Log10x MCP Server
OfficialSupported as a bring-your-own metrics backend (LOG10X_CUSTOMER_METRICS_URL / _TYPE / _AUTH) for per-pattern volume and cost series.
Backfills per-pattern log volume and cost metrics into Datadog (configured via DD_API_KEY / DD_APP_KEY / DD_SITE) through the log10x_backfill_metric tool, so cost views light up alongside existing Datadog dashboards.
GitHub sign-in mints and stores a Log10x API key (log10x_signin_start / log10x_signin_complete, log10x_login_status), and a GitHub repo plus local path (LOG10X_GH_REPO / LOG10X_GITOPS_REPO_PATH) can be wired up for GitOps-aware configuration tools.
Grafana Cloud is supported as a bring-your-own metrics backend (LOG10X_CUSTOMER_METRICS_URL / _TYPE / _AUTH) for per-pattern volume and cost series.
Reads and remote-writes per-pattern volume and cost series to a Prometheus backend using PROMETHEUS_REMOTE_WRITE_URL / PROMETHEUS_URL, enabling per-pattern metric backfill and queries.
Supported as a bring-your-own metrics backend (LOG10X_CUSTOMER_METRICS_URL / _TYPE / _AUTH) for per-pattern volume and cost series.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Log10x MCP ServerWhy did our log costs spike this week?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Log10x MCP Server
Ask your AI assistant about log costs, log patterns, and incidents in plain English, and get structured answers backed by real per-pattern metrics. "Why did our log costs spike this week?", "what's driving payments-svc volume?", "pull the payment_retry events for acme-corp from Jan 15 to Apr 15." The server exposes the 10x platform to Claude and any MCP-compatible assistant as a set of tools.
10x groups your logs by message type. The same lines repeat over and over with only the timestamp or request ID changing, so 10x collapses each flood of near-identical lines into one message type and ranks them by volume and cost. That is how the answers stay exact instead of best-effort clustering, no regex required.
This server is open source under MIT. A Log10x product license (API key) unlocks the account-scoped tools; without one, the server boots read-only against a public demo dataset so the tools can be explored immediately.
What you can ask
You say | What happens |
"Where do I start? Help me cut log costs." | A guided menu asks what you want (cut cost, investigate, install) and routes to the right next step, plus what's new and what changed. |
"Sign me in." / "Who am I connected as?" | GitHub sign-in mints and stores an API key, and shows the environments your account can reach. |
"Show me how to install this on my stack." | Paste-ready setup steps for your own pipeline, fetch-back wiring, and a recommended action per service. |
"Estimate savings on my data before I deploy." | A no-install savings report from a local log file or your existing log platform. |
"How much can I cut, and how much have I cut?" | Projected and realized savings with the per-pattern math behind every number. |
"What's driving my cost right now?" | The repeating message types and services driving volume and cost, and what moved week over week. |
"Why did payments-svc spike?" | A single-call investigation: timeline, correlated patterns, and the strongest temporal evidence, with confidence shown so nothing is presented as proven cause. |
"This message type is noise, cut it." | Sample, drop, compact, tier down, or offload a chosen message type, with examples and trend so the action is clear. |
"We are 100% Lambda, no cluster. Install there." | The install plan comes back for the serverless estate: the engine as a Lambda extension paired with the function's OTel collector, a CDK construct, and an AWS-native recurring tick over an S3 config plane. |
"Get me the actual events I offloaded." | Fetch the exact events back on demand from your own S3. |
"Recognize more of my message types." | Build a custom symbol library from your own logs so the engine finds more savings. |
Related MCP server: FOCUS MCP Server
Install
Claude Code
claude mcp add --transport stdio --env LOG10X_API_KEY=your-api-key log10x -- npx -y log10x-mcpVerify with /mcp. Omit the --env flag to run read-only against the public demo dataset.
Claude Desktop
Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"log10x": {
"command": "npx",
"args": ["-y", "log10x-mcp"],
"env": {
"LOG10X_API_KEY": "your-api-key"
}
}
}
}Cursor, Windsurf, and other MCP clients
Add an mcpServers entry of the same shape: "command": "npx", "args": ["-y", "log10x-mcp"], and LOG10X_API_KEY in env. Omit the key to run read-only demo mode.
Full setup walkthrough: https://doc.log10x.com/apps/mcp/
Credentials
Account-scoped tools need a Log10x API key. Two ways to get one:
GitHub sign-in: run
log10x_signin_start, complete the flow, thenlog10x_signin_complete. The key is stored for you.log10x_login_statusshows who you're connected as.Environment variable: set
LOG10X_API_KEYdirectly.
No key? The server boots read-only against the public 10x demo dataset (the same sample data the website console shows), so analysis, discovery, and the install advisors all work out of the box. Mutating tools are disabled in this mode so shared demo state stays untouched. Set LOG10X_DEMO_FALLBACK=off to boot into pure POC mode (savings estimates on your own files, no account). The mode is fixed at startup; restart the server to re-detect.
Environment variables
All optional. The common path is just LOG10X_API_KEY (or no key at all).
Variable | Purpose |
| Your Log10x API key. Omit to boot read-only on the public demo dataset. |
| API base URL override (default |
| Pin a specific environment id instead of autodiscovering from your account. |
| Set to |
| Set to |
| Point at your own metrics backend (Prometheus, Grafana Cloud, Mimir, Thanos, AMP) for BYO-metrics setups. |
| Datadog credentials for backfilling per-pattern metrics into Datadog. |
| Prometheus endpoints for backfilling and reading per-pattern series. |
| Base URL of your deployed Retriever query endpoint, for fetch-back (or set it with |
| Fetch-back query timeout (default 90000) and poll interval (default 1500). |
| Override the fetch-back auth header (defaults derive from the active environment). |
| S3 bucket names the offload tools manage. |
| Engine license key. Passed through to the engine on both the compile path and the local-engine run path ( |
| Path to an engine license file, the alternative to |
|
|
| Path to the local |
| Engine image for the run path in docker mode (default |
| Engine image shared by the run path and, as a fallback, |
| Compiler image for |
| GitHub repo and local path for GitOps-aware config tools. |
Connect your own data (optional)
10x keeps logs queryable without paying to index everything. The Receiver ships budget-overflow noise to your own S3, and the Retriever fetches those exact events back on demand when you need them. log10x_offload_add and log10x_retriever_register wire up the offload-and-fetch path; log10x_backfill_metric pushes per-pattern volume and cost series into your existing Datadog or Prometheus so the cost views light up alongside the rest of your dashboards.
Security
The server runs locally as a subprocess of your AI client. Only pre-aggregated metric queries (per-pattern volume and cost) leave the machine, never raw log content. Local triage with log10x_resolve_batch runs entirely on your machine over stdin and stdout. Connections to your own log platform use read-only credentials. Set LOG10X_MCP_READ_ONLY=true to refuse every mutating tool regardless of mode.
The fenced POC — provably offline
For an evaluation that has to be checkable rather than promised: MCP server and
log engine in one container started with --network none, over a log sample
you exported yourself with your own credentials.
docker run -i --rm --pull=never --network none --hostname localhost \
--cap-drop ALL --security-opt no-new-privileges \
-v "$PWD/poc/logs:/data:ro" -v "$PWD/poc/out:/out" \
-e TENX_LICENSE_KEY -e TENX_AIRGAPPED=true log10x/poc:localThere is no npx variant of this line, and that is not an oversight. npx
resolves and executes a package at run time, and a package's postinstall
script is unconfined code running with whatever network the host has — the
exact thing the fence exists to rule out. Everything in the image is baked at
build time; nothing is installed when the container starts.
The licence is minted by you, with one visible curl, before any log data is
in scope — in this profile the server never mints, and a missing licence fails
with those instructions rather than with a fetch. The log sample is exported
by you: log10x_emit_sample_plan renders a read-only shell script per
analyzer that you read once and run outside the container.
Verify it with one docker inspect line, then settle it by turning Wi-Fi off
and running the analysis again.
Full walkthrough, including what to check in the export script and the residuals we do not paper over: docs/fenced-poc.md.
Open source and license
MIT. Published on npm as log10x-mcp (Node 20+). The source is public so the behavior behind every tool can be read directly. Account-scoped tools require a Log10x product license (API key); the public demo dataset needs none.
MCP clients run the server as a long-lived child process. After upgrading the package, restart the client so the new version takes effect.
Documentation
Available Tools
55 toolslog10x_advise_installInstall wizardARead-onlyIdempotent
Progressive install wizard for the Log10x Reporter / Receiver on Kubernetes. This is the SINGLE entry point for installs — call it first. Do NOT call log10x_doctor or log10x_login_status as a pre-flight; the wizard handles login state, license acquisition, and demo-mode fallback internally, and surfacing the doctor's optional-capability warnings (Retriever, Datadog backfill, cross-pillar metrics) ahead of the install confuses users with concepts that are unrelated to deploying the Reporter/Receiver. Takes a snapshot_id from log10x_discover_env and walks the user through five decisions, asking one at a time and remembering each answer across turns (the snapshot's wizard session): (1) app — reporter (dedicated DaemonSet forwarder, zero-touch) or receiver (sidecar inside the user's existing forwarder); (2) forwarder — Receiver-only, auto-picked when one is detected, asked when multiple; (3) backends — array of metrics destinations, can be multiple (e.g., ["log10x", "datadog"] to report to both SaaS + own backend simultaneously); (4) airgapped — opt-in CISO-friction reducer, conflicts only with "log10x" in backends (engine sends NOTHING to log10x.com); (5) license_jwt — auto-fetched from /api/v1/license/demo if the user is not signed in, or from /api/v1/license with the persisted Auth0 token if they are. Each call merges new args into the session and either asks the next question (returning a markdown prompt) or emits the final install plan once all answers are in. Demo + airgapped surfaces a soft warning (engine downgrades to online mode on demo licenses). Plan is plan-only: emits helm commands + values.yaml; the user runs them. Tier prerequisites: none — this is a pre-install tool.
| Name | Required | Description | Default |
|---|---|---|---|
| app | No | Which Log10x app to install. **reporter** = a dedicated DaemonSet forwarder (zero-touch, runs alongside your existing forwarder); **receiver** = a sidecar plugged into your existing forwarder (filters/samples/compacts events in-flight). When omitted, the wizard asks the user. | |
| action | No | Plan scope when the wizard is ready to emit. Default: `all`. | |
| backends | No | Where the engine emits TenXSummary metrics. Multi-destination — a user can report to log10x SaaS AND their own backend simultaneously, e.g. `["log10x", "datadog"]`. Choices: **log10x** (optional Log10x-hosted backend, for evaluation), **datadog**, **elastic**, **cloudwatch**, **prometheus** (customer-owned). The wizard pre-fills detected backends from the snapshot. The only mutual exclusion is `airgapped: true` + `"log10x"` in this list. | |
| airgapped | No | When true, the Log10x agents send nothing to log10x.com — engine metrics, license re-validation, and update checks all go silent. Use to reduce CISO friction. Conflicts with `"log10x"` in `backends` (the wizard surfaces the conflict). **Demo licenses cannot actually run airgapped** — the engine downgrades to online mode with a warning. The wizard surfaces this softly when both are picked. | |
| forwarder | No | Receiver-only: which detected forwarder kind to sidecar into. Auto-uses the snapshot's detected forwarder when there's exactly one; the wizard asks when there are multiple. | |
| namespace | No | Target namespace. Default: snapshot.recommendations.suggestedNamespace. | |
| snapshot_id | Yes | ID returned by `log10x_discover_env`. The snapshot is cached for 30 min. | |
| release_name | No | Helm release name. Default: `my-<app>` (e.g., `my-reporter`). | |
| license_source | No | How the wizard should acquire the engine's license JWT. **Defaults to `"signin"`** when omitted — the wizard tries to mint a user-scoped license via the user's Auth0 session, and emits `signin_required` mode (chain through `log10x_signin_start` then re-invoke) when no session exists. Pass **`"demo"`** ONLY when the user explicitly asks for a quick 14-day anonymous demo (transient, can't run airgapped). Pass **`"paste"`** with `license_jwt_paste: "<jwt>"` when the user already has a JWT. | signin |
| license_jwt_paste | No | License JWT supplied by the user when `license_source: "paste"`. Mints from `POST /api/v1/license` (signed-in) or `POST /api/v1/license/demo` (anonymous). Maps to the chart's license Secret. | |
| backend_credentials | No | Per-backend credential configuration, keyed by backend kind (must be one of: log10x, datadog, elastic, cloudwatch, prometheus). **Only set for non-`log10x` backends** — `log10x` SaaS uses the license JWT and needs no extra credentials. Each entry has a `secretName` (the Kubernetes Secret the user creates out-of-band holding sensitive env vars like `DD_API_KEY`; default per backend is `<backend>-credentials`) and optional `plainValues` (overrides for non-sensitive env vars like `DD_SITE`). Example: `{ "datadog": { "secretName": "datadog-secret", "plainValues": { "DD_SITE": "us5.datadoghq.com" } } }`. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations (readOnlyHint/idempotentHint/openWorldHint) by disclosing cross-turn session state ('merges new args into the session and ... remembering each answer across turns'), the plan-only contract ('emits helm commands + values.yaml; the user runs them'), license acquisition paths, the demo+airgapped downgrade warning, and 'Tier prerequisites: none.' These are behavioral facts the annotations cannot convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded: purpose and the routing rule occupy the first two sentences. However it is a dense, long block with heavy parenthetical asides, and several schema-level details are restated, so it is efficient rather than tight.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 11-param, nested-object, stateful wizard with an output schema, the description covers the full decision flow, session semantics, prerequisites, and license paths. Since an output schema exists, no return-value explanation is needed, and nothing an agent needs to call it correctly appears to be missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds flow-level meaning the schema does not: the five-decision ordering, which decisions are auto-answered vs asked, the multi-destination example for backends, and the airgapped/log10x mutual exclusion. Useful added context without contradicting the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource up front ('Progressive install wizard for the Log10x Reporter / Receiver on Kubernetes') and explicitly positions itself against siblings: 'This is the SINGLE entry point for installs — call it first,' and names the tools it is not (log10x_doctor, log10x_login_status). An agent can discriminate this from the other ~50 log10x siblings without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use ('call it first'), explicit when-NOT-to-use ('Do NOT call log10x_doctor or log10x_login_status as a pre-flight'), and names the alternative flow when sign-in is needed (chain through log10x_signin_start then re-invoke). It even explains why the exclusion exists (doctor warnings confuse users). Nothing is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_advise_retrieverAdvise: Retriever installARead-onlyIdempotent
Given a DiscoverySnapshot (from log10x_discover_env), produce an install/verify/teardown plan for the Log10x Retriever. Unlike Reporter + Receiver, the Retriever has no forwarder choice — it is a standalone set of workloads (indexer + query-handler + stream-worker + filter CronJobs) that read from S3 via SQS and serve an HTTP query endpoint. The advisor detects existing AWS infra (input bucket with indexing-results/ prefix, four SQS queues — index/query/subquery/stream — and an IRSA-annotated ServiceAccount) from the discovery snapshot, or accepts explicit overrides. Preflight fails closed when any required resource is missing — the Retriever depends on Terraform-provisioned infra that this advisor does NOT create. Verify probes: pods Ready, indexer processing messages, query endpoint responding, S3 indexing-results/ getting writes, SQS queue drainage. Teardown uninstalls the Helm release but leaves AWS infra alone (Terraform's concern).
| Name | Required | Description | Default |
|---|---|---|---|
| action | No | Plan scope. Default: `all`. | |
| namespace | No | Target namespace. Default: snapshot.recommendations.suggestedNamespace. | |
| infra_mode | No | How the customer provisions AWS infra. **terraform** = emit .tf module block. **cli** = emit aws-cli commands. **existing** = infra already provisioned, wizard skips infra steps and jumps to helm values. Auto-detected as "existing" when the snapshot already has all four SQS URLs + IRSA. | |
| destination | No | Destination SIEM for the kept slice (e.g. `datadog`, `cloudwatch`, `splunk`). Gates SIEM down-tier sub-sections in the offload markdown. | |
| snapshot_id | Yes | ID returned by `log10x_discover_env`. The snapshot is cached for 30 min. | |
| iam_role_arn | No | IAM role ARN for the Retriever ServiceAccount (IRSA) (module output: iam_role_arn). Auto-detected from snapshot. | |
| index_bucket | No | S3 path for indexed results (include prefix). Default: `<index_source_bucket>/indexing-results/`. | |
| release_name | No | Helm release name. Default: `my-retriever`. | |
| license_source | No | How the wizard acquires the engine license JWT. Defaults to `"signin"` — emits `signin_required` mode when no Auth0 session exists. Pass `"demo"` for a 14-day anonymous JWT. Pass `"paste"` with `license_jwt_paste` to supply an existing JWT. | signin |
| index_queue_url | No | SQS URL for index operations (module output: index_queue_url). Auto-detected from snapshot. | |
| query_queue_url | No | SQS URL for query operations (module output: query_queue_url). Auto-detected from snapshot. | |
| stream_queue_url | No | SQS URL for stream operations (module output: stream_queue_url). Auto-detected from snapshot. | |
| license_jwt_paste | No | License JWT supplied by the user when `license_source: "paste"`. | |
| subquery_queue_url | No | SQS URL for sub-query operations (module output: subquery_queue_url). Auto-detected from snapshot. | |
| index_source_bucket | No | S3 bucket for source logs (module output: index_source_bucket_name). Auto-filled from snapshot.recommendations.retrieverS3Bucket when present. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover the safety profile (readOnly, idempotent, closed-world), yet the description adds substantial behavioral disclosure: the standalone workload set, S3/SQS dependency, fail-closed preflight when AWS infra is absent, the specific verify probes, and the fact that teardown leaves Terraform-managed infra untouched.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Dense but front-loaded, leading with the action and contrast to siblings before detailing behavior. The single-paragraph block is long, though nearly every sentence carries distinct information (preflight, verify, teardown semantics).
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 15-parameter tool with an output schema, the description supplies the behavioral context an agent needs — preflight conditions, verify probes, and teardown scope — without redundantly explaining return values. Nothing critical is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so parameters are already richly documented in the schema (infra_mode auto-detection, license_source modes, SQS queue outputs). The description adds only the general 'accepts explicit overrides' notion, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('produce an install/verify/teardown plan') and resource ('Log10x Retriever'), and explicitly contrasts itself with the Reporter + Receiver topological option. An agent can distinguish this from log10x_advise_install and the retriever query/probe siblings without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Clearly establishes the input context ('Given a DiscoverySnapshot from log10x_discover_env') and the override path, and notes preflight fails closed. However, it does not explicitly route between this tool and the sibling log10x_advise_install, leaving that alternative to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_baselineBaseline readinessARead-onlyIdempotent
Pre-flight readiness gate for cost-reduction tools. Verifies Reporter age (default 7d), pattern-coverage stability, and absence of acute anomalies before configure_engine / estimate_savings should run. Returns structured not_ready with the specific gate(s) that failed.
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | Output format. Always "summary" — the typed envelope. Field retained for backward-compat with callers that still pass `view: "summary"`. | summary |
| horizon | No | Lookback window for the baseline. 30d is the default and what `recommended_target_range` is calibrated against; 90d trades freshness for stability on lower-volume tenants. | 30d |
| destination | No | Destination SIEM. Required to project dollar baselines and decide which top contributors are compactable. Auto-detected from `env.analyzer` when omitted; falls back to `not_ready/no_destination` if neither is available. | |
| environment | No | Environment nickname for multi-env setups. | |
| statedDailyGb | No | Customer-stated daily SIEM ingest in GB. When supplied, the coverage gate compares observed bytes against this number; ≥80% passes, <80% returns `not_ready/coverage_low`. Omit to skip the coverage gate (the result still surfaces observed coverage as informational). | |
| monthly_volume_gb | No | What-if volume lens (forecast mode): model the environment at THIS monthly volume (decimal GB/month) instead of its measured volume. The real per-pattern shares and pattern mix are held fixed; only absolute bytes and dollars scale, by one uniform factor. Use it to project a prospect onto their own scale, or to forecast a real env after growth. Pairs with siem_lens. This is a PROJECTION: the envelope stamps volume_actual_gb vs volume_projected_gb and the scale factor, and the note points at the POC for the caller real patterns. | |
| effectiveIngestPerGb | No | Customer-negotiated $/GB for the destination. When supplied, baseline dollar projections use this rate and `rate_source` resolves to `customer_supplied`. Omit to fall back to vendors.json list pricing for the resolved destination (`rate_source: list_price`); omit BOTH this and `destination` to get a percent-first envelope (`rate_source: unset`, dollar fields null). |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover readOnlyHint/idempotent/openWorld, so the bar is lower, yet the description adds real behavior: default 7d Reporter window, coverage-stability and anomaly gates, and the failure contract (structured `not_ready` listing which gates failed). It doesn't specify latency or gate-combination logic, keeping it at a strong 4.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three front-loaded sentences: role first, then what it verifies, then the return contract. No redundant restatement of the name or title, and every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, the description needn't explain return values, and it nonetheless names the key `not_ready` outcome. Combined with the rich param schema, an agent has enough to invoke it correctly; only minor gate-interaction detail is absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents every parameter richly (horizon calibration, coverage gate threshold, projection semantics). The description body adds no parameter-level detail beyond 'default 7d,' so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource set ('Verifies Reporter age, pattern-coverage stability, absence of acute anomalies') and frames its role precisely as a 'pre-flight readiness gate.' It distinguishes itself from siblings by naming the downstream tools it gates (configure_engine / estimate_savings).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Clear context: run this before configure_engine / estimate_savings. However, it stops short of explicit when-not conditions (e.g., what to do if already run, or how it relates to sibling readiness tools like dependency_check or env_validate).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_commitment_reportCommitment reportARead-onlyIdempotent
CFO-facing weekly aggregate against a previously-opened commitment record. Applies a Bayesian Beta(2,2) prior to realized-savings estimates and renders a markdown summary suitable for sharing. REQUIRES a commitment record opened by a prior configure_engine apply; without one there is no baseline to report against.
| Name | Required | Description | Default |
|---|---|---|---|
| format | No | cfo_md=executive markdown with weekly chart and forward confidence; summary=typed envelope only; json=full structured data; weekly_digest=7-day operational digest from the recurring tick audit trail. | cfo_md |
| period | No | Reporting window. 30d=last 30 days, 90d=last 90 days, ytd=since Jan 1 of current year. | 90d |
| service | No | Service name to resolve a commitment by — used when commitment_id is omitted. When both are present, commitment_id wins. | |
| environment | No | Environment nickname; defaults to the active env. | |
| history_path | No | Override path to the recurring-tick JSONL audit trail (default: $LOG10X_RECUR_HISTORY_PATH or /tmp/log10x-recur-history.jsonl). Used only when format=weekly_digest. | |
| commitment_id | No | Commitment record id (created by log10x_configure_engine on PR-merge). If omitted, resolves the most recent commitment for the active service. | |
| action_intent_path | No | Override path to data/action-intent.json (relative to the gitops repo root or absolute). Used only when format=weekly_digest. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint/idempotentHint/openWorldHint=false, so safety is covered. The description adds real behavioral context beyond that: a Bayesian Beta(2,2) prior is applied to savings estimates, output is a markdown summary meant for sharing, and it fails without a prior commitment record.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, zero padding, with the tool's identity and the critical precondition front-loaded ahead of the methodology note.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
A read-only aggregate with 100% schema coverage and an output schema does not need return-value explanation, and the description supplies the key dependency and rendering method. Only the absence of alternative routing when no commitment exists keeps it from being fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the enum semantics for format and period plus the service/commitment_id precedence are already documented in the schema. The description only alludes to markdown/weekly rendering and adds no syntax or default details beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource (weekly aggregate report against a commitment record), plus audience and cadence, so an agent can distinguish it from savings/estimate_savings siblings without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit precondition ('REQUIRES a commitment record opened by a prior configure_engine apply') and the consequence when it is absent. It never names an alternative tool (e.g. log10x_savings, log10x_estimate_savings) to route to when no commitment exists, so it stops short of full when/when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_compileCompile symbol libraryAIdempotent
Compile a symbol library from any mix of sources, waiting inline for the result when it is quick and handing back a pollable job_id when it is not. It waits up to max_wait_ms (default 45s): a small compile, and EVERY re-run (which reuses prior units via the pinned output folder), finishes inside that window and returns the finished library plus the full scan/link diagnostics in ONE call; a long first compile of a large tree overruns the wait and returns a running job_id to poll with log10x_compile_status, or just call this tool again later, since the output is pinned and a finished run is collected near-instantly. max_wait_ms: 0 returns the job_id immediately (fire-and-forget). Sources combine freely: a local folder of source code / binaries (source_path), GitHub repositories via the GitHub REST API (github_repos, with optional github_branch / github_folders), docker/OCI images (docker_images), Helm charts (helm_charts), and Artifactory artifacts (artifactory_instance + artifactory_repo, with artifactory_files / artifactory_folders). The run scans the sources (Java, Go, Python, JS/TS, Scala, C/C++, C#, plus binaries) and writes per-file .10x.json symbol units plus a single linked .10x.tar library, the AOT artifact the 10x runtime later uses to assign hidden classes (TenXTemplates) to events. GitHub pull REQUIRES a token even for public repos: pass github_token or set GH_TOKEN; without one the tool returns not_configured. Docker-image pull is daemonless (podman bundled in compiler-10x, --cap-add SYS_ADMIN granted automatically) and public images need no credentials. Helm pull is a meta-source (renders the chart, by default also pulls the images it references); OCI/URL chart refs resolve standalone while a bare repo/chart needs a matching helm_repos entry. Artifactory pull needs a token (artifactory_token or ARTIFACTORY_TOKEN). REQUIRES the COMPILER flavor: runs log10x/compiler-10x @apps/compiler by default, or a local compiler-flavor tenx with mode="local". An engine built before the flavor rename reports that flavor as cloud, and both spellings are accepted; the native runtime build has no generate pipeline unit and is refused. No Kubernetes or Log10x account needed. .jar files are not scanned directly; provide extracted .class.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | Execution backend. `auto` (default) prefers Docker (the compiler image, guaranteed compiler flavor) and falls back to a local compiler-flavor tenx. `docker` forces the image (LOG10X_COMPILER_IMAGE or LOG10X_TENX_IMAGE, default log10x/compiler-10x:1.1.39, a pinned tag rather than :latest so the same sources compile through the same engine every time). `local` forces the binary (LOG10X_TENX_PATH or `tenx` on PATH) and refuses it unless its version banner reports the compiler flavor (`compiler`, or `cloud` on an engine built before the flavor rename). Of the three shipped flavors only `compiler` can compile: `runtime` (native binary) and `runtime-jvm` (JVM-packaged runtime, the only runtime available on Windows) are both refused, since neither carries the `generate` pipeline unit. With a local install, local-folder compilation and GitHub pull (REST API + token) work out of the box; docker_images pull additionally needs a container engine (podman or docker) on the host. The docker `compiler-10x` image bundles all of those (podman included, daemonless), which is why Docker is the default. | auto |
| helm_repos | No | Helm chart repositories to register before resolving helm_charts, each as "name=url" (e.g. ["ingress-nginx=https://kubernetes.github.io/ingress-nginx"]). Required for bare "repo/chart" names; unnecessary for OCI/URL refs. Added via `helm repo add` in pre-step containers (docker mode only; in mode=local the host helm config is used as-is). url must be an http(s):// chart-repo index URL; for an OCI registry, put the oci://… ref directly in helm_charts (`helm repo add` does not support oci://). | |
| timeout_ms | No | Hard cap on compile wall time in milliseconds. Default 1,800,000 (30 min). The first compile of a large codebase typically runs 10–30 min; subsequent runs are near-instant via checksum reuse. | |
| helm_charts | No | Helm charts to render and scan, as chart refs. A meta-source: the compiler runs `helm template` / `helm show chart` to extract the docker images and GitHub source repos the chart references, then (by default) pulls those too. OCI refs (e.g. "oci://ghcr.io/nginxinc/charts/nginx-ingress") and full URLs resolve standalone; a bare "repo/chart" (e.g. "ingress-nginx/ingress-nginx") needs a matching helm_repos entry. Combines freely with the other sources. In mode=local the host needs the helm CLI and must have the repos already `helm repo add`-ed. | |
| max_wait_ms | No | How long to wait inline (ms) for the compile to finish before handing back a job_id to poll. Default 45,000 (45s): small compiles and re-runs (which reuse prior units) finish inside this and return the library + diagnostics in ONE call. A long first compile of a large tree returns a running job_id you poll with log10x_compile_status, or just call this tool again later, since the output is pinned and a finished run is collected near-instantly. 0 = fire-and-forget (return the job_id immediately). | |
| output_path | No | Absolute path where the symbol library is written (the .10x.json units and the linked .10x.tar). Defaults to a fresh temp directory, returned in the result as data.payload.output.folder. | |
| source_path | No | Absolute path to a local folder of source code / binaries to scan. The compiler recursively traverses it for supported languages (Java, Go, Python, JS/TS, Scala, C/C++, C#) and binaries. Note: .jar files are not scanned directly; provide extracted .class files. Optional when github_repos is given; at least one source (source_path and/or github_repos) is required. | |
| docker_token | No | Registry token/password for docker_images (fed to `docker login --password-stdin` against the default registry, Docker Hub). Falls back to DOCKER_TOKEN from the MCP server environment. Omit for public images; pair with docker_username. Reaches the compiler as process environment only. | |
| github_repos | No | GitHub repositories to pull (via the GitHub REST API) and scan, each as owner/repo (e.g. ["apache/commons-cli"]). REQUIRES a GitHub token, even for public repos: pass github_token, or have GH_TOKEN / GITHUB_TOKEN set in the MCP server environment. Combines freely with source_path. | |
| github_token | No | GitHub access token for github_repos (a fine-grained token with read-only Contents access to the target repos suffices). Falls back to GH_TOKEN / GITHUB_TOKEN from the MCP server environment. Reaches the compiler as process environment only; never written to disk or argv. When docker_images are given too, this same token additionally lets the compiler pull + scan each image's source repo (the org.opencontainers.image.source annotation); without it that extra scan is skipped silently. | |
| library_name | No | Base name for the linked .10x.tar library file and the compile runtimeName. Sanitized to [A-Za-z0-9_.-]. | symbols |
| docker_images | No | Docker/OCI images to pull and scan for symbols, as image refs, fully-qualified recommended (e.g. ["docker.io/grafana/grafana:11.1.0"]; a port-bearing host like "harbor.corp:8443/team/app:2.1" is fine, and a bare "alpine" resolves against the engine default registry). The pull is daemonless (podman inside the compiler-10x image, no host docker socket), and the tool automatically grants the compile container `--cap-add SYS_ADMIN` (needed by podman; only when this arg is used). Public images need no credentials. docker_username + docker_token `docker login` to the DEFAULT registry (Docker Hub), so they cover private Docker Hub repos; images on a different private registry must be pre-authenticated on the host/engine. In mode=local the host needs a docker/podman CLI with a working engine, and pulled images are left in its store (remove:false). Combines freely with source_path and github_repos. | |
| github_branch | No | Branch to pull for ALL github_repos. Omit to pull each repo’s default branch. | |
| github_folders | No | Folders within each GitHub repo to pull (e.g. ["src/main/java"]). Omit to pull entire repos. Narrowing this speeds up both the pull and the scan. | |
| docker_username | No | Registry username for docker_images login, also used for private images a Helm chart references (helm_pull_images). Authenticates the default registry (Docker Hub). Falls back to DOCKER_USERNAME from the MCP server environment. Omit for public images. The engine logs in only when BOTH username and token are non-blank. Reaches the compiler as process environment only. | |
| helm_pull_repos | No | Whether to pull + scan the GitHub source repos a chart references (via org.opencontainers.image.source annotations). Default false because it REQUIRES a GitHub token (engine refuses an empty token); enabling it without github_token / GH_TOKEN returns not_configured. | |
| artifactory_repo | No | Artifactory repository key to pull from, e.g. "libs-release-local". Required when artifactory_instance is given. Scope the pull with artifactory_files and/or artifactory_folders. | |
| helm_pull_images | No | Whether to pull + scan the docker images a chart references (the richest symbol source for a chart). Default true. When true the tool grants the compile container `--cap-add SYS_ADMIN` (daemonless podman), same as docker_images. Set false to scan only the chart template/values text. | |
| artifactory_files | No | Specific files within artifactory_repo to pull, each a repo-relative path (e.g. ["dist/app-1.0.0.tar.gz"]). Combine with artifactory_folders; at least one of the two is required when pulling from Artifactory. | |
| artifactory_token | No | Artifactory API access token for artifactory_instance. Falls back to ARTIFACTORY_TOKEN from the MCP server environment. Required when pulling from Artifactory. Reaches the compiler as process environment only; never written to disk or argv. | |
| artifactory_folders | No | Folder paths within artifactory_repo to pull (e.g. ["com/acme/app"]). Traversed recursively unless artifactory_recursive is false. At least one of artifactory_files / artifactory_folders is required when pulling from Artifactory. | |
| artifactory_instance | No | Base URL of an Artifactory instance to pull artifacts (Java archives, .NET assemblies, etc.) from and scan, e.g. "https://demo.jfrog.io/artifactory". Requires artifactory_repo and a token (artifactory_token or ARTIFACTORY_TOKEN). Pull is via the Artifactory REST API, no extra host privilege. Combines freely with the other sources. | |
| artifactory_recursive | No | Whether artifactory_folders are pulled recursively (sub-folders too). Default true. Ignored when only artifactory_files are given. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations establish the mutation/idempotency profile, and the description adds substantial context beyond them: the pinned output folder enabling cheap re-runs, the daemonless podman pull with automatic --cap-add SYS_ADMIN, the mandatory GitHub token even for public repos, the not_configured failure mode, and the flavor gating that refuses runtime builds. This is rich behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The text is long but dense and front-loaded with the inline-wait behavior before drilling into sources and prerequisites; almost every clause carries distinct information. It is slightly repetitive in restating the re-run/pinned-output behavior across the description and the max_wait_ms schema entry, which keeps it from a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 23-parameter tool with an output schema, the description covers the operation model, source combinations, credential requirements, execution backends, flavor constraints, and failure modes (not_configured, refused runtime). Nothing an agent needs to invoke it correctly is missing, and return values are appropriately left to the output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3, and every parameter is already well documented in the schema. The description still adds cross-parameter semantics the schema does not: how sources combine freely, that github_token doubles as the source-repo credential for docker_images, and that max_wait_ms:0 means fire-and-forget.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Compile a symbol library from any mix of sources') and enumerates the source types it accepts. It is clearly distinguishable from siblings log10x_compile_status (polling) and log10x_compile_link (linking), and the output artifacts are named.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly describes the inline-vs-async decision: small compiles and every re-run finish within max_wait_ms and return in one call, while a long first compile returns a job_id to poll with log10x_compile_status or by re-calling this tool. It also states prerequisites and exclusions (GitHub token required, runtime flavors refused, .jar not scanned directly).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_compile_linkLink symbol unitsAIdempotent
Link an existing folder of .10x.json symbol units (from a prior compile) into a single .10x.tar library, with NO source scan. This is the same compiler-flavor Compiler app invoked with link-only arguments: the units folder is the outputSymbolFolder and no source is mounted, so the engine reuses the units already on disk (scans 0 new files) and merges them into the library, which is written into that same folder. Like log10x_compile it waits inline up to max_wait_ms (default 45s; linking is usually fast, so it normally returns the linked library in ONE call) and otherwise hands back a job_id to poll with log10x_compile_status. Use it to re-link after editing or pruning units, to assemble a library from a units tree built piecemeal, or to rebuild a library from the output folder of a prior log10x_compile. REQUIRES the COMPILER flavor (runs log10x/compiler-10x @apps/compiler by default, or a local compiler-flavor tenx with mode="local"; an engine built before the flavor rename reports it as cloud and both spellings are accepted, the native runtime build is refused). No Kubernetes or Log10x account needed.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | Execution backend, same contract as log10x_compile: `auto` prefers the compiler image, `docker` forces it, `local` uses a compiler-flavor tenx (an engine built before the flavor rename reports that flavor as `cloud`; both are accepted). Both runtime flavors are refused, `runtime` (native binary) and `runtime-jvm` (JVM-packaged, the only runtime on Windows), neither carries the `generate` pipeline unit. | auto |
| timeout_ms | No | Hard cap on link wall time in ms. Default 600,000 (10 min). Linking is much faster than scanning, but a very large units tree can still take minutes. | |
| units_path | Yes | Absolute path to a folder of .10x.json symbol units (produced by a prior compile) to link into a single .10x.tar library. Traversed recursively; the existing units are merged with NO source re-scan, and the .10x.tar is written into this same folder. | |
| max_wait_ms | No | How long to wait inline (ms) for the link to finish before handing back a job_id to poll. Default 45,000 (45s). Linking usually finishes inside this and returns the library in ONE call. A very large units tree returns a running job_id you poll with log10x_compile_status. 0 = fire-and-forget. | |
| library_name | No | Base name for the linked .10x.tar and the runtimeName. Sanitized to [A-Za-z0-9_.-]. | symbols |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations (readOnlyHint=false, idempotentHint=true) by disclosing that no source is mounted, 0 new files are scanned, the .10x.tar is written into the same units folder, the inline wait default and fallback job_id behavior, and that the native runtime build is refused. These are real operational traits an agent needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action and the key differentiator (no source scan) in the first sentence, then usage, then preconditions. It is long and the flavor-rename parenthetical is dense, but every block carries load-bearing information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a hybrid-timing tool that may return a library directly or a job_id, the description supplies the exact wait semantics, the poll destination, and execution-flavor constraints. An output schema exists, and the description still adds the return-mode distinction without redundant return-shape detail.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds value beyond the schema: recursive traversal of units_path, the same-folder write location of the library, the 45s inline wait that 'normally returns the linked library in ONE call', and sanitization of library_name. Some params (timeout_ms, mode flavors) are only lightly touched in prose.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Link an existing folder of .10x.json symbol units ... into a single .10x.tar library') and immediately scopes it against the sibling compile: 'with NO source scan'. An agent can distinguish this from log10x_compile without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly names three when-to-use scenarios (re-link after pruning units, assemble a piecemeal units tree, rebuild from a prior compile's output folder) and routes polling to log10x_compile_status. The compiler-flavor requirement is stated as a hard precondition with the accepted spellings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_compile_statusCompile statusARead-onlyIdempotent
Poll an asynchronous compile started by log10x_compile (or a link started by log10x_compile_link), by its job_id. Returns job_status (running / completed / failed / timed_out), the units produced so far + the linked .10x.tar (path + size), elapsed time, the engine exit code, and a credential-redacted tail of the engine log. Crucially, it promotes the engine's scan/link DIAGNOSTICS into the envelope so the compiler is not a black box at 100k–500k-file scale: per-language scan-failure counts with capped failure samples (which files failed to parse and why), and the link report (units merged / skipped, files excluded by folder/name filter, and the symbol-type histogram: class / enum / log / exec). Those appear once the compiler-10x image carries the engine diagnostics change; on an older image the tool degrades to unit counts + the log tail. The first terminal poll captures the exit code into the job record and frees the container; later polls stay readable and the compiled library is never removed.
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | summary returns the typed envelope (data.payload.job_status, .diagnostics, .output, .log_tail). | summary |
| job_id | Yes | The job id returned by log10x_compile (data.payload.job_id). | |
| log_lines | No | How many trailing engine-log lines to include in data.payload.log_tail (credential-redacted). 0 to omit. Raise it when diagnosing a failed run. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the read-only/idempotent/non-destructive profile, and the description adds substantial lifecycle detail beyond that: the first terminal poll captures the exit code and frees the container, later polls stay readable, the compiled library is never removed, and behavior degrades to unit counts + log tail on an older engine image. This is exactly the extra context annotations cannot express.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Dense but front-loaded: the polling action and job_id keying come first, then the returned fields, then the degradation caveat. Every sentence carries substance, though the diagnostics/return-value enumeration is heavier than strictly needed given an output schema exists.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an async status poller with an output schema, full schema coverage, and rich annotations, the description fills the remaining gaps (lifecycle, degradation, diagnostics promotion) so an agent can call and interpret it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema already documents job_id, view, and log_lines (including the 'raise it when diagnosing a failed run' hint). The description restates the job_id origin but adds no syntax or format detail beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (poll), resource (asynchronous compile), and names the two siblings that produce the job (log10x_compile and log10x_compile_link). An agent can distinguish this status poller from the retriever_query_status sibling and from the compile launchers without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Clearly establishes the usage context: call it to poll a job started by log10x_compile or log10x_compile_link, keyed by job_id. It does not explicitly name a competing status tool or say when-not to use it, but the precondition is unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_cost_optionsCost reduction optionsARead-onlyIdempotent
CALL THIS after the user picks 'show me what cutting costs would look like' from log10x_start. At Receiver/Retriever tier returns the 6-mode outcome-first menu (drop / sample / compact / tier_down / offload / observe_only), each gated by the customer's detected capabilities (receiver tier, SIEM type, offload bucket). At Reporter-only or Dev tier, collapses to 2 entries: observe_only + install_receiver (with prose explaining that the full 6-mode menu requires the Receiver in-path). All non-observe modes route to log10x_explain_mode. The envelope carries must_render_verbatim (show to user as-is), must_ask_user (numbered question), and forbidden_next_actions (do not call estimate_savings, configure_engine, or pattern_mitigate until the user picks). Accepts siem_lens (what-if destination): keeps the real volumes, prices + gates for that destination at list rates, and stamps siem_actual vs siem_lens in the envelope.
| Name | Required | Description | Default |
|---|---|---|---|
| service | No | Scope to a service. Passed forward to estimate_savings when the user picks a mode. | |
| siem_lens | No | What-if destination lens (alias of `destination` with provenance stamping): gate the 6-mode menu and downstream pricing for THIS destination while the connected pipeline keeps its actual one. The envelope stamps siem_actual vs siem_lens so receipts show the lens. | |
| destination | No | Destination stack. When set, routes_to.args carries THIS destination forward to estimate_savings — overrides the env-auto-detected SIEM. Pass when the upstream tool (baseline / configure_engine) already established a destination that differs from the env default; without it, cost_options falls back to siem_detected and routes_to may carry a destination the upstream chain did not pick. | |
| pattern_hash | No | Optional pattern hash to scope the cost option menu to a single pattern. When present, routes_to.args will include a proposed_config row for this hash. | |
| target_percent | No | % reduction goal carried from log10x_start pick, pre-filled when the user stated a target. | |
| monthly_volume_gb | No | What-if volume lens (forecast mode), forwarded to the estimate_savings this menu routes to. cost_options scales nothing itself; it carries this value into routes_to.args so the projection survives the hop. See log10x_estimate_savings for the projection semantics. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover read-only/idempotent/open-world, but the description adds substantive behavior beyond them: tier-dependent menu collapse (6 vs 2 entries), capability gating by receiver tier/SIEM/offload bucket, and envelope semantics (must_render_verbatim, must_ask_user, forbidden_next_actions). These are non-obvious operational traits an agent needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the trigger condition and packed with routing rules; every sentence conveys operational detail. It is dense rather than bloated, though some clauses overlap with the schema descriptions, preventing a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a menu-generating routing tool with an output schema present, the description supplies everything needed: entry conditions, tier-dependent output, envelope fields, and downstream routing. Nothing material is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema carries the parameter burden, and the description largely restates it (e.g., siem_lens provenance stamping and destination forwarding are already in the schema). It adds narrative value by explaining how parameters survive the hop into routes_to.args, but this is marginal over the schema text, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific action (return the cost-reduction option menu) and clearly distinguishes it from siblings by stating it produces a mode menu that routes to log10x_explain_mode rather than performing the estimation itself. It also specifies tier-dependent output shape (6-mode vs 2-entry), making the tool's identity unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states the trigger condition ('CALL THIS after the user picks ... from log10x_start') and the downstream routing ('All non-observe modes route to log10x_explain_mode'). It also names forbidden next actions (do not call estimate_savings, configure_engine, or pattern_mitigate until the user picks), which is unusually precise guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_customer_metrics_queryCustomer metrics queryARead-onlyIdempotent
Low-level PromQL passthrough to the customer metric backend configured via LOG10X_CUSTOMER_METRICS_URL. Returns the raw Prometheus response shape plus metadata about which backend served the query. This is the escape hatch for cross-pillar investigations the higher-level primitives don't cover — use it to explore the customer backend's label universe, run a one-off PromQL expression, or verify that a specific metric exists before correlating against it. For typical cross-pillar workflows, compose the deterministic primitives: log10x_metrics_that_moved → log10x_rank_by_shape_similarity → log10x_metric_overlay.
| Name | Required | Description | Default |
|---|---|---|---|
| end | No | End of the range window. Required when mode=range. | |
| mode | No | `instant` runs a point-in-time query; `range` runs over a time window with a bucket step. | instant |
| step | No | Bucket step for range queries, in seconds. Required when mode=range. | |
| start | No | Start of the range window — ISO8601 or UNIX seconds. Required when mode=range. | |
| promql | Yes | PromQL expression to execute against the customer metric backend. Example: `apm_request_duration_p99{service="payments-svc"}`. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint and openWorldHint, so the safety profile is covered. The description adds real context beyond that: it discloses the return shape (raw Prometheus response plus backend metadata) and the env-var-configured backend target. It stops short of noting auth requirements or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core purpose, then usage framing, then the alternative. Every sentence carries information, though the piece is on the longer side for a passthrough tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a five-parameter passthrough tool with an output schema, the description covers purpose, backend resolution, return shape, correct usage cases and the alternative workflow. Nothing an agent needs in order to choose or call it is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the schema already documents mode, start, end, step and promql with examples. The description adds no parameter-level detail beyond that, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: a low-level PromQL passthrough to the customer metric backend. It explicitly positions itself against siblings by calling itself 'the escape hatch' and naming the deterministic primitive chain it is not.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use cases (explore the label universe, run a one-off PromQL expression, verify a metric exists) and an explicit alternative path (`log10x_metrics_that_moved` → `log10x_rank_by_shape_similarity` → `log10x_metric_overlay`) for typical workflows.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_dependency_checkDependency check commandARead-onlyIdempotent
Given a pattern identity, generate commands to scan the user's SIEM/observability stack (Datadog monitors, Splunk saved searches, Grafana dashboards, Prometheus alert rules) for anything that depends on that pattern. Call this before any mute, drop, or source-code deletion — deleting a log line that feeds a live alert silently breaks the alert. Also call when a developer asks "am I allowed to delete this log.info() call" or "what references this pattern". This is the blast-radius check that turns a risky refactor into a reviewed one.
| Name | Required | Description | Default |
|---|---|---|---|
| vendor | No | SIEM vendor to scan. Omit to auto-detect from ambient credentials (DD_API_KEY+DD_APP_KEY → datadog; SPLUNK_HOST+SPLUNK_TOKEN → splunk; ELASTIC_URL → elasticsearch; AWS chain → cloudwatch). When multiple SIEMs are configured, the tool returns an "ambiguous" error listing them — pass vendor= to disambiguate. When the resolved SIEM has live credentials the scan runs in-process and returns actual dashboard/alert/saved-search names + URLs; otherwise the tool falls back to a paste-ready bash command. | |
| pattern | Yes | Pattern name (e.g., "Payment_Gateway_Timeout") | |
| service | No | Service name to scope the scan | |
| severity | No | Severity level |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, openWorldHint=false, idempotentHint=true, so the description doesn't need to re-litigate safety. It adds non-obvious behavior: the blast-radius semantics, that deleting a log line can silently break an alert, and (in schema) ambiguous-vendor errors and in-process vs bash-command fallback. The ambiguous-error and fallback behavior is documented in the schema rather than the description, so not a full 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core action, then the mandatory pre-condition, then example developer questions and the framing payoff. Every sentence earns its place. Slightly dense but not padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values needn't be explained. The description covers purpose, trigger conditions, and consequence, and the schema covers vendor resolution behavior. Complete enough for an agent to select and invoke correctly; minor gap is that the ambiguous-error case lives only in the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the vendor parameter carries a rich description (auto-detection rules, ambiguity error, in-process vs command fallback). The description itself contributes pattern-identity scoping but no per-parameter detail. Baseline 3 is correct when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (scan/generate commands) and resource (SIEM/observability stack for dependencies on a pattern), and enumerates the target surfaces (Datadog monitors, Splunk saved searches, Grafana dashboards, Prometheus alert rules). This clearly distinguishes it from siblings like log10x_pattern_mitigate or log10x_pattern_detail.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly gates usage: 'Call this before any mute, drop, or source-code deletion' and gives developer-phrased triggers ('am I allowed to delete this log.info() call'). Names the consequence of skipping it, which is exactly the when-to-use/when-not guidance an agent needs.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_discover_envDiscover env (k8s + AWS)ARead-onlyIdempotent
Read-only discovery of the caller's Kubernetes cluster + AWS account — i.e. the customer's INFRASTRUCTURE environment, NOT their Log10x account. When the user wants to install Log10x: call this tool FIRST and then log10x_advise_install — that's the whole pre-flight. Do NOT call log10x_doctor / log10x_login_status / log10x_savings / etc. before the install; the wizard handles all login + license logic internally, and surfacing those tools' optional-capability warnings (Retriever, Datadog backfill, cross-pillar metrics) makes the install feel more complicated than it is. Probes kubectl (workloads, DaemonSets, Helm releases, service-account IRSA annotations, metrics-backend agents) and AWS (EKS, S3, SQS, CloudWatch log groups) to detect: which forwarder is running (Fluent Bit, Fluentd, Filebeat, Logstash, OTel Collector, Vector), which log10x apps are already installed (Reporter, Receiver, Retriever), and which metrics backends are already deployed (Datadog Agent, Prometheus, Elastic, CloudWatch Agent, etc.). Returns a terse markdown report + a snapshot_id (cached 30 min) the advisor tools consume. Do NOT call this tool to answer "which Log10x environments do I have access to" / "list my envs" / "switch envs" — those are about the user's Log10x ACCOUNT environments, use log10x_login_status for that. Call THIS tool only when the question is about k8s workloads, AWS infra, or "what's deployed in my cluster". Every shell call is logged in the snapshot's probeLog for audit. No writes, no state mutation: only kubectl get and aws ... describe/list verbs. Tier prerequisites: none — this is a pre-install tool and runs against any customer environment.
| Name | Required | Description | Default |
|---|---|---|---|
| region | No | AWS region to probe. If omitted, uses the region from your AWS CLI profile. | |
| skip_aws | No | Skip all AWS probes (for cluster-only discovery). | |
| namespaces | No | Explicit list of Kubernetes namespaces to probe. If omitted, the tool auto-picks up to 5 likely candidates (demo, logging, observability, otel-demo, default) plus kube-system. | |
| bucket_hint | No | Substring to match against S3 bucket names. Defaults to "retriever"; also matches "log10x" and "tenx" out of the box. | |
| skip_kubectl | No | Skip all kubectl probes (for AWS-only discovery or when cluster access is restricted). | |
| forwarder_hint | No | Override forwarder detection. Use this if multiple forwarders are running and you want the advisor to target a specific one. | |
| namespace_hint | No | Preferred namespace for new installs. Defaults to "logging" unless an existing forwarder namespace is found. | |
| eks_cluster_name | No | EKS cluster to describe. If omitted and exactly one cluster exists in the account/region, that one is auto-selected. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint/idempotentHint annotations, the description discloses what is probed (kubectl workloads, IRSA annotations, AWS EKS/S3/SQS/CloudWatch), that shell calls are logged in probeLog for audit, that only get/describe/list verbs are used, a 30-min cache producing snapshot_id, and that no tier prerequisites apply. This is substantial context the annotations alone do not convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Long but front-loaded and information-dense: the core purpose leads, followed by when-to-use, when-not-to-use, then capabilities. The bolding aids scanning, though some routing detail is repeated across the middle section, keeping it just short of maximally tight.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need no exposition. For a zero-required-param discovery tool the description covers purpose, routing, safety profile, caching, and audit behavior — everything an agent needs to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all eight parameters are already documented with defaults and semantics. The description adds no per-parameter syntax or override guidance beyond what the schema provides. Baseline 3 applies when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (read-only discovery/probe) and resource (caller's Kubernetes cluster + AWS account infrastructure), and explicitly disambiguates from the similarly-named Log10x ACCOUNT environment concept. An agent can tell it apart from log10x_login_status without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit routing: call FIRST when the user wants to install Log10x, then log10x_advise_install, and explicitly names tools NOT to call beforehand (log10x_doctor, log10x_login_status, log10x_savings). Also names the alternative for account-env questions. Nothing is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_discover_joinDiscover join labelARead-onlyIdempotent
Auto-discover the structural join label between Log10x pattern metrics and the customer metric backend. Runs Jaccard similarity on label value sets across candidate label pairs, returns the best pair above the 0.7 threshold plus runner-ups above 0.5. The result is cached per-session keyed by (environment, customer-backend-endpoint) so the cross-pillar primitives (metrics_that_moved, rank_by_shape_similarity, metric_overlay) can auto-run this once at session start and reuse the cached join without re-probing. Agents should normally NOT need to call this tool directly — the primitives call it internally. The explicit tool exists for power users who want to inspect the join universe or force a re-discovery after backend changes. When no pair crosses the threshold, returns a structured no_join_available response with the full probed-label matrix and recommended next actions.
| Name | Required | Description | Default |
|---|---|---|---|
| window | No | Time window for label value enumeration (e.g., "10m", "1h", "30m"). When set, both the Log10x and customer backends are queried with [now - window, now] filtering, excluding stale label values from series that stopped emitting samples. CRITICAL for environments with historical replay data, decommissioned pods, or otherwise orphan label values — stale values drag Jaccard down and cause false `no_join_available` refusals. Recommended: "10m" for steady-state clusters, "1h" for bursty traffic. Omit to include all-time values (default Prometheus behavior). Alias: `timeRange`. | |
| timeRange | No | Alias for `window` for consistency with other Log10x tools. | |
| environment | No | Environment nickname (for multi-env setups). | |
| force_refresh | No | When true, bypass the session cache and re-run the Jaccard pass against the live backends. | |
| minimum_jaccard | No | Minimum Jaccard similarity to accept as a primary join. Default 0.7. Lower to 0.5 for exploratory discovery, 0.3 for noisy environments with historical stale values. | |
| candidate_labels | No | Optional subset of customer-side labels to probe (max 100). An AI caller reasoning over results can't meaningfully digest more than a few dozen; the cap reflects that, not a backend constraint. When omitted, all labels from the customer backend are probed in preferred-first order. | |
| customer_metrics_url | No | Per-call override for the customer metrics backend URL. Wins over LOG10X_CUSTOMER_METRICS_URL env var. Use this when the MCP server was launched with an empty/stale URL and you want to redirect to a reachable Prometheus without restarting the server. | |
| customer_metrics_auth | No | Per-call override for the customer metrics auth credential (bearer token, API key, or apiKey/envId for log10x type). | |
| customer_metrics_type | No | Per-call override for the customer metrics backend type. Defaults to generic_prom if customer_metrics_url is supplied without a type. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnly/openWorld/idempotent annotations, it discloses the session caching keyed by (environment, endpoint), reuse semantics across primitives, threshold behavior (0.7 primary / 0.5 runner-ups), and the exact fallback shape (`no_join_available` with probed-label matrix). This is rich context the annotations cannot convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads what the tool does, then the caching model, then the routing guidance, then the no-join fallback. Every sentence carries information, though the description is on the longer side for a tool that agents are told not to call directly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given an output schema exists, return values need not be explained, yet the description still characterizes the no-join fallback. Together with the caching and routing guidance, an agent has everything needed to decide whether and how to invoke it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema coverage the parameter documentation is already thorough, so the baseline is 3; the description adds value by naming the caching key (environment, customer-backend-endpoint) and restating the threshold semantics that tie parameters to behavior. It does not add much syntactic detail beyond the schema, keeping it from a 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('auto-discover the structural join label') and explains the mechanism (Jaccard similarity on label value sets). It is clearly distinguishable from the sibling log10x_discover_labels, which handles label discovery rather than cross-pillar join resolution.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells the agent 'normally NOT need to call this tool directly' because the primitives (metrics_that_moved, rank_by_shape_similarity, metric_overlay) call it internally, and reserves direct use for power users wanting to inspect the join universe or force re-discovery. This is clear when-to-use, when-not-to-use, and who-else-uses-it guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_discover_labelsDiscover labelsARead-onlyIdempotent
List the labels Log10x metrics can be filtered or grouped by. Call at the start of a session, or before calling any tool that takes a label/filter argument — stops the model from guessing label names like "namespace" when the real name is "k8s_namespace". Pass a label name to get its distinct values.
| Name | Required | Description | Default |
|---|---|---|---|
| label | No | If set, return distinct values for this label (e.g., "tenx_user_service" returns every service). If omitted, return the full label name list. | |
| limit | No | Max values to return when a label is specified. | |
| environment | No | Environment nickname (for multi-env setups). |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint and openWorldHint, so safety and idempotence are covered. The description adds the dual-mode behavior (list vs. distinct values) and the session-startup role, but says nothing about value cardinality beyond the schema's limit cap or pagination behavior; with an output schema present, that omission is minor.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences; the resource definition is front-loaded, the usage trigger follows, and the motivating example closes. No filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Zero required parameters, a full output schema, and complete annotations mean the agent needs nothing else. The description covers purpose, timing, and both invocation modes, which is everything a discovery tool of this shape requires.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all three parameters are already documented in detail. The description's 'pass a label name to get its distinct values' largely restates the label property's own schema text, so it adds framing rather than new semantics. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('List') and resource ('labels Log10x metrics can be filtered or grouped by'), plus the second operating mode ('pass a label name to get its distinct values'). An agent immediately understands the resource is label metadata, distinguishing it from sibling tools like log10x_discover_env or log10x_services.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly prescribes when to call it: 'at the start of a session, or before calling any tool that takes a label/filter argument.' It also gives the concrete failure mode it prevents (guessing 'namespace' when the real name is 'k8s_namespace'), which is the strongest possible justification for the timing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_doctorDoctor (health check)ARead-onlyIdempotent
Run a startup health check on the Log10x MCP installation. Probes: environment configuration validity, prometheus.log10x.com reachability and auth, Reporter tier detection (Edge / Cloud / none), Retriever endpoint configuration (informational), Datadog destination credentials (informational), paste endpoint reachability, cross-pillar enrichment floor (v1.4, when LOG10X_CUSTOMER_METRICS_URL is set). Returns a markdown report with pass / warn / fail per check and remediation hints. Call this once at the start of a session to verify the install, or any time a tool returns an unexpected error and you want to isolate whether the problem is configuration or transient.
| Name | Required | Description | Default |
|---|---|---|---|
| environment | No | Optional environment nickname to probe. In multi-env setups, omit to run the checks against ALL configured environments; pass a specific nickname to check only that one. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/openWorld, so the safety profile is covered; the description adds the return shape (markdown report with pass/warn/fail and remediation hints) and conditional behavior (cross-pillar enrichment floor only when LOG10X_CUSTOMER_METRICS_URL is set). It stops short of describing what happens for informational vs failing probes or any partial-failure behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The purpose is front-loaded in the first sentence and each clause earns its place via concrete probe names. The probe enumeration is dense and slightly list-heavy, but no sentence is redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a diagnostic tool with an output schema and full annotation coverage, the description supplies everything an agent needs: what it probes, when to call it, the result format, and conditional behavior tied to an env var. Nothing required to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the single `environment` parameter (omit for all environments, pass a nickname for one) is already fully documented in the schema. The description adds nothing about the parameter, so the baseline of 3 is correct.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb+resource ("Run a startup health check on the Log10x MCP installation") and enumerates the exact probes it performs, so the scope is unambiguous. It does not explicitly name or differentiate itself from overlapping siblings like log10x_env_validate or log10x_dependency_check, which is the only gap keeping it below 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states clear when-to-use conditions: "once at the start of a session" and after any unexpected tool error to isolate configuration problems. It does not name when NOT to use it or point at specific alternative diagnostic tools, so it falls short of the 5 criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_emit_sample_planEmit a sample-export script for the fenced POCARead-only
Render a read-only shell script that exports a log sample out of the user's OWN log analyzer, with the user's OWN credentials, on a machine the user chooses — and then stop. This server does not run the script and, in the fenced profile, could not: it runs inside a container started with --network none. That split is the point. Code that sees log data has no network; code that has network is the user's own aws / curl driven by a script short enough to read once. Use this as step 2 of the fenced POC (step 1 is minting the licence with one visible curl, step 3 is running log10x_poc_from_local inside the fenced container over the exported files, step 4 is verifying the fence with docker inspect and by turning Wi-Fi off). Also use it whenever the credentials live somewhere this process does not — a jump host, a locked-down laptop, another team. Args: siem (required: cloudwatch / splunk / elasticsearch / opensearch / datadog), window (default 14d), target_event_count (default 1,000,000 — the same default log10x_poc_from_siem uses, so both paths sample the same size), scope, query, output_dir (default ./poc/logs), write_script (default true, writes export-sample.sh mode 0755 in the working directory). Returns the script text, the read-only API operations and credential variables it touches, a review checklist, and the exact log10x_poc_from_local arguments to call next. The sampling matches log10x_poc_from_siem bucket for bucket — same stratified sub-windows, same per-bucket cap — so a fenced POC and a credentialed POC over the same window differ because the logs differ. Emitted scripts contain no log10x hostname; the server refuses to return one that does. ClickHouse, Azure Monitor, Coralogix, GCP Logging and Sumo Logic are follow-up work. Read-only: it renders text and writes one script file; it contacts nothing.
| Name | Required | Description | Default |
|---|---|---|---|
| siem | Yes | Which log analyzer to export the sample from. One script per analyzer: `cloudwatch` (aws CLI: DescribeLogGroups + FilterLogEvents), `splunk` (search/jobs/export), `elasticsearch` and `opensearch` (_cat/indices + _search), `datadog` (v2 logs search). ClickHouse, Azure Monitor, Coralogix, GCP Logging and Sumo Logic are follow-up work — for those, export plain text yourself, one log message per line, and run the POC over it. | |
| query | No | Analyzer-native filter layered on top of `scope`: a CloudWatch filter pattern, an SPL fragment, a Lucene query_string for Elasticsearch, a Datadog query. Narrowing here narrows what the savings projection covers, so say so in the report if you use it. | |
| scope | No | Analyzer-native scope. CloudWatch: log group name or prefix (`/aws/ecs/*` — the asterisks are stripped, CloudWatch matches on prefix). Splunk: index name. Elasticsearch / OpenSearch: index pattern (default `logs-*`). Datadog: index name. Omitted means everything the credentials can read. | |
| window | No | How far back to sample. Accepts `1h`, `24h`, `7d`, `14d`, `30d`. Default `14d`, matching `log10x_poc_from_siem` — a wide window is what makes first-seen, growth and stable-versus-new readable at all. | 14d |
| output_dir | No | Where the script writes the exported sample, relative to wherever the user runs it. Default `./poc/logs`, which is the directory the documented `docker run` line mounts read-only at /data. | |
| write_script | No | Default true: also write the script next to the working directory as `export-sample.sh` (mode 0755) so the user can read it in an editor rather than out of a chat transcript. Set false to get the text back and nothing on disk. | |
| target_event_count | No | Target event count for the export. Default 1,000,000 (~500 MB at 500 B average) — the same default `log10x_poc_from_siem` uses, so a fenced POC and a credentialed one see samples of the same size. Lower it when the export has to fit a laptop or a coffee break. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations: discloses that the server runs under `--network none`, never executes the emitted script, refuses to return a script containing a log10x hostname, writes export-sample.sh at mode 0755, and touches nothing. It also frames the readOnlyHint=true annotation explicitly ('it renders text and writes one script file; it contacts nothing'), so no hidden side effects are left unstated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core purpose and the network split before the procedural detail, and the POC step enumeration earns its length by telling the agent where this fits. It is somewhat verbose and repeats the 'same default as log10x_poc_from_siem' rationale across two params, which is minor redundancy rather than waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 7-param tool with an output schema, it covers everything an agent needs: prerequisites, what it returns (script text, touched API operations/credential vars, checklist, next-call args), follow-up steps, and the unsupported analyzers with a manual workaround. Nothing required to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is already 100%, so the schema does the heavy lifting; the description adds cross-tool meaning by explaining why defaults match log10x_poc_from_siem (so both paths sample the same size) and when to lower target_event_count. That rationale is genuinely beyond the schema, though much of the per-arg text restates enum/default facts already documented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a precise verb+resource: 'Render a read-only shell script that exports a log sample.' It immediately names its scope (user's own analyzer, own credentials, chosen machine) and explicitly distinguishes itself from siblings log10x_poc_from_local and log10x_poc_from_siem, so an agent can route correctly without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use: step 2 of the fenced POC (with steps 1, 3, 4 enumerated) and whenever credentials live somewhere the process cannot reach. It also states what it does NOT do (does not run the script, contacts nothing) and points at the alternative path for credentialed sampling, leaving nothing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_env_diff_vs_envvarsDiff env doc vs LOG10X_* env varsARead-onlyIdempotent
Compare the stored env-config document against the LOG10X_* environment variables the env-var bridge would have produced, and report per-field disagreements with remediation recommendations. Call this when the user says "but I set the env var" or downstream tools report a value the user thinks they overrode — the on-prem store wins over env vars per resolver precedence, and silent-override is the most common boot-time surprise. Args: env_id (required — env_id UUID or nickname). For each disagreeing field (env_id, nickname, cluster., destination., streamer., retriever., offload_destinations[0].), returns { field, stored, envvar, recommendation }. The recommendation tells the user to either unset the LOG10X_ env var (preferred — on-prem store is the source of truth) or to update the stored doc via the matching setter (log10x_dest_set for destination, log10x_set_gitops_repo for gitops). Pure-on-prem-store configs (no LOG10X_* env vars set) return ok:true with an empty diff and a note that no ambiguity is possible.
| Name | Required | Description | Default |
|---|---|---|---|
| env_id | Yes | Env identifier — either the `env_id` UUID or the `nickname` from the env-config document. Resolved by walking the store chain (k8s → aws_ssm → gcp_sm → azure_ac → local). |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnly, idempotent), yet the description adds substantial behavior: resolver precedence, the silent-override failure mode, the per-field return shape, and the pure-on-prem edge case returning ok:true with an empty diff. That is well beyond what structured fields convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the purpose, then the trigger condition, then args and return shape. It is dense but nearly every sentence carries distinct information; the field-list enumeration of disagreeing fields is the only mildly padded part.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, the description need not explain return values, yet it still enumerates the diff fields and remediation guidance. Combined with the precedence rule and edge case, an agent has everything needed to call and interpret this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and there is a single parameter, so the schema already documents env_id as a UUID or nickname resolved through the store chain. The description merely restates that env_id is required and accepts a UUID or nickname, adding no new syntax or edge-case detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and both operands: it compares the stored env-config document against the LOG10X_* environment variables the env-var bridge would produce, and reports per-field disagreements. This is clearly distinguishable from nearby siblings like log10x_env_validate or log10x_discover_env.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit triggering condition: 'Call this when the user says "but I set the env var" or downstream tools report a value the user thinks they overrode.' It also explains the underlying rule (on-prem store wins per resolver precedence) that makes this tool the right one in that situation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_env_validateValidate env config docARead-onlyIdempotent
Run schema validation + cross-field sanity checks on a stored env-config document at ~/.log10x/envs/<env_id>.json. Call this after any edit to the env doc (via log10x_dest_set / hand-edit / restore) or pre-flight before downstream tools that need a coherent config (commitment_report, configure_engine, offload-recipe emitters). Args: env_id (required — env_id UUID or nickname). Returns the canonical zod schema parse result PLUS findings across: destination.region required for vendors that need it (cloudwatch / datadog / azure-monitor / gcp-logging); ingest_url shape sanity (http(s):// prefix, splunk /services/collector suffix); streamer.url / retriever.url shape; cluster cloud type vs offload destination type alignment (eks↔s3, gke↔gcs, aks↔azure_blob); at-least-one active offload destination; SIEM region vs offload destination region (cross-region egress warning). Each finding carries severity (error / warning / info) and a remediation recommendation. Errors block downstream actions; warnings/info surface for the user.
| Name | Required | Description | Default |
|---|---|---|---|
| env_id | Yes | Env identifier — either the `env_id` UUID or the `nickname` from the env-config document. Resolved by walking the store chain (k8s → aws_ssm → gcp_sm → azure_ac → local). |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish readOnlyHint/idempotent, but the description adds what the annotations cannot: each finding carries severity (error/warning/info) with a remediation, and errors block downstream actions while warnings/info only surface. It also describes the specific cross-field rules checked, which is meaningful behavioral context beyond the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the action and the call-timing guidance, then the return shape and the enumerated checks. Dense but each clause carries information; the long findings enumeration is justified by the breadth of checks, though a bulleted form would scan faster.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers purpose, trigger conditions, parameter requirement, and the full breadth of validation findings with severity semantics. Return values are additionally backed by an output schema, so nothing an agent needs to invoke and interpret this tool is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single env_id parameter, including the UUID-or-nickname resolution chain. The description restates 'env_id (required — env_id UUID or nickname)' without adding syntax or format beyond what the schema already provides, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (validate) and resource (stored env-config document at a concrete path), and enumerates the exact checks performed (schema parse plus cross-field sanity). An agent can distinguish it from siblings such as log10x_doctor or log10x_env_diff_vs_envvars without reading either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to call it: 'after any edit to the env doc (via log10x_dest_set / hand-edit / restore) or pre-flight before downstream tools that need a coherent config', naming concrete downstream consumers (commitment_report, configure_engine, offload-recipe emitters).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_estimate_savingsEstimate savingsARead-onlyIdempotent
[FRESH-SESSION ROUTING: if this is the user first cost question of the session, call log10x_start first instead — it returns the orientation menu the user needs before any per-tool action.] Two-mode savings estimator with percent-first reporting and a dollar overlay. forecast projects bytes_in -> bytes_out and percent reduction for a proposed plan; pass effective_ingest_per_gb (or rely on the account profile list-price rate) to overlay $/mo per pattern and in totals. verify counts realized savings from the engine routeState label over a window with cap-hit / drift / new-patterns / leakage attribution, leading with percent and adding the dollar overlay only when a rate is set. Without a rate, dollar fields are emitted as null (never as a fabricated $1/GB number); the envelope carries rate_source: list_price | customer_supplied | unset so callers can show how the overlay was derived. Accepts siem_lens (what-if destination): keeps the real volumes, prices + gates for that destination at list rates, and stamps siem_actual vs siem_lens in the envelope. REQUIRES Reporter-tier cost attribution (per-pattern bytes in the metrics backend). Before anything is deployed, use log10x_poc_from_local or log10x_poc_from_siem_submit instead.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | forecast: project savings of a proposed per-pattern policy (or a target_percent). verify: measure realized savings from a deployed policy by comparing baseline vs post-merge windows. | forecast |
| service | No | Scope the target_percent greedy solver and coverage_pct to a single service. When present, only patterns from that service are candidates; coverage_of_env_pct and dollar totals reflect that service only. pattern_limit is ignored (all service patterns are returned). If omitted, runs across all services. | |
| es_pruned | No | Elasticsearch only: are compactable fields excluded from _source? Default false — the unpruned ratio band is used. | |
| siem_lens | No | What-if destination lens (alias of `destination` with provenance stamping): price the projection for THIS destination while the pipeline keeps its actual one. Envelope stamps siem_actual vs siem_lens. | |
| timeRange | No | forecast mode: alias for `observation_window` for consistency with other Log10x tools. If both are set, `observation_window` wins. | |
| deployment | No | How the customer RUNS the destination, which decides whether compaction is available at all: the expander is software they install (the l1es Elasticsearch/OpenSearch plugin, the 10x Splunk app), so a managed or serverless platform can carry compacted bytes but has nowhere to expand them. Set only from what the user actually said — absent means unknown, and an unknown deployment prices only the levers that hold either way. Irrelevant on destinations whose levers do not depend on it (Datadog, CloudWatch, Azure, Coralogix). | |
| allow_lossy | No | Permit the ladder solver to close a keep-everything shortfall with sample/drop (lossy, opt-in). Default false: the plan stops at the keep-everything ceiling and reports the gap instead of silently discarding events. Only set after the user explicitly chooses loss. | |
| destination | No | Destination stack. Required for both modes (used to look up ingest $/GB + compact ratio band). | |
| environment | No | Environment nickname; routes to the right metrics backend. | |
| post_window | No | verify mode: PromQL range expression for the post-merge window, e.g. "7d". | |
| commitment_id | No | verify mode: when present, the verify output is shaped as a commitment delta (used by log10x_commitment_report). | |
| contract_type | No | verify mode: shapes the dollar projection (committed vs on-demand renewal math). | |
| pattern_limit | No | forecast mode: maximum number of per_pattern rows returned. Default 50 when service is omitted; ignored (unlimited) when service is set. Totals and coverage_pct are always computed over the full solver result before slicing. | |
| default_action | No | forecast mode, OPTIONAL: force one action onto every solver-selected pattern (a mode choice — "cut 50% via drop"). Hard constraint when present, subject to destination compatibility (compact is replaced by the destination canonical action when compact_mode=no-op). OMIT for the product default: the ladder solver picks the destination's keep-everything lever per pattern (compact -> tier_down -> offload-with-retriever), never lossy unless allow_lossy. | |
| target_percent | No | forecast mode: % volume reduction goal. Tool runs the same greedy solver as configure_engine on observed 30d bytes. | |
| tier_down_plan | No | Which tier_down plan to price when the action is tier_down. Matches the plan name (case-insensitive substring): omit for the destination default (e.g. Azure Basic Logs), or pass e.g. "auxiliary" to price the aggressive alternative (Azure Auxiliary Logs). No effect on destinations without an alternative tier. | |
| baseline_window | No | verify mode: PromQL range expression for the pre-merge window, e.g. "7d", "168h". | |
| proposed_config | No | forecast mode: explicit per-pattern (action, optional cap) rows. Either this OR target_percent is required. | |
| enforcement_mode | No | forecast mode: when manual_report, reframes the headline as a potential-savings estimate under external enforcement rather than engine enforcement. Headline reads 'If you enforce externally: X savings potential. Enforcement choice is yours.' instead of the standard forecast headline. | |
| retention_months | No | Retention window for storage cost. Default 1 month. | |
| budget_gb_monthly | No | forecast mode: VOLUME BUDGET — keep monthly ingest toward the destination at or under this many GB/mo. BYTE accounting: tier_down keeps every byte in the destination, so it cannot serve this target and is excluded from the ladder (compact only where it lands on the billed wire, then offload with the retriever, then lossy on allow_lossy). Mutually exclusive with target_percent, budget_usd_monthly, default_action, and proposed_config. | |
| monthly_volume_gb | No | What-if volume lens (forecast mode): model the environment at THIS monthly volume (decimal GB/month) instead of its measured volume. The real per-pattern shares and pattern mix are held fixed; only absolute bytes and dollars scale, by one uniform factor. Use it to project a prospect onto their own scale, or to forecast a real env after growth. Pairs with `siem_lens`. This is a PROJECTION: the envelope stamps volume_actual_gb vs volume_projected_gb and the scale factor, and the note points at the POC for the caller's real patterns. | |
| budget_usd_monthly | No | forecast mode: DOLLAR BUDGET — keep the (service-scoped or whole) destination bill at or under this $/mo. The ladder solver derives the reduction: max(0, bill - budget). Idempotent: already under budget returns an empty plan with the headroom stated. Mutually exclusive with target_percent, budget_gb_monthly, default_action, and proposed_config. | |
| check_dependencies | No | Ladder-plan path only: scan the destination (read-only) for dashboards, alerts, and saved searches that reference the top planned message types, and attach the result as plan_dependencies. Runs only when credentials for the destination are present in the session environment; otherwise the plan carries a one-line note saying it was not checked. Set false to skip the scan for speed. | |
| exception_services | No | Ladder-plan path only: services pinned at pass — their patterns stay in the bill but are never planned, exactly like protected severities. The SOC-owned or compliance-bound slice of the estate, stated as a hard exclusion. Case-insensitive. | |
| include_referenced | No | Ladder-plan path only: message types LITERALLY referenced by a monitor, alert, saved search, or dashboard (found by the dependency scan) are EXCLUDED from the plan by default — they stay exactly as they are, and the plan re-solves around them. Pass true only after the user explicitly chooses to include them (the render shows what including them adds). | |
| observation_window | No | forecast mode: PromQL range expression for the observation window the solver/projection runs over. Default `30d`. Accepts `1h`, `24h`, `7d`, `30d`, etc. Alias: `timeRange`. | |
| unprotect_patterns | No | Ladder-plan path only: pattern hashes the user EXPLICITLY unpinned from the severity floor (a warn-level retry storm they chose to act on). Bypasses severity protection for the listed hashes only; hard exclusions still win. Set only after the user names the type and chooses this — never inferred. The render flags these rows with their severity. | |
| retriever_installed | No | Whether the S3 retriever is installed (or the user has agreed to install it). Gates the offload rung of the ladder solver: without it, offloaded events would be unreachable, so the plan stops at the in-SIEM levers and the gap names "install the retriever" as the lossless remedy. Set from conversation; log10x_advise_retriever is the install path. | |
| effective_ingest_per_gb | No | forecast and verify mode: override the destination list-price rate with the customer's contracted $/GB. When supplied, dollar projections use this rate and surface rate_source='customer_supplied'. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare readOnly/idempotent/openWorld=false; the description adds substantial behavior beyond them: null dollar fields rather than fabricated rates, the rate_source enum (list_price | customer_supplied | unset), siem_actual vs siem_lens provenance stamping, volume_actual_gb vs volume_projected_gb scale-factor stamping, and the tier prerequisite. This is exactly the extra context an agent needs for correct invocation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the session-routing caveat, then purpose, then mode details and prerequisites — a sound order. It is dense for a 30-parameter tool but some phrasing repeats (the dollar-overlay/null-rate point is made multiple times), so it is not maximally tight.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values need not be described, and the description instead covers what the schema cannot: mode semantics, the routing prerequisite, the tier requirement, unsafe-default behavior (allow_lossy opt-in, no fabricated dollar numbers), and envelope provenance fields. Complete for a tool of this complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds real meaning beyond the schema on the two modes, the effective_ingest_per_gb rate-override contract, siem_lens provenance, and the Reporter-tier prerequisite that gates the tool. It does not attempt to re-explain all 30 params, which is appropriate given the schema already does that.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Two-mode savings estimator with percent-first reporting and a dollar overlay') and then decomposes both modes precisely: forecast projects bytes_in -> bytes_out and percent reduction; verify counts realized savings over a window. It explicitly distinguishes itself from siblings by naming log10x_poc_from_local, log10x_poc_from_siem_submit, and log10x_start as the correct tools in other situations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when/when-not routing: 'if this is the user first cost question of the session, call log10x_start first' and 'Before anything is deployed, use log10x_poc_from_local or log10x_poc_from_siem_submit instead.' It also states the precondition (REQUIRES Reporter-tier cost attribution) and the mode-selection rule (forecast for proposed policy, verify for deployed policy).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_event_lookupEvent lookupARead-onlyIdempotent
Resolve a raw log line or pattern name to its stable pattern identity (the hash of its representing-token subset), then return byte volume + share per service (with cost overlay when $/GB is set), before→after delta, first-seen timestamp within the observation window, an AI classification (error/debug/info) with a recommended action (filter/keep/reduce), and the current offload disposition (pass / sample / compact / drop) read from the Reporter routeState label. Call this first whenever a user pastes a SINGLE log line and asks "what is this", "is this new", "is this safe to drop", or "is this being dropped / offloaded". The lookup is structural, not byte-exact — different timestamps/request IDs/user IDs on the same underlying pattern resolve to the same identity. If no match is returned, say so honestly. Use log10x_resolve_batch instead when the user pastes MULTIPLE events, a SIEM dump, or a batch to triage.
| Name | Required | Description | Default |
|---|---|---|---|
| pattern | No | Pattern name or search term to look up (e.g., "Payment_Gateway_Timeout"). Omit when passing `pattern_hash` / `tenxHash` instead. | |
| service | No | Service to scope the lookup | |
| tenxHash | No | Legacy alias of `pattern_hash`. Both are accepted. Pass either the canonical `pattern_hash` form or this legacy form — they are treated identically. | |
| siemScope | No | SIEM scope for the live sample line on a tenxHash reverse lookup: a CloudWatch log group (`/aws/ecs/my-svc`), ES index, or Splunk index. When omitted, the detected SIEM connector uses its own default scope. Only consulted when `tenxHash` was passed (the cross-pillar correlation case). | |
| timeRange | No | Time range. Sub-day values for incident-window lookups. '24h' and '1d' are equivalent. | 7d |
| environment | No | Environment nickname | |
| analyzerCost | No | SIEM ingestion cost in $/GB (deprecated alias of `effective_ingest_per_gb`) | |
| pattern_hash | No | Canonical 11-char hash seen on a SIEM / CloudWatch Logs event (e.g. "03ndjreM-sU"). Alias of `tenxHash`; both are accepted. Resolved against the 10x metrics to recover the pattern, then the normal cost/services breakdown is shown. | |
| effective_ingest_per_gb | No | Customer-supplied SIEM ingest cost in $/GB. When set, dollar fields populate with rate_source=customer_supplied; when absent and no list rate is detected, dollar fields collapse to null and rate_source=unset. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only cover the safety profile (readOnly/openWorld/idempotent), so the description carries the rest and does: it discloses the matching is structural rather than byte-exact (timestamps/IDs collapse to one identity), the offload disposition comes from the Reporter `routeState` label, cost fields only populate when $/GB is set, and that a no-match should be reported honestly.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the identity-resolution purpose before the return payload and the call-first guidance, and every clause maps to a real behavior. The long enumeration of returned fields is dense but it is the part that differentiates this tool, so it earns its space.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 9-parameter, zero-required tool with full schema coverage, an output schema, and annotations, the description supplies the remaining decision-relevant context: when to call it, when not to, the structural-match caveat, and the honesty requirement on no-match.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema itself already documents aliasing (tenxHash/pattern_hash), the cost-rate source semantics, and the siemScope default, so the description adds little beyond repeating 'cost overlay when $/GB is set'. Baseline 3 applies when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource (resolve a raw log line or pattern name to a stable pattern identity) and enumerates the returned payload, so the agent knows exactly what comes back. It also names the sibling it is not (log10x_resolve_batch), making the split unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit trigger conditions: 'Call this first' when a user pastes a SINGLE log line and asks 'what is this', 'is this new', 'is this safe to drop', or 'is this being dropped'. It then names the exclusion case (MULTIPLE events, SIEM dump, batch triage) and routes to log10x_resolve_batch.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_explain_modeExplain enforcement modeARead-onlyIdempotent
CALL THIS AFTER log10x_cost_options when the user picks a mode. Explains the chosen enforcement mode (drop / sample / compact / tier_down / offload / observe_only) in service-level plain language, with dollar math when byte metrics are available. Returns must_render_verbatim (plain-text three-section card, no markdown), must_ask_user (Apply or Preview choice), and forbidden_next_actions (locks apply tools and log10x_preview_filter until the user picks). routes_to.apply routes all non-observe modes to log10x_configure_engine; observe_only has routes_to.apply === null (no enforcement step). routes_to.preview routes to log10x_preview_filter with { service, mode }.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | Which enforcement mode to explain. Keep-everything levers come first, then the lossy opt-ins. `compact` = keeps everything: engine minifies events ~50-80% losslessly; all events still reach the stack. `offload` = keeps everything: engine diverts matched events to a customer-owned S3 bucket; readable via log10x_retriever_query. `tier_down` = keeps everything: engine stamps the routeState marker; a routing rule moves those events to a cheaper storage tier (Datadog Flex / CloudWatch IA / Azure Monitor Basic or Auxiliary Logs). `sample` = lossy opt-in: engine passes 1-in-N events through to the stack; the rest are discarded. `drop` = lossy opt-in: engine hard-drops matched patterns at the Receiver before delivery. `observe_only` = engine observes and fingerprints but does not act; use to baseline volume before committing. | |
| service | Yes | Service name to personalize the explanation with service-level volume and cost figures. | |
| destination | No | Auto-detected destination stack or forwarder. When omitted the tool infers from envs.json / env vars. Used to name the specific vendor in the explanation ("your Datadog workspace", "your Splunk index", etc.). | |
| effective_ingest_per_gb | No | Customer-supplied $/GB rate used for the dollar overlay. When set, source_disclosure.rate_source='customer_supplied'. When absent, the shared rate resolver falls back to envs.json analyzerCost → LOG10X_ANALYZER_COST → destination list price → unset (no dollar overlay). |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the readOnly/idempotent annotations by disclosing runtime contract details: must_render_verbatim (plain-text card, no markdown), must_ask_user (Apply/Preview), and forbidden_next_actions that lock apply tools and log10x_preview_filter until the user chooses. This tells the agent exactly how to render and gate the response, which the annotations cannot convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the trigger condition and core purpose, and every sentence carries routing or rendering information. It is very dense in a single long second sentence, which slightly taxes readability but wastes no words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a coordination tool in a multi-step flow, the description covers preconditions, expected output shape, user-gating, and post-call routing to both apply and preview paths. Despite an output schema existing, the extra contract detail makes the tool fully actionable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema already richly documents every parameter, including the full mode enum definitions. The description adds only the routing-shaped { service, mode } usage for preview, so with structured data doing the heavy lifting this sits at the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Explains the chosen enforcement mode') and enumerates the exact modes it covers. It also names the sibling it must follow (log10x_cost_options) and the siblings it routes to (log10x_configure_engine, log10x_preview_filter), so an agent can distinguish it from those tools without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit sequencing: 'CALL THIS AFTER log10x_cost_options when the user picks a mode.' It also specifies downstream routing per mode (apply for non-observe, null for observe_only, preview always), giving clear when-to-use and what-follows guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_extract_templatesExtract templatesARead-onlyIdempotent
Extract the structural template library from a log corpus by RUNNING A LOCAL LOG10X PIPELINE on the user's machine. Returns per-template records (the engine-internal templateHash + the template body with variable slots) and event count. Companion to log10x_resolve_batch — both tools answer 'can you run log10x locally / templatize these events'. Does NOT need Kubernetes, a deployed Reporter, or a Log10x account; the pipeline runs in-process on the host via either a locally-installed tenx binary or a docker run log10x/pipeline-10x container. Use for: (a) bootstrapping a pattern catalog before wiring up a Reporter, (b) offline auditing of archived log corpora, (c) validating that a config change produces expected template identities. Validation mode: pass expected.min_templates, expected.required_patterns, and/or expected.forbidden_merges to turn extraction into assertion-checked validation — each assertion reports PASS/FAIL in the output. REQUIRES a local engine: the tenx binary on PATH, or Docker with LOG10X_TENX_MODE=docker. No preflight checks for it: log10x_doctor does not probe the engine.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Local file path or glob when source=file. | |
| text | No | Raw text blob when source=text. | |
| view | No | summary returns the typed envelope (data.templates[], data.event_count, data.assertions, data.human_summary). The deprecated markdown view was removed; data.human_summary carries the prose distillation for chat rendering. | summary |
| top_n | No | Max templates to return. | |
| events | No | Inline log lines when source=events. | |
| source | Yes | Input mode. `file`: read from a local path/glob. `events`: array of raw log lines. `text`: newline-separated log events as a single string. | |
| expected | No | Optional assertions — turns extraction into validation. Each assertion reports pass/fail in the output. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover safety (readOnlyHint, idempotentHint), and the description adds substantial operational context: it runs in-process on the host, requires the tenx binary on PATH or Docker via LOG10X_TENX_MODE=docker, and warns that log10x_doctor does not preflight the engine. It stops short of describing failure modes or rate/scale limits, so it lands just below the top mark.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose and mechanism, then use cases, then validation mode, then prerequisites. Dense and well-organized, though the baroque bolding and backtick-heavy formatting make it longer than strictly necessary for an agent to parse the core contract.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need little prose, yet the description still names the returned fields and covers the prerequisite engine setup, the sibling relationship, and the validation variant. For a 7-parameter tool with a nested expected object, nothing an agent needs to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% so the baseline is 3, but the description adds real meaning: it explains the validation assertion trio (expected.min_templates, required_patterns, forbidden_merges) and their PASS/FAIL output, plus the view=summary envelope contents. That is genuine value beyond the schema text.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource — 'Extract the structural template library from a log corpus' — and immediately narrows the mechanism ('RUNNING A LOCAL LOG10X PIPELINE'). It explicitly differentiates from the sibling log10x_resolve_batch, so an agent can route between them without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives three concrete when-to-use scenarios (bootstrapping a catalog, offline auditing, validating config changes) plus a named companion/alternative tool. It also states what is NOT required (Kubernetes, Reporter, account), which removes a false blocker an agent might otherwise assume.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_find_skewFind skewARead-onlyIdempotent
Identify patterns where one slot value dominates the field (>= 60% of events by default). Surfaces sampling opportunities: "slot verb is get 78% of events — sample the get case at 1/10 and save volume without losing signal." Differentiated against analyzer field histograms because the engine groups by per-pattern field-set, so dominance is measured within the structural pattern, not globally. Stage 1: accepts events as a paste array (same shape as log10x_resolve_batch). Calibration honesty: the 60% concentration floor and 1/10 sampling rate are hand-picked defaults tagged unvalidated_default in the output. The envelope surfaces the empirical observed_dominant_pct_distribution across all candidate slots so the agent can judge whether 0.6 is well above or below the noise floor for this dataset. See docs/cross-pillar-primitives.md for the agent behavior contract.
| Name | Required | Description | Default |
|---|---|---|---|
| top_n | No | Number of findings to return. Default 20. | |
| events | Yes | Events to analyze for slot skew. Same shape as log10x_resolve_batch — raw strings or JSON objects. Each event is templated locally; skew is computed across the resulting patterns. | |
| sample_n | No | Sampling rate N for the savings projection (1/N of the dominant case kept). Default 10. Same calibration caveat — sample_n=10 is a defensible starting point but not validated for any specific cost target. | |
| min_events | No | Minimum events per pattern to bother checking. Default 10 (filters low-sample noise). | |
| min_concentration | No | Minimum dominant-value fraction for a slot to be flagged as skewed. Default 0.6 (a slot is "skewed" when one value is 60%+ of events). Hand-picked default tagged as `unvalidated_default` in the output. Compare against the `observed_dominant_pct_distribution` in `threshold_audit` to judge whether 0.6 is well above or below this dataset's noise. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover safety (readOnly, idempotent, closed-world), yet the description adds real behavioral context: thresholds are hand-picked and tagged `unvalidated_default`, and the envelope surfaces `observed_dominant_pct_distribution` so the agent can calibrate. It also references a docs contract for agent behavior. It does not describe output shape in detail, but the output schema exists to carry that.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core definition and the example before the differentiation and calibration caveats. Dense but each sentence carries substantive information; the embedded quote and markdown formatting add mild length without much waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers the technique, its scope relative to alternatives, the Stage 1 input constraint, and the calibration caveat, while an output schema already documents return values. An agent has enough to select and invoke it correctly without opening sibling tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds meaning beyond the schema by framing min_concentration (0.6) and sample_n (1/10) as unvalidated calibration defaults and telling the agent to compare 0.6 against the observed distribution before trusting it. That interpretive guidance is not present in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('identify patterns where one slot value dominates the field') and immediately grounds it with a concrete example threshold (>= 60%). It explicitly distinguishes itself from analyzer field histograms by explaining that dominance is measured within per-pattern field-sets, which an agent cannot infer from the name alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a clear use context (surfacing sampling opportunities to save volume) and differentiates against the closest conceptual alternative (analyzer field histograms). It also flags the Stage 1 constraint of accepting a paste array. It stops short of stating when NOT to use it versus siblings like log10x_top_patterns or log10x_estimate_savings, so it is not a full 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_investigateInvestigateARead-onlyIdempotent
Single-call root-cause investigation for any log line, pattern, service, or environment. Returns a complete causal chain (for acute spikes) or co-drifter cohort (for gradual drift) with confidence scores derived mechanically from data signal quality, plus ready-to-run verification commands. Per-pattern blocks include offload_status (pass / sample / compact / drop) so the narrative reflects whether the receiver is admitting or dropping the implicated patterns, matching top_patterns and pattern_trend. Call whenever the user asks 'what is going on with X', 'why is X spiking', 'investigate X', or pastes a log line / alert and asks for diagnosis. Input is the user's natural-language target — pass their words verbatim. The tool detects whether the input is a raw log line, pattern identity, service name, or 'environment' and runs the appropriate flow. It also detects whether the trajectory is acute or gradual drift and renders a different report shape for each. Confidence percentages decompose into named sub-scores (stat × lag × chain for acute; slope_sig × cohort for drift) — walk the user through the decomposition when asked. Show the entire markdown report to the user without modification.
| Name | Required | Description | Default |
|---|---|---|---|
| depth | No | `shallow`: anchor service only. `normal` (default): anchor service + immediate dependencies. `deep`: full environment-wide. | normal |
| window | No | Analysis window. Defaults to `1h` for acute-spike cases; `30d` recommended for drift cases. Accepts any PromQL-style duration string (`15m`, `1h`, `6h`, `24h`, `1d`, `7d`). Alias: `timeRange`. If neither is set, defaults to `1h`; if both are set, `window` wins. | |
| timeRange | No | Alias for `window` for consistency with other Log10x tools. If both are set, `window` wins. | |
| use_bytes | No | Use byte-based rate instead of event-count. Event-count is strongly preferred; use only if the Reporter does not emit the count metric. | |
| environment | No | Environment nickname — required in multi-env setups. | |
| starting_point | Yes | The user's target, verbatim. Can be a raw log line, a pattern identity (symbolMessage or tenx_hash), a service name, or the literal string "environment"/"all"/"audit". The tool detects the mode automatically. | |
| baseline_offset | No | Offset for the baseline comparison. Defaults to `24h` for short windows (acute-spike cases) and to the same value as `window` for long windows (≥7d, drift cases). Override only if you need a non-standard comparison. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover only safety/idempotency, but the description goes well beyond them: it discloses the dual report shapes (acute chain vs. drift cohort), the mechanical confidence decomposition sub-scores, per-pattern offload_status states, and mode auto-detection from input. This is rich behavioral context an agent could not infer from structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose is front-loaded in the first sentence, and most sentences carry distinct information (report shapes, confidence math, trigger phrases). It runs long and includes agent-facing render instructions ('show the entire markdown report...') that could arguably live outside a tool description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, the description needn't enumerate return fields, and it still conveys the two report shapes, confidence decomposition, and offload_status semantics. For a 7-parameter, mode-switching tool, an agent has everything needed to call and interpret it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is already 100%, so the baseline is 3, but the description adds real semantic value: starting_point should be the user's words verbatim and the tool auto-detects whether it is a log line, pattern ID, service, or 'environment'. The other parameters (depth, window, baseline_offset) are left to the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('root-cause investigation') with explicit scope ('any log line, pattern, service, or environment') and a named output ('causal chain' or 'co-drifter cohort'). This lets an agent distinguish it from siblings like log10x_pattern_trend or log10x_top_patterns without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides concrete trigger phrases ('what is going on with X', 'why is X spiking', pasted log lines) that map directly to invocation contexts. However, it never names an alternative tool or states when NOT to use it (e.g., versus top_patterns or pattern_trend), so it stops short of full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_login_statusLogin statusARead-onlyIdempotent
List the user's Log10x ACCOUNT environments and report credential / login state. Call this, and ONLY this, for any of these phrasings: 'which Log10x environments do I have', 'which environments are available to me', 'list my envs', 'what tenants/accounts can I query', 'am I logged in', 'switch envs'. For 'log me in' / 'sign me up' / 'create a Log10x account' / 'use my real account': call log10x_signin_start (browser Auth0 device flow; the model chains to log10x_signin_complete automatically), or call log10x_signin_complete directly with { api_key: "<key>" } if the user already has a key. Do NOT call log10x_discover_env for these questions — that tool scans the user's Kubernetes/AWS infrastructure, unrelated to Log10x account environments. In demo mode (no key set, or key failed validation), the response is a step-by-step config guide. In signed-in mode, lists the user's identity, every env they can reach with permissions (OWNER/WRITE/READ), the default env, and the most-recently used env this session. Read-only, takes no args.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and openWorldHint=false, so the safety profile is covered. The description adds information the annotations cannot: mode-dependent behavior (demo mode with no key or failed validation returns a step-by-step config guide; signed-in mode returns identity, reachable envs with OWNER/WRITE/READ permissions, default env, and session-most-recent env). That is genuine behavioral disclosure beyond structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core purpose in the first sentence, then routes. The bolded phrasing lists are long but each entry is a real disambiguation trigger rather than filler, so the length is largely earned; a slight deduction for the density of emphasis and repeated tool names.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return shape need not be restated, and annotations cover the safety profile. What remains — the two operating modes and which sibling tools handle the authentication path — is fully covered, leaving nothing an agent needs missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Zero parameters, so the baseline is 4. The description confirms 'takes no args', which is consistent with the empty schema and useful confirmation for an agent deciding whether it needs to gather inputs first, though it adds little beyond what the empty schema already implies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List the user's Log10x ACCOUNT environments and report credential / login state') and immediately scopes it against siblings by naming log10x_signin_start, log10x_signin_complete, and log10x_discover_env with the reason discover_env is unrelated. An agent can identify this tool and its boundary without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit routing: an enumerated list of user phrasings that must map to this tool ('which environments do I have', 'am I logged in', 'switch envs') and a separate enumerated list for when to use log10x_signin_start / log10x_signin_complete instead, plus an explicit 'Do NOT call log10x_discover_env' exclusion with rationale. This is about as complete as when/when-not guidance gets.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_measure_compactionMeasure compactionARead-onlyIdempotent
Measure real per-pattern compaction ratios from a SIEM sample. Pulls sample_size events for a service over timeRange, runs them through the local tenx engine, and returns per-pattern compaction_ratio_x (original bytes / encoded bytes) derived from actual measurements. Use this to replace generic 5-10x estimates in log10x_estimate_savings and log10x_pattern_detail with measured values for this customer environment. Requires: tenx CLI installed locally (LOG10X_TENX_PATH or tenx on PATH) AND SIEM credentials (same as log10x_poc_from_siem). Confidence tiers: high (>=50 events), medium (10-49), low (<10). Results flow into log10x_estimate_savings to improve savings projections. REQUIRES a local engine: the tenx binary on PATH, or Docker with LOG10X_TENX_MODE=docker.
| Name | Required | Description | Default |
|---|---|---|---|
| service | Yes | Service name to scope the stack sample to. Used as the query filter (e.g., Datadog `service:<name>`, Splunk `sourcetype=<name>`, CloudWatch stream prefix). | |
| timeRange | No | Lookback window for the stack pull. Format: <N><unit> where unit is m (minutes), h (hours), or d (days). Default "24h". | 24h |
| environment | No | Log10x environment id. Omit to use the default environment. | |
| sample_size | No | Number of events to pull from the stack for measurement. Default 500. Larger samples improve confidence (high confidence requires >=50 events per pattern) but take longer to pull and process. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint/idempotentHint annotations, it discloses hard prerequisites (tenx CLI on PATH or LOG10X_TENX_PATH, Docker mode, SIEM credentials), the data-provenance chain, and confidence tiers keyed to event counts (high >=50, medium 10-49, low <10). This is exactly the behavioral context annotations cannot convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action and value, and most sentences earn their place. There is some redundancy, however, as the local-engine requirement is effectively stated twice ('Requires: tenx CLI installed locally...' and 'REQUIRES a local engine: the tenx binary on PATH, or Docker...').
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Because an output schema exists, return values needn't be explained, and the description still covers the full operational picture: prerequisites, environment scoping, confidence behavior, and integration with downstream savings tools. Nothing an agent needs to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is already 100%, so the baseline is 3, but the description adds real meaning: it ties sample_size to confidence quality ('high confidence requires >=50 events per pattern') and explains the cost tradeoff of larger samples. It also frames timeRange as the measurement window, going beyond the schema's format description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('Measure real per-pattern compaction ratios from a SIEM sample') and explains the mechanism (pulls events, runs through local tenx engine, returns compaction_ratio_x). It explicitly differentiates from siblings by naming log10x_estimate_savings and log10x_pattern_detail as the tools whose generic estimates it replaces.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit routing: 'Use this to replace generic 5-10x estimates in log10x_estimate_savings and log10x_pattern_detail with measured values for this customer environment.' Prerequisites and the downstream flow into log10x_estimate_savings are stated, leaving little to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_metric_overlayMetric overlayARead-onlyIdempotent
Third step of cross-pillar investigation: return aligned anchor + candidate timeseries plus deterministic facts (peak_at, peak_offset_seconds, n_buckets_aligned). No Pearson, no tier — pure raw data for the agent to interpret. Use this once log10x_rank_by_shape_similarity has narrowed to a single suspect, or to manually verify any anchor/candidate pair side-by-side. Bucket size auto-selected from window length; both series are right-aligned to the same trailing bucket grid so a sparse anchor and dense candidate compare on the same chaos window.
| Name | Required | Description | Default |
|---|---|---|---|
| step | No | Bucket step. Smaller = more samples + more cost. Default 30s. | 30s |
| anchor | Yes | The anchor identity. For `log10x_pattern`: the pattern symbol_message (e.g. `error_processing_payment_$`). For `customer_metric`: a PromQL expression (e.g. `apm_request_duration_p99{service="payments"}`). | |
| window | No | Time window. PromQL-style duration: `15m`, `1h`, `6h`, `24h`. Alias: `timeRange`. | 1h |
| candidate | No | The candidate metric to overlay against the anchor. Must be a customer-side PromQL expression that returns a single series. Alias of `candidates[0]` — pass either form (sibling tools metrics_that_moved and rank_by_shape_similarity use `candidates` array; this tool accepts both for consistency). | |
| timeRange | No | Alias for `window`. | |
| candidates | No | Candidates array. Accepted for parity with metrics_that_moved + rank_by_shape_similarity. Only the first element is overlaid (metric_overlay is single-candidate by design — use rank_by_shape_similarity to rank N first, then overlay the winner). | |
| anchor_type | Yes | Which side the anchor comes from. `log10x_pattern`: anchor is a 10x pattern symbol_message. `customer_metric`: anchor is a customer PromQL expression. | |
| environment | No | Environment nickname (for multi-env setups). | |
| max_buckets | No | Max buckets to return in the aligned output. Pre-truncates from the most recent end if window/step exceeds this. | |
| customer_metrics_url | No | Per-call override for the customer metrics backend URL. Wins over LOG10X_CUSTOMER_METRICS_URL env var. Use when MCP was launched with an empty/stale URL. | |
| customer_metrics_auth | No | ||
| customer_metrics_type | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint/openWorldHint/idempotentHint, so the safety profile is covered. The description adds real behavioral context beyond that: bucket size is auto-selected from window length and both series are right-aligned to the same trailing grid so a sparse anchor and dense candidate compare on the same chaos window. It doesn't discuss truncation/cost limits explicitly, but that is covered by max_buckets in the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the step's role in the investigation flow, then output facts, then the exclusion ('No Pearson, no tier'), then usage. Every sentence carries signal. Slightly dense, but no filler sentences.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 12-parameter, multi-backend tool the description conveys the return shape, alignment mechanics, and single-suspect usage pattern; an output schema exists so return values need not be fully re-explained. It is complete enough for correct invocation, though auth/backend override parameters are left to schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 83%, so most parameters are already documented. The description nonetheless adds cross-parameter meaning the schema lacks: bucket size auto-selection from window length and the shared right-alignment grid. It also reinforces the single-candidate design, which the schema hints at only via 'candidates[0]'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('return aligned anchor + candidate timeseries plus deterministic facts'), names the concrete outputs and explicitly what it is not ('No Pearson, no tier — pure raw data'). This cleanly distinguishes it from the sibling log10x_rank_by_shape_similarity without needing to open either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use: 'Use this once log10x_rank_by_shape_similarity has narrowed to a single suspect, or to manually verify any anchor/candidate pair side-by-side.' The alternative and the sequencing condition are both named, leaving nothing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_metrics_that_movedMetrics that movedARead-onlyIdempotent
First step of cross-pillar investigation: deterministic filter on which customer metrics actually moved while an anchor was active. Anchor is either a Log10x pattern (anchor_type: "log10x_pattern") OR a customer metric expression (anchor_type: "customer_metric"); candidates are all sibling series from the OTHER pillar. Partitions the anchor's window into high-phase / low-phase buckets by median rate and keeps only candidates whose mean value differs ≥15% between the two phases. Returns moved[], not_moved[], evaluation_failed[] — no Pearson, no tier, no causal framing. This is the cheap deterministic cut that pares the candidate set before the more expensive shape-similarity pass. Compose with log10x_rank_by_shape_similarity and log10x_metric_overlay.
| Name | Required | Description | Default |
|---|---|---|---|
| step | No | Bucket step. | 30s |
| anchor | Yes | Anchor identity. For `anchor_type=log10x_pattern`: the pattern Symbol Message NAME or its 11-char `pattern_hash` (= `tenx_hash`) — the tool detects shape and queries the correct PromQL label (`message_pattern` vs `tenx_hash`). For `anchor_type=customer_metric`: a customer PromQL expression. | |
| window | No | Time window. Alias: `timeRange`. | 1h |
| timeRange | No | ||
| candidates | Yes | Customer-side PromQL expressions to evaluate (max 100). An AI caller reasoning over results can't meaningfully digest more than a few dozen; the cap reflects that, not a backend constraint. Pre-filter with `metrics_sharing_resource` or label-scoped `customer_metrics_query` queries. | |
| anchor_type | Yes | Anchor side. `log10x_pattern` = anchor is a 10x pattern. `customer_metric` = anchor is a customer PromQL. | |
| environment | No | ||
| phase_gap_floor | No | Relative gap floor between anchor-high and anchor-low phase means. Candidate is "moved" iff its gap ≥ this. Default 0.15 (=15%) is an uncalibrated default — output is tagged `unvalidated_default` until a caller-side calibration overrides it. See `docs/cross-pillar-primitives.md` for the calibration playbook. | |
| customer_metrics_url | No | Per-call override for the customer metrics backend URL. Wins over LOG10X_CUSTOMER_METRICS_URL env var. Use when MCP was launched with an empty/stale URL. | |
| customer_metrics_auth | No | ||
| customer_metrics_type | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds substantial behavioral detail beyond the annotations: it explains the median-rate phase partitioning, the ≥15% gap rule, the returned arrays (`moved[]`, `not_moved[]`, `evaluation_failed[]`), and explicitly states what it does not do ('no Pearson, no tier, no causal framing'). The annotations already cover read-only/idempotent safety, and the description does not contradict them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the purpose and workflow role, then adds algorithm and return details. It is dense but largely earns its space; the only minor redundancy is the repeated emphasis on 'deterministic' and 'cheap' across two sentences.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex 11-parameter tool with an output schema and rich annotations, the description supplies the investigation context, algorithm, outputs, and composition guidance an agent needs. It does not need to re-explain return values because an output schema exists, but it still orients the caller correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 64% schema coverage, the schema carries much of the parameter detail, but the description adds conceptual meaning: it defines the anchor/candidate pillar relationship ('candidates are all sibling series from the OTHER pillar') and clarifies the anchor_type branches. It also implies the phase-gap-floor behavior. It does not document every parameter, but it adds value beyond the schema for the core semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource — a deterministic filter on which customer metrics moved while an anchor was active — and distinguishes the tool from siblings by naming the expensive shape-similarity pass it precedes. An agent can identify the tool's role in cross-pillar investigation without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly frames the tool as the 'first step' and 'cheap deterministic cut' to use before 'the more expensive shape-similarity pass', and it names the two composition tools (`log10x_rank_by_shape_similarity`, `log10x_metric_overlay`). This gives clear when-to-use and sequencing guidance with named alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_overflow_contentsOverflow contentsARead-onlyIdempotent
The contents view of the customer-owned offload S3 bucket — per-pattern bytes, event count, time-first-seen, time-last-seen, and growth rate. Filtered to action=offload via the cap-CSV the MCP wrote (drop patterns are NOT in S3; compact and tier_down route elsewhere). Call this as the maintenance-loop review: "what's accumulating in my overflow queue?" Routes the agent to log10x_retriever_query for rehydration when an incident or audit needs the data back in the SIEM.
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | Output format. Always "summary" — the typed envelope (data.patterns[], data.totals). | summary |
| limit | No | Cap on the number of per-pattern rows returned. Total bytes always reflect the full overflow, even when rows are truncated. | |
| service | No | Filter to a single service. Omit for the full overflow queue across every service that routes to S3. | |
| timeRange | No | Window over which to compute overflow contents. 30d matches the maintenance-loop cadence; sub-30d windows for incident-window probes. '24h' and '1d' are equivalent. | 30d |
| environment | No | Environment nickname |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, and openWorld, so the safety profile is covered. The description adds genuine non-obvious behavior: only action=offload data is present (drop patterns are NOT in S3; compact and tier_down route elsewhere) and it is sourced from a cap-CSV the MCP wrote. It stops short of disclosing any latency or pagination caveats, but the substantive scoping insight is a real value-add.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the resource definition before the routing guidance, with each sentence carrying distinct information (fields, filtering scope, usage framing, alternative). Slightly dense with parenthetical asides, but nothing is redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need no explanation. Combined with annotations covering the safety profile and a description that covers scope, filtering, and routing, an agent has everything needed to call this correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents every parameter, including the limit truncation note and timeRange equivalences. The description reinforces the offload filter but adds no syntax or semantics beyond what the schema provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific resource (offload S3 bucket contents) and enumerates the returned fields (per-pattern bytes, event count, time-first-seen, time-last-seen, growth rate). It also distinguishes itself from related siblings by naming log10x_retriever_query for rehydration, so an agent can route correctly without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly frames the when: 'Call this as the maintenance-loop review: what's accumulating in my overflow queue?' and names the alternative (log10x_retriever_query) with the condition that selects it (incident or audit needs data back in the SIEM). Nothing is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_pattern_detailPattern detailARead-onlyIdempotent
CALL THIS AFTER log10x_preview_filter when the user drills into a specific pattern by number. Returns a full single-pattern view: 24h line chart (up to 12 rows, 72 chars wide), ASCII horizontal bar chart for cross-service byte distribution (top 8 services), severity breakdown, and up to 5 sample events truncated to 120 chars each. Requires pattern_hash (tenx_hash from preview_filter.data.patterns[].tenx_hash). must_ask_user: Back to preview list, or Apply with this in the picture. actions[]: log10x_preview_filter (back) and log10x_configure_engine (apply).
| Name | Required | Description | Default |
|---|---|---|---|
| pattern | No | Pattern name (Symbol Message, e.g. "Payment_Gateway_Timeout") as an alias for pattern_hash. Resolved to hash via metrics lookup. Provide either pattern or pattern_hash. | |
| timeRange | No | Time window for the volume trend and sample events lookback. Default 7d. Pattern: ^\d+[mhd]$. | 7d |
| environment | No | Environment nickname for multi-env setups. | |
| pattern_hash | No | The tenx_hash of the pattern to drill into. Obtained from log10x_preview_filter data.patterns[].tenx_hash. Preferred over pattern when available (skips a metrics lookup). | |
| include_samples | No | When true (default), attempts to fetch up to 3 full sample events from your stack. Set false to skip the stack round-trip. | |
| monthly_volume_gb | No | What-if volume lens (forecast mode): model the environment at THIS monthly volume (decimal GB/month) instead of its measured volume. The real per-pattern shares and pattern mix are held fixed; only absolute bytes and dollars scale, by one uniform factor. Use it to project a prospect onto their own scale, or to forecast a real env after growth. Pairs with siem_lens. This is a PROJECTION: the envelope stamps volume_actual_gb vs volume_projected_gb and the scale factor, and the note points at the POC for the caller real patterns. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover the safety profile (readOnly, idempotent, openWorld), and the description layers on behavior they cannot express: the stack round-trip that include_samples controls, the fact that output is deliberately truncated (12 rows, 72 chars, top 8 services, 5 samples at 120 chars), and the projection semantics of monthly_volume_gb including the volume_actual_gb vs volume_projected_gb envelope stamp. This is real disclosure beyond structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the call trigger and purpose, then the payload, then the required input and routing. Most sentences earn their place, but the chart-dimension minutiae ('72 chars wide', '120 chars each') is cosmetic detail that competes with the routing information an agent actually needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so explaining return contents was optional, yet the workflow routing and the must_ask_user/actions contract are exactly what an agent needs and are present. The one gap is that it asserts 'Requires pattern_hash' while the schema marks zero required parameters and offers pattern as an equivalent alias — a minor inconsistency that could mislead an agent about hard requirements.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so every parameter is already documented, including the pattern/pattern_hash precedence and the projection caveat. The description restates the pattern_hash sourcing (tenx_hash from preview_filter.data.patterns[]) and little else about the remaining params (timeRange, environment, include_samples), so it sits at the baseline for a fully-covered schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Returns a full single-pattern view') and enumerates the concrete payload: 24h line chart, cross-service bar chart, severity breakdown, sample events. It also names its position in the workflow relative to log10x_preview_filter, so an agent can distinguish it from pattern_trend, pattern_examples, and pattern_diff without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit trigger ('CALL THIS AFTER log10x_preview_filter when the user drills into a specific pattern by number') plus named alternatives for both directions: log10x_preview_filter (back) and log10x_configure_engine (apply). It even specifies the must_ask_user prompt, so the agent knows the required interaction loop, not just when to call.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_pattern_diffPattern diff (set diff across a time boundary)ARead-onlyIdempotent
Set diff of patterns across a time boundary. Compares pattern presence in two windows (the most recent timeRange window as "after" vs the immediately preceding timeRange window as "before") and returns four sets: new (present after, absent before), retired (present before, absent after), persistent (present in both), and re_emerged (flagged as new but actually existed prior to the before-window — the "the bug we thought we fixed is back" case, derived by checking first_seen against the before-window boundary). Plus co_emergence_clusters: groups of 3+ patterns whose first_seen timestamps cluster within ±co_emergence_window_seconds (default 60s). That cluster is a deploy fingerprint — no CI/CD integration required; the agent can then query the customer's deploy system externally with the cluster timestamp. This tool is coherent ONLY because log10x pattern_hash is stable across queries; competitors that re-cluster per query (Datadog Log Patterns, Cribl, Edge Delta) can't answer the diff question because their "patterns" on either side of the boundary aren't comparable. Use for "what changed since last deploy", "which patterns disappeared this week", "did the rollback bring back the old errors", or paired with log10x_pattern_examples on a flagged hash to see slot distribution. Scoping: service and severity narrow the universe; limit caps rows per category. Returns structured envelope under data.diff with the four sets plus an incidents block when co_emergence clusters are detected.
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | Output format. | summary |
| limit | No | Max rows per category (new / retired / persistent / re_emerged). Default 20. | |
| service | No | Service name to scope. Omit for all services. | |
| severity | No | Severity to scope (e.g. `ERROR`, `CRITICAL`). | |
| timeRange | No | Window size on both sides of the boundary. The tool compares the most recent `timeRange` ("after") against the immediately preceding `timeRange` ("before"). Example: `timeRange: "1d"` compares today vs yesterday. | 1d |
| environment | No | Environment nickname (for multi-env setups). | |
| analyzerCost | No | stack ingestion cost in $/GB. Auto-detected from profile. | |
| co_emergence_window_seconds | No | Time spread for clustering co-emergent patterns. Default 60s — tight enough to fingerprint a single deploy. | |
| min_co_emergence_cluster_size | No | Minimum cluster size to emit. Default 3 — 2 patterns sharing a timestamp is often coincidence. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnlyHint, idempotentHint, openWorldHint), so the bar is lower, and the description still adds real behavioral context: how re_emerged is derived (checking first_seen against the before-window boundary), how co-emergence clusters fingerprint a deploy with default 60s window, and that an incidents block is emitted when clusters are found. It stops short of noting limits, auth, or large-window cost behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The core definition and the labeled sets are front-loaded and the Scoping/Returns structure helps. But roughly a third of the text is competitive marketing ('coherent ONLY because log10x pattern_hash is stable... competitors that re-cluster per query') that does not help an agent select or invoke the tool, so several sentences do not earn their place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 9-parameter tool with an output schema and read-only annotations, the description is complete: it explains usage triggers, scoping, defaults, the semantics of each returned set, and the conditions under which an incidents block appears. Nothing an agent needs to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all nine parameters, and the description largely restates them (timeRange window pairing, limit rows-per-category, service/severity scoping). The re_emerged boundary semantics and cluster-fingerprint framing add a little meaning beyond the schema, but not enough to rise above the baseline for full coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb+resource+scope ('Set diff of patterns across a time boundary') and enumerates exactly what is computed: the new/retired/persistent/re_emerged sets plus co_emergence_clusters. This is unambiguous and clearly distinguishable from look-alike siblings such as log10x_pattern_trend or log10x_whats_changing, which do not produce a set diff.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Concrete trigger phrases are given ('what changed since last deploy', 'which patterns disappeared this week', 'did the rollback bring back the old errors') and it names a specific companion call (log10x_pattern_examples on a flagged hash). However it never explicitly distinguishes itself from the similarly-purposed siblings log10x_whats_changing and log10x_pattern_trend, leaving that disambiguation to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_pattern_examplesPattern examplesARead-onlyIdempotent
Pull recent live events for a pattern from the customer's log analyzer (Splunk, Datadog, Elasticsearch, CloudWatch) and return them grouped by templateHash with template-extracted slot values per match. Bounded to a 24-hour window (live log analyzer retention); for older history use log10x_retriever_query. Input is either a Symbol Message (pattern name like Payment_Gateway_Timeout) or a pasted raw log line; pasted lines resolve via the same templater path as log10x_resolve_batch. The tool runs a SIEM phrase-search probe, runs returned events through the local templater, groups by templateHash (one bucket per template variant of the pattern; the stable pattern identity is the tenx_hash carried on each bucket), applies a content-token Jaccard similarity threshold (≥0.85) to discriminate the matching pattern's events from look-alikes, and returns the top buckets by event count. Output is honest about partial extractions: per-bucket templateHash labels, recall counts, and explicit parseFailed markers when slot extraction fails. Multi-line group templates report head-line-only with an explicit warning. Designed as an orchestration primitive called by log10x_investigate when the chain needs concrete event evidence after a metric-tier identification. Direct user-facing use is fine but rare; prefer log10x_event_lookup + log10x_pattern_trend for single-line inspection.
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | Response shape. `summary` (default) returns slim top-3 buckets (rank, template_hash, tenx_hash, event_count, jaccard, severity, service, recommended_action, headline, ~200-char sample_event preview) plus pattern-level counts. No raw_events, no full sample_event, no slot_distribution, no rationale prose. Target: under 8K tokens. `detail` returns one fully-hydrated bucket (requires bucket_id); pair with retriever_query for raw events. | summary |
| limit | No | Maximum number of sample events per templateHash bucket. 1-50, default 10. | |
| scope | No | Vendor-specific scope (Splunk index, Datadog index, ES index pattern, CloudWatch log group). Defaults to a sensible per-vendor value when omitted. | |
| vendor | No | Log analyzer to search. Auto-detected when exactly one of the supported vendors has credentials in the env; pass explicitly when multiple are configured. | |
| pattern | No | Pattern name (e.g. `Payment_Gateway_Timeout`) or a pasted raw log line. Pasted lines resolve to the matching pattern via the same pattern-extraction path as log10x_resolve_batch. Either pattern or pattern_hash must be provided; pattern_hash is preferred when available. | |
| service | No | Optional service-name scope. Translated to the vendor-specific service filter. | |
| severity | No | Optional severity scope (e.g., `ERROR`, `WARN`). | |
| bucket_id | No | Bucket identifier to fully hydrate. Accepts either the `template_hash` or the `tenx_hash` returned in a prior `view=summary` call. When supplied, the response carries one bucket with full sample_event, full slot_distribution (un-cropped sample_values), bucket_interpretation.rationale, and human_summary. Other buckets are omitted. | |
| timeRange | No | Window for the live SIEM probe. Capped at 24h. To sample a pattern's offloaded cohort (events the Receiver routed to the overflow bucket, which the SIEM never received), use log10x_retriever_query. '1d' is a legacy alias for '24h'. | 1h |
| environment | No | Environment nickname. | |
| slot_filter | No | Optional slot-value filter. When provided, only buckets whose slot_distribution carries the given slot value pass through. Useful for drilling into a single dominant value from a previous pattern_examples call. | |
| pattern_hash | No | Canonical 11-char hash. Either pattern (Symbol Message name) or pattern_hash must be provided; pattern_hash is preferred when available. Resolved to the pattern name via the 10x metrics (same path pattern_detail uses). |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover the safety profile (readOnlyHint, openWorldHint, idempotentHint), and the description goes well beyond them: SIEM phrase-search probe, local templater pass, Jaccard ≥0.85 discrimination, top-buckets-by-count ordering, explicit parseFailed markers, and head-line-only warnings for multi-line templates.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Dense but front-loaded: the core action and 24h constraint come first, with alternatives and orchestration role after. Some clauses (templater-path recap, similarity threshold mechanics) are verbose, but every sentence carries operational information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value detail is not required, and the description still covers partial-extraction semantics, retention limits, and the orchestration contract. For a 12-param open-world tool, nothing an agent needs to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already explains view, bucket_id, timeRange, slot_filter, etc. The description restates the pattern/pattern_hash duality and the 24h cap but adds no syntax or format detail beyond what the schema provides, matching the baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (pull recent live events) and resource (for a pattern), names the supported log analyzers, and explicitly distinguishes itself from log10x_retriever_query, log10x_event_lookup, and log10x_pattern_trend. An agent can identify the tool's role without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use ('orchestration primitive called by log10x_investigate when the chain needs concrete event evidence'), when-not (bounded to 24h; use log10x_retriever_query for older history), and preferred alternatives for single-line inspection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_pattern_mitigatePattern mitigateARead-onlyIdempotent
[FRESH-SESSION ROUTING: if this is the user first cost question of the session, call log10x_start first instead — it returns the orientation menu the user needs before any per-tool action.] Given one pattern (symbolMessage identity or tenx_hash), return the env-gated CAPABILITY MENU of which mitigation paths are reachable: drop_at_analyzer, drop_at_forwarder, mute_at_10x, compact_at_10x. Each option carries enabled (true/false), label, and disabled_reason when not reachable. This is a REACHABILITY-FIRST router: it answers "which of the four tiers can I use right now given my env wiring" — NOT "how much would each save". Per-option estimated savings (% reduction, $/mo) and paste-ready config snippets are surfaced by the next-tool chain (log10x_cost_options for the action menu, then the specific action tool for the snippet) — NOT this envelope. The agent surfaces the menu to the user; the user picks; chain to log10x_cost_options for the action-level breakdown. Action-shaped tool — calibration honesty: the envelope's recommendation_basis tells the agent WHERE the capability detection came from (envs.json, snapshot, env vars, or unknown). recommendation_audit.capability_sources carries the per-field source, and snapshot_age_seconds carries snapshot staleness. The agent SHOULD NOT auto-route to the chosen sub-tool until the user picks an option, and SHOULD verify the basis before treating capability detection as authoritative (e.g., a stale snapshot may mis-flag mute as enabled when the receiver was uninstalled). See docs/cross-pillar-primitives.md for the agent behavior contract. Call this when a previous tool surfaced a high-cost pattern and the user asks 'what should I do' / 'how do I drop this' / 'how do I reduce this'.
| Name | Required | Description | Default |
|---|---|---|---|
| pattern | Yes | The pattern identity to mitigate. Pass the canonical name from a prior log10x_top_patterns / log10x_event_lookup row. | |
| service | No | Optional service scope. When set, options that target a single service (forwarder drop, exclusion filter) are scoped to it. | |
| snapshot_id | No | Snapshot from log10x_discover_env. Used to detect which 10x components are deployed in the active env (receiver, retriever, GitOps wiring). When passed, the envelope's `recommendation_audit.capability_sources` reflects which capabilities came from the snapshot vs envs.json. Without it, the tool still works but may dim PR-based options if the active env's envs.json does not list a gitops repo. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish read-only/idempotent behavior, but the description adds substantial context beyond them: it discloses the envelope fields (recommendation_basis, recommendation_audit.capability_sources, snapshot_age_seconds), the caveat that a stale snapshot may mis-flag mute as enabled, and the behavioral contract that the agent surfaces the menu and waits for a user pick. This is exactly the kind of disclosure that goes beyond structured annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Content is front-loaded with routing and the core purpose, and every section is relevant. It is dense with bolded emphasis and some repetition (the 'NOT this envelope' point is restated), which costs a little tightness, but the length is largely justified by the routing contract and chaining instructions.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a router whose output schema exists, the description covers everything an agent needs: the trigger, the reachability-first semantics, the chaining path, the audit/staleness fields, and a pointer to the behavior contract doc. No gap that would cause a wrong invocation remains.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so parameters are already documented; the description nonetheless adds meaning by clarifying that pattern accepts a symbolMessage identity or tenx_hash from a prior tool, that service scopes single-service options, and that snapshot_id drives which capability sources populate the audit. Marginal but real added value over the schema baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (return the env-gated capability menu for a given pattern) and enumerates the four tiers it reports on (drop_at_analyzer, drop_at_forwarder, mute_at_10x, compact_at_10x). It also explicitly draws the boundary against siblings, declaring it is a 'REACHABILITY-FIRST router' and not the savings/action tool. An agent can distinguish it from log10x_cost_options and the action tools without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Names the exact triggering condition ('when a previous tool surfaced a high-cost pattern and the user asks what should I do / how do I drop this') and the prerequisite routing (call log10x_start first on the session's first cost question). It routes to the specific alternatives (log10x_cost_options for the action menu, then the action tool for the snippet) and warns not to auto-route until the user picks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_pattern_trendPattern trendARead-onlyIdempotent
Return the volume history for a single pattern over a chosen window (e.g. 1h, 24h, 7d, 30d), with a sparkline and spike detection — ranked by byte volume (with cost overlay when $/GB is set). Call this after log10x_event_lookup when the user asks "is this getting worse", "has it been louder before", "when did it start", or wants temporal context on a pattern surfaced in an earlier step. Always state the observation window explicitly in the reply — "flat at 2/h for the last 6 months of observation, spiked at 13:58 today" — and never claim history older than the window. Pass include to select the cohort: admitted (default), dropped (offloaded-only trend — useful for "is the receiver dropping more of this lately"), or both (total ingest). The envelope reports which cohort the series represents so the agent never conflates admitted-only with total volume.
| Name | Required | Description | Default |
|---|---|---|---|
| step | No | Data point interval. Default `auto` sizes the step to give ~12–30 buckets per window (1h→5m, 6h→15m, 1d/24h→1h, 7d→6h, 30d→1d). Override only when a specific resolution is required; an over-coarse step (e.g. 1h on a 1h window) produces a 2-point series with no usable trend shape. | auto |
| view | No | Output format. Always "summary" — the structured envelope. Field retained for backward-compat. | summary |
| include | No | Which engine-decision cohort to scope the trend to. `kept` (default) = events that actually reached the destination (routeState=~"pass|", absence-tolerant). `dropped` = everything the receiver acted on, so everything the destination did NOT receive (offload | compact | tier_down | drop | sample). Pass `drop` for the literal hard-drop cohort alone. `both` = the pre-decision union; envelope adds a parallel `dropped_time_series` and `dropped_share_pct` so one call shows offload share over time. Use `dropped` to verify post-deploy realised savings or to chart "what we are offloading right now". Use `both` to overlay kept vs dropped on the same window. | kept |
| pattern | No | Pattern name (e.g., "Payment_Gateway_Timeout"). Provide either pattern or pattern_hash — pattern_hash is preferred when available (skips a metrics lookup). | |
| timeRange | No | Time range. '24h' and '1d' are equivalent (one-day window). Sub-day values show fine-grained trajectory around an incident. | 7d |
| environment | No | Environment nickname | |
| analyzerCost | No | SIEM ingestion cost in $/GB | |
| pattern_hash | No | The tenx_hash of the pattern (11-char stable identity from top_patterns / preview_filter). Preferred over pattern when available. | |
| include_chart | No | Set include_chart=true to embed the rendered chart inline (large; default false to avoid response truncation). | |
| monthly_volume_gb | No | What-if volume lens (forecast mode): model the environment at THIS monthly volume (decimal GB/month) instead of its measured volume. The real per-pattern shares and pattern mix are held fixed; only absolute bytes and dollars scale, by one uniform factor. Use it to project a prospect onto their own scale, or to forecast a real env after growth. Pairs with siem_lens. This is a PROJECTION: the envelope stamps volume_actual_gb vs volume_projected_gb and the scale factor, and the note points at the POC for the caller real patterns. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare read-only/idempotent/open-world, so the description carries the rest: it warns about conflating admitted-only with total volume, states the envelope reports the represented cohort, and discloses the projection stamping (volume_actual_gb vs volume_projected_gb). Some of the text is agent-facing output guidance rather than tool behavior, which slightly dilutes it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The purpose is front-loaded in the first sentence and the routing rule follows. It is long, but the length is largely earned by ten parameters and three cohorts; there is some duplication with the verbose schema descriptions for `include` and `step`.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present and annotations covering the safety profile, the description need not explain return values, and it covers when-to-use, cohort semantics, and the projection caveat. The only gap is the cohort-label inconsistency with the schema, which slightly weakens completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, and the description does add real semantic meaning (what kept vs dropped represent, the dropped_share_pct overlay, the what-if projection lens). However, it references enum values that do not exist in the schema – 'admitted' (schema default is 'kept') and 'drop' (schema value is 'dropped') – which partially undermines the added guidance.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
It states a specific verb and resource ('Return the volume history for a single pattern over a chosen window') plus the derived features (sparkline, spike detection, cost overlay). It positions itself relative to a named sibling, log10x_event_lookup, and its temporal-scope framing separates it from a generic pattern detail lookup.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit triggering conditions ('Call this after log10x_event_lookup when the user asks "is this getting worse"...') and names the predecessor tool. It also explains when to choose each `include` cohort ('dropped' to verify post-deploy savings, 'both' to overlay kept vs dropped).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_poc_from_localPOC from local logs (kubectl)ARead-only
Run a log-cost-optimization POC entirely from local log sources — pass path for one log file (wrapper-normalized) or paths for files, directories and globs; kubectl samples pod logs; docker and journald to follow. No log-analyzer credentials required. Use when the prospect has no SIEM connection or has not yet shared API keys. Returns a synchronous markdown report with: (a) sample composition table — top-N pods by byte volume; the prospect must confirm the sample looks like their production mix, (b) industry-pricing matrix — projected savings at Datadog / Splunk / CloudWatch / Sumo / Elastic / OpenSearch list prices, NOT a prediction of any specific bill, (c) top patterns in the kubectl-sourced sample. For native exclusion configs, paste-ready Receiver YAML, and the full 9-section report tied to a specific log analyzer's actual GB-billed volume, run log10x_poc_from_siem once credentials are available. No automatic fallthrough: this tool is invoked explicitly. If log10x_poc_from_siem failed on missing credentials, the calling LLM should ask the user before re-invoking with this tool — local-source framing is genuinely different from SIEM-attached framing and silent fallthrough would be a bait-and-switch. REQUIRES a local engine: the tenx binary on PATH, or Docker with LOG10X_TENX_MODE=docker. No log-analyzer credentials and no deployment are needed, but without an engine this returns an error rather than a report. Pass target_percent_reduction as a whole-number percent (e.g. 40 for 40%) to get a feasibility verdict against that target. Two modes, and the agent should name whichever the user's phrasing invites. Run normally, this tool reads local files but the server around it still has network. Run inside the FENCED profile (TENX_AIRGAPPED=true, --network none, the log10x/poc image) it is the same analysis with no network at all, and its output carries its own docker inspect proof. log10x_emit_sample_plan produces the sample for that mode from the user's own analyzer. Offer it; do not ask which one first.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | One local log file to analyse (source=`file`). Wrapped JSONL is normalized so the engine patterns payloads, not wrappers. For many files or globs use `paths` instead. | |
| siem | No | The destination SIEM, used for the report header chip and command selection. When absent the analysis assumes CloudWatch and the report labels the assumption. | |
| paths | No | Required for `source: file`: files, directories, or glob patterns (`*`, `**`, `?`) to sample, e.g. `["/var/log/app/*.log", "./bundle/**"]`. A directory is read one level deep; use `dir/**` for the tree. | |
| source | No | Where to pull log lines from. `kubectl` samples pod logs; `file` samples local logs — pass `paths` (files, directories, globs) or `path` (one file; fluentd/k8s/docker-wrapped JSONL is detected and normalized before the engine sees it). `docker` and `journald` are follow-up work. | kubectl |
| window | No | How far back to read per pod (`source: kubectl`). For `source: file` this is the time span you declare the sampled file tails to cover — it drives the daily projection, so set it if you know it. Accepts `1h`, `24h`, etc. Default `1h`. | 1h |
| max_pods | No | Cap on number of pods sampled. Default 20. | |
| workload | No | Forwarder workload name (daemonset/deployment) for the apply commands. Not guessed when absent. | |
| forwarder | No | Forwarder in the pipeline (fluentd, fluent-bit, filebeat, logstash, otel-collector, vector, hec). Used to pick verified apply/undo commands. Not guessed when absent — the report says commands are unavailable. | |
| namespace | No | Kubernetes namespace to sample from (`source: kubectl` only). Pass `*` to sample across all namespaces. Default `default`. | default |
| allow_lossy | No | Permit sample/drop (lossy) to close a keep-everything shortfall. Default false: the plan stops at the keep-everything ceiling and reports the gap. Only set after the user explicitly chooses loss. | |
| pin_patterns | No | Advanced — most customers will not need this. Map of pattern_hash to action for rare per-pattern overrides within a pod / source. Applied AFTER pin_services. | |
| pin_services | No | Primary per-pod/source override surface. Map of pod / source name to action. Pins are applied AFTER the destination default and AFTER exception_services. Feasibility reruns with the pins; max_achievable shifts and reason cites the pins. | |
| per_pod_limit | No | Cap on log lines pulled per pod. Default 5000. | |
| budget_gb_monthly | No | VOLUME BUDGET: keep projected monthly ingest at or under this many GB/mo. BYTE accounting: tier_down keeps every byte and is excluded from the ladder for this target. Sample scaled to a 30-day month before solving. Mutually exclusive with target_percent_reduction and budget_usd_monthly. | |
| budget_usd_monthly | No | DOLLAR BUDGET: keep the projected monthly bill on the assumed SIEM at or under this $/mo. The sample is scaled to a 30-day month (kubectl window, or file timestamp span) before solving, so the budget and the bill share a denominator. Mutually exclusive with target_percent_reduction and budget_gb_monthly. | |
| exception_services | No | Services / pods flagged by the customer to stay in the log analyzer with full retention (action=pass). Their bytes are subtracted from the achievable reduction pool used for the feasibility verdict. Matched case-insensitively against the pod / source name. | |
| report_annotations | No | Optional one-sentence annotations keyed by evidence statement identifier, rendered under the matching action. Hard cap 140 chars each; over-cap or unknown-hash input refuses the render (nothing is truncated). | |
| retriever_installed | No | Whether the prospect will install the S3 retriever. Gates the offload rung of the plan ladder: without it offloaded events would be unreachable, so the plan stops at the in-SIEM levers and the gap names "install the retriever" as the lossless remedy. Set from conversation. | |
| target_percent_reduction | No | Customer-specified target reduction percent. If absent, POC produces a recommendation-only output. If present, POC produces a feasibility verdict + a pre-deploy commitment artifact stub the agent can surface alongside the per-pod savings matrix. The cap CSV is attached by a later change. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true and openWorldHint=true, and the description adds substantial behavior beyond them: it requires a local engine (tenx on PATH or Docker with LOG10X_TENX_MODE=docker) and errors without one, needs no analyzer credentials, returns a synchronous markdown report whose sections are enumerated, and supports a fenced airgapped mode. That is rich context the annotations cannot convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose and the local-vs-SIEM routing are front-loaded, and most sentences carry operational weight. It runs long and slips into agent-directed phrasing ("Offer it; do not ask which one first") and some repetition, but for a 19-parameter tool with two runtime modes the length is largely earned.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 19 params, nested objects, enums, an output schema, and a mode split, the description covers environment prerequisites, credential-free operation, error behavior, report contents, and the sibling alternative. Nothing an agent needs to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents all 19 parameters and baseline would be 3. The description nonetheless adds selection semantics — path vs paths, kubectl-sourced vs file-sourced sampling, and that target_percent_reduction is a whole-number percent (e.g. 40 for 40%) — which meaningfully helps invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource+scope: runs a log-cost-optimization POC entirely from local log sources, itemizing the input modes (path, paths, kubectl/docker/journald). It explicitly names and contrasts the sibling log10x_poc_from_siem, so an agent can route between them without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use ("Use when the prospect has no SIEM connection or has not yet shared API keys"), when-not (no automatic fallthrough; ask the user before re-invoking after a SIEM-credential failure), and names the alternative tool and the condition that selects it. This is about as complete as usage guidance gets.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_poc_from_siem_statusPOC from SIEM (status)ARead-onlyIdempotent
Retrieve progress or a view of the report from a log10x_poc_from_siem_submit run. Pass snapshot_id; optionally view to select the level of detail. In-progress responses report status (pulling / templatizing / rendering), progress_pct, step_detail, and elapsed_seconds — poll every ~30s until done. Complete responses render one of six views: summary (default, ~30 lines — exec banner + top-5 wins + views CTA), full (complete 9-section report, ~300 lines), yaml (paste-ready Receiver mute-file for the top N patterns), configs (native SIEM exclusion configs — Datadog exclusion filter / Splunk props.conf / etc.), top (expanded N-row drivers table), pattern (deep-dive on one identity — requires pattern arg). Failures include partial_report_markdown when any events were successfully pulled before the error. The full report is also written to ${LOG10X_REPORT_DIR:-/tmp/log10x-reports}/poc_from_siem-.md regardless of which view the caller requested. Snapshots live in-memory per MCP process; a restart clears them, so persist the final report path if you need it later. Unified envelope: response carries status, query_count, total_latency_ms, backend_pressure_hint, human_summary, plus the existing snapshot-lifecycle fields. Errors (unknown snapshot_id, render failure) come back as status: 'error' with a structured PrimitiveError envelope. See docs/cross-pillar-primitives.md for the agent behavior contract. Two modes, and the agent should name whichever the user's phrasing invites. This tool is the NETWORKED one: it reads the analyzer directly over the network with the caller's credentials, and the MCP mints one licence. The FENCED mode runs the same POC with no network at all — log10x_emit_sample_plan renders a read-only export script the user runs themselves, and the analysis happens in a container started with --network none, so 'cannot exfiltrate' is a kernel fact the user checks with one docker inspect rather than a claim we make. Offer it; do not ask which one first.
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | How to surface the report. Default `summary` returns the v2 structured envelope (`data.result` carries the full JSON: input section with scale + methodology + coverage, output section with aggregates, incidents, per-pattern actions). The agent reads this directly and writes prose in its own voice — no rendered markdown is included in the summary path. Use `markdown` to receive the rendered 9-section markdown report (legacy / human-readable surface). `yaml` returns paste-ready receiver mute-file entries; `configs` returns native SIEM exclusion configs; `top` returns an expanded N-row drivers markdown; `pattern` deep-dives on one identity (requires `pattern` arg). `full` is kept as an alias for `markdown`. | summary |
| top_n | No | Number of rows for views that accept it (`top`, `yaml`, `configs`, `summary`). Defaults: summary=5, top=20, yaml/configs=5. | |
| pattern | No | Required when view="pattern". The snake_case pattern identity to expand. Pass the raw identity as printed in prior views. | |
| snapshot_id | Yes | Snapshot id returned by log10x_poc_from_siem_submit. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With annotations covering the safety profile, the description still adds substantial behavioral context: in-progress field set, the six view shapes, failure partial_report_markdown behavior, the always-written report path, and critically that snapshots are in-memory per process and cleared on restart. None of this is in the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The core purpose is front-loaded and dense with useful detail, but the trailing 'two modes' paragraph is off-topic for a status tool and reads as shared boilerplate, diluting focus. Overall the text is long and heavy for what is fundamentally a polling/getter.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a snapshot-retrieval tool with an output schema and full annotations, the description covers lifecycle (in-memory, restart clears), error envelope shape, envelope fields, and view semantics. Nothing an agent needs to call and interpret it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% so the baseline is 3, but the description adds value by tying `pattern` to the pattern view requirement and implying view-dependent behavior (top_n defaults varying by view). It largely mirrors the schema's own rich view description, keeping it from a 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb+resource: 'Retrieve progress or a view of the report from a log10x_poc_from_siem_submit run.' This cleanly distinguishes it from the submit sibling and the other status tools. An agent knows exactly what this does without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete usage: poll every ~30s until done, pass snapshot_id, use view to control detail level, and pattern arg required for the pattern view. It also routes to log10x_emit_sample_plan for the fenced alternative. However the 'two modes' paragraph awkwardly describes mode selection for the POC overall rather than this status tool, adding some routing ambiguity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_poc_from_siem_submitPOC from SIEM (submit)A
Kick off a full log-cost-optimization POC against the user's SIEM. Pulls a representative event sample, templatizes into stable pattern identities, and renders a 9-section markdown report covering top cost drivers, Receiver recommendations, ready-to-paste native SIEM exclusion configs, Compact mode potential, risk/dependency checks, and deployment paths. Supported SIEMs: cloudwatch (AWS CloudWatch Logs via IAM credential chain), datadog (DD_API_KEY + DD_APP_KEY), sumo (Sumo Logic), gcp-logging (GCP Cloud Logging), elasticsearch (Elastic Cloud / self-hosted), azure-monitor (Azure Monitor / Log Analytics), splunk (SPLUNK_HOST + SPLUNK_TOKEN), clickhouse (OpenObserve / SigNoz / custom schemas). Auto-detects the SIEM from env vars when siem omitted — explicitly pass siem if multiple credential sets exist. scope and query are SIEM-specific: CloudWatch (log group + filter pattern), Datadog (index + query), Sumo (_sourceCategory + query), GCP (project id + filter), Elasticsearch (index pattern + KQL), Azure (workspace id + KQL), Splunk (index + SPL), ClickHouse (database + SQL WHERE). For ClickHouse, also pass clickhouse_table (required) and column-mapping args for custom schemas (OpenObserve/SigNoz auto-detected). Returns a snapshot_id — poll via log10x_poc_from_siem_status to retrieve progress and the final report. Report is also written to ${LOG10X_REPORT_DIR:-/tmp/log10x-reports}/poc_from_siem-<timestamp>.md. Default window is 7d, default target event count is 250k, default max pull time is 5 min — the pull stops at whichever of the two ceilings hits first. Tier prerequisites: none. No log10x API key required. Templating defaults to privacy_mode=true: events are templated by a local Log10x engine, either a native tenx CLI (install for macOS/Linux/Windows: https://doc.log10x.com/install/) or a local Docker container (set LOG10X_TENX_MODE=docker, auto-detected and preferred when the mode is unset), and never leave the machine. Set privacy_mode: false to route through the public Log10x paste endpoint — demo use only, not production log content. Two modes, and the agent should name whichever the user's phrasing invites. This tool is the NETWORKED one: it reads the analyzer directly over the network with the caller's credentials, and the MCP mints one licence. The FENCED mode runs the same POC with no network at all — log10x_emit_sample_plan renders a read-only export script the user runs themselves, and the analysis happens in a container started with --network none, so 'cannot exfiltrate' is a kernel fact the user checks with one docker inspect rather than a claim we make. Offer it; do not ask which one first.
| Name | Required | Description | Default |
|---|---|---|---|
| siem | No | Which SIEM to pull from. Omit to auto-detect from ambient credentials. Valid values: cloudwatch, datadog, sumo, gcp-logging, elasticsearch, azure-monitor, splunk, clickhouse. | |
| query | No | SIEM-native filter expression layered on top of `scope`. Syntax per SIEM (CloudWatch filter pattern; Datadog query; KQL for ES/Azure; SPL for Splunk; SQL WHERE for ClickHouse; Sumo query). | |
| scope | No | SIEM-specific resource scope. CloudWatch: log group name or wildcard (`/aws/ecs/*`). Datadog: index name. Sumo: `_sourceCategory`. GCP: project id. Elasticsearch: index pattern. Azure Monitor: workspace id. Splunk: index name. ClickHouse: database name. | |
| window | No | Window to pull over. Accepts "1h", "24h", "7d", "14d", "30d". Default "14d" — wide windows unlock the differentiated longitudinal signals (first-seen, growth, stable-vs-new) that the agent cannot compute from a small sample. Pull pacing is automatic; long windows take minutes but the snapshot continues in the background. | 14d |
| ai_prettify | No | Default true: use MCP sampling to ask the host LLM (the same model the user is already chatting with — Claude Desktop, Claude Code, Cursor, etc.) to batch-generate 3-5-word human-readable names for the top patterns. No Log10x-side endpoint, no extra API key — the host uses whatever model + credentials the user already has. Sends only templated pattern identities (no variable values, no raw log content). Skipped automatically when the host does not advertise the `sampling` capability; the report falls back to raw snake_case identities plus a note. Set false to skip unconditionally. | |
| environment | No | Optional environment nickname — cosmetic only, for the report header. | |
| pin_patterns | No | Advanced — most customers will not need this. Map of pattern_hash to action for rare per-pattern overrides within a service. Applied AFTER pin_services. Use only when a single pattern inside an otherwise-reducible service must be excepted (e.g., audit-trail log line inside a chatty service). | |
| pin_services | No | Primary per-service override surface. Map of service name to action. "Pin payment-svc to pass" → {"payment-svc":"pass"}. Pins are applied AFTER the destination default and AFTER exception_services. Feasibility math reruns with the pins; max_achievable_percent may shift and reason cites the pins. | |
| total_daily_gb | No | Customer's total daily log volume in GB/day. Pick any one of total_daily_gb / total_monthly_gb / total_annual_gb — whichever unit the user naturally thinks in. The tool normalizes to daily internally. When any is provided (or auto_detect_volume succeeds), per-pattern costs are extrapolated from the pulled sample to the full volume, producing meaningful annual-savings figures instead of sub-cent numbers. Priority: daily > monthly > annual. If the pull was narrowed via `query` to one service, this overstates cost — only a fraction of daily volume matches the filter. | |
| total_annual_gb | No | Customer's total annual log volume in GB/year. See total_daily_gb for semantics. | |
| clickhouse_table | No | [ClickHouse] Required — table name holding log events. | |
| max_pull_minutes | No | Hard cap on pull wall-time. Default 30. The pull stops at whichever of target_event_count, max_pull_minutes, or saturation-detected hits first. Long pulls run in the background; poll status while the user does other things. | |
| total_monthly_gb | No | Customer's total monthly log volume in GB/month. See total_daily_gb for semantics. | |
| enrich_max_tokens | No | Output token cap for the host-agent enrichment call. Default 8000. | |
| auto_detect_volume | No | Default true: when no total_*_gb arg is provided, probe the SIEM's usage/metrics API to auto-detect daily ingest volume. Per-SIEM best-effort: CloudWatch (describeLogGroups ÷ retention), Datadog (Usage API), Elasticsearch (_stats), Azure (Usage KQL table), GCP (Cloud Monitoring byte_count), ClickHouse (system.parts), Splunk (license API), Sumo (Account Usage API). Fails silently and falls back to scenario brackets if the current creds lack the required scope. Set false to skip the probe and go straight to manual args or scenarios. | |
| exception_services | No | Services flagged by the customer to stay in the SIEM with full retention (action=pass). Typically 1-3 services for audit, compliance, or executive dashboards. Patterns whose service is in this list are pinned to pass on the envelope outputs and their bytes are subtracted from the achievable reduction pool used for the feasibility verdict. | |
| target_event_count | No | Target event count for the pull. Default 1,000,000 (~500 MB at 500B avg, tokenizes in 5-10 min). The pull self-terminates earlier on saturation — when new patterns per 100k events drops below 2%, the long tail has been covered and the report is generated. This default is intentionally two orders of magnitude beyond what an unaided agent can fit in context. | |
| analyzer_cost_per_gb | No | Override the $/GB rate for cost calculations. Default is read from vendors.json per detected SIEM. | |
| enrich_with_host_agent | No | Default true: after the engine produces measured findings (per-pattern $/mo, growth, incident clusters), ask the MCP host LLM via sampling to contribute operational context the engine cannot see: kubectl events / deploys correlating with GROWING patterns, alert / dashboard dependencies before recommending mute, code-level root-cause refinement on code_fix patterns, and prioritization based on customer context. Single round-trip, capped at 8000 output tokens. Skipped automatically when the host does not advertise sampling; the v2 envelope still ships without enrichment. Contributions land in output.agent_enrichment.contributions with an audit trail (tools_inspected) so the customer sees what the agent says it looked at. | |
| target_percent_reduction | No | Customer-specified target reduction percent. If absent, POC produces a recommendation-only output. If present, POC produces a feasibility verdict (`output.feasibility`) plus a pre-deploy commitment artifact stub (`output.commitment_artifact`) the agent can surface alongside the per-pattern actions. The cap CSV ready to commit is attached by a later change. | |
| clickhouse_message_column | No | [ClickHouse] Column holding the message body. Default auto-detected. | |
| clickhouse_service_column | No | [ClickHouse] Optional column for service name. | |
| clickhouse_severity_column | No | [ClickHouse] Optional column for severity. | |
| clickhouse_timestamp_column | No | [ClickHouse] Column holding the timestamp. Default auto-detected. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Far exceeds the annotations (readOnlyHint=false, openWorldHint=true, idempotentHint=false). It discloses network behavior, a single licence minted, privacy_mode defaults with data residency, background execution, auto-detection failure fallback, and the FENCED-mode contrast — behavior an agent cannot infer from structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose is front-loaded, but the body is very long and padded with persuasive wording (the 'kernel fact' exfiltration framing, 'Offer it; do not ask which one first') that goes beyond invocation guidance. Some length is justified by 24 parameters, yet much of the text duplicates the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the description correctly points to snapshot_id polling. It covers the essential operational context (creds, auto-detect, background pulls), though the stale default values undermine completeness for callers trusting the prose over the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents all 24 parameters richly. Worse, the description contradicts the schema defaults: it claims 'Default window is 7d, default target event count is 250k, default max pull time is 5 min,' while the schema declares 14d, 1,000,000, and 30 minutes respectively. Misleading default values are worse than silence.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Kick off a full log-cost-optimization POC against the user's SIEM') and enumerates exactly what it does: pulls a sample, templatizes, renders a 9-section report. It also distinguishes itself from siblings, naming log10x_poc_from_siem_status for polling and log10x_emit_sample_plan for the fenced alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly frames when to use this tool ('the NETWORKED one') versus the fenced mode that 'runs the same POC with no network at all,' and directs the agent to 'offer it; do not ask which one first.' It also names the exact follow-up tool (log10x_poc_from_siem_status) for retrieving results.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_preview_filterPreview filter patternsARead-only
CALL THIS AFTER log10x_explain_mode when the user picks Preview. Shows the list of patterns that would be affected by applying a given enforcement mode to a service, before any action is taken. Returns a fixed-width plain-text table (no markdown pipes) with columns: rank, descriptor, volume, %, service, severity, first seen, trend sparkline. Writes a CSV to /tmp/log10x-preview--.csv. must_ask_user offers: drill into pattern #N (calls log10x_pattern_detail), Apply, or go back to pick a different mode. forbidden_next_actions locks log10x_configure_engine, log10x_pattern_mitigate, and log10x_advise_retriever until the user commits.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | The enforcement mode being previewed. Controls which patterns are highlighted as affected. | |
| top_n | No | Number of patterns to surface. Default 20. | |
| service | Yes | Service to scope the preview to. | |
| environment | No | Environment nickname for multi-env setups. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint/openWorldHint/idempotentHint, but the description adds behavior they cannot: a filesystem side effect (CSV written to /tmp/log10x-preview-<mode>-<service>.csv), the exact return rendering (fixed-width text, no markdown pipes), and an interaction contract (must_ask_user options, forbidden_next_actions locking configure/mitigate/advise_retriever). This is genuinely additive context beyond structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the activation condition and every sentence carries distinct actionable content (trigger, scope, return shape, side effect, allowed next actions, blocked actions). It is dense and slightly run-on toward the end, but there is no filler or repetition of the title/name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a workflow-gated preview tool with an output schema, four documented params, and annotations, the description covers the missing pieces an agent needs: precondition, consumed output format, the CSV artifact, and the permitted follow-up actions. Nothing required to invoke or follow up correctly is absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and every parameter carries its own description including the mode enum values, so the schema already does the heavy lifting. The description only implicitly echoes the service+mode pairing ('applying a given enforcement mode to a service') and says nothing about top_n or environment semantics, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (preview) and resource (the patterns a given enforcement mode would affect, scoped to a service) and explicitly frames it as a no-side-effect dry run. The sequencing cue referencing log10x_explain_mode and the drill-down reference to log10x_pattern_detail lets an agent distinguish it from the ~50 sibling tools without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit trigger ('CALL THIS AFTER log10x_explain_mode when the user picks Preview'), an explicit scope caveat ('before any action is taken'), a named alternative next step ('drill into pattern #N calls log10x_pattern_detail'), and locks three specific sibling tools until the user commits. There is essentially nothing left to infer about when to select this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_product_qaProduct Q&A from shipped docsARead-onlyIdempotent
Answer Log10x product questions from the docs corpus that ships inside the MCP build (chunked + indexed at install time). Use whenever the user asks a factual product question — "what is the Receiver", "how is pattern_hash computed", "what data leaves my network", "does the Reporter modify data" — instead of answering from training data. Inputs: topic for an exact docs-slug lookup (e.g. faq/security/data-protection), or query for natural-language TF-IDF search across the corpus. category narrows search to one of faq / apps / engine / api / config / manage. max_results caps the result count (default 3). Output is a standard chassis envelope with found, ranked results (each carrying matched chunks + canonical_url), and similar_topics as a did-you-mean fallback. Always cite canonical_url when surfacing an answer to the user. The corpus is shipped from config/mksite/docs at build time; in development the loader also honors LOG10X_PRODUCT_KB_PATH.
| Name | Required | Description | Default |
|---|---|---|---|
| depth | No | Response detail. "short" (default) returns a tight grounded answer plus citation metadata (topic + canonical_url, no section bodies) and offers a chained learn_more action per citation. "full" returns the matched section bodies for one specific page and is requested via the learn_more action the short response hands back (pass that action verbatim: `topic` + `depth: "full"`). | |
| query | No | Natural-language query — prefer this for how-to / content questions. Examples: "what does the kustomize overlay patch", "how is pattern_hash computed". When `topic` is also set, ranks that page's sections by this query. | |
| topic | No | Exact docs slug to fetch a known page. Example: "faq/security/data-protection" or "apps/receiver/deploy". For a multi-section page, ALSO pass `query` to get the asked-about section instead of the page intro. | |
| category | No | Restrict results to one category. One of: faq, apps, engine, api, config, manage. Combines with `query`. | |
| max_results | No | Cap on the number of results returned. Default 3. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover readOnly, idempotent, closed-world. The description adds unique operational context: the corpus ships inside the MCP build, is chunked/indexed at install time, and in development honors LOG10X_PRODUCT_KB_PATH. It doesn't cover staleness or size limits of the index, but with annotations handling safety it clears the bar.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core purpose and examples, then a compact parameter-and-output block. It is dense but readable; a sentence about `depth`/`learn_more` chaining would have been a bigger win than the environment-variable aside, which is somewhat tangential for an agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite 5 params and 0 required fields, the description gives the agent routing logic (topic vs query vs category), result shaping (max_results default), output envelope shape (found/results/similar_topics), and the citation obligation (always cite canonical_url). Output schema exists, but the description's summary of the envelope is still a net positive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds value by stating the equivalence between topic-only vs topic+query ('ranks that page's sections by this query') and naming the exact enum values for `category` while explaining its filter semantics beyond the schema's list.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (answer Log10x product questions from the shipped docs corpus) and grounds it with concrete example questions. Distinguishes itself from data-oriented siblings like log10x_event_lookup and log10x_top_patterns by anchoring to a static docs corpus rather than live telemetry.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says to use it whenever the user asks a factual product question 'instead of answering from training data,' with rousing examples. It also explains when to pick `topic` (exact slug) vs `query` (natural-language search), which is the key routing decision.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_rank_by_shape_similarityRank by shape similarityARead-onlyIdempotent
Second step of cross-pillar investigation: Pearson correlation + signed lag on a pre-filtered candidate set (typically the moved[] output of log10x_metrics_that_moved). Returns per-candidate: pearson_magnitude, pearson_signed (direction preserved), lag_seconds (signed: negative = candidate leads anchor, positive = candidate lags), lag_at_bound (flag: peak landed at search-window boundary), lag_tightness (how sharply the Pearson surface peaks), anchor_phase_gap, anchor_phase_aligned (flag: candidate value differs ≥15% between anchor's high-phase and low-phase buckets), n_buckets. No tier, no causal label — the agent reads the flags and decides. Compose with log10x_metric_overlay for the final per-candidate aligned-timeseries view.
| Name | Required | Description | Default |
|---|---|---|---|
| step | No | 30s | |
| anchor | Yes | Anchor identity. For `anchor_type=log10x_pattern`: the pattern Symbol Message NAME or its 11-char `pattern_hash` (= `tenx_hash`) — the tool detects shape and queries the correct PromQL label (`message_pattern` vs `tenx_hash`). For `anchor_type=customer_metric`: a customer PromQL expression. | |
| window | No | 1h | |
| timeRange | No | ||
| candidates | Yes | Customer-side PromQL expressions to rank (max 100). An AI caller reasoning over results can't meaningfully digest more than a few dozen; the cap reflects that, not a backend constraint. | |
| anchor_type | Yes | ||
| environment | No | ||
| lag_search_max_abs | No | Maximum absolute lag in seconds to scan. Default 1800s — uncalibrated. Output is tagged `unvalidated_default` when used as-is. Narrow it when the use case has a known tighter upper bound on cascade latency (e.g. 300 for sub-5-min cascades). See `docs/cross-pillar-primitives.md` for the calibration playbook. | |
| customer_metrics_url | No | Per-call override for the customer metrics backend URL. Wins over LOG10X_CUSTOMER_METRICS_URL env var. Use when MCP was launched with an empty/stale URL. | |
| customer_metrics_auth | No | ||
| customer_metrics_type | No | ||
| anchor_phase_aligned_floor | No | Relative phase-gap floor for the `anchor_phase_aligned` flag. Default 0.15 — uncalibrated, same provenance caveat as lag_search_max_abs. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint and openWorldHint, so the safety profile is covered. The description goes further by disclosing that no tier or causal label is produced ('the agent reads the flags and decides') and by explaining what each returned flag means, which is genuine behavioral context beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The text is dense and front-loaded with the core algorithm and workflow position, followed by a compact enumeration of output fields. Every sentence carries information, though the long inline field list is heavy for a single sentence and could be more scannable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex 12-parameter analysis tool, the description supplies the workflow framing, the semantic meaning of its outputs, and calibration caveats, and an output schema exists so return values need not be repeated. The remaining gap is input parameter coverage, which the description largely leaves to the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 12 parameters and only 42% schema description coverage, the description should compensate for undocumented parameters, but it does not. Parameters such as step, window, timeRange, environment, customer_metrics_auth and customer_metrics_type receive no explanation in either place, and the description's content is almost entirely about output fields rather than inputs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific operation (Pearson correlation + signed lag ranking) on a specific resource (a pre-filtered candidate set), and even states its position in the workflow ('Second step of cross-pillar investigation'). An agent can distinguish it from siblings like log10x_metric_overlay or log10x_metrics_that_moved without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It clearly places the tool in a workflow, naming the typical input source ('the moved[] output of log10x_metrics_that_moved') and the composition partner ('Compose with log10x_metric_overlay for the final per-candidate aligned-timeseries view'). It does not state explicit exclusions or when-not-to-use, so it falls just short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_resolve_batchTriageARead-onlyIdempotent
Templatize a batch of log events and return per-pattern triage. This is one of two tools that ACTUALLY RUN A LOCAL LOG10X PIPELINE on the user's machine (the other is log10x_extract_templates) — call this whenever the user asks 'can you run log10x locally', 'do a local pipeline run', 'templatize these events', or supplies any batch to analyze (Datadog/Splunk/Elastic query results, Slack incident attachments, kubectl logs, raw text). Does NOT need Kubernetes, a deployed Reporter, or a Log10x account — the pipeline runs in-process on the host. Output structures the batch by a paste-local templateHash with per-pattern frequency + severity + full template structure + per-slot variable distribution. Each top pattern carries actions[] chaining to log10x_investigate (historical correlation) and log10x_retriever_query (archive retrieval). Do NOT call for single-line resolution — use log10x_event_lookup for that. REQUIRES a local engine: the tenx binary on PATH, or Docker with LOG10X_TENX_MODE=docker.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Local file path when source=file. Required for file mode. | |
| text | No | Raw text blob when source=text — newline-separated log events. | |
| events | No | Inline log lines: an array of lines, or a single newline-separated string (both accepted). `source` need not be set. | |
| source | No | Optional — auto-inferred from whichever of `events` / `text` / `path` you actually provide, so you normally do not set it. Provide explicitly only to disambiguate when more than one is present. | |
| environment | No | Environment nickname — used to build next_actions that call log10x_investigate. | |
| top_n_patterns | No | How many patterns to return in the ranked triage. | |
| include_next_actions | No | Whether to generate next_action suggestions for each top pattern. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnly/idempotent/openWorld, and the description goes well beyond them: it discloses the hard prerequisite (tenx binary on PATH or Docker with LOG10X_TENX_MODE=docker), what is NOT required (Kubernetes, deployed Reporter, Log10x account), that the pipeline runs in-process, and the shape of the returned triage including actions[] chaining. This is genuinely non-obvious operational context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core action and usage triggers first, then prerequisites. It is dense and slightly over-long, but nearly every sentence carries routing or prerequisite value rather than filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, the description needn't detail return values, yet it still summarizes the triage structure and downstream chaining. Combined with full schema coverage and annotations, an agent has everything needed to call this correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all seven parameters including source inference and top_n_patterns bounds, making 3 the baseline. The description adds only marginal per-parameter meaning (e.g. that `environment` feeds next_actions), without new syntax or format detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Templatize a batch of log events and return per-pattern triage') and explicitly positions itself against siblings, naming both the parallel pipeline tool (`log10x_extract_templates`) and the excluded single-line tool (`log10x_event_lookup`). An agent can distinguish it without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit trigger phrases ('can you run log10x locally', 'do a local pipeline run', 'templatize these events') plus concrete input sources (Datadog/Splunk/Elastic results, Slack attachments, kubectl logs, raw text). It also states when NOT to use it, routing single-line cases to `log10x_event_lookup`.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_retriever_probeRetriever e2e probeARead-only
End-to-end probe of the deployed Retriever chain. Fires a synthetic query at the picked top-volume tenx_hash (or an explicit target_hash) and asserts every stage in order: offload bucket has recent data, indexer pipeline is running (kubectl logs grep for 'starting pipeline - Tenx: @/apps/retriever/index'), SQS subquery + stream queues drained (depth ≤ 10), retriever pod containers all ready, then submits the query and asserts CloudWatch scan complete events have matched>0, CloudWatch stream worker complete events exist, S3 qr//*.jsonl files were written, and the MCP returned events_matched>0 AND events_returned>0. Returns a structured verdict (green / broken / unknown) with per-assert observed + remedy. Call this as the post-install verify step (chained from log10x_advise_retriever step_verify) OR as a deep doctor diagnostic when log10x_retriever_query returns 0 events and the cause is unclear. Catches the silent-failure shapes that take hours to debug manually: indexer not booted, chart 1.0.20 / runtime-name stream pipeline launch failures, IRSA s3:PutObject misconfigured, MCP input_bucket misaligned with engine write location.
| Name | Required | Description | Default |
|---|---|---|---|
| namespace | No | Kubernetes namespace where the retriever pod runs. Default: "log10x". | log10x |
| target_hash | No | Pre-picked tenx_hash to query for. When omitted, the probe queries the metric backend for the top-volume hash over the last 5 min. | |
| input_bucket | No | S3 bucket where the retriever WRITES qr/<id>/*.jsonl result objects. Default: read from the resolved env-config's `retriever.input_bucket` (walking K8s ConfigMap → AWS SSM → GCP Secret Manager → Azure App Config → local file in that order). Falls back to LOG10X_RETRIEVER_INPUT_BUCKET / __SAVE_LOG10X_RETRIEVER_BUCKET__ env vars and the helm-release probe when no env-config is reachable. | |
| offload_bucket | No | S3 bucket the receiver offloads data to (the bucket the retriever indexer reads from). Default: pick the `status="active"` entry from the resolved env-config's `offload_destinations[]` (walking K8s ConfigMap → AWS SSM → GCP Secret Manager → Azure App Config → local file in that order). Falls back to the LOG10X_STREAMER_BUCKET / LOG10X_OFFLOAD_BUCKET env var when no env-config is reachable. When the env var disagrees with the resolved value, the env var is ignored AND a stale-env-var warning is emitted on `envelope.warnings`. | |
| window_minutes | No | Query window size in minutes. Default: 5. | |
| query_log_group | No | CloudWatch log group the retriever writes per-query execution events to. | log10x-retriever-query-events |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/openWorld/non-idempotent, but the description goes far beyond them: it enumerates each ordered assertion (bucket freshness, indexer pipeline, SQS queue depth ≤ 10, pod readiness, CloudWatch events, S3 files, MCP counts) and the verdict shape (green/broken/unknown with per-assert observed + remedy). It also discloses the failure classes it catches, rich behavioral context an agent cannot get from annotations alone.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the purpose, then the assertion chain, then usage routing — logical order. It is dense and long for a single paragraph, but nearly every clause (the assertion sequence, the named failure shapes) carries selection or diagnostic value, with only mild redundancy between the assertion list and the 'catches silent-failure shapes' sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value detail is not required, yet the description still signals the structured verdict form. Combined with the explicit trigger conditions and full assertion coverage, an agent has everything needed to invoke and interpret this diagnostic correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the six parameter descriptions are already exhaustive (env-config resolution order, env-var fallback, stale-warning behavior), so the schema carries the load. The body adds only the conceptual note that target_hash defaults to top-volume and that bucket misalignment is a failure shape, which is marginal beyond the schema; baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (end-to-end probe) and resource (the deployed Retriever chain) with explicit scope, and it distinguishes itself from siblings by naming the exact stages it asserts. An agent can tell this apart from log10x_retriever_query, log10x_advise_retriever, and log10x_doctor without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit when-to-use: 'post-install verify step (chained from log10x_advise_retriever step_verify)' OR 'deep doctor diagnostic when log10x_retriever_query returns 0 events and the cause is unclear.' It names the triggering alternatives and the exact conditions that select each, leaving nothing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_retriever_queryRetriever queryARead-onlyIdempotent
Forensic retrieval / rehydration from the Log10x Retriever archive (the customer's own S3 bucket) by the engine's STABLE pattern identity. The use case: events the receiver offloaded to the archive instead of the SIEM, or that aged out of SIEM retention, recovered by querying the stamped identity over a historical window. Pre-computed Bloom filters scope the scan to the matching pattern identity (tenx_user_pattern) so only relevant byte ranges are fetched (the moat: query-side token precision, not a full S3 scan). Matched events land as a list of *.jsonl objects in the customer's S3; the tool returns an in-context preview (capped by limit) PLUS data.results_location (the S3 bucket + prefix holding the full object set). A capable agent reads those objects directly to answer, or hands the S3 object list to the customer's own S3-to-SIEM path. No re-ingestion pipeline, no proprietary format. The envelope additionally carries per-pattern offload_status so retrieval results agree with the live metric-surface disposition (pass / sample / compact / drop) without a second tool call. Call for: events matching a pattern OUTSIDE SIEM retention; events filtered by a variable value that is not a faceted SIEM dimension (e.g. 'all payment_retry events for customer acme-corp 90 days ago'); compliance / audit / forensic exact retrieval; confirming what the receiver actually offloaded for a given pattern. Optional JavaScript filters refine over payloads after the Bloom-scoped fetch. For a time-bucketed series instead of raw events, use log10x_retriever_series. The envelope carries by_severity / by_service / by_day rollups with a rollup_basis provenance stamp (qrs_summaries = whole-match from engine summaries; events_capped = derived from the capped download).
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End of the query window. Same grammar as `from`. Default `now`. | now |
| from | Yes | Start of the query window. Accepts ISO8601 (`2026-01-15T00:00:00Z`), epoch millis, or relative (`now-1h`, `now-24h`, `now-7d`). Normalized to the engine's `now("-1h")` form before dispatch. | |
| view | No | summary returns the typed envelope (data.events_matched, data.events[], data.query_id, data.diagnostics, data.human_summary). The deprecated markdown view was removed; data.human_summary carries the prose distillation for chat rendering. | summary |
| debug | No | Escalate the CloudWatch log level to DEBUG for THIS query only — per-blob Bloom decisions, per-fetch S3 reads, per-event results-writer samples. Use only when normal-run diagnostics cannot explain a 0-result or truncated outcome (volume is ~100x higher). Default false. | |
| limit | No | Hard cap on events returned after merging per-worker result files. Default 500. Typical conversational queries want 10-100; the LLM will render only the first 50. | |
| format | No | `events` (default: raw events), `count` (total + severity/service rollups, no event bodies), `aggregated` (events bucketed into a time series — use with bucket_size), `ephemeral_series` (bucketed series in Prometheus range-query shape for cross-pillar correlation). All four formats are rolled up client-side from the same events stream. | events |
| search | No | Bloom-filter search expression using the TenX subset: `==`, `||`, `&&`, `includes(field, "substr")`. Example: `severity_level=="ERROR" && includes(text, "ECONNREFUSED")`. Selective values are dramatically cheaper than open-ended scans. REQUIRED unless `pattern_hash` is given: the engine rejects a blank search, so there is no unscoped full-window scan. To scope to one pattern pass `pattern_hash`, which is matched as a text token; a Reporter-named `pattern` cannot be matched against the archive at all and is refused with a remedy. | |
| target | No | Target app/service prefix to scope the index scan. Defaults to __SAVE_LOG10X_RETRIEVER_TARGET__ (env var). Required if no default is configured. | |
| filters | No | JavaScript filter expressions evaluated in-memory against each decoded event after the Bloom-scoped fetch. Full TenX JS API: `this.customer_id === "acme-corp"`, `this.http_code.startsWith("5")`. Filters are AND-combined. | |
| pattern | No | Reporter-named pattern (Symbol Message). NOT SUPPORTED against the offload archive: passing it returns an error naming the remedy, rather than a silent empty result. A Symbol Message is a label DERIVED from the event, so it is never a token in the archived bytes, and the Bloom index holds only text tokens plus template hashes. (The field this once queried, `tenx_user_pattern`, does not exist in the engine at all, which is why name-scoped queries returned BLOOM_REJECTED_ALL.) Pass `pattern_hash` instead: top_patterns returns it on the same row as the name, and event_lookup resolves a name to a hash. | |
| bucket_size | No | Bucket size when format=aggregated or ephemeral_series. Examples: `1m`, `5m`, `1h`, `1d`. | 5m |
| environment | No | Environment nickname — required if multi-env. | |
| pattern_hash | No | Canonical pattern_hash from top_patterns / event_lookup. When provided, search is auto-built as `includes(text, "<hash>")` and no name resolution runs. It matches the stamped hash as a TEXT TOKEN because the archive re-derives its own `tenx_hash` field per multi-line group, so a field equality against a metrics-side hash matches nothing. This is the chain-stable identity emitted by top_patterns.payload.patterns[].pattern_hash — bypasses the name→hash resolver entirely. Precedence: `search` > `pattern_hash` > `pattern`. Example: `pattern_hash: "4Kjc7PHLWqY"`. | |
| result_target | No | Tier-1 result-sink redirect: write this query OUTPUT (events, summaries, markers) under tenx/<result_target>/ in the same bucket instead of the default target, e.g. to a prefix a SIEM connector watches. Omit to keep results under the scan target (default). Bare token [A-Za-z0-9_-]+. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Despite annotations already covering readOnly/openWorld/idempotent, the description adds real behavioral context beyond them: matched events land as *.jsonl in S3 while the tool returns a limit-capped preview plus data.results_location, offload_status agrees with the live disposition without a second call, rollups carry a provenance stamp, and debug escalates log volume ~100x. It discloses what gets returned and where, which annotations alone cannot.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The content is dense and nearly every clause carries information, but it is delivered as a single sprawling paragraph with no structural separation of purpose, usage, and mechanics, making it hard to scan. A front-loaded one-line purpose followed by grouped sections would serve an agent better than this wall of text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 14-parameter tool with an output schema, the description is complete: it covers the retrieval model, the S3 result location, the offload_status agreement, the pattern_hash requirement, and the failure mode for 'pattern'. Nothing an agent needs to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds cross-parameter semantics the schema does not: why 'pattern' is refused against the archive (derived label, not a token), why pattern_hash matches as a text token, and the search > pattern_hash > pattern precedence. That is meaningful value on top of the schema rather than repetition.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Forensic retrieval / rehydration') and resource ('Log10x Retriever archive (the customer's own S3 bucket)') and immediately scopes it to engine stable pattern identity. It explicitly distinguishes itself from the sibling log10x_retriever_series ('For a time-bucketed series instead of raw events, use ...'), so an agent can separate them without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides an explicit 'Call for:' list of triggering conditions (events outside SIEM retention, non-faceted variable filtering, compliance/audit retrieval, confirming offloads) plus the named alternative for the series case. It even encodes the search/pattern_hash/pattern precedence, which routes the agent away from the unsupported 'pattern' path.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_retriever_query_statusRetriever query statusARead-onlyIdempotent
Post-hoc diagnostic surface for a specific retriever query, addressed by queryId (returned from log10x_retriever_query or recovered from the S3 results prefix). Pulls the coordinator's _DONE.json stats (scanned / matched / streamRequests / streamBlobs / submittedTasks / expectedMarkers), counts per-worker byte-count markers under q/<queryId>/, lists result JSONL files under qr/<queryId>/, optionally filters CloudWatch events from the queryLogGroup for the queryId substring (when the chart's queryLogGroup is configured), and runs a diagnostics engine that classifies the run into states like dispatcher_failure (scanned=0 + submittedTasks>0 — typical signature of the chart 1.0.20 incomplete streamer→retriever rename), results_not_uploaded, or observability_disabled. When pod logs are reachable from the MCP host, fetches a tail and greps for the cloud/streamer/subquery include-resolution signature to confirm the dispatcher-failure category. Call this whenever log10x_retriever_query returns 0 events but the wall-clock implies real scan work, or whenever an offline post-mortem needs the structured timeline for a specific queryId. Pass fetch_results: true to ALSO recover the completed results from S3 (10-event preview + counts + results_location) after a partial or timed-out query, without resubmitting.
| Name | Required | Description | Default |
|---|---|---|---|
| target | No | Target app/service prefix used when the original query was submitted. Defaults to "app". Must match the target that was passed to the original query. | app |
| query_id | Yes | UUID of a previously-submitted retriever query. Returned as data.query_id from log10x_retriever_query. | |
| fetch_results | No | When true and the query has completed, ALSO recover the results from S3: a 10-event preview, counts, and the results_location pointer — same core fields as a completed log10x_retriever_query. Use after a partial/timed-out query to recover stranded events without resubmitting. | |
| include_pod_logs | No | When true and a dispatcher_failure is suspected (scanned=0 + submittedTasks>0), attempt kubectl logs on the retriever pod to confirm the chart 1.0.20 include-resolution error. Requires kubectl access from the MCP process. Set false to skip the kubectl call. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/openWorld, so the safety profile is covered; the description adds substantial context beyond that: the specific artifacts read, the diagnostic states it classifies (dispatcher_failure, results_not_uploaded, observability_disabled), and the kubectl dependency for pod-log tailing. These behavioral details are exactly what an agent needs and are not derivable from annotations or schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single dense paragraph, but it is front-loaded with the core purpose and the when-to-use guidance before the implementation detail. Every sentence carries operative information (states, signatures, kubectl requirement), so the length is justified, though it reads as dense and could be split for scanability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value explanation is unnecessary, and annotations cover the safety profile. The description supplies everything else an agent needs: addressing, triggering conditions, the fetch_results escape hatch, and the pod-log requirement, leaving no material gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3; the description adds meaning beyond the schema by noting queryId can be 'recovered from the S3 results prefix' and that fetch_results recovers results 'after a partial or timed-out query... without resubmitting.' These extend the schema's own parameter docs rather than merely repeating them.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Post-hoc diagnostic surface for a specific retriever query') and immediately distinguishes it from the sibling by naming the addressing key queryId and its origin in log10x_retriever_query. The description of what it pulls (coordinator _DONE.json stats, per-worker markers, result JSONL, CloudWatch events, diagnostics classification) makes the purpose unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit triggering conditions: 'Call this whenever log10x_retriever_query returns 0 events but the wall-clock implies real scan work, or whenever an offline post-mortem needs the structured timeline.' It also routes a distinct use case (recovering stranded results via fetch_results without resubmitting), covering when-to-use and the alternative path.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_retriever_seriesRetriever time seriesARead-onlyIdempotent
Materialize a fidelity-aware time series from the customer's S3 archive over an arbitrary window, with optional group-by on enrichment fields. Auto-selects between exact full aggregation (Strategy A) and per-window-sampled fan-out (Strategy B) based on Reporter pattern volume — small/moderate-volume queries get exact counts; high-volume / long-window queries get a sampled series with time-distribution + group-ranking fidelity preserved and tail caveats reported. Pathological volume is refused with structured narrowing guidance, never silently truncated. Call when: (a) the user wants a 'rate of pattern X over the last 30 days, broken down by tenant' answer that exceeds SIEM retention/budget, (b) a baseline needs building from cost-driver patterns where Prometheus has continuous metrics but the grouped breakdown lives only in the S3 archive. Use log10x_retriever_query instead when you need the actual event payloads (not aggregates).
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End of the query window. Same grammar as `from`. Default `now`. | now |
| from | Yes | Start of the query window. ISO8601, epoch millis, or relative (`now-1h`, `now-7d`, `now-30d`). | |
| view | No | summary returns the typed envelope (data.mode, data.bucket_seconds, data.series_count, data.points_returned, data.top_groups, data.caveats, data.human_summary). The deprecated markdown view was removed; data.human_summary carries the prose distillation for chat rendering. | summary |
| search | No | Bloom-filter search expression using the TenX subset. Tightly bound queries (e.g., `includes(text, "<pattern_hash>")`, `severity_level == "ERROR"`) are dramatically cheaper. (legacy example removed: `tenx_user_pattern == "PaymentRetry"`) get the cheapest fetch path. Pattern-bound expressions are also what unlocks the Reporter-driven cost heuristic — without one, mode selection falls back to window-length only. Pass `pattern` instead for the common case of scoping to one Reporter-named pattern. | |
| target | No | Target app prefix. Defaults to __SAVE_LOG10X_RETRIEVER_TARGET__. | |
| filters | No | In-memory JS filters applied after the Bloom-scoped fetch (AND-combined). | |
| pattern | No | Reporter-named pattern (Symbol Message). NOT SUPPORTED against the offload archive: passing it returns an error naming the remedy, rather than a silent empty result. A Symbol Message is a label DERIVED from the event, so it is never a token in the archived bytes, and the Bloom index holds only text tokens plus template hashes. (The field this once queried, `tenx_user_pattern`, does not exist in the engine at all, which is why name-scoped queries returned BLOOM_REJECTED_ALL.) Pass `pattern_hash` instead: top_patterns returns it on the same row as the name, and event_lookup resolves a name to a hash. | |
| fidelity | No | `auto` (tool decides via Reporter volume + window length), `full` (force exact aggregation — may exceed Lambda budget), `per_window_sampled` (force sampling, default K=1000 per sub-window), or `per_window_sampled:K` (custom K). | auto |
| group_by | No | Optional enrichment field to group the series by — e.g., `tenx_user_service`, `severity_level`, `k8s_namespace`. Top-1000 group values are retained; tail collapsed to `_other_`. | |
| bucket_size | No | Time bucket granularity (`1m`, `5m`, `1h`, `1d`). Determines the resolution of the output series. | 5m |
| environment | No | Environment nickname — required if multi-env. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare read-only/idempotent/open-world; the description goes well beyond by disclosing the auto strategy-selection heuristic (volume + window length), the sampling behavior with fidelity guarantees, that tail caveats are reported, and that pathological volume is refused with structured narrowing guidance rather than silently truncated. That is exactly the behavioral context an agent needs to set expectations on output reliability.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core capability, then conditions, then the alternative. It is dense but nearly every clause carries information; the two long sentences are packed with nested parentheticals, which costs a little readability but not correctness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return-shape explanation is unnecessary, and the description still covers the operation's mode, its fidelity caveats, its refusal behavior, and routing to the payload-fetching sibling. Nothing material is missing for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema carries the heavy lifting and baseline is 3. The description adds how the fidelity tradeoff plays out (small/moderate volume = exact counts vs high-volume = sampled) and references group-by on enrichment fields, which gives callers a reason to pick `full` vs `per_window_sampled` beyond the bare enum values.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb (materialize) + resource (fidelity-aware time series) + scope (S3 archive over an arbitrary window, optional group-by). It explicitly contrasts itself with the sibling log10x_retriever_query ('actual event payloads, not aggregates'), so an agent can distinguish them without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
States two concrete when-to-use conditions (a) breakdown answers exceeding SIEM retention and (b) building baselines where grouped breakdowns live only in the archive, plus an explicit when-not with a named alternative. Nothing is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_savingsPipeline savingsARead-onlyIdempotent
Show pipeline savings — what percent of bytes the receiver (filtering + compaction) and retriever (indexing) are removing, with a dollar overlay when an analyzer $/GB rate is set (account profile list price, or per-call effective_ingest_per_gb override). Without a rate, the headline is percent-and-bytes only — never a fabricated $1/GB number. Use for "how much are we saving", "pipeline ROI", or "what is the Log10x stack worth financially". Accepts siem_lens (what-if destination): keeps the real volumes, prices + gates for that destination at list rates, and stamps siem_actual vs siem_lens in the envelope.
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | Output format. Always "summary" — the typed envelope (data.totals, data.edge, data.retriever, data.run_rate). Field retained for backward-compat. | summary |
| siem_lens | No | What-if destination lens: price the SAME real volumes at this destination's list rates instead of the connected pipeline's. Dollars switch to the lens list price (env-configured rates never leak across destinations); the envelope stamps siem_actual vs siem_lens. Volumes/patterns are unaffected. | |
| timeRange | No | Time range. '24h' and '1d' are equivalent. | 7d |
| environment | No | Environment nickname | |
| storageCost | No | S3 storage cost in $/GB/month. Defaults to $0.023 (S3 Standard). | |
| analyzerCost | No | DEPRECATED alias for effective_ingest_per_gb. stack ingestion cost in $/GB. | |
| effective_ingest_per_gb | No | Customer-supplied stack ingestion cost in $/GB. When provided, rate_source=customer_supplied and dollars are populated. When omitted and no profile rate is available, rate_source=unset and the headline reports percent + bytes only (no dollars). |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover read-only/idempotent/open-world, but the description adds real behavioral policy: without a rate it reports percent-and-bytes only and 'never a fabricated $1/GB number', and siem_lens switches pricing to list rates and stamps siem_actual vs siem_lens. This goes meaningfully beyond the annotations, though it doesn't cover latency, permissions, or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core definition, then the dollar-overlay condition, then use cases, then the siem_lens note. It is a dense single paragraph that borders on long, and the closing siem_lens sentence partially duplicates the schema's siem_lens description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, the description need not explain return values, and it covers the key conditional behavior an agent needs (rate source determines whether dollars appear). Nothing essential for correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds semantics the schema lacks: what siem_lens does to volumes vs. pricing, and the rate_source fallback behavior tied to effective_ingest_per_gb. The output-shaping role of view/timeRange is largely left to the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('Show pipeline savings') and breaks down the computation ('what percent of bytes the receiver (filtering + compaction) and retriever (indexing) are removing'), which is genuinely distinguishing. It does not, however, name or contrast against the close sibling log10x_estimate_savings, so the agent must infer the boundary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Concrete trigger phrases are given ('how much are we saving', 'pipeline ROI', 'what is the Log10x stack worth financially'), and the rate-dependent condition for when dollars appear is explained. No explicit when-not guidance or named alternative tools, so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_servicesServicesARead-onlyIdempotent
[FRESH-SESSION ROUTING: if this is the user first cost question of the session, call log10x_start first instead — it returns the orientation menu the user needs before any per-tool action.] List every service the Log10x pipeline is watching, ranked by byte volume (with cost overlay when $/GB is set) plus per-service share of total AND the four action-axis columns (bytes_passed / bytes_offloaded / bytes_compacted / bytes_dropped) derived by joining routeState="drop" events against the cap-CSV. Pass exception_services to mark customer-flagged services as current_mode=pass — their next_action points at log10x_pattern_mitigate instead of log10x_configure_engine. Call first on open-ended cost questions, before drilling into a specific service.
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | Output format. Always "summary" — the typed envelope (data.services[], data.totals). Field retained for backward-compat. | summary |
| siem_lens | No | What-if destination lens: price the per-service $/mo columns at this destination's list rates instead of the connected pipeline's (env-configured rates never cross destinations). Volumes/patterns are unaffected; the envelope stamps siem_actual vs siem_lens. | |
| timeRange | No | Time range. Sub-day values available for incident-window service ranking. '24h' and '1d' are equivalent. | 7d |
| environment | No | Environment nickname | |
| analyzerCost | No | SIEM ingestion cost in $/GB | |
| monthly_volume_gb | No | What-if volume lens (forecast mode): model the environment at THIS monthly volume (decimal GB/month) instead of its measured volume. The real per-pattern shares and pattern mix are held fixed; only absolute bytes and dollars scale, by one uniform factor. Use it to project a prospect onto their own scale, or to forecast a real env after growth. Pairs with siem_lens. This is a PROJECTION: the envelope stamps volume_actual_gb vs volume_projected_gb and the scale factor, and the note points at the POC for the caller real patterns. | |
| exception_services | No | Customer-flagged services that must stay in the SIEM with full retention (audit / regulatory / executive). Per row, marks current_mode="pass" and points next_action at pattern_mitigate instead of the configure_engine bulk path. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and openWorldHint, so the safety profile is covered. The description adds non-obvious behavior: the cost overlay only activates when $/GB is set, the action-axis columns come from a join against routeState="drop" events and the cap-CSV, and exception_services flips current_mode to pass and changes the downstream next_action target.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Dense but front-loaded, with the fresh-session routing placed first and the call-first guidance last. It is longer than strictly necessary and packs derivation detail into one long sentence, but nearly every clause carries actionable information rather than restating the name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the description still covers routing, ranking, the conditional cost overlay, exception handling, and the derived columns. For a 7-parameter read-only tool this is complete enough to invoke correctly without opening anything else.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents siem_lens, monthly_volume_gb, timeRange, view, and analyzerCost. The description still adds consequence-level meaning that the schema does not: what exception_services does to current_mode and next_action, and the conditional coupling of the cost overlay to a set $/GB.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a precise verb and resource ('List every service the Log10x pipeline is watching') and specifies the ranking key, the cost overlay, the share-of-total column, and the four action-axis columns. An agent knows exactly what this returns and how it differs from drill-down siblings like log10x_pattern_detail.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The routing preamble names a concrete alternative (log10x_start) with the exact condition that selects it (first cost question of the session), and the closing line states when to call this versus drilling into a specific service. The exception_services path also re-routes next_action toward log10x_pattern_mitigate rather than log10x_configure_engine, giving explicit alternative routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_setup_recurringSet up recurring cost-reductionARead-onlyIdempotent
Conversational wizard that configures a recurring autonomous cost-reduction agent. Walks the user through seven decisions — target services, savings target (%), tick schedule, scheduler runtime, gitops config repo, exception services, and final confirm — then emits two ready-to-commit artifacts: policy.yaml (the declarative policy the tick CLI consumes) and a scheduler manifest (Kubernetes CronJob YAML, GitHub Actions workflow, or crontab entry + wrapper script depending on the chosen scheduler). Each call merges the latest answer into the wizard session and either asks the next missing question or emits the artifacts once all answers are present. Re-invoke with the same session_id on every subsequent turn; sessions live 30 minutes. To skip interactive Q&A, supply all fields (target_services, target_percent, schedule, scheduler, config_plane, confirm: true) in a single call. Optional overrides: exceptions (services never touched), min_delta_pp (minimum savings delta before committing a new CSV, default 2pp), env_id, namespace, secret_name. Apply instructions for the chosen scheduler are in data.apply_instructions. After the first tick runs, call log10x_commitment_report to verify realized savings. REQUIRES nothing deployed to ASK: it renders manifests from your answers and writes to no account. The emitted tick needs a scheduler runtime (k8s CronJob, GitHub Actions, crontab, EventBridge, Container Apps job) and a policy repo or S3 prefix you control before it runs.
| Name | Required | Description | Default |
|---|---|---|---|
| env_id | No | Log10x environment ID. Auto-detected from LOG10X_ENV_ID when absent. | |
| confirm | No | Set to true to confirm the configuration and emit the artifacts. The wizard asks for confirmation interactively when omitted. | |
| schedule | No | Tick schedule. Presets: daily-03utc (default), every-6h, every-12h, every-24h-localtz. Or pass a raw 5-field cron expression (e.g. "0 5 * * 1"). | |
| namespace | No | Kubernetes namespace for the CronJob. Default: log10x. Only used when scheduler=k8s_cron. | |
| scheduler | No | Where the recurring tick runs. k8s_cron = Kubernetes CronJob (default when kubectl reachable), github_actions = GHA workflow, crontab = crontab + wrapper script, eventbridge = AWS-native (EventBridge Scheduler + CodeBuild, S3 config plane — no cluster, no GitHub; the fit for AWS serverless estates), container_apps_job = Azure-native (Container Apps scheduled Job, git config plane; the fit for Azure serverless estates). | |
| exceptions | No | Service names the policy must never touch (audit / regulatory / executive). Optional — defaults to empty. Pass [] to explicitly clear all exceptions. | |
| session_id | No | Wizard session handle. Omit on the first call — a new session is minted and returned. Pass it back unchanged on every subsequent call. | |
| secret_name | No | Name of the Kubernetes Secret holding LOG10X_API_KEY. Default: log10x-secret. Only used when scheduler=k8s_cron. | |
| config_plane | No | Where the recurring CLI reads policy.yaml and writes updated cap CSVs: a gitops repo URL (e.g. https://github.com/acme/log10x-config), a local path, or — required when scheduler=eventbridge — an S3 prefix (e.g. s3://acme-logs/log10x-config). | |
| min_delta_pp | No | Minimum change in savings percentage points required before the tick commits a new CSV. Default: 2. Set to 0 to commit on every tick. | |
| target_percent | No | Desired savings target, as a percentage of current log volume (1-95). Default: 30. The CLI's per-pattern planner works backward from this target. | |
| target_services | No | Services the policy targets. Empty array = all services. Use service names from `log10x_services`. The wizard asks if omitted. | |
| budget_gb_monthly | No | VOLUME BUDGET: keep monthly ingest for the targeted services at or under this many GB/mo. A standing line, not a one-shot cut: each tick scales the budget to its lookback window and cuts only the overage — already under budget means every pattern passes. Replaces target_percent in policy.yaml (mutually exclusive). Dollar budgets are a one-shot answer via log10x_estimate_savings (budget_usd_monthly); the recurring tick is byte-denominated. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover the safety profile (readOnlyHint, idempotentHint, openWorldHint), and the description adds genuinely new behavior: session lifetime of 30 minutes, the merge-and-ask-next-question loop, artifact emission on completion, and the explicit 'writes to no account' guarantee. These are traits no structured field conveys.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose and artifact output are front-loaded, and the length is justified for a 13-parameter stateful wizard. There is mild redundancy between the 'REQUIRES nothing deployed' sentence and the closing prerequisite sentence, which keeps it from a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given an output schema exists, the description needn't explain return values, and it still points to data.apply_instructions. For a complex, multi-turn setup tool it covers invocation, state, prerequisites, and the next step, leaving no critical gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so parameters are already documented; the description adds value by framing them as an ordered set of seven decisions and clarifying that supplying all of them bypasses interactive Q&A. It largely restates defaults (min_delta_pp 2pp) already in the schema, so it stops short of a 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource — configures a recurring autonomous cost-reduction agent — and enumerates the exact artifacts it emits (policy.yaml, scheduler manifest). It also names the sibling follow-up tool (log10x_commitment_report), so an agent can distinguish it from the surrounding cost/savings tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly describes the invocation protocol (re-invoke with the same session_id each turn, or supply all fields in one call to skip Q&A), names the alternative path, and states prerequisites (a scheduler runtime and a config repo/S3 prefix) plus the follow-up verification call. Nothing about when to use it is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_siem_connectorEmit SIEM connector for an offload bucketARead-onlyIdempotent
Generate the customer-applied SIEM-side connector config (Datadog Forwarder Lambda, or the Splunk Add-on for AWS SQS-based S3 input) that makes a SIEM pull log10x's offload output from the customer's own S3 bucket. Call this when the user has offloaded a pattern's data to S3 (the offload action / a log10x_offload_add destination) and asks how to get Datadog or Splunk to ingest it, e.g. 'ship my offload bucket to Splunk' or 'wire Datadog to read these logs'. log10x deliberately never pushes to a SIEM (vendor-driven re-ingest collides with Datadog Rehydration billing, Splunk HEC permissions, and Elastic _bulk limits); it lands NDJSON in the customer bucket and the SIEM pulls, and this tool emits exactly that pull-side connector. Args: siem (required: datadog / splunk / both), bucket (required: the offload bucket), account_id (required), region (default us-east-1), prefix (optional, default app/), plus per-SIEM options (datadog_forwarder_arn, sqs_queue_name, sourcetype, index). Returns, per target: the discovery model, ordered setup steps, paste-ready terraform (an SNS fan-out plus IAM, and for Splunk the SQS queue and the S3-to-SNS-to-SQS notification), the SIEM-native config (the Splunk inputs.conf aws_sqs_based_s3 stanza), and verified caveats. Recipes are matched to log10x's actual offload output (uncompressed NDJSON, one event per line, Hive-partitioned keys) and encode the key gotcha: the offload bucket usually already notifies the 10x indexer's SQS, and S3 allows only one notification config per overlapping prefix, so both recipes fan out via SNS rather than a second raw bucket notification. Honest caveats are surfaced: Datadog is logs-only (use log10x_backfill_metric for per-pattern metrics), and the Splunk SQS-based input collects only objects created after setup (backfill older data with a Generic S3 input). Read-only: it generates config and does not create AWS resources or mutate any env document.
| Name | Required | Description | Default |
|---|---|---|---|
| siem | Yes | Which SIEM should pull the offload: datadog (Forwarder Lambda), splunk (Add-on SQS-based S3 input), or both. | |
| index | No | Splunk index for the input. Default "main". | |
| bucket | Yes | The offload bucket the SIEM should read (where 10x writes the NDJSON). | |
| prefix | No | Offload key prefix the SIEM should watch. Default "app/". | |
| region | No | AWS region of the bucket. | us-east-1 |
| account_id | Yes | AWS account ID that owns the bucket (same account the SIEM connector runs in). | |
| sourcetype | No | Splunk sourcetype for the input. Default "log10x:offload". | |
| sqs_queue_name | No | Name for the SQS queue the Splunk input drains (splunk only). | |
| datadog_forwarder_arn | No | ARN of an already-deployed Datadog Forwarder Lambda (datadog only). Omit to leave a placeholder. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the readOnly/idempotent annotations: it explains the deliberate architectural stance (no vendor push due to Datadog Rehydration billing, Splunk HEC permissions, Elastic _bulk limits), the S3 single-notification-per-prefix gotcha and SNS fan-out workaround, and honest caveats (Datadog logs-only, Splunk SQS only picks up post-setup objects). It also confirms no AWS resources are created.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose and usage, then args, then return shape, then caveats — a logical order. However it is delivered as a single dense paragraph and repeats some parameter info already in the schema, so it is slightly heavier than needed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex 9-parameter config-generation tool with an output schema, the description still supplies the decision context (when to use), the behavioral rationale, the return contents (discovery model, steps, terraform, native config, caveats), and the key gotchas — nothing material is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 9 parameters including defaults and the siem enum. The description largely restates required args (siem, bucket, account_id, region, prefix) and groups the per-SIEM options, adding only modest value over the structured fields.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Generate the customer-applied SIEM-side connector config ... Datadog Forwarder Lambda, or Splunk Add-on SQS-based S3 input') and defines the exact artifact produced. An agent can distinguish this from sibling tools like log10x_offload_add or log10x_backfill_metric without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to call it ('when the user has offloaded a pattern's data to S3 ... and asks how to get Datadog or Splunk to ingest it') with concrete utterances ('ship my offload bucket to Splunk'). It also names the escape hatches for adjacent needs (log10x_backfill_metric for metrics, Generic S3 input for backfill).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_signin_completeSign in (complete)AIdempotent
Step 2 of the Log10x sign-in chain. Two mutually-exclusive paths controlled by which arg you pass. (a) { device_code: "<...>" }: finishes the browser flow that log10x_signin_start began. The model should call this AUTOMATICALLY right after log10x_signin_start returns, passing back the opaque device_code from that response unchanged. Polls Auth0's /oauth/token until the user confirms the device authorization in their browser, then exchanges the Auth0 access token for a long-lived Log10x API key. (b) { api_key: "<key>" }: pasted-key path, no browser. Validates the key against /api/v1/user and saves it. Pass exactly one of device_code or api_key; both or neither is rejected with a clear error. Either path writes the resolved API key to ~/.log10x/credentials (mode 0600), hot-reloads the MCP's env list in-process, and (if LOG10X_API_KEY is set in the host config and would override the new file) clears that env var in-process and tells the user to remove it from their host config to make the change permanent.
| Name | Required | Description | Default |
|---|---|---|---|
| api_key | No | Log10x API key to sign in with directly (no browser). Validated against /api/v1/user before saving. Use this when the user already has a key from console.log10x.com → Profile → API Settings, or when issued out-of-band by a workspace admin. Mutually exclusive with `device_code`. | |
| device_code | No | The opaque device_code returned by `log10x_signin_start`. Pass it back unchanged. The tool polls Auth0 for the access token, then exchanges it for a long-lived Log10x API key. Mutually exclusive with `api_key`. | |
| wait_seconds | No | Max seconds to poll for browser confirmation (only used when device_code is passed). Default 600. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (readOnlyHint=false, openWorldHint=true), the description discloses substantial behavior: it polls Auth0's /oauth/token until browser confirmation, exchanges the access token, writes the key to ~/.log10x/credentials with mode 0600, hot-reloads the MCP's env list in-process, and clears an overriding LOG10X_API_KEY with instructions to make it permanent. This is far richer than the annotation set.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The (a)/(b) path structure is well front-loaded and each sentence carries load-bearing information (the two paths, the exclusivity rule, the side effects). It is dense and somewhat lengthy, and the trailing sentence about env-var clearing is convoluted, costing a point versus maximal conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the description still covers both invocation paths, the automatic-call trigger relative to log10x_signin_start, and all side effects. Combined with 100% schema coverage and annotations, an agent has everything needed to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and each param already documents its role and mutual exclusivity, so the baseline is 3. The description adds cross-parameter semantics beyond the schema—that passing both args or neither is rejected with a clear error—but it never mentions wait_seconds at all, so it doesn't fully cover the parameter surface.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb+resource ('Step 2 of the Log10x sign-in chain') and immediately disambiguates from the sibling it follows, log10x_signin_start, by explaining how it finishes that flow. An agent can distinguish it from every other sign-in sibling without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit routing: 'call this AUTOMATICALLY right after log10x_signin_start returns' for the device_code path, and 'use this when the user already has a key' for the api_key path. It also states the exclusion rule (pass exactly one; both or neither is rejected). Nothing is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_signin_startSign in (start browser flow)ARead-only
Step 1 of the Log10x browser sign-in chain. Call this for any of these phrasings: 'sign me up for Log10x', 'create a Log10x account', 'log me in to Log10x', 'set up my Log10x account', 'switch from demo to my own data'. Requests an Auth0 device code, opens the user's browser to auth.log10x.com with the user_code pre-embedded, and returns IMMEDIATELY (no polling). Response carries user_code, verification_uri_complete, and the opaque device_code. What the model MUST do after this returns: (1) show the user the user_code and verification_uri_complete so they can verify the code in their browser matches, then (2) AUTOMATICALLY call log10x_signin_complete with { device_code: "<the device_code from this response>" } as the next tool call. The user does NOT need to ask for that second step. For pasted-key sign-in instead of browser: skip this tool and call log10x_signin_complete directly with { api_key: "<key>" }.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the readOnly/openWorld/idempotent profile, and the description adds substantially more: it returns IMMEDIATELY with no polling, it opens the user's browser to auth.log10x.com with user_code pre-embedded, it returns user_code/verification_uri_complete/device_code, and it mandates the automatic follow-up call with the device_code. That is rich, non-obvious behavioral context an agent would otherwise have to guess.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the chain-step identity and well-organized into when-to-call, what-it-returns, and required-next-step sections. It is long, and the enumerated phrasing list plus bold emphasis is somewhat repetitive, but each section carries actionable information for a multi-step auth flow.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, yet the description still clarifies the immediate-return semantics and the mandatory second call, closing the loop between the two sibling tools. Nothing an agent needs to invoke this correctly or route the chain is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Zero input parameters, so the baseline is 4; there is nothing to disambiguate beyond the empty object schema. The description instead details response fields, which is useful but not parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (initiate the Log10x browser sign-in) and explicitly positions itself as 'Step 1 of the Log10x browser sign-in chain,' naming the sibling log10x_signin_complete as the follow-on step. An agent can distinguish it from signin_complete and login_status without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Lists the triggering phrasings ('sign me up', 'log me in', 'switch from demo to my own data') and gives an explicit exclusion + alternative: for pasted-key sign-in, skip this tool and call log10x_signin_complete directly. When-to-use, when-not-to-use, and the alternative are all stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_signoutSign outAIdempotent
Wipe the persistent credentials file at ~/.log10x/credentials and reload envs so subsequent calls fall back to demo mode (or whichever lower-priority configuration source picks up). Call this for: "sign me out of Log10x", "log out", "remove my Log10x credentials", "stop using my Log10x account", "go back to demo mode". Idempotent — running it without saved credentials is a no-op. Does NOT revoke the API key on the BE; the user must do that from console.log10x.com → Profile → API Settings if they want to invalidate the key everywhere (mirrors gh auth logout and aws sso logout). If the user has LOG10X_API_KEY set in their MCP host config, that env var will still be active after sign-out — the tool result will flag this so the LLM can tell the user to also unset it and restart.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare idempotentHint=true and readOnlyHint=false, and the description goes well beyond that: idempotency has a concrete meaning (no-op without saved credentials), it discloses the non-revocation limitation, and it warns that LOG10X_API_KEY in the host config survives sign-out and will be flagged in the result.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core action, then trigger phrases, then caveats, which is a sound ordering. It is dense and slightly long, with the gh/aws analogy being the least load-bearing clause, but essentially every sentence carries operational information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Since an output schema exists, the description needn't explain return values, and it still notes the result will flag lingering env vars. Auth, idempotency, residual state, and post-call user guidance are all covered for a destructive-leaning credential tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline is 4. The description correctly adds no parameter detail because there is none to explain, though it does describe the environmental side effects that make a zero-argument call meaningful.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('wipe the persistent credentials file at ~/.log10x/credentials') plus the follow-on effect (reload envs, fall back to demo mode). This is unmistakably distinct from the sibling sign-in tools and requires no schema inspection to identify.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides an explicit 'Call this for' trigger list of user phrasings ('sign me out', 'log out', 'stop using my Log10x account'), and defines the boundary against alternatives by stating what it does NOT do (no BE key revocation) and pointing to console.log10x.com for that.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_startLog10x orientationARead-onlyIdempotent
CALL THIS FIRST whenever the user asks any open-ended cost question, says save X%, asks where do I start, what should I do, how can you help — before any other tool. Detects the customer's tier (Dev CLI / Reporter / Receiver / Retriever) via three live probes (gateway auth, Reporter metric counts, Retriever resolution), detects the SIEM, and returns a structured orientation envelope with three compliance levers the agent MUST obey: must_render_verbatim (markdown to surface to the user as-is, no summarising), must_ask_user (a numbered question the agent MUST ask before any follow-up tool call), and forbidden_next_actions (tool names the agent MUST NOT call until the user has picked an option). Also returns a 5-phase journey (Visibility → Attribution → Mitigation → Forensic → Commitment) showing where the customer is, an action menu gated by available capabilities (compact_installable, tier_down_available, offload_ready, forensic_query_available), and the resolved tier. The tool is read-only, takes an optional intent_hint (cost / forensic / install / orient), and is safe to call on any boot state — including when no env is configured yet (skips gateway/Reporter probes and treats the customer as Dev CLI tier). Accepts siem_lens (what-if destination): keeps the real volumes, prices + gates for that destination at list rates, and stamps siem_actual vs siem_lens in the envelope.
| Name | Required | Description | Default |
|---|---|---|---|
| siem_lens | No | What-if destination lens: orient pricing/applicability for THIS destination while the pipeline keeps its actual one (the user's stack differs from the connected demo/env). Carry the same siem_lens onto cost_options / estimate_savings / top_patterns / savings calls that follow. | |
| intent_hint | No | Optional hint at what brought the user here. `cost` = wants to cut/save bill; `forensic` = wants to read back the offloaded cohort from the overflow bucket; `install` = wants to deploy; `orient` = first-time session, open-ended. When omitted, the tool treats it as `orient`. | |
| session_state | No | Optional caller hint at where the user is in the session. `fresh` (default when omitted) = first message of a new chat, emit the full orientation envelope. `midway` = the agent has already surfaced the orientation envelope this session and the user is mid-flow, emit a short "already oriented, proceeding" envelope. `returning` = treated as `fresh` because the menu / journey phase may have shifted since the last session. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only cover read-only/idempotent/open-world safety; the description goes far beyond, disclosing three live probes, tier detection, the compliance-lever envelope (must_render_verbatim, must_ask_user, forbidden_next_actions), the 5-phase journey, capability-gated menu, and safe-on-any-boot-state behavior including no-env handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The directive is well front-loaded ('CALL THIS FIRST...') and every clause carries operational signal, but the single dense paragraph lumps many concepts together and would benefit from structuring. Slightly over-stuffed for one sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex orientation tool with an output schema already covering return values, the description is complete: boot-state edge cases, tier branching, siem_lens what-if semantics, and session_state handling are all addressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and each parameter already has a detailed enum description, so the schema does the heavy lifting. The description restates intent_hint and siem_lens behavior (including carrying siem_lens forward to cost_options/estimate_savings) but adds little the schema does not already say.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (orientation/first-call tool), its scope (open-ended cost questions, 'where do I start'), and explicitly positions itself before all siblings ('before any other tool'). The agent can identify it as the entry-point tool without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit trigger conditions ('CALL THIS FIRST whenever the user asks any open-ended cost question, says save X%, asks where do I start'), sequencing relative to other tools, and even encodes when-not-to-proceed via forbidden_next_actions gating. Nothing is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_top_patternsTop patternsARead-onlyIdempotent
Return the top N log patterns ranked by byte volume (with cost overlay when $/GB is set), optionally with a delta column vs a comparison_window baseline (week-over-week / day-over-day / 1h-vs-prior-1h). Use for "what is expensive right now", "what are the noisy patterns in this hour", "give me a snapshot of my loudest events", "what changed this week", "did the deploy add cost". Can be scoped by service label. timeRange accepts free-form <n><m|h|d> durations (e.g., 48h, 3d, 15m) — there's no enum snap. Pass comparison_window to get a per-row delta column; omit for current-rank-only. Pass include to choose which cohort to rank: admitted (default — what the receiver let through), dropped (the offloaded / overflow cohort alone), or both (total ingest pre-receiver). Use dropped for "what is the receiver throwing away" and both for an apples-to-apples pre/post comparison. Accepts siem_lens (what-if destination): keeps the real volumes, prices + gates for that destination at list rates, and stamps siem_actual vs siem_lens in the envelope. REQUIRES Reporter-tier metrics. Before anything is deployed, the POC tools answer the same question from your own logs.
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | Output format. Always "summary" — the structured JSON envelope with patterns, incidents, totals, and chained-tool action hints. Field retained for backward-compat with callers that still pass `view: "summary"`. | summary |
| limit | No | Number of patterns to return. Default 10. | |
| offset | No | Skip the first N patterns of the ranked result (for pagination). Default 0. | |
| include | No | Which engine-decision cohort to scope to. `kept` (default) = events the engine forwarded as-is (routeState!="drop") — the pre-PL-12 behavior. `dropped` = events stamped routeState="drop" by the engine (the offload/down-tier cohort). `both` = the pre-decision union; per-row output adds kept_bytes / dropped_bytes / dropped_share_pct. Use `dropped` to verify post-deploy realised savings or to answer "which patterns are we offloading right now". Use `both` to compute the offload share denominator in a single call. | kept |
| service | No | Service name to scope the result. Omit for all services. | |
| verbose | No | When true, every card carries the full forwarder snippet inline, every CTA renders unconditionally, and the volume-trend chart shows on every top-3 card. Default: compact mode (snippet templated once at top, CTAs gated to where they earn their line, chart only on ACUTE/NEW patterns). | |
| severity | No | Severity level to scope the result (e.g., `ERROR`, `CRITICAL`, `DEBUG`). | |
| siemScope | No | stack scope for the verbatim sample line on the top rows. | |
| siem_lens | No | What-if destination lens: keep the real volumes, price the $/mo columns at this destination's list rates (env-configured rates never cross destinations). Envelope stamps siem_actual vs siem_lens. | |
| timeRange | No | Time range to aggregate over. Default 1h. | 1h |
| environment | No | Environment nickname (for multi-env setups). | |
| analyzerCost | No | DEPRECATED — use effective_ingest_per_gb. stack ingestion cost in $/GB. Auto-detected from profile if omitted. | |
| include_chart | No | Set include_chart=true to embed the rendered chart inline (large; default false to avoid response truncation). | |
| monthly_volume_gb | No | What-if volume lens (forecast mode): model the environment at THIS monthly volume (decimal GB/month) instead of its measured volume. The real per-pattern shares and pattern mix are held fixed; only absolute bytes and dollars scale, by one uniform factor. Use it to project a prospect onto their own scale, or to forecast a real env after growth. Pairs with siem_lens. This is a PROJECTION: the envelope stamps volume_actual_gb vs volume_projected_gb and the scale factor, and the note points at the POC for the caller real patterns. | |
| effective_ingest_per_gb | No | Customer-supplied $/GB rate used for the dollar overlay. When set, headline tags `rate_source=customer_supplied`. When absent, falls back to the profile list rate (`rate_source=list_price`) or omits dollars entirely (`rate_source=unset`). |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the readOnly/idempotent/openWorld annotations: it discloses the Reporter-tier metrics requirement, the free-form timeRange syntax with no enum snap, the siem_lens what-if stamping (siem_actual vs siem_lens), and the projection semantics of monthly_volume_gb. These are real preconditions an agent would otherwise miss.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with what the tool returns and heavily information-dense, with the sample-question list doing useful matching work. It is on the long side, but most sentences carry non-obvious constraint or routing information rather than restating the name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema and annotations already cover return shape and safety, so the description focuses correctly on tier requirements, cohort semantics, and what-if/projection behavior. The main gap is its own inconsistency: it describes a `comparison_window` parameter and an `admitted` default that the schema does not contain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is already 100%, so the baseline is 3, and the description does add real value on timeRange syntax and cohort selection. However it introduces a naming mismatch that could cause a failed call: it says the default cohort is `admitted`, while the schema enum is `kept`, and it references a `comparison_window` parameter that does not exist in the input schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Return the top N log patterns ranked by byte volume') plus the optional cost overlay and delta column. An agent can tell this apart from cost/savings siblings and from the POC tools without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly enumerates the triggering questions ('what is expensive right now', 'what changed this week', 'did the deploy add cost'), states when to pass or omit comparison_window, and gives distinct-use guidance for kept/dropped/both cohorts. It also routes pre-deploy callers to the POC tools as an alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_whats_changingWhat's changing — patterns ranked by delta vs baselineARead-onlyIdempotent
Patterns ranked by delta vs a baseline window — the "what grew (or shrank) the most since X" question. Distinct from log10x_top_patterns which ranks by current cost; this tool ranks by delta and applies gates (min_delta_usd, min_delta_contribution_pct) that drop noise-level changes. comparison_window: "auto" (default) averages three offsets (1×, 2×, 3× the timeRange) for noise smoothing; specific offsets like "7d" compare to a single anchor — e.g. {timeRange: "1d", comparison_window: "1d"} is today vs yesterday (deploy-delta), {timeRange: "7d", comparison_window: "7d"} is this week vs last week. Brand-new patterns (no baseline samples) are EXCLUDED — they go to log10x_whats_new for clean separation of stories. Restores the capability of the deleted log10x_cost_drivers tool (commit 27dce7d, chk-15) using the modern StructuredOutput envelope and the shared baseline machinery in top-volume-extras.ts / gates in lib/gates.ts. Use for "what grew most this week", "which patterns regressed after the deploy", "what's driving cost up since yesterday". Returns patterns with per-row delta_usd, baseline_usd, current_usd, delta_pct, and a flag for whether each row crossed the contribution gate.
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | Output format. `summary` returns the structured envelope; `markdown` returns a rendered table. | summary |
| limit | No | Max patterns to return. Default 10. | |
| service | No | Service name to scope the result. Omit for all services. | |
| severity | No | Severity level to scope (e.g. `ERROR`, `CRITICAL`). | |
| timeRange | No | Current window to evaluate. Day-level only — delta math requires day-aligned baseline offsets. For sub-day spike investigation use `log10x_pattern_trend` or `log10x_investigate`. | 7d |
| environment | No | Environment nickname (for multi-env setups). | |
| analyzerCost | No | SIEM ingestion cost in $/GB. Auto-detected from profile if omitted. | |
| min_delta_usd | No | Dollar floor for delta. Rows with delta < min_delta_usd are dropped. Default $500/wk scaled to the selected timeRange window. Set to 0 to disable. | |
| comparison_window | No | Baseline window to compare against. `"auto"` (default) averages three offsets (1×, 2×, 3× the timeRange) for noise smoothing. A specific offset like `"7d"` compares to that single anchor — e.g. `{timeRange: "1d", comparison_window: "1d"}` = today vs yesterday (deploy-delta); `{timeRange: "7d", comparison_window: "7d"}` = this week vs last week. | auto |
| min_delta_contribution_pct | No | Contribution gate as a percentage. A row's delta must be at least this fraction of total positive delta to be surfaced. Default 5. Set to 0 to disable. |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/openWorld, so the safety profile is covered. The description adds genuine behavioral detail beyond that: the `min_delta_*` gates that drop noise-level changes, that `auto` averages three offsets, that brand-new patterns are EXCLUDED and routed elsewhere. It doesn't discuss rate limits or result size, but for a read-only analytical tool this is strong disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The core purpose, exclusions, and usage examples are front-loaded and well organized. However, the sentence about restoring a deleted tool via commit 27dce7d and internal files (`top-volume-extras.ts`, `lib/gates.ts`) is implementation/commit archaeology that adds noise rather than helping an agent select or invoke the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value explanation is unnecessary, and the description covers scope, gate behavior, exclusions, and use cases. It is complete enough to call correctly; the only minor gap is that the described return-row fields go a bit beyond what the output schema responsibility warrants, but nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all ten parameters, including the `comparison_window` offset semantics that the description largely repeats. The description reinforces the `timeRange`/`comparison_window` interaction with examples, but adds little that isn't already in the schema, making the baseline of 3 appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource and the ranking axis: 'Patterns ranked by delta vs a baseline window.' It explicitly distinguishes itself from sibling `log10x_top_patterns` (which ranks by current cost) and from `log10x_whats_new` (brand-new patterns). An agent can identify exactly what this tool produces without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use triggers ('what grew most this week', 'which patterns regressed after the deploy', 'what's driving cost up since yesterday') and names the alternative tools and conditions that select them (`top_patterns` for current cost, `whats_new` for new patterns, `pattern_trend`/`investigate` for sub-day spikes). Nothing is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
log10x_whats_newWhat's new — patterns by first_seen recencyARead-onlyIdempotent
Patterns whose first_seen timestamp falls inside a recency window — the "what showed up recently" question. Distinct from log10x_top_patterns (current cost ranking) and log10x_whats_changing (delta vs baseline). New patterns have no baseline, so delta math is meaningless; this tool exists so they get a clean home and don't pollute the changing-vs-baseline surface. Implementation: queries bytes_per_pattern in the current timeRange window to find candidate hashes, then for each hash queries the 30-day history to find the earliest non-zero datapoint via fetchFirstSeenBatch. A pattern is "new" when its first_seen timestamp is younger than first_seen_within (default 1d). Default sort: by first_seen recency descending (most recent first). Use first_seen_within: "1h" for incident triage, "1d" for daily-deploy review, "7d"+ for weekly observability hygiene. Returns patterns with first_seen, age, cost_now_usd, bytes_now, events_now, and the service + severity attribution.
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | Output format. | summary |
| limit | No | Max patterns to return. Default 10. | |
| service | No | Service name to scope the result. Omit for all services. | |
| severity | No | Severity level to scope (e.g. `ERROR`, `CRITICAL`). | |
| timeRange | No | Time range used to score current cost. Default 1h. | 1h |
| environment | No | Environment nickname (for multi-env setups). | |
| analyzerCost | No | SIEM ingestion cost in $/GB. Auto-detected from profile if omitted. | |
| first_seen_within | No | Patterns whose first-seen timestamp is younger than this are "new." Default `1d`. Use `1h` for incident triage, `1d` for daily-deploy review, `7d`+ for weekly observability hygiene. | 1d |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| tool | Yes | |
| view | No | |
| images | No | |
| actions | No | |
| summary | Yes | |
| warnings | No | |
| truncated | No | |
| next_cursor | No | |
| render_hint | No | |
| generated_at | Yes | |
| schema_epoch | Yes | |
| schema_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/openWorld, so safety is covered; the description still adds real behavioral value by defining what 'new' means (first_seen younger than first_seen_within), stating the default sort order (recency descending), and noting new patterns have no baseline. The fetchFirstSeenBatch/bytes_per_pattern plumbing is internal detail the caller does not need, which keeps this from a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded correctly: purpose, then sibling differentiation, then semantics. However, the long implementation sentence ('queries bytes_per_pattern ... via fetchFirstSeenBatch') and the trailing list of returned fields are not needed for correct invocation and pad an otherwise tight description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 8 parameters, full schema coverage, an output schema, and complete annotations, the description covers everything an agent needs to choose and call the tool correctly. Return fields are listed redundantly (the output schema already has them) but nothing is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all 8 parameters are already documented and the baseline is 3. The description's first_seen_within guidance (triage vs deploy review vs hygiene) duplicates the schema's own description text rather than adding new semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States the specific resource (patterns) and the exact selection criterion (first_seen inside a recency window) and pins down the question it answers: 'what showed up recently'. It explicitly names the two nearest siblings and contrasts them (cost ranking vs delta-vs-baseline), so an agent can route without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use guidance keyed to concrete scenarios: '1h' for incident triage, '1d' for daily-deploy review, '7d+' for weekly observability hygiene. It also states when-not-to-use by naming log10x_top_patterns and log10x_whats_changing as the alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
55 tool updates
v1.30.7- First observed
log10x_advise_install - First observed
log10x_advise_retriever - First observed
log10x_baseline - First observed
log10x_commitment_report - First observed
log10x_compile - First observed
log10x_compile_link - First observed
log10x_compile_status - First observed
log10x_cost_options - First observed
log10x_customer_metrics_query - First observed
log10x_dependency_check - First observed
log10x_discover_env - First observed
log10x_discover_join - First observed
log10x_discover_labels - First observed
log10x_doctor - First observed
log10x_emit_sample_plan - First observed
log10x_env_diff_vs_envvars - First observed
log10x_env_validate - First observed
log10x_estimate_savings - First observed
log10x_event_lookup - First observed
log10x_explain_mode - First observed
log10x_extract_templates - First observed
log10x_find_skew - First observed
log10x_investigate - First observed
log10x_login_status - First observed
log10x_measure_compaction - First observed
log10x_metric_overlay - First observed
log10x_metrics_that_moved - First observed
log10x_overflow_contents - First observed
log10x_pattern_detail - First observed
log10x_pattern_diff - First observed
log10x_pattern_examples - First observed
log10x_pattern_mitigate - First observed
log10x_pattern_trend - First observed
log10x_poc_from_local - First observed
log10x_poc_from_siem_status - First observed
log10x_poc_from_siem_submit - First observed
log10x_preview_filter - First observed
log10x_product_qa - First observed
log10x_rank_by_shape_similarity - First observed
log10x_resolve_batch - First observed
log10x_retriever_probe - First observed
log10x_retriever_query - First observed
log10x_retriever_query_status - First observed
log10x_retriever_series - First observed
log10x_savings - First observed
log10x_services - First observed
log10x_setup_recurring - First observed
log10x_siem_connector - First observed
log10x_signin_complete - First observed
log10x_signin_start - First observed
log10x_signout - First observed
log10x_start - First observed
log10x_top_patterns - First observed
log10x_whats_changing - First observed
log10x_whats_new
TDQS
Scored across 55 tools
Tool names and descriptions establish distinct boundaries, but several clusters genuinely overlap: log10x_savings vs log10x_estimate_savings vs log10x_commitment_report, the retriever family (query/series/probe/query_status), the POC family (from_local/from_siem_submit/from_siem_status), and multiple 'what changed' tools (top_patterns/whats_changing/whats_new/pattern_diff). The verbose routing hints embedded in descriptions (e.g. 'call X not Y') actually confirm that selection is error-prone and requires careful reading rather than being self-evident.
Every tool uses the uniform log10x_ prefix plus a consistent snake_case verb_noun or verb_noun_qualifier pattern (log10x_retriever_query, log10x_pattern_trend, log10x_compile_status). No camelCase or mixed conventions anywhere. Naming is fully predictable.
At 55 tools this is well past the heavy threshold and forces the agent to carry a very large surface for one server, with many near-siblings that only differ by nuance. While the broad platform scope (install, signin, cost, retrieval, compile, cross-pillar, POC) means each tool maps to some real capability, the count is still excessive and several tools could be merged.
Coverage is genuinely broad and closed-loop: sign-in/out lifecycle, env validation and diffing, install/discovery advisors, cost attribution and mitigation, retrieval/rehydration, compile, and cross-pillar correlation all have entry points with status/poll companions. Minor gaps exist (e.g. no true delete/teardown for some artifacts, some backends explicitly deferred), but the surface covers the stated domain well.
Maintenance
Related MCP Connectors
Query cloud, AI and SaaS spend across 25+ providers: costs, budgets, anomalies, unit economics.
Connects AI assistants to CloudQuell multi-cloud and AI cost, savings, anomaly, and budget data.
Query OneLens cloud-cost data in natural language: breakdowns, trends, cost centers. Read-only.
- mcpOAuthcom.vibgrate
Query your team's drift, vulnerability, and upgrade data from any AI assistant. OAuth 2.1, 51 tools.
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceProvides seamless access to Kibana and Periscope logs through a unified API with KQL and SQL querying, AI-powered log analysis, and support for searching across 1.3+ billion logs in 9 indexes.1-
- AlicenseNot gradedqualityAmaintenanceEnables AI assistants to analyze cloud billing data in FOCUS format through natural language queries. Provides 36+ predefined cost analysis queries, custom SQL execution, and schema documentation for multi-cloud cost optimization and FinOps practices.11Apache 2.0
- FlicenseNot gradedqualityBmaintenanceEnables querying and managing AI logs through tools like listing logs, retrieving jobs, and performing AI-powered chat queries. Also provides access to gateway security reports and guardrail testing.-
- AlicenseAqualityBmaintenanceLets AI agents query, manage, and operate their LLM observability data directly from the conversation. Provides 87 tools for cost analysis, alerting, anomaly detection, and runtime control gates.87209 npmMIT