Skip to main content
Glama
log-10x

Log10x MCP Server

Official
by log-10x

What's changing — patterns ranked by delta vs baseline

log10x_whats_changing
Read-onlyIdempotent

Rank log patterns by cost delta versus a baseline window to reveal what grew or shrank most since a given time, filtering noise-level changes.

Instructions

Patterns ranked by delta vs a baseline window — the "what grew (or shrank) the most since X" question. Distinct from log10x_top_patterns which ranks by current cost; this tool ranks by delta and applies gates (min_delta_usd, min_delta_contribution_pct) that drop noise-level changes. comparison_window: "auto" (default) averages three offsets (1×, 2×, 3× the timeRange) for noise smoothing; specific offsets like "7d" compare to a single anchor — e.g. {timeRange: "1d", comparison_window: "1d"} is today vs yesterday (deploy-delta), {timeRange: "7d", comparison_window: "7d"} is this week vs last week. Brand-new patterns (no baseline samples) are EXCLUDED — they go to log10x_whats_new for clean separation of stories. Restores the capability of the deleted log10x_cost_drivers tool (commit 27dce7d, chk-15) using the modern StructuredOutput envelope and the shared baseline machinery in top-volume-extras.ts / gates in lib/gates.ts. Use for "what grew most this week", "which patterns regressed after the deploy", "what's driving cost up since yesterday". Returns patterns with per-row delta_usd, baseline_usd, current_usd, delta_pct, and a flag for whether each row crossed the contribution gate.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
viewNoOutput format. `summary` returns the structured envelope; `markdown` returns a rendered table.summary
limitNoMax patterns to return. Default 10.
serviceNoService name to scope the result. Omit for all services.
severityNoSeverity level to scope (e.g. `ERROR`, `CRITICAL`).
timeRangeNoCurrent window to evaluate. Day-level only — delta math requires day-aligned baseline offsets. For sub-day spike investigation use `log10x_pattern_trend` or `log10x_investigate`.7d
environmentNoEnvironment nickname (for multi-env setups).
analyzerCostNoSIEM ingestion cost in $/GB. Auto-detected from profile if omitted.
min_delta_usdNoDollar floor for delta. Rows with delta < min_delta_usd are dropped. Default $500/wk scaled to the selected timeRange window. Set to 0 to disable.
comparison_windowNoBaseline window to compare against. `"auto"` (default) averages three offsets (1×, 2×, 3× the timeRange) for noise smoothing. A specific offset like `"7d"` compares to that single anchor — e.g. `{timeRange: "1d", comparison_window: "1d"}` = today vs yesterday (deploy-delta); `{timeRange: "7d", comparison_window: "7d"}` = this week vs last week.auto
min_delta_contribution_pctNoContribution gate as a percentage. A row's delta must be at least this fraction of total positive delta to be surfaced. Default 5. Set to 0 to disable.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
dataNo
toolYes
viewNosummary
imagesNo
actionsNo
summaryYes
warningsNo
truncatedNo
next_cursorNo
render_hintNo
generated_atYes
schema_epochYes
schema_versionYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.30.7

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/openWorld, so the safety profile is covered. The description adds genuine behavioral detail beyond that: the `min_delta_*` gates that drop noise-level changes, that `auto` averages three offsets, that brand-new patterns are EXCLUDED and routed elsewhere. It doesn't discuss rate limits or result size, but for a read-only analytical tool this is strong disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core purpose, exclusions, and usage examples are front-loaded and well organized. However, the sentence about restoring a deleted tool via commit 27dce7d and internal files (`top-volume-extras.ts`, `lib/gates.ts`) is implementation/commit archaeology that adds noise rather than helping an agent select or invoke the tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-value explanation is unnecessary, and the description covers scope, gate behavior, exclusions, and use cases. It is complete enough to call correctly; the only minor gap is that the described return-row fields go a bit beyond what the output schema responsibility warrants, but nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all ten parameters, including the `comparison_window` offset semantics that the description largely repeats. The description reinforces the `timeRange`/`comparison_window` interaction with examples, but adds little that isn't already in the schema, making the baseline of 3 appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource and the ranking axis: 'Patterns ranked by delta vs a baseline window.' It explicitly distinguishes itself from sibling `log10x_top_patterns` (which ranks by current cost) and from `log10x_whats_new` (brand-new patterns). An agent can identify exactly what this tool produces without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use triggers ('what grew most this week', 'which patterns regressed after the deploy', 'what's driving cost up since yesterday') and names the alternative tools and conditions that select them (`top_patterns` for current cost, `whats_new` for new patterns, `pattern_trend`/`investigate` for sub-day spikes). Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.