lograft
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| lograft_parse_kqlA | Extract structural facts from a Kusto Query Language (KQL) query without executing it. Returns the referenced tables, projected columns, time range, and ticket mentions. Most users want lograft_investigate; use this atomic tool only when you need partial pipeline output. Pure compute, no side effects, no network. |
| lograft_normalizeA | Normalise a CSV / JSON / Azure-Monitor-JSON log export into a 5-field rowset (timestamp, level, message, source, raw). Pass sessionId to receive an opaque rowsetRef for downstream lograft_correlate calls (avoids re-shipping large payloads through MCP). Most users want lograft_investigate; this atomic tool is for partial pipelines. |
| lograft_gather_repo_contextA | Snapshot a git repository's recent commits (default: last 14 days, max 200 commits) plus current branch and origin URL. Pure read-only, shells out to git. Most users want lograft_investigate; this atomic tool is for partial pipelines. |
| lograft_correlateA | Join a NormalizedRowset against a RepoContext using explicit keys (operation_Id, configured ticket regex, service allowlist). Output is redacted via the internal middleware before being returned. Most users want lograft_investigate; this atomic tool is for partial pipelines. |
| lograft_investigateA | Run the full investigation pipeline in one call: parse KQL (optional) -> normalize -> gather repo context -> correlate -> redact -> render md+json+html bundle. Either pass result={inline|path} (paste mode) OR live={workspace,subscription,table,...} (delegates to azmcp). Returns a Bundle with paths to the written files. This is the tool most users want first. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 5 tools
Each tool targets a distinct step in the investigation pipeline, with explicit guidance that most users should start with lograft_investigate. The atomic tools (parse_kql, normalize, gather_repo_context, correlate) have no overlapping purposes.
All tools share the lograft_ prefix and use clear verb_noun or verb patterns (e.g., parse_kql, gather_repo_context, investigate). The naming is uniform and predictable.
Five tools is an ideal count for this domain—neither too few nor too many. Each atomic tool serves a specific need, and the full pipeline tool ties them together efficiently.
The pipeline is fully covered: parsing KQL, normalizing logs, gathering repo context, correlating, and generating a final bundle. There are no obvious gaps for the stated purpose of log investigation.