Query logs from a Kubernetes pod. Returns sanitized logs with PII/secrets redacted.

Args: pod_name: Pod name or regex pattern (e.g. 'payment-service' or 'payment-.*') namespace: Kubernetes namespace container: Container name filter (optional) timeframe_minutes: How many minutes of logs to retrieve (1-1440) limit: Maximum number of log lines (1-500)

Execute a custom log query (LogQL for Loki, Datadog syntax, or CloudWatch Insights).

Args: query: Backend-native query string timeframe_minutes: How many minutes of logs to retrieve (1-1440) limit: Maximum number of log lines (1-500)

Get metrics for a Kubernetes pod (CPU, memory, restarts, network).

Args: pod_name: Pod name or regex pattern namespace: Kubernetes namespace metric_type: One of: cpu, memory, restarts, network_rx, network_tx

Execute a raw PromQL query against Prometheus.

Args: query: PromQL expression range_query: Set to true for a time-series range query timeframe_minutes: Time range for range queries (1-1440) step: Step interval for range queries (e.g. '1m', '5m', '1h')

Get overall Kubernetes cluster health: node count, pod status, CPU/memory utilization.

Retrieve a distributed trace by ID from Tempo.

Args: trace_id: Hexadecimal trace ID (16-32 characters)

Search for distributed traces in Tempo by service, operation, or tags.

Args: service_name: Filter by service name operation: Filter by operation name tags: Filter by span tags (key-value pairs) min_duration: Minimum trace duration (e.g. '100ms', '1s') max_duration: Maximum trace duration timeframe_minutes: How far back to search (1-1440) limit: Maximum traces to return (1-100)

Analyze logs for a service — detects errors, anomalies, and patterns with recommendations.

Args: service_name: Service/pod name or regex pattern namespace: Kubernetes namespace timeframe_minutes: How many minutes of logs to analyze (1-1440) limit: Maximum log lines to analyze (1-500)

Build a chronological incident timeline combining logs, metrics, and traces.

Args: service_name: Affected service name namespace: Kubernetes namespace timeframe_minutes: Time window to analyze (1-1440)

Enrich an alert with full context: recent logs, metrics, traces, and recommendations.

Args: alert_name: Name of the alert that fired service_name: Affected service name namespace: Kubernetes namespace timeframe_minutes: Context window in minutes (1-60)

Get resource cost attribution by namespace with optimization suggestions. Note: Requires Prometheus backend. Cost estimates are approximate.

Args: namespace: Filter by namespace (optional — omit for all namespaces) timeframe_minutes: Usage averaging window (1-1440)

Check SLO compliance — error budgets, burn rate, and availability vs. latency targets.

Args: service_name: Service to check namespace: Kubernetes namespace availability_target: Target availability (0.0-1.0, default 99.9%) latency_target_ms: Target latency in milliseconds latency_percentile: Latency percentile to measure (default p99) window_hours: Measurement window in hours (1-720)

Search AWS CloudTrail events by keyword, event name, username, or resource. Requires cloudtrail:LookupEvents IAM permission.

Args: keyword: Search term matched against event name event_name: Exact CloudTrail event name (e.g. 'DeleteDeployment') username: Filter by IAM username or role session name resource_name: Filter by AWS resource name or ID timeframe_minutes: How far back to search (1-1440) limit: Maximum events to return (1-50)

Get the full CloudTrail audit trail for a specific AWS resource. Shows who created, modified, and deleted it. Requires cloudtrail:LookupEvents IAM permission.

Args: resource_id: AWS resource ID or ARN timeframe_days: How many days back to search (1-90) limit: Maximum events to return (1-50)

Get the configuration-change history for one AWS resource, with field-level diffs.

Answers "what actually changed on this resource, and when". CloudTrail records that an API call happened; AWS Config records the resulting state, so this is what tells you a security group's ingress rules went from one value to another.

Each change carries a capture time and a config_item_id for citation, plus the resources AWS Config considers related — useful for establishing whether a changed resource is actually connected to a failing one.

Requires AWS Config to be enabled and config:GetResourceConfigHistory.

Args: resource_type: AWS Config resource type, e.g. 'AWS::EC2::SecurityGroup' resource_id: Resource ID, e.g. 'sg-0123456789abcdef0' timeframe_hours: How far back to look (1-720) limit: Maximum configuration snapshots to retrieve (1-100)

Get AWS Config compliance status for resources. Shows drift and non-compliant rules. Requires AWS Config to be enabled and config:Describe* IAM permissions.

Args: resource_id: Specific resource ID (optional — omit for all rules summary) resource_type: AWS resource type e.g. 'AWS::EC2::Instance' (optional) compliance_filter: Filter by COMPLIANT, NON_COMPLIANT, or NOT_APPLICABLE

Get vulnerability findings for a container image in ECR. Uses AWS Inspector v2 if enabled, falls back to ECR basic scan. Requires ecr:DescribeImageScanFindings and inspector2:ListFindings IAM permissions.

Args: repository_name: ECR repository name image_tag: Image tag to check (default: latest) severity_filter: Severities to include e.g. ['CRITICAL', 'HIGH']

Get database performance insights for RDS or ElastiCache.

Args: db_identifier: RDS instance/cluster ID or ElastiCache cluster ID db_type: 'rds' or 'elasticache' timeframe_minutes: Time window to analyze (1-1440)

Get Kubernetes events for a namespace or pod. Answers 'why is my pod pending/OOMKilled/CrashLoopBackOff?' Requires rbac.enabled=true in Helm values.

Args: namespace: Kubernetes namespace pod_name: Filter events for a specific pod (optional) event_type: Filter by 'Warning' or 'Normal' (optional) timeframe_minutes: How far back to look (1-1440) limit: Maximum events to return (1-500)

Get HPA scaling history and current autoscaler status for deployments. Requires kube-state-metrics for historical data.

Args: namespace: Kubernetes namespace deployment_name: Filter to a specific deployment (optional) timeframe_minutes: How far back to look (1-1440)

Get Kubernetes node pressure conditions, resource capacity, and eviction status. Identifies nodes with MemoryPressure, DiskPressure, or PIDPressure.

Get recent alerts and active silences from Prometheus Alertmanager. Requires MCP_ALERTMANAGER_URL to be configured.

Args: service_name: Filter alerts by service name (optional) namespace: Filter alerts by namespace label (optional) timeframe_minutes: How far back to look (1-1440) include_silences: Whether to include active silences (default: true)

Get recent Kubernetes deployment changes — what was rolled out in the last N minutes. Useful for correlating deployments with incidents.

Args: namespace: Kubernetes namespace timeframe_minutes: How far back to look (1-1440)