Log10x MCP Server

Official

by log-10x

Overview Schema Source Related Servers Discussions Admin

TypeScript

Local

Retriever time series

log10x_retriever_series

Read-onlyIdempotent

Build exact or sampled grouped time series from S3 offload buckets over any window, auto-selecting mode and reporting fidelity caveats for rate/baseline queries.

Instructions

Materialize a fidelity-aware time series from the customer's S3 offload bucket over an arbitrary window, with optional group-by on enrichment fields. Auto-selects between exact full aggregation (Strategy A) and per-window-sampled fan-out (Strategy B) based on Reporter pattern volume: small/moderate-volume queries get exact counts; high-volume / long-window queries get a sampled series with time-distribution + group-ranking fidelity preserved and tail caveats reported. Pathological volume is refused with structured narrowing guidance, never silently truncated. Call when: (a) the user wants a 'rate of pattern X over the last 30 days, broken down by tenant' answer that exceeds SIEM retention/budget, (b) a baseline needs building from cost-driver patterns where Prometheus has continuous metrics but the grouped breakdown lives only in the offload bucket. Use log10x_retriever_query instead for the event payloads (not aggregates).

Input Schema

Name	Required	Description	Default
`to`	No	End of the query window. Same grammar as `from`. Default `now`.	now
`from`	Yes	Start of the query window. ISO8601, epoch millis, or relative (`now-1h`, `now-7d`, `now-30d`).
`view`	No	summary returns the typed envelope (data.mode, data.bucket_seconds, data.series_count, data.points_returned, data.top_groups, data.caveats, data.human_summary). The deprecated markdown view was removed; data.human_summary carries the prose distillation for chat rendering.	summary
`search`	No	Bloom-filter search expression using the TenX subset. Tightly bound queries (e.g., `includes(text, "<pattern_hash>")`, `severity_level == "ERROR"`) are dramatically cheaper. (legacy example removed: `tenx_user_pattern == "PaymentRetry"`) get the cheapest fetch path. Pattern-bound expressions are also what unlocks the Reporter-driven cost heuristic: without one, mode selection falls back to window-length only. Pass `pattern` instead for the common case of scoping to one Reporter-named pattern.
`target`	No	Target app prefix. Defaults to __SAVE_LOG10X_RETRIEVER_TARGET__.
`filters`	No	In-memory JS filters applied after the Bloom-scoped fetch (AND-combined).
`pattern`	No	Reporter-named pattern (Symbol Message). NOT SUPPORTED against the offload bucket: passing it returns an error naming the remedy, rather than a silent empty result. A Symbol Message is a label DERIVED from the event, so it is never a token in the offloaded bytes, and the Bloom index holds only text tokens plus template hashes. (The field this once queried, `tenx_user_pattern`, does not exist in the engine at all, which is why name-scoped queries returned BLOOM_REJECTED_ALL.) Pass `pattern_hash` instead: top_patterns returns it on the same row as the name, and event_lookup resolves a name to a hash.
`fidelity`	No	`auto` (tool decides via Reporter volume + window length), `full` (force exact aggregation: may exceed Lambda budget), `per_window_sampled` (force sampling, default K=1000 per sub-window), or `per_window_sampled:K` (custom K).	auto
`group_by`	No	Optional enrichment field to group the series by: e.g., `tenx_user_service`, `severity_level`, `k8s_namespace`. Top-1000 group values are retained; tail collapsed to `_other_`.
`bucket_size`	No	Time bucket granularity (`1m`, `5m`, `1h`, `1d`). Determines the resolution of the output series.	5m
`environment`	No	Environment nickname: required if multi-env.

Output Schema

Name	Required	Default
`data`	No
`tool`	Yes
`view`	No	summary
`images`	No
`actions`	No
`summary`	Yes
`warnings`	No
`truncated`	No
`next_cursor`	No
`render_hint`	No
`generated_at`	Yes
`schema_epoch`	Yes
`schema_version`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed5 schema fields changedv1.30.8Oct 15, 2026

changedInput schema / properties / environment / description

Previous value: -"Environment nickname — required if multi-env."New value: +"Environment nickname: required if multi-env."

changedInput schema / properties / fidelity / description

Previous value: -"`auto` (tool decides via Reporter volume + window length), `full` (force exact aggregation — may exceed Lambda budget), `per_window_sampled` (force sampling, default K=1000 per sub-window), or `per_window_sampled:K` (custom K)."New value: +"`auto` (tool decides via Reporter volume + window length), `full` (force exact aggregation: may exceed Lambda budget), `per_window_sampled` (force sampling, default K=1000 per sub-window), or `per_window_sampled:K` (custom K)."

changedInput schema / properties / group_by / description

Previous value: -"Optional enrichment field to group the series by — e.g., `tenx_user_service`, `severity_level`, `k8s_namespace`. Top-1000 group values are retained; tail collapsed to `_other_`."New value: +"Optional enrichment field to group the series by: e.g., `tenx_user_service`, `severity_level`, `k8s_namespace`. Top-1000 group values are retained; tail collapsed to `_other_`."

changedInput schema / properties / pattern / description

Previous value: -"Reporter-named pattern (Symbol Message). NOT SUPPORTED against the offload archive: passing it returns an error naming the remedy, rather than a silent empty result. A Symbol Message is a label DERIVED from the event, so it is never a token in the archived bytes, and the Bloom index holds only text tokens plus template hashes. (The field this once queried, `tenx_user_pattern`, does not exist in the engine at all, which is why name-scoped queries returned BLOOM_REJECTED_ALL.) Pass `pattern_hash` instead: top_patterns returns it on the same row as the name, and event_lookup resolves a name to a hash."New value: +"Reporter-named pattern (Symbol Message). NOT SUPPORTED against the offload bucket: passing it returns an error naming the remedy, rather than a silent empty result. A Symbol Message is a label DERIVED from the event, so it is never a token in the offloaded bytes, and the Bloom index holds only text tokens plus template hashes. (The field this once queried, `tenx_user_pattern`, does not exist in the engine at all, which is why name-scoped queries returned BLOOM_REJECTED_ALL.) Pass `pattern_hash` instead: top_patterns returns it on the same row as the name, and event_lookup resolves a name to a hash."

changedInput schema / properties / search / description

Previous value: -"Bloom-filter search expression using the TenX subset. Tightly bound queries (e.g., `includes(text, \"<pattern_hash>\")`, `severity_level == \"ERROR\"`) are dramatically cheaper. (legacy example removed: `tenx_user_pattern == \"PaymentRetry\"`) get the cheapest fetch path. Pattern-bound expressions are also what unlocks the Reporter-driven cost heuristic — without one, mode selection falls back to window-length only. Pass `pattern` instead for the common case of scoping to one Reporter-named pattern."New value: +"Bloom-filter search expression using the TenX subset. Tightly bound queries (e.g., `includes(text, \"<pattern_hash>\")`, `severity_level == \"ERROR\"`) are dramatically cheaper. (legacy example removed: `tenx_user_pattern == \"PaymentRetry\"`) get the cheapest fetch path. Pattern-bound expressions are also what unlocks the Reporter-driven cost heuristic: without one, mode selection falls back to window-length only. Pass `pattern` instead for the common case of scoping to one Reporter-named pattern."

First observedv1.30.7Sep 11, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint/idempotentHint/openWorldHint, but the description adds substantial context beyond them: automatic Strategy A/B selection driven by volume, sampled-series tail caveats being reported, and pathological volume being refused with structured narrowing guidance rather than silently truncated. This is exactly the behavioral disclosure an agent needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose and the key behavioral contract before detailed rationale; the parenthetical volume-heuristic explanation is dense but earns its place. Slightly long, but no true filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists and the view parameter documents the returned envelope, so return values need not be re-explained. Given complexity (mode auto-selection, sampling fidelity, refusal semantics), the description covers everything an agent needs to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all 11 parameters (fidelity modes, group_by top-1000/_other_, search grammar, etc.). The description adds only a light gesture toward group-by-on-enrichment-fields and the fidelity heuristic, which is already in the schema, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Materialize a fidelity-aware time series from the customer's S3 offload bucket over an arbitrary window') and explicitly distinguishes itself from the sibling log10x_retriever_query. An agent can tell what this produces (aggregated series) versus event payloads without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-call scenarios (a) and (b) with concrete user intents, plus a named alternative ('Use log10x_retriever_query instead for the event payloads'). Both the triggering cases and the exclusion are spelled out.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server