost analysis queries, custom SQL execution, and schema documentation for multi-cloud cost optimization and FinOps practices.11Apache 2.0
- FlicenseNot gradedqualityDmaintenanceEnables querying and managing AI logs through tools like listing logs, retrieving jobs, and performing AI-powered chat queries. Also provides access to gateway security reports and guardrail testing.-
- AlicenseAqualityCmaintenanceLets AI agents query, manage, and operate their LLM observability data directly from the conversation. Provides 87 tools for cost analysis, alerting, anomaly detection, and runtime control gates.87132 npmMIT