Skip to main content
Glama
log-10x

Log10x MCP Server

Official

Find skew

log10x_find_skew
Read-onlyIdempotent

Detect log pattern slots where one value dominates at least 60% of events, exposing sampling opportunities to reduce repetitive volume.

Instructions

Identify patterns where one slot value dominates the field (>= 60% of events by default). Surfaces sampling opportunities: "slot verb is get 78% of events, sample the get case at 1/10 to cut its volume." Sampling is lossy: the other 9 in 10 of those events are discarded. Differentiated against analyzer field histograms because the engine groups by per-pattern field-set, so dominance is measured within the structural pattern, not globally. Stage 1: accepts events as a paste array (same shape as log10x_resolve_batch). Calibration: the 60% concentration floor and 1/10 sampling rate are hand-picked defaults tagged unvalidated_default in the output. The envelope surfaces the empirical observed_dominant_pct_distribution across all candidate slots so the agent can judge whether 0.6 is well above or below the noise floor for this dataset. See docs/cross-pillar-primitives.md for the agent behavior contract.

Input Schema

NameRequiredDescriptionDefault
top_nNoNumber of findings to return. Default 20.
eventsYesEvents to analyze for slot skew. Same shape as log10x_resolve_batch: raw strings or JSON objects. Each event is templated locally; skew is computed across the resulting patterns.
sample_nNoSampling rate N for the savings projection (1/N of the dominant case kept). Default 10. Same calibration caveat: sample_n=10 is a defensible starting point but not validated for any specific cost target.
min_eventsNoMinimum events per pattern to bother checking. Default 10 (filters low-sample noise).
min_concentrationNoMinimum dominant-value fraction for a slot to be flagged as skewed. Default 0.6 (a slot is "skewed" when one value is 60%+ of events). Hand-picked default tagged as `unvalidated_default` in the output. Compare against the `observed_dominant_pct_distribution` in `threshold_audit` to judge whether 0.6 is well above or below this dataset's noise.

Output Schema

NameRequiredDescriptionDefault
dataNo
toolYes
viewNosummary
imagesNo
actionsNo
summaryYes
warningsNo
truncatedNo
next_cursorNo
render_hintNo
generated_atYes
schema_epochYes
schema_versionYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed2 schema fields changedv1.30.8
    • changedInput schema / properties / events / description
      Previous value: -"Events to analyze for slot skew. Same shape as log10x_resolve_batch — raw strings or JSON objects. Each event is templated locally; skew is computed across the resulting patterns."New value: +"Events to analyze for slot skew. Same shape as log10x_resolve_batch: raw strings or JSON objects. Each event is templated locally; skew is computed across the resulting patterns."
    • changedInput schema / properties / sample_n / description
      Previous value: -"Sampling rate N for the savings projection (1/N of the dominant case kept). Default 10. Same calibration caveat — sample_n=10 is a defensible starting point but not validated for any specific cost target."New value: +"Sampling rate N for the savings projection (1/N of the dominant case kept). Default 10. Same calibration caveat: sample_n=10 is a defensible starting point but not validated for any specific cost target."
  2. First observedv1.30.7

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent, and the description adds substantial extra behavior: sampling is lossy (9 of 10 dominant events discarded), default thresholds are tagged unvalidated_default, and the output envelope surfaces observed_dominant_pct_distribution so the agent can judge calibration. This is exactly the kind of beyond-annotation disclosure that earns top marks.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the purpose, then layers differentiation, the Stage 1 input contract, and calibration caveats. It is dense and somewhat long, with a quoted example that is illustrative but adds bulk; still, nearly every sentence carries information, so only minor trimming is warranted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description need not restate returns, yet it still explains the key envelope field (observed_dominant_pct_distribution) and references the agent behavior contract doc. Given a 5-param tool with a required events array and calibration-heavy defaults, everything an agent needs to call it correctly is present.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline would be 3, but the description adds meaning: it explains the calibration caveat behind min_concentration (0.6 floor) and sample_n (1/10), and points the agent to threshold_audit for judging whether the defaults fit the dataset. That is genuine added value over the schema text.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific behavior: identify patterns where one slot value dominates a field (>=60% by default), with a concrete example of the finding it produces. It explicitly differentiates itself from analyzer field histograms, explaining that dominance is measured within the structural pattern rather than globally, so an agent can tell it apart from siblings without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear usage context (surface sampling opportunities, Stage 1 accepts events as a paste array shaped like log10x_resolve_batch) and contrasts the mechanism against analyzer field histograms. It does not state an explicit when-not or name a preferred alternative for overlapping cases, so it falls short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.