Extract structural facts from a Kusto Query Language (KQL) query without executing it. Returns the referenced tables, projected columns, time range, and ticket mentions. Most users want lograft_investigate; use this atomic tool only when you need partial pipeline output. Pure compute, no side effects, no network.

Normalise a CSV / JSON / Azure-Monitor-JSON log export into a 5-field rowset (timestamp, level, message, source, raw). Pass sessionId to receive an opaque rowsetRef for downstream lograft_correlate calls (avoids re-shipping large payloads through MCP). Most users want lograft_investigate; this atomic tool is for partial pipelines.

Snapshot a git repository's recent commits (default: last 14 days, max 200 commits) plus current branch and origin URL. Pure read-only, shells out to git. Most users want lograft_investigate; this atomic tool is for partial pipelines.

Join a NormalizedRowset against a RepoContext using explicit keys (operation_Id, configured ticket regex, service allowlist). Output is redacted via the internal middleware before being returned. Most users want lograft_investigate; this atomic tool is for partial pipelines.

Run the full investigation pipeline in one call: parse KQL (optional) -> normalize -> gather repo context -> correlate -> redact -> render md+json+html bundle. Either pass result={inline|path} (paste mode) OR live={workspace,subscription,table,...} (delegates to azmcp). Returns a Bundle with paths to the written files. This is the tool most users want first.