Log10x MCP Server

Official

by log-10x

Overview Schema Source Related Servers Discussions Admin

TypeScript

Local

Measure compaction

log10x_measure_compaction

Read-onlyIdempotent

Calculate per-pattern compact ratios from sampled SIEM events via a local tenx engine to replace default ratios in savings estimates.

Instructions

Measure per-pattern compact ratios (bytes before and after encoding) on a sample pulled from the customer's SIEM and run through a local engine; a ratio on that sample, not a SIEM meter reading. Pulls sample_size events for a service over timeRange, runs them through the local tenx engine, and returns per-pattern compaction_ratio_x (original bytes / encoded bytes) derived from that sample. Use this to replace the destination's default compact ratio in log10x_estimate_savings (one measured capture per destination, named in compact_ratio_basis) with ratios measured on this customer's sample. Requires: tenx CLI installed locally (LOG10X_TENX_PATH or tenx on PATH) AND SIEM credentials (same as log10x_poc_from_siem_submit). Confidence tiers: high (>=50 events), medium (10-49), low (<10). Results flow into log10x_estimate_savings to improve savings projections. REQUIRES a local engine: the tenx binary on PATH, or Docker with LOG10X_TENX_MODE=docker.

Input Schema

Name	Required	Description	Default
`service`	Yes	Service name to scope the stack sample to. Used as the query filter (e.g., Datadog `service:<name>`, Splunk `sourcetype=<name>`, CloudWatch stream prefix).
`timeRange`	No	Lookback window for the stack pull. Format: <N><unit> where unit is m (minutes), h (hours), or d (days). Default "24h".	24h
`environment`	No	Log10x environment id. Omit to use the default environment.
`sample_size`	No	Number of events to pull from the stack for measurement. Default 500. Larger samples improve confidence (high confidence requires >=50 events per pattern) but take longer to pull and process.

Output Schema

Name	Required	Default
`data`	No
`tool`	Yes
`view`	No	summary
`images`	No
`actions`	No
`summary`	Yes
`warnings`	No
`truncated`	No
`next_cursor`	No
`render_hint`	No
`generated_at`	Yes
`schema_epoch`	Yes
`schema_version`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

First observedv1.30.7Sep 11, 2026

TDQS

A4.8/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint/idempotentHint, but the description adds substantial context beyond them: the result is a sample-derived ratio, not a SIEM meter reading; it requires a local tenx binary with the LOG10X_TENX_PATH/PATH resolution order; and it discloses confidence tiers keyed to event counts. These are real behavioral traits an agent cannot learn from the structured fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Dense and front-loaded, leading with the measurement semantics before prerequisites. It repeats the local-engine requirement twice (the 'tenx CLI installed locally OR SIEM credentials' list and the trailing 'REQUIRES a local engine' sentence), which is the main waste, and the final sentence is redundant emphasis.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be re-explained, yet the description still names `compaction_ratio_x` and its numerator/denominator for clarity. For a tool with credential, local-engine and sampling caveats, it covers everything an agent needs to call it correctly or route elsewhere.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3, but the description adds interpretive meaning: `sample_size` events are pulled over `timeRange`, and larger samples map to the stated confidence tiers. It also clarifies that each measured capture corresponds to one destination named in `compact_ratio_basis`, which is useful framing beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Measure per-pattern compact ratios (bytes before and after encoding)') and scopes it precisely to a sample pulled from the customer's SIEM. It explicitly distinguishes itself from the default-ratio path by naming `log10x_estimate_savings` as the downstream consumer, so an agent can separate it from siblings like `log10x_savings` without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use ('Use this to replace the destination's default compact ratio in log10x_estimate_savings') plus hard prerequisites: tenx CLI locally or Docker, and SIEM credentials matching `log10x_poc_from_siem_submit`. It also states the outcome ('Results flow into log10x_estimate_savings to improve savings projections'), leaving nothing to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server