Log10x MCP Server

Official

by log-10x

Overview Schema Source Related Servers Discussions Admin

TypeScript

Local

Advise: Retriever install

log10x_advise_retriever

Read-onlyIdempotent

Generate install, verify, or teardown plans for a Log10x Retriever from a DiscoverySnapshot, covering AWS or Azure storage steps, Helm release actions, and probes.

Instructions

Given a DiscoverySnapshot (from log10x_discover_env), produce an install/verify/teardown plan for the Log10x Retriever. Unlike Reporter + Receiver, the Retriever has no forwarder choice: it is a standalone set of workloads (indexer + query-handler + stream-worker) that read source logs from object storage through a queue and serve an HTTP query endpoint. Two storage providers, picked by storage_provider: aws (S3 input bucket with an indexing-results/ prefix, four SQS queues, an IRSA-annotated ServiceAccount), auto-detected from the discovery snapshot or supplied explicitly; azure (AKS, Azure Blob containers, four Azure Storage Queues, workload identity), where the chart's own provision-retriever.sh creates the resources and the plan quotes it. blockers carries the inputs a complete plan is still missing and the plan emits no steps while it is non-empty; the preflight table is the state report beside it, and a FAIL row there is reported, not a gate, so read preflight_summary.fail as well as blockers. Verify probes follow the provider: pods Ready, indexer processing, query endpoint responding, then S3 + SQS probes on aws and Blob + Storage Queue probes on azure. Teardown uninstalls the Helm release; on aws the S3 / SQS / IAM lifecycle stays with Terraform, on azure the last step runs the provisioning script with --destroy to delete the resource group it created.

Input Schema

Name	Required	Description
`action`	No	Plan scope. Default: `all`.
`location`	No	Azure region for the provisioning command, e.g. `eastus` (azure only).
`namespace`	No	Target namespace. Default: snapshot.recommendations.suggestedNamespace.
`infra_mode`	No	How the customer provisions AWS infra. terraform = emit .tf module block. cli = emit aws-cli commands. existing = infra already provisioned, wizard skips infra steps and jumps to helm values. Auto-detected as "existing" when the snapshot already has all four SQS URLs + IRSA.
`destination`	No	Destination SIEM for the kept slice (e.g. `datadog`, `cloudwatch`, `splunk`). Gates SIEM down-tier sub-sections in the offload markdown.
`snapshot_id`	Yes	ID returned by `log10x_discover_env`. The snapshot is cached for 30 min.
`azure_queues`	No	Azure Storage Queue names on the storage account (azure only). Default: tenx-index / tenx-query / tenx-subquery / tenx-stream, matching the provisioning script.
`iam_role_arn`	No	IAM role ARN for the Retriever ServiceAccount (IRSA) (module output: iam_role_arn). Auto-detected from snapshot.
`index_bucket`	No	S3 path for indexed results (include prefix). Default: `<index_source_bucket>/indexing-results/`.
`release_name`	No	Helm release name. Default: `my-retriever`.
`license_source`	No	How the engine is licensed. Defaults to `"builtin"`: nothing is minted and no key is written, and the engine runs its built-in evaluation licence (10 nodes, 30 days from each start, airgapped). Pass `"paste"` with `license_jwt_paste` to wire a licence you hold into the values file. `"signin"` mints a user-scoped JWT (emits `signin_required` when no Auth0 session exists) and `"demo"` mints a 1-node, 14-day JWT; a minted JWT is never written to disk, so it is supplied at install time with `--set-string`. Omitting this arg on a later call keeps the earlier choice.
`resource_group`	No	Azure resource group for the provisioning command and the teardown (azure only).
`azure_client_id`	No	Client id of the user-assigned managed identity federated to the release ServiceAccount (azure only). The provisioning script writes it into the values file it produces, under `storage.azure.auth.clientId`.
`azure_tenant_id`	No	Entra tenant id (azure only). The provisioning script writes it into the values file it produces, under `storage.azure.auth.tenantId`.
`index_container`	No	Blob path for indexed results (azure only), as `account/container/path`. Default: `<storage_account>/tenx-index/tenx`.
`index_queue_url`	No	SQS URL for index operations (module output: index_queue_url). Auto-detected from snapshot.
`input_container`	No	Azure Blob container holding source logs (azure only). Bare container name, e.g. `logs`.
`query_queue_url`	No	SQS URL for query operations (module output: query_queue_url). Auto-detected from snapshot.
`storage_account`	No	Azure storage account holding the input and index containers (azure only). Flat namespace only: a hierarchical-namespace account reorders listings and is refused by the engine at construction.
`aks_cluster_name`	No	AKS cluster the release installs into (azure only). Used by the provisioning command (`--create-aks` for a new cluster) and by the `az aks get-credentials` step that points kubectl at it.
`storage_provider`	No	Which object store the Retriever reads. aws (default) = S3 buckets, four SQS queues, IRSA. azure = Azure Blob containers, four Azure Storage Queues, AKS workload identity, behind the chart's `storage.provider: azure` block. Auto-selected as "azure" when the resolved env-config offload destination has type `azure_blob`. Azure is read and index side: the Retriever indexes and queries blobs already in the container, and forwarder offload recipes stay S3-shaped.
`stream_queue_url`	No	SQS URL for stream operations (module output: stream_queue_url). Auto-detected from snapshot.
`license_jwt_paste`	No	License JWT supplied by the user when `license_source: "paste"`.
`subquery_queue_url`	No	SQS URL for sub-query operations (module output: subquery_queue_url). Auto-detected from snapshot.
`index_source_bucket`	No	S3 bucket for source logs (module output: index_source_bucket_name). Auto-filled from snapshot.recommendations.retrieverS3Bucket when present.

Output Schema

Name	Required	Default
`data`	No
`tool`	Yes
`view`	No	summary
`images`	No
`actions`	No
`summary`	Yes
`warnings`	No
`truncated`	No
`next_cursor`	No
`render_hint`	No
`generated_at`	Yes
`schema_epoch`	Yes
`schema_version`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed13 schema fields changedv1.30.8Oct 15, 2026

addedInput schema / properties / aks_cluster_name

Added value: +{
+  "description": "AKS cluster the release installs into (azure only). Used by the provisioning command (`--create-aks` for a new cluster) and by the `az aks get-credentials` step that points kubectl at it.",
+  "type": "string"
+}

addedInput schema / properties / azure_client_id

Added value: +{
+  "description": "Client id of the user-assigned managed identity federated to the release ServiceAccount (azure only). The provisioning script writes it into the values file it produces, under `storage.azure.auth.clientId`.",
+  "type": "string"
+}

addedInput schema / properties / azure_queues

Added value: +{
+  "additionalProperties": false,
+  "description": "Azure Storage Queue names on the storage account (azure only). Default: tenx-index / tenx-query / tenx-subquery / tenx-stream, matching the provisioning script.",
+  "properties": {
+    "index": {
+      "type": "string"
+    },
+    "query": {
+      "type": "string"
+    },
+    "stream": {
+      "type": "string"
+    },
+    "subquery": {
+      "type": "string"
+    }
+  },
+  "type": "object"
+}

addedInput schema / properties / azure_tenant_id

Added value: +{
+  "description": "Entra tenant id (azure only). The provisioning script writes it into the values file it produces, under `storage.azure.auth.tenantId`.",
+  "type": "string"
+}

addedInput schema / properties / index_container

Added value: +{
+  "description": "Blob path for indexed results (azure only), as `account/container/path`. Default: `<storage_account>/tenx-index/tenx`.",
+  "type": "string"
+}

addedInput schema / properties / input_container

Added value: +{
+  "description": "Azure Blob container holding source logs (azure only). Bare container name, e.g. `logs`.",
+  "type": "string"
+}

removedInput schema / properties / license_source / default
```
Removed value: -"signin"
```

changedInput schema / properties / license_source / description

Previous value: -"How the wizard acquires the engine license JWT. Defaults to `\"signin\"` — emits `signin_required` mode when no Auth0 session exists. Pass `\"demo\"` for a 14-day anonymous JWT. Pass `\"paste\"` with `license_jwt_paste` to supply an existing JWT."New value: +"How the engine is licensed. Defaults to `\"builtin\"`: nothing is minted and no key is written, and the engine runs its built-in evaluation licence (10 nodes, 30 days from each start, airgapped). Pass `\"paste\"` with `license_jwt_paste` to wire a licence you hold into the values file. `\"signin\"` mints a user-scoped JWT (emits `signin_required` when no Auth0 session exists) and `\"demo\"` mints a 1-node, 14-day JWT; a minted JWT is never written to disk, so it is supplied at install time with `--set-string`. Omitting this arg on a later call keeps the earlier choice."

changedInput schema / properties / license_source / enum

Previous value: -[
-  "signin",
-  "demo",
-  "paste"
-]New value: +[
+  "builtin",
+  "signin",
+  "demo",
+  "paste"
+]

addedInput schema / properties / location

Added value: +{
+  "description": "Azure region for the provisioning command, e.g. `eastus` (azure only).",
+  "type": "string"
+}

addedInput schema / properties / resource_group

Added value: +{
+  "description": "Azure resource group for the provisioning command and the teardown (azure only).",
+  "type": "string"
+}

addedInput schema / properties / storage_account

Added value: +{
+  "description": "Azure storage account holding the input and index containers (azure only). Flat namespace only: a hierarchical-namespace account reorders listings and is refused by the engine at construction.",
+  "type": "string"
+}

addedInput schema / properties / storage_provider

Added value: +{
+  "description": "Which object store the Retriever reads. **aws** (default) = S3 buckets, four SQS queues, IRSA. **azure** = Azure Blob containers, four Azure Storage Queues, AKS workload identity, behind the chart's `storage.provider: azure` block. Auto-selected as \"azure\" when the resolved env-config offload destination has type `azure_blob`. Azure is read and index side: the Retriever indexes and queries blobs already in the container, and forwarder offload recipes stay S3-shaped.",
+  "enum": [
+    "aws",
+    "azure"
+  ],
+  "type": "string"
+}

First observedv1.30.7Sep 11, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds substantial behavior beyond the readOnly/idempotent annotations: `blockers` gating (no steps emitted while non-empty), the preflight table's FAIL row being a report rather than a gate, provider-specific verify probes, and the teardown lifecycle split (Terraform retains S3/SQS/IAM on aws; azure runs `--destroy`). This is exactly the non-obvious signaling an agent needs and is not derivable from annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Despite its length, it is front-loaded with purpose and then ordered by provider, blockers/preflight, verify, and teardown. Some clauses (e.g. quoting the provisioning script, repeating Helm/files mechanics) are dense run-ons, but for a 25-parameter tool the size is proportionate and most sentences carry unique information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and the description still covers the parts an agent cannot infer: what the plan contains, how `blockers`/`preflight_summary.fail` behave, provider-specific probes, and teardown semantics. Nothing essential for correct invocation appears missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description goes further by explaining cross-parameter relationships: how `storage_provider` flips the whole aws/azure resource model, that `blockers` reflect missing inputs, and how auto-detection works. It does not cover every one of the 25 parameters, but it adds relational meaning the schema cannot.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a precise verb+resource: given a DiscoverySnapshot, produce an install/verify/teardown plan for the Log10x Retriever. It explicitly contrasts the Retriever with Reporter + Receiver (no forwarder choice, standalone workloads), so an agent can place it against siblings like log10x_advise_install without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Names the prerequisite input (`snapshot_id` from `log10x_discover_env`) and the selection logic for providers (auto-detected, or overridden via `storage_provider`, auto-azure when offload destination is `azure_blob`). It does not explicitly route between this and the sibling advisories (e.g. `log10x_advise_install`), so it is clear on context but lacks exclusion guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server