Ratatosk
Ratatosk is an MCP server that gives AI agents structured, entity-level facts extracted from CNCF project release notes, enabling upgrade analysis and security monitoring across 74+ tracked projects.
check_stack: Provide your running component versions (e.g., Envoy v1.36.8, Istio 1.30.1) and get a briefing on CVEs fixed, APIs removed, and defaults changed along your upgrade path. Version comparison happens locally — your versions never leave your machine; only project slugs are sent to the server.list_projects: List all tracked CNCF projects with slug, name, tier (graduated/incubating), category, and analyzed release counts. Use this first to resolve correct project slugs.get_release: Fetch full details for a specific project release — coverage assessment, source URL, and all extracted facts. Omit the version to get the latest reviewed release.list_releases: Get light summaries of the newest N reviewed releases for a project, with fact counts by severity and max advisory severity — ideal for a quick "what changed lately" overview.list_facts: Poll an incremental, cursor-paginated feed of typed release facts (security fixes, deprecations, removals, breaking changes, default changes, etc.), filterable by project, fact type, and severity. Ordered byfact_idascending (oldest first).facts_by_entity: Reverse-index lookup by exact identifier — CVE ID, CRD name, feature gate, flag, metric, config field, or dependency — returning every fact associated with it across all tracked projects.
ratatosk-mcp
Ratatosk reads CNCF release notes every hour. Your agents get the changes.
In Norse myth, Ratatoskr is the squirrel that carries messages up and down the world tree. This one carries release intelligence. ratatosk.io watches 76 CNCF projects and turns every release note into typed, entity-level changes: security fixes, breaking changes, removals, deprecations, changed defaults — each one classified by how you should act on it now. Routine lines are recorded too, but kept out of the way.
This repository is the MCP server that hands those changes to your agent as tools. MCP (Model Context Protocol) is the open standard AI agents use to call external tools; any MCP-capable client — Claude Code, Claude Desktop, kagent, your own SDK agent — can connect. No account, no API key.
Two ways to connect
Hosted — nothing to install. Register https://ratatosk.io/mcp as a
remote MCP server in any client that supports remote connectors. The hosted
endpoint allows each caller 60 tool calls a minute, counted per caller rather
than pooled — for polling or CI workloads, self-host. With the Claude Code
CLI:
claude mcp add --transport http ratatosk https://ratatosk.io/mcpSelf-hosted — the same server, running as your own process. Run it with Docker, the Helm chart, or a source build. With Claude Code and Docker installed:
claude mcp add ratatosk -- docker run -i --rm ghcr.io/garlickim21/ratatosk-mcp:0.9.00.9.0 is the current release; use latest to follow new ones.
Either way, verify the connection:
claude mcp list
# ratatosk: … - ✔ ConnectedThen ask your agent a question the tools can answer:
You: "We run envoy v1.36.8 and istio 1.30.1. Anything we must do before upgrading?"
Your agent calls
check_stackand answers from the record: the CVEs fixed after your version, the APIs removed on your upgrade path, the defaults that changed — separated into what applies to everyone and what applies only if your configuration matches. Each change carries a verbatim quote from the release notes as evidence.
One entry from a real check_stack answer, as the agent receives it
(istio, measured 2026-08-20):
{
"severity": "high",
"family": "security",
"bucket": "action",
"applies_if": "uses JWKS Resolver",
"quote": "- CVE-2026-31837 / GHSA-v75c-crr9-733c : (CVSS score 8.7, High): JWKS Resolver Failure May Allow Authentication Bypass Using Known Default Keys.",
"same_matter_also_addressed_in": ["1.28.5", "1.29.1"]
}applies_if is a condition the agent evaluates, not prose to read: a stack
that runs no JWKS resolver skips this entry without asking anyone. The answer
also carries its own privacy line, verbatim: "versions were compared locally;
only project slugs were sent to the server."
Other clients (Claude Desktop, kagent, in-cluster agents) and the full setup reference: see the install guide.
Related MCP server: cncf-tech-advisor-mcp
Tools
Two things the tools speak in. A change is one thing a release did, taken from an official release note and tied to the exact identifiers it touches (a CVE id, a flag, a CRD, a config field), with a verbatim quote as evidence. Every change carries three axes:
family —
security,breaking, ordeprecated: what kind of thing it is.bucket —
action(applies to everyone),check(only ifapplies_ifmatches your setup),plan(announced for later),other(the full record).applies_if — a boolean expression you can evaluate against your own manifests, not prose to read.
A matter is the issue underneath, identified by matter_key and stable
across releases and branches: the same security roll-up landing on five
branches shares one key. Severity lives on the cited advisories and is read
from the ledger's current value, not frozen at analysis time.
Tool | What it does |
| Takes the component versions you run and returns the changes on your upgrade path, split by bucket: |
| The incremental change feed, oldest-analyzed first. Filter by project, family, or bucket; page with the |
| Reverse lookup: every change touching one exact identifier — such as a CVE id, CRD, feature gate, flag, config field, or dependency |
| Every release in which one matter appeared. The same roll-up lands on several branches carrying different advisories — told only the newest, you would assume you were covered |
| One release in full: its changes, a summary, and the link to the original note. A release with zero changes means it was read and found routine |
| The newest releases of one project as one-line summaries (dates, counts by bucket and family, highest advisory severity), newest first — the tool for "what changed in X lately" |
| The roster of tracked projects and their canonical slugs (the short project id every other tool takes) — look names up here instead of guessing |
Full per-tool parameters, example calls, and measured responses live in the tools reference.
How your component versions are handled
Self-hosted: check_stack sends only project slugs to the server and
compares versions locally, inside this process — the versions you pass it
never reach ratatosk.io. The server publishes changes; your agent decides what
applies. The version normalizer is bundled (internal/version), so range
comparison happens client-side too. This holds for upgrade questions as well:
the upstream API has a convenience endpoint (/v1/upgrade/{project}) that
receives caller-supplied versions — check_stack does not call it; the
comparison is in the source you can read.
One limit on that guarantee: it covers check_stack. Tools that take a
version as an argument — get_release(project, version) — put that version
in the upstream request path, because fetching a specific release means
naming it. That named path is not kept on my side, though: before a log line
is written, query strings are stripped and /v1/releases/… and
/v1/upgrade/… paths are reduced to their prefix, so neither the slug nor
the version lands in a log.
Hosted: your check_stack arguments (the versions you run) pass through
the server's memory to produce the same answer, and are not written down.
Here is what each layer on the way keeps:
The hosted MCP process itself logs only its startup line — a normal request adds nothing.
The upstream API's request log writes one line only when the caller sends a
traceparent, and that line carries a normalized endpoint label and the trace id — never a path, query, or body.The front-door access log strips query strings, reduces
/v1/releases/…and/v1/upgrade/…paths to their prefix, masks caller IPs, and has no field for request bodies.
The hosted endpoint runs with its audit stream off, and I keep it off — not
recording request content is the operating stance for that endpoint. One
boundary I do not control: connection metadata on the CDN leg
follows the CDN provider's own policy. If your requirements rule out that transit,
self-host: then only project slugs leave your infrastructure on a
check_stack call.
Self-hosting adds the opposite capability: an opt-in audit stream
(MCP_AUDIT=metadata or full) that records who called which tool, emitted
inside your own infrastructure into your own collectors. The hosted endpoint
has none by design. Details in the install guide.
Documentation
Install & usage — hosted endpoint · local stdio · in-cluster (Helm) · kagent (한국어 · 日本語)
Helm chart — values, kagent toggle (한국어 · 日本語)
kagent example — manifests + ratatosk-agent (한국어 · 日本語)
Upstream API
This server is a thin client over the public REST API. If you would rather
call it directly, GET /v1 on ratatosk.io describes itself. No API key; rate
limited at 1200 requests per minute per IP.
Data & terms
The data is served free of charge by ratatosk.io — a term that may change,
with advance notice — under its terms of service.
Analyses are AI-generated reference information with no warranty — check the
original release notes before acting, especially when an agent acts on your
behalf. Original notes belong to their respective projects; responses that
carry a full note include an attribution notice (raw_notes_notice).
License
The code in this repository is licensed under Apache-2.0.
Available Tools
7 toolschanges_by_entityARead-only
Reverse index: every change touching one exact identifier — a CVE id, CRD, feature gate, flag, metric, config field, or dependency. Case-insensitive. Call this when you have a specific identifier (e.g. from a manifest or advisory) and want to know what changed around it.
| Name | Required | Description | Default |
|---|---|---|---|
| kind | No | optional: api|crd|feature_gate|flag|metric|config_field|extension|dependency|cve|advisory|subsystem | |
| name | Yes | exact identifier to look up: CVE id, CRD, feature gate, flag, metric, config field, dependency |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint annotation already signals safety, and the description adds useful behavioral detail beyond it: exact match, case-insensitivity, and the reverse-index nature of the lookup. It does not mention output ordering or pagination, but for a straightforward read-only lookup this is acceptable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences, front-loaded with the core concept, and every sentence contributes meaning: what it does, matching behavior, and when to use it. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple lookup tool with two parameters and no output schema, the description gives enough context: purpose, identifier types, matching behavior, and usage trigger. It could mention pagination or result contents, but it is not a critical gap for this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both 'kind' and 'name' well. The description reinforces exact-identifier semantics and case-insensitivity but adds little beyond what the parameter descriptions already provide.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb/resource framing: 'Reverse index: every change touching one exact identifier' and enumerates supported identifiers (CVE, CRD, feature gate, etc.). This clearly distinguishes it from siblings like list_changes or get_release, which are broader or differently scoped.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly says 'Call this when you have a specific identifier... and want to know what changed around it,' giving a clear use case. It does not name alternatives or exclusion cases, but the context is sufficiently clear versus the sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_stackARead-only
Check the user's running component versions against known changes. Versions are compared INSIDE THIS SERVER PROCESS — only project slugs are sent upstream, and this tool never calls the server-side /v1/upgrade endpoint. Run the server yourself and running versions never leave your infrastructure; on the hosted endpoint they transit server memory only and are not logged. Returns, per component, the changes from releases NEWER than the running version (the upgrade path). Default is a briefing: summary (new_changes, distinct_matters, by_severity, by_family, by_bucket), then the items split by what the caller must do — action_required applies to everyone, check_config applies only if its applies_if holds against the running configuration (resolve it before recommending; an unmet condition is not a reason to upgrade, it is a precondition for later — the entry's version is the minimum to be on before enabling that feature). The split comes from the server's bucket field, the SAME rule the website and the weekly email use. Repeat appearances of one matter_key (the same issue fixed on several release branches) collapse into one entry, and same_matter_also_addressed_in names every other release on record that carried it. Branch-aware: a matter already fixed at or below the running version ON THE RUNNING BRANCH is excluded (the install has it), counted in note — so a backport visible on a newer branch is not reported as outstanding work. Line-aware: a repository can publish separate products or channels (containerd api/, Flatcar lts vs stable, openfeature flagd vs core) and there is NO version order between lines, so only the line your version belongs to is compared — pass the tag as published, prefix included ("flagd/v0.16.1", "lts-4081.3.9"), or the wrong line is compared. Pass version_source per component (where you read the version — e.g. a daemonset image tag, or that the user stated it): it is echoed back as an audit trail. This server cannot see your environment, so it cannot verify a version or its source; a running version older than every release on record is flagged in note, which is the only cross-check available here. Use detail:"full" for every change verbatim in relevant_changes (capped at 50 per component with relevant_changes_omitted — narrow with severity_min or target_version), target_version to limit to one upgrade hop, severity_min to filter. Components with zero changes carry tracked:true|false — tracked:false means the project is NOT covered by ratatosk, so the absence of changes is no-coverage, not safety. Drill down with get_release or changes_by_entity.
| Name | Required | Description | Default |
|---|---|---|---|
| detail | No | brief (default): summary + the items to act on, split by bucket; full: every change verbatim | |
| components | Yes | the running stack to check | |
| severity_min | No | only changes at or above this severity: info|low|medium|high|critical |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes well beyond the readOnlyHint annotation: it states that versions are compared inside the server process, that only project slugs are sent upstream, that /v1/upgrade is never called, and that running versions are not logged. It also discloses branch-aware and line-aware comparison behavior, the tracked:false no-coverage meaning, and the 50-item cap with relevant_changes_omitted.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but information-dense; every sentence carries behavior an agent must know, and the core purpose is front-loaded. It is not formatted with bullets or section breaks, which makes it harder to scan, but there is little to no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the full burden of explaining return values, and it does so thoroughly: summary fields, bucket split, action_required vs check_config, matter_key collapsing, note flags, tracked semantics, and follow-up drill-down tools. It also anticipates common pitfalls like wrong line prefixes and target versions at or below the running version.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Even though schema coverage is 100%, the description adds critical parameter semantics: version must be passed exactly as published with its line prefix, target_version only applies when strictly above the running version, version_source is echoed as an audit trail, and severity_min filters by severity. It also explains the detail:'full' behavior and the omission cap, which the schema alone does not convey.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Check the user's running component versions against known changes.' It then states exactly what is returned — per-component changes from releases newer than the running version — which clearly distinguishes this stack-level check from sibling drill-down tools like get_release and changes_by_entity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear usage context: use it when you have running component versions and need the upgrade path, and it explains how to shape results with detail, target_version, and severity_min. It explicitly points to alternatives at the end ('Drill down with get_release or changes_by_entity'), though it does not enumerate when list_changes or list_projects would be the better choice.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_matterARead-only
Every release in which one matter appeared, oldest first. Take matter_key verbatim from a change (case-sensitive, contains '/' and ':'). Use it to answer 'which version fixes this for MY branch' and 'have I already handled this'. Why every occurrence and not just the newest: the same containerd security roll-up landed on five branches carrying 2, 4 and 10 advisories respectively — told only the newest, someone on the 2-advisory branch would assume they were fully covered. Set include_all for the routine record too (mostly bot dependency bumps).
| Name | Required | Description | Default |
|---|---|---|---|
| matter_key | Yes | the matter_key taken verbatim from a change (case-sensitive; contains '/' and ':') | |
| include_all | No | also include the routine record (mostly bot dependency bumps); off by default |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the description only needs to add behavioral context. It does so by specifying ordering (oldest first), the effect of include_all (routine bot-bump records), and a concrete rationale for returning all releases. It does not contradict annotations, and provides useful context beyond the safe-read signal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with a clear purpose and each sentence adds value. However, the containerd roll-up rationale is fairly long for a two-parameter read tool, making the description more verbose than necessary, though the detail is meaningful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple tool shape and absent output schema, the description sufficiently covers what is returned (every release, oldest first), when to use it, and how the include_all flag changes the result. No significant gaps remain for an AI agent to select and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description largely restates what the schema already says about matter_key (verbatim, case-sensitive, contains '/' and ':') and include_all (routine records, off by default), adding no new parameter-level meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence clearly states the operation: list every release in which a matter appeared, oldest first. It also distinguishes this from sibling tools like list_releases or get_release by focusing on a single matter across releases.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly identifies the questions this tool answers: 'which version fixes this for MY branch' and 'have I already handled this'. It also explains why returning every occurrence matters, which guides when to use this tool, though it does not name alternative tools explicitly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_releaseARead-only
One reviewed release: envelope (summary, source URL, release URL) plus all its changes. changes=[] means the release was read and nothing operator-facing was recorded — auditable silence, not a gap. Each change carries family (security|breaking|deprecated), actionability, bucket (act now / check first / plan ahead), a machine-evaluable applies_if, cited advisories with CURRENT severity, and the verbatim quote it came from. by_bucket/by_family/max_severity summarize the same set; notes_total counts routine entries not shown individually. Omit version for the latest reviewed release of the project. version is accepted with or without the leading 'v' (projects disagree on the spelling); a wrong tag returns an error listing the project's recent reviewed tags — retry with one of those. Set include_raw for the original release note body (raw_notes).
| Name | Required | Description | Default |
|---|---|---|---|
| project | Yes | project slug, e.g. envoy | |
| version | No | release tag exactly as published, e.g. v1.38.3; omit for the latest reviewed release | |
| include_raw | No | also return the original release note body as raw_notes — judge from the source instead of the extracted changes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark the tool as read-only, and the description adds valuable behavioral details: changes=[] represents auditable silence rather than a gap, each change includes family/actionability/bucket/applies_if/advisories/verbatim quote, and summaries are derived from the same set. It also discloses error behavior for an invalid version, exceeding what annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Though dense, every sentence earns its place: core purpose, edge-case meaning of changes=[], field enumeration, version semantics, and include_raw. There is no filler or redundancy, and the most important information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description fully documents return values: envelope fields, change fields, summary fields, notes_total, and raw_notes. It also explains error handling and parameter behavior, making the tool self-sufficient for an agent to select and invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but the description enriches every parameter: project slug example, version can be omitted for latest, 'v' prefix tolerance, wrong-tag error behavior, and include_raw returning raw_notes. This goes well beyond the schema's per-parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'One reviewed release' and immediately specifies the return shape: an envelope (summary, source URL, release URL) plus all changes. This clearly identifies the tool as fetching a single release's full detail, distinguishing it from siblings like list_releases, with a specific verb and resource.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides concrete usage guidance: omit version for the latest reviewed release, version accepts with or without a leading 'v', and a wrong tag returns an error listing recent reviewed tags for retry. It does not explicitly name alternatives (e.g., 'use list_releases to see all'), so it falls short of full when/when-not coverage, but context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_changesARead-only
Incremental SYNC feed of release changes for CNCF/cloud-native projects. Ordered by seq ascending — OLDEST analyzed first, so a single page is NOT the newest data; page through with since= until next_since comes back null. Built for keeping a local copy up to date. For 'what is the latest release of X' or 'recent releases of X', use list_releases or get_release (omit version for the newest) instead. Filter by project, by family (security|breaking|deprecated — what kind of thing it is) and by bucket (action|check|plan — how to act now). The routine record (bot dependency bumps and the like) is excluded by default. Two fields matter most: applies_if tells you whether an entry is yours to act on — when its targets are present, look them up in the running configuration instead of parsing the sentence; matter_key is the identity of the underlying matter across releases, which get_matter expands.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | page size, default 20, max 200 — raise it when you are syncing a local copy, not when you are answering one question | |
| since | No | cursor: return changes with seq greater than this | |
| bucket | No | action|check|plan — how to act now. action applies to everyone; check only if applies_if matches your setup; plan is announced for later | |
| family | No | security|breaking|deprecated — what kind of thing it is | |
| project | No | project slug filter, e.g. envoy, istio, cilium |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already mark readOnlyHint=true, and the description adds substantial behavior beyond that: ascending seq order, oldest-first semantics, next_since-based pagination until null, default exclusion of routine records, and the roles of applies_if and matter_key. This gives an agent a clear model of how the feed behaves, not just what it does.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but every sentence carries information: purpose, ordering, pagination, alternatives, filter semantics, and key response fields. It is front-loaded with the core sync behavior. It could be slightly more scannable, but it is not padded or redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 5-parameter tool with no output schema and no enums, the description covers the essential context: how to page, when to stop, which filters to use, what the key response fields mean, and how to route to sibling tools. An agent has enough to invoke it correctly and interpret the response meaningfully.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so a baseline of 3 applies. The description adds meaningful value by explaining bucket as 'how to act now' with per-bucket guidance, family as 'what kind of thing it is', and limit as something to raise for syncs but not one-off questions. This goes beyond the schema's field labels.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a precise statement: 'Incremental SYNC feed of release changes for CNCF/cloud-native projects.' It names the verb, resource, and ordering semantics, and explicitly distinguishes itself from list_releases/get_release for 'latest release' queries. This makes the tool's purpose unmistakable and clearly separate from siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly says when to use the tool ('Built for keeping a local copy up to date') and when not to ('For what is the latest release... use list_releases or get_release'). It also explains pagination with since and when to stop, and clarifies filters and the default exclusion of routine records.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_projectsARead-only
Every project ratatosk tracks: slug (the canonical id all other tools take), name, tier (graduated|incubating), category, analyzed_releases; image_aliases where a project runs under other names in clusters (an image or workload matching an alias belongs to that project at the version its tag says), and cluster_core:true on the cluster substrate (control plane, datastore, DNS, runtime, CNI/dataplane) — every cluster_core project present in a cluster belongs in its check_stack call. Some cluster_core entries carry a visibility hint (how the component is observed and where it can legitimately be unreadable — e.g. etcd may live outside the k8s API): an unreadable one is reported as unchecked, never guessed. Small response, no arguments — call this FIRST when you are unsure of a slug instead of guessing (a wrong slug shows up as tracked:false in check_stack).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, and the description adds behavioral context: it explains how cluster_core projects are included, how visibility hints work, and that unreadable components are reported as unchecked, never guessed. This goes beyond the annotation by detailing edge-case behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but information-rich, covering all key aspects in a single paragraph. It is front-loaded with the core purpose and then details edge cases. Slightly long but every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no parameters and no output schema, the description fully compensates by explaining the return fields, the meaning of cluster_core, visibility hints, and the recommended usage pattern. It is complete for an agent to use correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and the schema coverage is 100% (no params). The description explains the output fields in detail, which is valuable since there is no output schema. It compensates for the lack of structured output documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists all projects tracked by ratatosk, specifying the fields returned (slug, name, tier, category, analyzed_releases, image_aliases, cluster_core) and the purpose of each. It distinguishes itself from siblings by emphasizing it is the canonical source for slugs and should be called first when unsure.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly instructs to call this tool FIRST when unsure of a slug, and warns against guessing (a wrong slug shows up as tracked:false in check_stack). This provides clear when-to-use guidance and differentiates from sibling tools like check_stack.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_releasesARead-only
The newest N reviewed releases of one project, as light summaries (version, released/reviewed dates, changes_total, counts by bucket and by family, max advisory severity, notes_total). THE tool for 'recent releases of X' / 'what changed in X lately' — newest first, unlike the list_changes sync feed which walks oldest-first by seq. changes_total=0 means the release was read and is routine (auditable silence). Drill into a row with get_release(project, version) for the full changes.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | how many recent releases, default 5, max 20 | |
| project | Yes | project slug, e.g. istio |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses key behavioral traits such as the newest-first ordering, the meaning of changes_total=0 as 'auditable silence' (routine read), and the limitation to N newest releases. It also mentions the light summary format. While annotations already indicate read-only, it adds meaningful context beyond that, though it could also note potential pagination or lack thereof.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, front-loaded with the core purpose, and every sentence adds value: it defines the output fields, contrasts with list_changes, clarifies changes_total semantics, and provides a pointer to get_release for full details. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity, the description is comprehensive: it specifies the output fields, ordering, the meaning of a zero changes_total, and a pointer to get_release for full details. Annotation provides additional safety context (read-only), and the schema covers parameters fully. No gaps are evident.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents both parameters (project and limit) with examples and defaults, achieving 100% coverage. The description does not add additional parameter semantics beyond what is in the schema, so the baseline of 3 is appropriate as the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as returning the newest N reviewed releases with a specific set of summary fields, and it is explicitly contrasted with list_changes, which walks oldest-first. It states the verb 'list' and the resource 'releases', making its purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It specifies when to use this tool ('recent releases of X' / 'what changed in X lately') and explicitly differentiates it from the sibling tool list_changes, which is oldest-first by seq, providing a clear alternative and exclusion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
2 tool updates
v0.9.0- Changed
check_stack3 fields changed- added
Input schema / properties / components / anyOfAdded value: +[ + { + "description": "the running stack to check", + "items": { + "additionalProperties": false, + "properties": { + "project": { + "description": "project slug, e.g. envoy", + "type": "string" + }, + "target_version": { + "description": "optional upgrade destination, strictly above the running version: only changes with running < version <= target are returned; a target at or below running would make that range empty and is ignored with a note", + "type": "string" + }, + "version": { + "description": "the version currently running, exactly as the project publishes it — keep any release-line prefix (flagd/v0.16.1, lts-4081.3.9, api/v1.11.1), since only that line is compared. e.g. v1.36.8", + "type": "string" + }, + "version_source": { + "description": "where the running version was read, e.g. daemonset/cilium image tag or a user-provided value; echoed back so the claim can be audited", + "type": "string" + } + }, + "required": [ + "project", + "version" + ], + "type": "object" + }, + "type": [ + "null", + "array" + ] + }, + { + "description": "the same array JSON-encoded as a string; accepted, but send the array", + "type": "string" + } +] - removed
Input schema / properties / components / itemsRemoved value: -{ - "additionalProperties": false, - "properties": { - "project": { - "description": "project slug, e.g. envoy", - "type": "string" - }, - "target_version": { - "description": "optional upgrade destination, strictly above the running version: only changes with running < version <= target are returned; a target at or below running would make that range empty and is ignored with a note", - "type": "string" - }, - "version": { - "description": "the version currently running, exactly as the project publishes it — keep any release-line prefix (flagd/v0.16.1, lts-4081.3.9, api/v1.11.1), since only that line is compared. e.g. v1.36.8", - "type": "string" - }, - "version_source": { - "description": "where the running version was read, e.g. daemonset/cilium image tag or a user-provided value; echoed back so the claim can be audited", - "type": "string" - } - }, - "required": [ - "project", - "version" - ], - "type": "object" -} - removed
Input schema / properties / components / typeRemoved value: -[ - "null", - "array" -]
- Changed
list_changes1 field changed- changed
Input schema / properties / limit / descriptionPrevious value: -"page size, default 50, max 200"New value: +"page size, default 20, max 200 — raise it when you are syncing a local copy, not when you are answering one question"
7 tool updates
v0.7.5- Added
changes_by_entity - Changed
check_stack4 fields changed- changed
Input schema / properties / components / items / properties / target_version / descriptionPrevious value: -"optional upgrade destination, strictly above the running version: only facts with running < version <= target are returned; a target at or below running would make that range empty and is ignored with a note"New value: +"optional upgrade destination, strictly above the running version: only changes with running < version <= target are returned; a target at or below running would make that range empty and is ignored with a note" - changed
Input schema / properties / components / items / properties / version / descriptionPrevious value: -"the version currently running, e.g. v1.36.8"New value: +"the version currently running, exactly as the project publishes it — keep any release-line prefix (flagd/v0.16.1, lts-4081.3.9, api/v1.11.1), since only that line is compared. e.g. v1.36.8" - changed
Input schema / properties / detail / descriptionPrevious value: -"brief (default): summary + critical/high facts + one-liners for the rest; full: every fact verbatim"New value: +"brief (default): summary + the items to act on, split by bucket; full: every change verbatim" - changed
Input schema / properties / severity_min / descriptionPrevious value: -"only facts at or above this severity: info|low|medium|high|critical"New value: +"only changes at or above this severity: info|low|medium|high|critical"
- Removed
facts_by_entity - Added
get_matter - Changed
get_release1 field changed- changed
Input schema / properties / include_raw / descriptionPrevious value: -"also return the original release note body as raw_notes — judge from the source instead of the extracted facts"New value: +"also return the original release note body as raw_notes — judge from the source instead of the extracted changes"
- Added
list_changes - Removed
list_facts
1 tool update
v0.4.2- Changed
check_stack1 field changed- changed
Input schema / properties / components / items / properties / target_version / descriptionPrevious value: -"optional upgrade destination: only facts with running < version <= target are returned"New value: +"optional upgrade destination, strictly above the running version: only facts with running < version <= target are returned; a target at or below running would make that range empty and is ignored with a note"
6 tool updates
v0.4.1- Changed
check_stack1 field changed- added
Input schema / properties / components / items / properties / version_sourceAdded value: +{ + "description": "where the running version was read, e.g. daemonset/cilium image tag or a user-provided value; echoed back so the claim can be audited", + "type": "string" +}
- Added
facts_by_entity - Added
get_release - Added
list_facts - Added
list_projects - Added
list_releases
2 tool updates
v0.4.0- Removed
facts_by_entity - Removed
get_release
1 tool update
v0.3.7- Removed
list_facts
2 tool updates
v0.3.6- Added
facts_by_entity - Added
list_facts
2 tool updates
v0.3.5- Added
check_stack - Removed
list_facts
2 tool updates
v0.1.1- First observed
get_release - First observed
list_facts
TDQS
Each tool has a distinct role: project discovery, release summaries, release detail, change feed, matter expansion, entity reverse lookup, and running-stack comparison. The descriptions explicitly call out when not to use a particular tool, which removes most ambiguity.
Six of seven tools follow a clear verb_noun pattern: get_release, get_matter, list_releases, list_changes, list_projects, check_stack. The exception is changes_by_entity, which is a noun phrase rather than a verb-led name, but all names are still lowercase snake_case and otherwise predictable.
Seven tools is a well-scoped size for this domain. Each tool covers a distinct part of the release-change and upgrade-analysis workflow, and none feels redundant or superfluous.
The toolset covers the full workflow: discovering tracked projects, listing releases, reading release details, syncing change feeds, expanding matters across releases, doing entity-based reverse lookup, and checking a running stack against known changes. Drill-down paths are explicit and there are no obvious dead ends.
Maintenance
Related MCP Connectors
Check exact npm/PyPI upgrades for evidence-backed breaking changes; query APIs and components.
Latest versions, LTS windows, and EOL dates for 300+ products. Fresh ground truth for stale models.
An agent-friendly API for product changelogs. A unified registry via CLI, API, or MCP.
Changelogs for apps, games and operating systems. Ask what shipped since the version you run.
Related MCP Servers
- AlicenseAqualityAmaintenanceDependency intelligence for AI agents. CVE scanning, health checks, upgrade planning.95172Apache 2.0
- FlicenseNot gradedqualityCmaintenanceEnables querying the CNCF landscape to search for projects, get detailed information, GitHub metrics, maturity status, and case studies for technology decision support.3-
- FlicenseNot gradedqualityDmaintenanceProvides breaking changes analysis for libraries across multiple languages, enabling version upgrade planning, dependency audits, and migration reports through MCP tool access and expert workflows.-

Modelmeterofficial
AlicenseNot gradedqualityCmaintenanceEnables AI agents to query model pricing, deprecations, and cost estimates via a machine-readable changelog of the AI stack.1MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/garlicKim21/ratatosk-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server