kube-diagnostics-mcp
Adds Angular frontend diagnostics: bundle stats, Core Web Vitals per route, and real-user monitoring beacons.
Optional signal provider that queries Datadog's REST API for metrics and signals (implemented but not yet tested against a live org).
Provides read-only Kubernetes diagnostics: workload status, events, resources, logs, endpoints, recent changes, and composed runbook analyses such as diagnose_service and health_report, without Secret access or exec.
Adds NGINX diagnostics via the probe sidecar: stub_status, access log analysis, and config linting for timeouts, caching, and security headers.
Optional signal provider that queries Prometheus for golden signals and metrics to support latency, resource, and change diagnostics.
Optional signal provider that queries Splunk's REST API for log and signal data (implemented but not yet tested against a live instance).
Adds Spring Boot diagnostics: heap-vs-limit mismatches, HikariCP pool exhaustion, thread dump deadlock detection, and Java stack-trace grouping.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@kube-diagnostics-mcpwhy is checkout slow?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
kube-diagnostics-mcp
A read-only MCP diagnostics service for microservices on Kubernetes.
It turns the debugging runbook into tools so that "why is checkout slow?", "what changed?",
and "is anything leaking?" become a conversation with a model instead of an hour of kubectl,
dashboards, and log greps.
Sibling of postgres-readonly-mcp and
jira-readonly-mcp: the server owns the credentials,
calls the real backends, and hands the model compact, sanitized, size-capped results. The model never
sees a kubeconfig, a ServiceAccount token, or a Secret.
Claude Code / OpenCode / any MCP client
│ MCP over Streamable HTTP (bearer token) or stdio for local use
▼
┌──────────────────────────────┐ read-only RBAC: get/list/watch, no Secrets, no exec
│ HUB (Deployment) │──► Kubernetes API + metrics.k8s.io
│ encodes the runbook │──► Prometheus (optional provider)
│ ~55 tools, 4 runbooks │──► Datadog / Splunk (optional providers)
└──────────┬───────────────────┘
│ HTTP + shared token, restricted by NetworkPolicy
▼
┌──────────────────────────────┐ native sidecar (initContainer, restartPolicy: Always)
│ PROBE (per pod, optional) │ shares the pod's network namespace:
│ no Kubernetes credentials │ /proc/net, DNS, TCP checks, Actuator on localhost,
│ ~40 MB, distroless │ nginx stub_status, access log, static build, RUM ingest
└──────────────────────────────┘Status: v0.1.0. Everything documented below runs end to end against the included fault lab
(kind + Angular/nginx + two Spring Boot services + Postgres with 29 injected faults); the CI
workflow runs the unit tests, builds the image, renders the manifests, and scans for leaked
secrets. Datadog and Splunk providers are implemented against their documented REST APIs and
enabled by env vars, but have not yet been run against a live org/instance (see the caveat under
Signal providers). The container image is published to GHCR by the release workflow on v* tags;
until the first tag, build it locally.
Contents
Related MCP server: K8s Doctor MCP
Why this and not kubectl-as-MCP
Generic Kubernetes MCP servers give a model get pods and get logs. That is table stakes, and this
server has a small set of those primitives too. The value is in three other things:
Composed runbook tools.
diagnose_serviceruns status → events → resources → OOM/crash → endpoints → JVM/pool/downstreams → log errors → golden signals → recent changes, and returns ranked hypotheses with evidence and the next tool to call.diagnose_slow_requests,diagnose_slow_page, andhealth_reportdo the same for latency, a slow frontend route, and the Monday-morning digest.The in-pod view. A tiny probe sidecar sees what nothing outside the pod can: sockets in
/proc/net, DNS as the app resolves it, Actuator on localhost when it is deliberately not exposed, nginxstub_status, the served static build, and browser beacons for real-user monitoring.Stack-aware analysis. Spring Boot heap-vs-limit mismatches, HikariCP pool exhaustion, thread dump deadlock detection, Java stack-trace grouping, nginx config linting (timeouts, caching, security headers), Angular bundle stats, Core Web Vitals per route.
Everything returned is shaped for a model: grouped, counted, capped, and scrubbed.
Threat and security model
This project is read-only by construction, with independent layers:
RBAC (
deploy/hub/rbac.yaml): the hub's ServiceAccount getsget/list/watchon workloads, pods,pods/log, events, ConfigMaps, Services, EndpointSlices, NetworkPolicies, Ingresses, HPAs, PDBs, RBAC objects, nodes, andmetrics.k8s.io. It has no access to Secrets at all, and nopods/exec,pods/attach, orpods/portforward. Secret usage is derived from pod specs (which Secret, which key, env or volume), never contents.A client wrapper with no write methods (
src/k8s/client.ts): every Kubernetes call goes throughReadOnlyKubeClient, which exposes only get/list/log methods. There is no code path that can send a POST, PUT, PATCH, or DELETE, so a bug in a tool cannot mutate the cluster even if RBAC were misconfigured.The probe has no credentials. It runs as a native sidecar with
automountServiceAccountTokenirrelevant (it never talks to the API server), non-root, read-only root filesystem, all capabilities dropped. It answers only the hub (shared bearer token, compared in constant time) and only on the paths listed insrc/probe/server.ts. Actuator endpoints that dump state (heapdump,env,logfile,shutdown, ...) are on a deny list and are never proxied.Input guard (
src/security/guard.ts): every name, namespace, selector, hostname, and port that ends up in an API path or a probe URL is validated against Kubernetes naming rules. Fails closed.
On top of those, defense in depth:
Sanitizer (
src/security/sanitize.ts), applied to every tool result and every log line: connection strings with credentials (any scheme, plusjdbc:),BearerandBasictokens, JWTs,password=/api_key=-style assignments (includingSPRING_DATASOURCE_PASSWORD=), PEM private keys, AWS/GCP/GitHub/Slack/Stripe key shapes. Values stored under credential-looking keys are replaced outright. This is a heuristic scrubber, not a guarantee.Env values from Secrets are never resolved.
get_configshows them asfrom: secret:NAME/KEY. Literal env values under credential-looking names are redacted too, and flagged as a finding.Sensitive-data scanning returns counts and masked samples only (
src/security/sensitive.ts):ja***@***.com,41** **** **** 11. The matched value is never returned.Size caps. Logs are capped by lines and bytes; every result is capped by
DIAG_MAX_RESULT_BYTES; thread dumps and access logs are summarized, never returned raw.Active checks are off by default.
resolve_dns,check_connectivity,check_security_headers, and the TLS handshake inget_tls_statusgenerate traffic. They requireDIAG_ALLOW_ACTIVE_CHECKS=trueon the hub (and on the probe for the in-pod ones) and are labeled[ACTIVE]in their descriptions.Audit log. Every tool call is logged with its arguments (free-text arguments omitted), never its output.
What this does not protect against. Anyone who can call the hub can read anything its RBAC can
read, which includes application logs and ConfigMaps. Treat the hub token like a read-only cluster
credential. Log scrubbing is best-effort; if your application logs raw card numbers, the
scan_logs_for_sensitive_data tool will tell you, but get_logs will also have shown masked
versions of them to the model. Restrict the hub with DIAG_NAMESPACES and a namespaced Role instead
of the ClusterRole when you can.
Quick start (local, stdio)
Requirements: Node 20+, a kubeconfig with read access.
git clone https://github.com/ranson21/kube-diagnostics-mcp.git
cd kube-diagnostics-mcp
npm ci && npm run buildRegister it with your MCP client. Claude Code:
claude mcp add kube-diagnostics -e DIAG_DEFAULT_NAMESPACE=myapp -- node /path/to/kube-diagnostics-mcp/dist/index.jsOpenCode (opencode.json):
{
"mcp": {
"kube-diagnostics": {
"type": "local",
"command": ["node", "/path/to/kube-diagnostics-mcp/dist/index.js"],
"environment": { "DIAG_DEFAULT_NAMESPACE": "myapp" }
}
}
}Then ask: "run health_report on myapp", "diagnose_service checkout", "what changed in the last 6 hours?". In stdio mode the hub uses your kubeconfig's current context and whatever it can read. Without probes, the probe-backed tools explain what is missing instead of failing.
Deploying in a cluster
# 1. Tokens: one for MCP clients, one shared between the hub and every probe.
HUB=$(openssl rand -hex 32); PROBE=$(openssl rand -hex 32)
kubectl kustomize deploy/hub \
| sed -e "s/REPLACE_WITH_RANDOM_HUB_TOKEN/$HUB/" -e "s/REPLACE_WITH_RANDOM_PROBE_TOKEN/$PROBE/" \
| kubectl apply -f -
# 2. Reach it (port-forward for a try; an Ingress with TLS for real use).
kubectl -n kube-diagnostics port-forward svc/kube-diagnostics-hub 8090:8090The hub speaks MCP Streamable HTTP at http://localhost:8090/mcp with Authorization: Bearer $HUB.
Claude Code: claude mcp add --transport http kube-diagnostics http://localhost:8090/mcp --header "Authorization: Bearer $HUB".
deploy/hub/deployment.yaml runs one replica as non-root with a
read-only root filesystem and a NetworkPolicy that only admits port 8090. Scope it with
DIAG_NAMESPACES=team-a,team-b (comma-separated) and, if you prefer, replace the
ClusterRoleBinding with RoleBindings in those namespaces.
The image is ghcr.io/ranson21/kube-diagnostics-mcp:0.1.0 (distroless Node 22, non-root), or build
your own with docker build -t kube-diagnostics-mcp:dev ..
The probe sidecar
The same image with DIAG_MODE=probe. Add it to a workload as a native sidecar (Kubernetes
1.29+; an init container with restartPolicy: Always, which starts before the app and stays up):
kubectl -n myapp apply -f deploy/probe/token-secret.yaml # same value as the hub's probe-token
kubectl -n myapp patch deployment checkout --patch-file deploy/probe/sidecar-patch.yaml
kubectl -n myapp apply -f deploy/probe/networkpolicy.yaml # only the hub may reach :9911deploy/probe/sidecar-patch.yaml documents every knob. The
useful ones:
Env | Enables |
| JVM health, thread dumps, HikariCP, per-endpoint metrics, Actuator health (Spring Boot) |
|
|
|
|
|
|
| RUM ingest on |
|
|
|
|
The hub discovers probes by container name (diag-probe by default) and talks to podIP:9911.
The probe listens on the pod IP because the hub is in another pod; the NetworkPolicy is what keeps
everyone else out. /proc/net needs no special privileges: a sidecar shares the network namespace.
Tools
Every tool takes namespace (optional when DIAG_DEFAULT_NAMESPACE is set) and most take
service, which is resolved as a Deployment, StatefulSet, DaemonSet, Service, or Pod name, in
that order. [probe] tools need the sidecar; [ACTIVE] tools need DIAG_ALLOW_ACTIVE_CHECKS.
Tools that need a provider that is not configured say so and suggest what to configure.
Runbooks (start here)
Tool | Answers |
| "Why is X broken or slow?" Ranked hypotheses with evidence: OOM, crash loops, scheduling, probe failures, image pulls, no endpoints, CPU throttling, JVM pressure, pool exhaustion, slow downstreams, log error clusters, elevated error rate, recent changes, config smells. |
| Latency-focused: per-endpoint latency, throttling, GC, HikariCP, thread pool/lock/deadlock, downstream latency, proxy 504/499. |
| A slow Angular route: TTFB vs render split, bundle and caching, browser-side API latency vs service-side metrics, CLS/INP. |
| The maintenance digest: unhealthy pods, restarts, warnings, resource pressure, HPA at max, node pressure, endpoint problems, missing NetworkPolicies, security findings, TLS gaps, suggested actions. |
Orientation
list_providers, list_namespaces, list_workloads, get_topology (Service → pods → workloads plus
dependencies inferred from env/ConfigMap references and probe-observed connections),
get_service_overview.
Health and state
get_pod_status, get_events (deduplicated, warnings first), get_logs (sanitized, capped,
previous=true for the crashed container, grep accepts /regex/i), summarize_log_errors
(groups by signature; Java stack traces by exception class + first application frame),
get_config (resolved env with secret references, probes, resources, mounts, and findings such as
-Xmx larger than the memory limit), get_rollout_history (revision diffs), what_changed (one
timeline of rollouts, scaling, HPA actions, ConfigMap updates, restarts, notable events).
Performance
get_resource_pressure (usage vs requests/limits, CFS throttling ratio via Prometheus, OOM kills),
compare_replicas (hot pod, leak, stuck rollout, no node spread), get_node_pressure,
get_hpa_status, get_golden_signals, query_metrics (raw PromQL, compacted),
find_slow_traces and get_trace (Datadog APM today; Tempo/Jaeger would be another provider).
Connectivity
get_endpoints (selector mismatches, targetPort vs containerPort), get_network_policies,
get_ingress_routes, [probe] get_open_connections (TIME_WAIT/CLOSE_WAIT storms, connections per
destination resolved to Services), [probe] get_listening_ports, [probe, ACTIVE] resolve_dns,
[probe, ACTIVE] check_connectivity (with a diagnosis: refused vs timeout vs DNS),
[probe] get_process_stats (fd count vs limit, threads, zombies).
Java / Spring Boot
[probe] get_jvm_health, [probe] get_thread_dump_summary (deadlock detection, pool saturation,
lock contention, top stacks; never the raw dump), [probe] get_connection_pool_status (HikariCP),
get_endpoint_metrics, [probe] get_outbound_client_metrics (http.client.requests by target),
[probe] get_actuator_health, get_jvm_config.
Proxy / Angular
[probe] get_proxy_status, [probe] summarize_access_log (status classes, p50/p95 per path,
per-upstream 504s, 499s meaning clients gave up, proxy-vs-upstream gap, scanner-like paths,
sensitive data in the log), get_proxy_config_summary (lints the nginx ConfigMap: timeouts,
buffering, gzip, cache headers for hashed chunks vs index.html, security headers, rate limits),
[probe] get_static_bundle_stats, [ACTIVE] check_security_headers.
Real-user monitoring
[probe RUM] get_web_vitals (p75/p95 per route with Google's good/needs-improvement/poor ratings),
get_page_views, get_page_load_breakdown (Navigation Timing phases), get_browser_api_latency
(browser-observed latency per API path, to compare with proxy and service numbers),
get_frontend_errors.
Security
security_posture (privileged, root, host namespaces, capabilities, seccomp, writable rootfs,
secrets as env, unpinned images, no limits, SA token automount, missing NetworkPolicy, over-privileged
RBAC; severities critical..info), get_exposure (LoadBalancer/NodePort, Ingress with/without TLS,
management paths exposed), get_rbac_for_workload, get_secret_usage (names and keys only),
get_tls_status, scan_logs_for_sensitive_data, [probe] get_egress_destinations (public
internet and cloud-metadata destinations flagged), get_image_inventory.
Signal providers
The runbooks need a few signals: resource usage, golden signals, log search, slow traces, web
vitals. Where they come from is a deployment detail behind
src/providers/types.ts. The registry asks providers in priority order
and reports which one answered.
Provider | Configured by | Provides |
| always | resource usage from metrics-server; golden signals from Micrometer via the probe (cumulative since JVM start, so p50 is the mean and p99 the max); log search from pod logs |
|
| windowed golden signals ( |
|
| golden signals and per-resource breakdown from APM trace metrics ( |
|
| log search over your Kubernetes index via oneshot SPL; golden signals computed with |
Providers are tried in order: Prometheus, Datadog, Splunk, native. Each tool result names the
provider that answered. list_providers shows what is configured and whether it is reachable
(Datadog: /api/v1/validate; Splunk: /services/server/info).
Datadog knobs. DIAG_DATADOG_SCOPE=env:prod adds tags to every query. DIAG_DATADOG_APM_OPERATION
is the span name whose trace metrics carry request rate and latency: servlet.request (default)
for Java/Spring, http.request for most others. DIAG_DATADOG_SERVICE_TAG / DIAG_DATADOG_NAMESPACE_TAG
default to service / kube_namespace. DIAG_DATADOG_RUM_APPLICATION filters RUM to one app.
DIAG_DATADOG_LOG_INDEXES limits log search. Keys never leave the hub; the model sees only results.
Splunk knobs. DIAG_SPLUNK_INDEX, DIAG_SPLUNK_NAMESPACE_FIELD / DIAG_SPLUNK_SERVICE_FIELD
(defaults namespace / container_name, the Splunk Connect for Kubernetes names; OpenTelemetry
collectors use k8s.namespace.name / k8s.container.name), DIAG_SPLUNK_AUTH_SCHEME=Splunk for a
session key instead of an authentication token, DIAG_SPLUNK_VERIFY_TLS=false for a self-signed
management port, and DIAG_SPLUNK_REQUEST_*_FIELD for the status/duration/path/method field names in
your request logs (defaults match the fault lab's nginx JSON log). Splunk Observability Cloud
(SignalFlow, APM) is a different API and is not implemented.
Caveat. Both providers were written against the documented REST request/response shapes and are pinned by unit tests with a mocked HTTP layer, but they have not been exercised against a live Datadog org or Splunk instance from this environment. The first real run may need a tag or field name adjusted; every one of them is an env var. If you can reach the official Datadog or Splunk MCP servers, run them alongside this one for ad-hoc exploration; this server's providers exist so the runbooks can pull the few signals they need.
Real-user monitoring
[probe RUM] get_web_vitals (p75/p95 per route with Google's good/needs-improvement/poor ratings),
get_page_views, get_page_load_breakdown (Navigation Timing phases), get_browser_api_latency
(browser-observed latency per API path, to compare with proxy and service numbers),
get_frontend_errors.
Security
security_posture (privileged, root, host namespaces, capabilities, seccomp, writable rootfs,
secrets as env, unpinned images, no limits, SA token automount, missing NetworkPolicy, over-privileged
RBAC; severities critical..info), get_exposure (LoadBalancer/NodePort, Ingress with/without TLS,
management paths exposed), get_rbac_for_workload, get_secret_usage (names and keys only),
get_tls_status, scan_logs_for_sensitive_data, [probe] get_egress_destinations (public
internet and cloud-metadata destinations flagged), get_image_inventory.
Signal providers
The runbooks need a few signals: resource usage, golden signals, log search, slow traces, web
vitals. Where they come from is a deployment detail behind
src/providers/types.ts. The registry asks providers in priority order
and reports which one answered.
Provider | Configured by | Provides today |
| always | resource usage from metrics-server; golden signals from Micrometer via the probe (cumulative since JVM start, so p50 is the mean and p99 the max); log search from pod logs |
|
| windowed golden signals ( |
|
| placeholder: validates config, reports "not implemented". The intended API mapping is documented in |
|
| placeholder, same shape, in |
Why placeholders: in the environment this was built for, the Datadog and Splunk endpoints (and their official MCP servers) are not reachable yet. When they are, implementing a provider is filling in the methods of one class; nothing in the tools changes. If you can reach the official Datadog or Splunk MCP servers, run them alongside this one: they cover ad-hoc log/metric/trace exploration far more completely, and this server covers what they do not (cluster state, in-pod view, runbooks, security posture).
Real-user monitoring
rum-client/ is a ~3 KB browser package built on Google's web-vitals. It collects
LCP, INP, CLS, FCP, TTFB, Navigation Timing phases, SPA route views, same-origin API timings, and JS
errors, and beacons them to /__rum, which nginx forwards to the probe in the same pod. See
rum-client/README.md for the Angular Router hook.
Privacy by construction: routes are reported as patterns (/products/:id), query strings and
fragments are dropped, there are no cookies and no user identifiers, the session id lives in
sessionStorage, and the probe's ingest accepts an allow-list of fields and discards everything
else. Aggregates are kept in memory for DIAG_PROBE_RUM_RETENTION_MINUTES (default 6 h) and
exported as Prometheus metrics (rum_web_vital, rum_page_views_total,
rum_frontend_errors_total, rum_sessions) for long-term retention.
If you already run Datadog RUM, you do not need this client: when no probe has RUM data, the RUM
tools fall back to the Datadog provider, which computes the same summaries from RUM view and error
events (route grouping uses @view.url_path_group).
The fault lab
faultlab/ is a small but realistic stack: an Angular 20 app behind nginx, two Spring
Boot 3.5 services (Java 21, JPA, Actuator, Micrometer), and Postgres 16 with pg_stat_statements and
a read-only role for postgres-readonly-mcp. It carries 29 deliberately injected faults
(CPU throttling, -Xmx above the memory limit, a memory leak that ends in OOMKilled, HikariCP pool
exhaustion, an N+1 query, a Java deadlock, a Service selector that matches nothing, no
NetworkPolicy, a root container with a literal password in env, wildcard RBAC on Secrets, a liveness
probe on the wrong path, proxy_read_timeout 2s producing 504s, no cache headers, source maps in
prod, a 3.4 MB hero image without dimensions, an 800 ms busy loop in a route, PII in logs, ...).
Every fault is listed in faultlab/README.md with its symptom, and marked in
source with FAULT/FIX comments.
kind create cluster --config deploy/kind/kind-config.yaml
kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml
kubectl -n kube-system patch deploy metrics-server --type=json \
-p='[{"op":"add","path":"/spec/template/spec/containers/0/args/-","value":"--kubelet-insecure-tls"}]'
# hub + probes share one probe token; the hub token is what MCP clients present
export HUB_TOKEN=$(openssl rand -hex 32) PROBE_TOKEN=$(openssl rand -hex 32)
docker build -t kube-diagnostics-mcp:dev . && kind load docker-image --name kube-diag kube-diagnostics-mcp:dev
kubectl kustomize deploy/hub \
| sed -e "s/REPLACE_WITH_RANDOM_HUB_TOKEN/$HUB_TOKEN/" -e "s/REPLACE_WITH_RANDOM_PROBE_TOKEN/$PROBE_TOKEN/" \
-e "s|ghcr.io/ranson21/kube-diagnostics-mcp:0.1.0|kube-diagnostics-mcp:dev|" \
| kubectl apply -f -
kubectl -n kube-diagnostics set env deploy/kube-diagnostics-hub DIAG_ALLOW_ACTIVE_CHECKS=true DIAG_DEFAULT_NAMESPACE=faultlab
make -C faultlab build load # ~5 min cold: Maven and Angular build inside Docker
make -C faultlab deploy # applies faultlab/k8s-probe: the lab + probe sidecars + RUM (uses $PROBE_TOKEN)
open http://localhost:30080/ # click around to generate RUM data (in a visible window: hidden tabs never paint)
make -C faultlab load-test DURATION=120
kubectl -n kube-diagnostics port-forward svc/kube-diagnostics-hub 8090:8090 &
SMOKE_URL=http://localhost:8090/mcp SMOKE_TOKEN=$HUB_TOKEN npx tsx scripts/smoke.ts faultlabThe smoke script calls 35 tools and prints compact results. It talks to the in-cluster hub because
kind pod IPs are not routable from the host, and the probe-backed tools need to reach podIP:9911.
Without SMOKE_URL it spawns a local stdio hub instead, which is fine for everything that only
needs the API server.
What the runbooks find in the lab, unprompted: HikariCP acquisition timeouts and 5-second
connection holds on order-service; the -Xmx900m vs 512 MiB mismatch and a 1-CPU JVM on
catalog-service; per-endpoint p95s for /reviews (N+1) and /products/slow; 504s per upstream at
the proxy with proxy_read_timeout 2s; 16 card numbers and 16 emails in the catalog logs;
reviews-service with zero endpoints; wildcard RBAC on Secrets for the order-service
ServiceAccount; no NetworkPolicy; source maps and a 3 MiB hero image in the served build; poor LCP
and CLS on /products/:id and poor INP on /checkout from RUM.
Configuration reference
All configuration is environment variables. See .env.example.
Variable | Default | Meaning |
|
|
|
|
| hub: |
|
| hub HTTP bind |
| bearer token MCP clients must present (required for http unless | |
| all | comma-separated allow-list; lists are then done per namespace, so a namespaced Role suffices |
| used when a tool call omits | |
|
| enable DNS/TCP/HTTP/TLS checks that generate traffic |
|
| per-pod log fetch caps |
|
| per-tool result cap |
|
| how the hub finds probes |
| shared hub↔probe token | |
|
| call timeouts |
| Prometheus provider | |
| see Signal providers | |
|
|
|
probe: |
Development
npm ci
npm run typecheck
npm test # vitest: sanitizer, scanner, guard, config, /proc/net parsing, access log, RUM, thread dumps, nginx conf, model
npm run dev # stdio hub against your current kubeconfig
DIAG_MODE=probe DIAG_PROBE_ALLOW_UNAUTHENTICATED=true npm run dev # a local probe on :9911
npx tsx scripts/smoke.ts <namespace> [tool ...] # end-to-end against a clusterLayout mirrors the sibling projects: src/security/ (guard, sanitize, sensitive), src/k8s/
(read-only client), src/probe/ (sidecar server, /proc/net, access log, RUM aggregator, hub-side
client), src/providers/ (signal providers), src/hub/tools/* (one file per tool group),
src/hub/runbooks.ts, src/hub/server.ts (registration), src/hub/transport/http.ts.
Design notes and limits
Hub + probe, not sidecar-only. A sidecar alone sees one pod. Cross-service questions (topology, rollouts, events, endpoints, RBAC) need the API server, so the MCP server is a hub and the sidecar is a thin probe the hub fans out to. The hub works without any probes.
Micrometer's default meters are cumulative. Without Prometheus,
get_golden_signalsreports mean and max since JVM start and says so. ConfigureDIAG_PROMETHEUS_URLfor windowed percentiles./proc/netis a snapshot.get_open_connectionsandget_egress_destinationssee sockets that exist at that instant. Short-lived connections between calls are not seen.Static bundle stats need a shared volume. Containers do not share filesystems; the fault lab copies the build into an emptyDir with an init container. In production, serve from a volume or skip that tool.
No Secret contents, ever.
get_tls_statustherefore cannot read certificates from Secrets; with active checks it performs a TLS handshake against a host you name instead.Tracing is provider-only.
find_slow_traces/get_traceneed Datadog APM (implemented) or a future Tempo/Jaeger provider; without one they return guidance.Pattern matching has false positives. The sensitive-data scanner labels confidence per kind and keeps the phone-number detector deliberately narrow.
License
Apache-2.0. See LICENSE.
Available Tools
57 toolscheck_connectivityB
[probe, ACTIVE] TCP connect from inside the pod to host:port with latency and a diagnosis of the failure mode. Requires DIAG_ALLOW_ACTIVE_CHECKS.
| Name | Required | Description | Default |
|---|---|---|---|
| pod | No | Exact pod name (alternative to service) | |
| host | Yes | ||
| port | Yes | ||
| service | No | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses that this is an active probe (ACTIVE), that it runs from inside the pod, and that it requires a special permission flag. However, with no annotations provided, it does not disclose side effects, timeouts, or whether the connection attempt could trigger alarms or resource usage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single dense sentence that front-loads the core action and permission requirement. It is concise and avoids filler, though the bracketed '[probe, ACTIVE]' prefix is slightly cryptic.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 5-parameter tool with no output schema and no annotations, the description covers the core action and permission but does not explain how pod vs service selection works, what the diagnosis output looks like, or what failure modes are reported. It is adequate but has clear gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 60%, and the description adds context for host and port (the target of the TCP connect) but does not clarify the relationship between pod and service parameters, nor the namespace requirement beyond what the schema already says. The description adds some meaning but leaves ambiguity about mutually exclusive or alternative parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('TCP connect') and resource ('host:port from inside the pod'), and adds latency and failure-mode diagnosis. It is distinguishable from siblings like resolve_dns and get_open_connections, though it does not explicitly name a sibling alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies an active network diagnostic use case and mentions a required permission (DIAG_ALLOW_ACTIVE_CHECKS), but it does not explicitly state when to prefer this over alternatives like resolve_dns or get_endpoints, nor when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_security_headersB
[ACTIVE] GET a URL from the hub and report missing security headers, version disclosure, cookie flags, HTTP->HTTPS redirect. Requires DIAG_ALLOW_ACTIVE_CHECKS.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description bears the burden of behavioral disclosure. It discloses that the tool performs an active GET and requires a specific permission, which is useful. However, it does not mention potential side effects, failure modes, rate limits, or what exactly happens when the URL is unreachable. The description gives partial transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that efficiently conveys the tool's function, the required permission, and the checks performed. No fluff, and the core purpose is front-loaded. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has one parameter, no output schema, and no annotations. The description lists the categories of findings (missing headers, version disclosure, etc.), which gives a reasonable idea of the output. However, it does not specify the return format, success/error behavior, or how results are presented, leaving some gaps for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It clarifies that the 'url' parameter is the URL to fetch from the hub, but adds little beyond that. It does not explain URL format expectations, restrictions, or how the URL relates to the hub. Minimal semantic value added.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific action: GET a URL and report missing security headers, version disclosure, cookie flags, and HTTP->HTTPS redirect. This is a specific verb and resource with concrete checks. However, it does not explicitly distinguish itself from security-related siblings like security_posture or get_tls_status, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus alternatives. The only added note is the permission requirement (DIAG_ALLOW_ACTIVE_CHECKS), which is a prerequisite, not a usage signal. There is no mention of when this check is appropriate compared to passive checks or other security tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
compare_replicasA
Is one replica the outlier? Per-pod usage, restarts, node, revision hash; flags hot pods, leaks, stuck rollouts, and no node spread.
| Name | Required | Description | Default |
|---|---|---|---|
| service | Yes | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It lists the specific dimensions inspected and the conditions it flags, giving an agent a strong sense of what the tool analyzes and surfaces. It does not explicitly state that it is read-only or side-effect-free, but the compare-and-flag framing strongly implies a diagnostic read operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise while remaining informative. The front-loaded question captures the primary use case immediately, and the second sentence packs the comparison dimensions and flag categories with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with only two parameters, thorough schema coverage, and no output schema, the description gives enough context to know when and how to invoke it. It communicates the comparison dimensions and potential findings. Minor ambiguity remains around terms like 'usage' and 'leaks', but these are acceptable domain terms.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%: both `service` and `namespace` have clear descriptions in the schema. The tool description adds workload/replica context but does not materially extend the parameter semantics beyond what the schema already provides, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool's purpose: determining whether one replica is an outlier by examining per-pod usage, restarts, node, and revision hash, and flagging issues like hot pods, leaks, stuck rollouts, and missing node spread. It is specific enough to be distinguished from general pod-status tools, but it does not explicitly name a sibling tool for differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The opening question 'Is one replica the outlier?' implies a clear use case for this tool, and the rest of the description reinforces when it would be helpful. However, it does not explicitly provide when-to-use/when-not-to-use guidance or mention alternative sibling tools such as get_pod_status or diagnose_service.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
diagnose_serviceA
RUNBOOK: status -> events -> resources/throttling -> OOM/crash -> endpoints -> JVM/pool/downstreams -> log errors -> golden signals -> recent changes. Returns ranked hypotheses with evidence and the next tool to run. Start here for 'why is X broken/slow?'.
| Name | Required | Description | Default |
|---|---|---|---|
| window | No | Time window like 15m, 2h, 1d (default 30m) | |
| service | Yes | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the behavioral disclosure burden. It clearly describes the ordered runbook, the ranked-hypothesis output, and the fact that it returns a next tool to run. It does not explicitly mention side effects or cost, but the diagnostic framing strongly implies a read-only analysis wrapper.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact: a dense but meaningful runbook list followed by the output contract and usage trigger. Every sentence adds information, there is no filler, and the key 'Start here' guidance is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Even without an output schema, the description tells the agent what to expect (ranked hypotheses, evidence, and next tool), when to invoke it, and what diagnostic path it follows. Combined with full schema coverage for the three parameters, an agent has enough context to invoke the tool correctly and interpret its result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with service, window, and namespace already documented in the input schema. The tool description adds no parameter-level detail beyond the runbook's conceptual categories, so the baseline score of 3 is appropriate since the schema handles the semantic load.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states exactly what the tool produces: ranked hypotheses with evidence and a recommendation for the next tool to run. The 'Start here for why is X broken/slow?' phrase clearly frames it as a diagnostic entry point, distinguishing it from the many sibling get_* tools that fetch individual signals.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Start here' gives explicit when-to-use guidance for service health or performance questions, and the runbook indicates it orchestrates a sequence of diagnostic steps. It does not enumerate specific when-not-to-use cases or name alternatives, but the context is clear enough for an agent to route appropriately.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
diagnose_slow_pageB
RUNBOOK for a slow frontend route: vitals -> TTFB vs render split -> bundle/caching -> browser API latency -> service metrics. Pass proxy_service (nginx workload) and api_service.
| Name | Required | Description | Default |
|---|---|---|---|
| route | Yes | ||
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) | |
| api_service | No | ||
| proxy_service | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the full burden of behavioral disclosure. It reveals that the tool performs a sequence of diagnostic steps (a runbook), implying it aggregates multiple metrics and likely performs read-only checks. However, it does not explicitly state that it is read-only, whether it makes any external calls, or what the output format is. The structured process is disclosed but not the full behavioral profile.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that efficiently conveys the purpose and the required parameters. It is concise with no redundant information. However, the structure is a dense runbook summary that could benefit from breaking out the steps more clearly, though it remains appropriately short.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a complex diagnostic tool that orchestrates multiple checks, yet the description provides no information about the expected output, how to interpret results, or the full meaning of all parameters. With no output schema and low parameter coverage, the description is insufficient for an agent to know what to expect after invocation or how to use the tool effectively beyond the basic purpose.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 25%, with only the 'namespace' parameter having a description. The tool description adds semantic value for 'proxy_service' by noting it is an nginx workload, and implies 'api_service' is the backend API service. However, it does not clarify the required 'route' parameter or provide further detail on 'namespace'. Given the low schema coverage, the description partially compensates but leaves gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it is a runbook for diagnosing slow frontend routes, listing the diagnostic steps (vitals, TTFB vs render split, bundle/caching, browser API latency, service metrics). It distinguishes itself from backend-focused tools by explicitly mentioning 'frontend route'. However, it does not name any sibling tools directly, so differentiation is implicit rather than explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description instructs the user to 'Pass proxy_service (nginx workload) and api_service', which gives a hint about required inputs. It implies usage for slow frontend routes but does not explicitly state when to use this tool versus the individual metrics tools (e.g., get_web_vitals, get_page_load_breakdown) or exclude cases. No explicit alternatives or when-not-to-use guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
diagnose_slow_requestsA
RUNBOOK for latency: per-endpoint latency, throttling, GC, connection pool, thread pool/locks, downstreams, proxy timeouts (pass proxy_service for the user-facing view).
| Name | Required | Description | Default |
|---|---|---|---|
| window | No | Time window like 15m, 2h, 1d (default 30m) | |
| service | Yes | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) | |
| proxy_service | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It does a good job by listing what the tool examines across multiple layers (GC, connection pool, thread pool/locks, downstreams, proxy timeouts), giving an agent an accurate picture of scope. It does not state whether it is read-only or how results are structured, but for a diagnostics tool the coverage enumeration provides solid transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single dense sentence front-loads the purpose ('RUNBOOK for latency') and then packs the coverage areas into a comma-separated list. The proxy_service guidance is placed last, which is slightly off as it is an important conditional, but overall there is no wasted text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a complex runbook-style diagnostic with no output schema and no annotations, so the description must compensate. The enumerated coverage areas are informative, but the description does not clarify what the runbook returns (a report? structured findings?), how to proceed through steps, or what output shape an agent should expect. For a tool of this complexity, the description is adequate but leaves the output contract unstated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 75%, so the schema already documents service, window, and namespace. The description adds genuine meaning to proxy_service, which has no schema description, by explaining it switches to the user-facing view. However, it does not elaborate on window format or the interplay of the parameters beyond the schema, so it adds value only marginally above baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description leads with 'RUNBOOK for latency' and enumerates the exact analysis dimensions (per-endpoint latency, throttling, GC, connection pool, thread pool/locks, downstreams, proxy timeouts). This clearly distinguishes it from narrow siblings like get_endpoint_metrics, get_thread_dump_summary, and get_connection_pool_status, which each cover only one slice, while diagnose_slow_requests is the aggregate diagnostic.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description conveys that this is a runbook for latency diagnosis, which implies it is the first stop when requests are slow, but it never explicitly says when not to use it or names alternative tools (e.g., find_slow_traces for trace-level, diagnose_service for a broader service check). The proxy_service hint ('for the user-facing view') is the only conditional routing guidance present.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
find_slow_tracesB
Slowest traces for a service from the tracing provider (none configured yet: returns guidance).
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| window | No | Time window like 15m, 2h, 1d (default 1h) | |
| service | Yes | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) | |
| min_duration_ms | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it responsibly discloses a key behavior: if no tracing provider is configured, the tool returns guidance instead of actual traces. This goes beyond the surface meaning and helps set expectations, though it doesn't specify what the guidance contains.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that states the core purpose first and appends the caveat in parentheses. No filler words or redundant phrases.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no annotations, no output schema, and 5 parameters, but the description does not explain expected return format, possible values of 'guidance', or the semantics of limit and min_duration_ms. An agent would need to call it blindly or rely on the schema, which is not sufficient for a complex tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds little beyond the schema. It mentions 'for a service', which duplicates the service parameter description, and 'slowest' hints at ordering, but does not explain limit, window, min_duration_ms, or namespace. With schema coverage at 60% and no descriptions for some params, the description doesn't compensate for the undocumented ones.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb-resource pairing: it returns the slowest traces for a given service from the tracing provider. It also communicates the current state (none configured), which makes the tool's behavior clear even if siblings are not explicitly named.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to choose this tool over siblings like get_trace or diagnose_slow_requests. The parenthetical about returning guidance is more of a behavioral caveat than a usage rule, and no conditions or exclusions are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_actuator_healthB
[probe] Actuator /health with component detail (db, diskSpace, redis, custom indicators).
| Name | Required | Description | Default |
|---|---|---|---|
| pod | No | Exact pod name (alternative to service) | |
| service | No | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the burden of behavioral disclosure. It discloses that it probes the actuator /health endpoint and shows component detail, which is useful. However, it does not mention what happens on failure, whether it requires authentication, likely response format, or if it could be slow due to multiple indicator calls. It also does not note that 'pod' and 'service' are alternatives, which is implied by the schema. The disclosure is minimal but not misleading, so a 3 is fair.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is concise and directly states the core function. The '[probe]' prefix is unusual but adds a signal for the agent that this is a probing action. No fluff or unnecessary detail. It is appropriately sized and front-loaded with the action and endpoint.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (3 parameters, no output schema), the description is somewhat incomplete. It does not explain how to choose between pod and service, nor does it mention that namespace is required even though it is marked as not required in the schema (but described as required in parentheses). The description covers the 'what' but not the 'how' or 'when' edges. For an agent to choose this among 40+ siblings, it needs a bit more context on when this is the go-to tool versus get_jvm_health or get_connection_pool_status. So a 3 is appropriate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with detailed descriptions for each parameter (pod, service, namespace). The description adds the context of which components will be checked, which could influence which parameters to use (e.g., service might be more suitable for deployments). However, it does not explain the relationship or priority between pod and service (e.g., which takes precedence), so it adds modest value beyond the schema's already thorough documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool calls the actuator /health endpoint and lists the specific components (db, diskSpace, redis, custom indicators). It distinguishes it from sibling health tools like get_jvm_health which focuses on JVM, and health_report which is a broader diagnostic. However, it does not explicitly differentiate from similar health checks like get_connection_pool_status, but the endpoint-specific phrasing is clear enough.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage: when you need health details from the actuator endpoint, particularly for DB, disk, Redis, and custom indicators. However, it does not provide explicit guidance on when to prefer this over other health-related tools (e.g., get_jvm_health, health_report, get_connection_pool_status). The naming and description suggest it, but it is not explicitly stated, and there is no mention of prerequisites such as needing a metrics endpoint or using list_namespaces first.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_browser_api_latencyB
[probe RUM] Browser-observed latency per API endpoint and slowest assets; compare with service-side and proxy-side numbers to localize slowness.
| Name | Required | Description | Default |
|---|---|---|---|
| route | No | ||
| service | No | Proxy workload whose probe ingests RUM (auto-discovered if omitted) | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It reveals it is a 'probe RUM' and that it returns browser-observed latency, but does not disclose potential side effects, response format, pagination, or whether it is read-only (though 'get' implies it). It also does not mention any prerequisites like namespace availability. The description adds minimal behavioral context beyond what the name and schema already imply.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, compact sentence that front-loads the probe context and clearly states the deliverable and comparison purpose. There is no redundant wording, and every clause contributes to understanding the tool's function. It is efficient and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with three parameters, no output schema, and no annotations, the description is sparse. It does not explain return format, how 'slowest assets' are defined, or the necessity of providing namespace (schema hints at it but description does not). It also omits any mention of the 'route' parameter, leaving agents to guess its role. The description is insufficient for confident invocation without further inference.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 67%, with route lacking a description. The tool description does not elaborate on any parameters; it only mentions 'per API endpoint' which loosely maps to route but adds no concrete details. It does not compensate for the missing route documentation or clarify how service and namespace interplay. The description adds little value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool provides browser-observed latency per API endpoint and slowest assets, and its purpose of comparing with service-side and proxy-side numbers to localize slowness. This differentiates it from sibling tools like get_endpoint_metrics, though it does not explicitly name alternatives. The verb 'get' is implicit but the resource and intent are unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when you need to localize slowness by comparing browser-side numbers with service/proxy data, giving a clear context. However, it does not explicitly state when not to use it or name alternative tools for different contexts (e.g., service-side latency). The guidance is present but not fully explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_configA
Resolved configuration of a workload: env (secret-sourced values shown as references, credential-looking keys redacted), ConfigMap previews, probes, resources, mounts, security context, plus findings (secrets in env, missing probes, JVM heap vs limit...).
| Name | Required | Description | Default |
|---|---|---|---|
| service | Yes | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses important behaviors: secret-sourced values shown as references, credential-looking keys redacted, and findings (secrets in env, missing probes, JVM heap vs limit). This goes beyond a simple 'get' and explains what the agent can expect, including security handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, dense sentence that front-loads the main purpose ('Resolved configuration of a workload') and then enumerates the content categories. It is efficient with no fluff, though the list is long and somewhat packed. Still, it's well-structured for scanning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given there's no output schema, the description explains what the result contains (env, ConfigMap previews, probes, etc.) and how sensitive data is handled. It covers the core information an agent needs to invoke the tool correctly. It doesn't mention potential errors or access requirements, but for a config retrieval tool this is reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with both parameters clearly described in the schema (workload name and namespace). The tool description adds no additional semantics beyond listing config categories; it doesn't clarify parameter usage beyond what's already in the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns the resolved configuration of a workload, listing specific components (env, ConfigMap previews, probes, resources, mounts, security context, findings). This is a specific verb+resource that distinguishes it from more narrow siblings like get_jvm_config or get_proxy_config_summary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. It mentions 'see list_namespaces' for the namespace parameter, but doesn't indicate when to choose get_config over get_service_overview or get_jvm_config. The description implies it's for full config inspection, but doesn't state exclusions or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_connection_pool_statusB
[probe] HikariCP active/idle/pending/max, acquire and usage times, timeouts. Pool exhaustion is the #1 Java+DB slowness cause.
| Name | Required | Description | Default |
|---|---|---|---|
| pod | No | Exact pod name (alternative to service) | |
| service | No | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description bears the full burden of behavioral disclosure. It labels itself a '[probe]', suggesting a read-only operation, but does not state whether it requires special permissions, is expensive, or what the response shape is. It lists metrics but lacks details on side effects or limitations, leaving the agent to infer safety.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the key metrics. The additional note about pool exhaustion being a common cause adds diagnostic context without being verbose. It is appropriately concise and structured, though the second clause could be seen as slightly optional.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple probe with three optional parameters and no output schema, the description is mostly sufficient. However, it does not explain how the parameters interact (e.g., whether pod or service is preferred) or describe the return format. Given the absence of an output schema and annotations, more detail on expected response structure would improve completeness. It is adequate but has clear gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all three parameters (pod, service, namespace) have individual descriptions. The tool description does not add any additional parameter context beyond what the schema already provides. It does not clarify when to use 'pod' versus 'service', but the schema descriptions themselves are adequate. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves HikariCP connection pool metrics (active/idle/pending/max, acquire/usage times, timeouts), making its purpose evident. It distinguishes from generic health tools by focusing on the connection pool, though it doesn't explicitly name alternatives. The verb is implicit but the resource and metrics are specific.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The note 'Pool exhaustion is the #1 Java+DB slowness cause' implies this tool is for diagnosing DB slowness, providing some context. However, it does not explicitly state when to use this tool versus alternatives like get_jvm_health or diagnose_slow_requests, nor does it mention exclusions. The guidance is implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_egress_destinationsB
[probe] Where a pod currently talks to, classified (cluster service/pod, private, PUBLIC INTERNET, cloud metadata). Exfil and unexpected-dependency signal.
| Name | Required | Description | Default |
|---|---|---|---|
| pod | No | Exact pod name (alternative to service) | |
| service | No | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. 'Currently talks to' implies a snapshot, and the categories hint at output content, but the description does not disclose whether this is a read-only operation, what data source is used, whether permissions are needed, or what the return shape is.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two short clauses that state the purpose and the classifications, with no filler or redundant content. The key scoping information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no output schema and no annotations, the description should explain more about what the caller receives and how to choose parameters. It conveys the core idea and classification dimensions, but leaves the return format, parameter relationships, and behavioral expectations unspecified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameters are already well documented. The description adds no parameter-specific details beyond the schema, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the resource ('a pod') and the behavior ('where it currently talks to') and adds a useful classification scheme (cluster service/pod, private, PUBLIC INTERNET, cloud metadata). This distinguishes it from generic connectivity tools, though it does not explicitly name a sibling alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Exfil and unexpected-dependency signal' provides implied usage context for security and dependency investigations. However, it does not explicitly state when to use this tool versus alternatives like get_outbound_client_metrics or get_open_connections, nor does it describe exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_endpoint_metricsC
[probe/Prometheus] Per-endpoint request rate, error rate, and latency (http.server.requests).
| Name | Required | Description | Default |
|---|---|---|---|
| window | No | Time window like 15m, 2h, 1d (default 15m) | |
| service | Yes | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It only mentions the Prometheus source and metric name, but omits details like aggregation semantics, pagination, limits, or whether results are raw or summarized. No side effects or prerequisites are mentioned.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence with a clear tag indicating the data source. It is front-loaded with the purpose and avoids unnecessary fluff. Could be slightly more structured but remains efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no output schema and only a high-level description, the agent lacks clarity on what 'endpoint' means (e.g., path, method), how metrics are aggregated, or how to interpret latency percentiles. The description is too sparse to fully guide correct invocation and interpretation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description does not elaborate on parameters; it only describes the output. The schema already explains service and window, and namespace references list_namespaces. No additional value is added by the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool provides per-endpoint request rate, error rate, and latency, with the metric source (http.server.requests). This is specific and distinguishes it from outbound or frontend metrics, though it doesn't explicitly contrast with get_golden_signals or query_metrics.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus alternatives like query_metrics or get_golden_signals. There are no exclusions or context hints about typical scenarios, leaving the agent to infer suitability.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_endpointsB
Service -> EndpointSlice: matching pods, ready endpoints, targetPort vs containerPort mismatches. Catches the classic 'selector matches nothing'.
| Name | Required | Description | Default |
|---|---|---|---|
| service | No | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavioral traits. It mentions the kind of information returned (matching pods, ready endpoints, port mismatches) but does not state whether it is read-only, any potential limitations (e.g., no pagination, large result sets), or any side effects. The description is minimal and leaves the agent without a clear safety profile.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no wasted words. It front-loads the core purpose and uses concise Kubernetes terminology. It is efficient and clear, though it could benefit from a structured format for the different pieces of information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple diagnostic tool with 2 parameters and no output schema, the description provides enough to understand what the tool returns (matching pods, ready endpoints, port mismatches). However, it lacks explicit usage guidance and does not mention any failure modes or interpretation notes, making it adequate but not fully comprehensive for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description does not add any extra meaning to the parameters beyond what the schema already provides (service and namespace descriptions are already explicit). It correctly relies on the schema for parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action (Service -> EndpointSlice) and lists the exact data it provides (matching pods, ready endpoints, targetPort vs containerPort mismatches). It clearly distinguishes itself from siblings like get_endpoint_metrics (metrics) and get_pod_status (pod status) by focusing on endpoint slice health and selector matching.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for diagnosing selector mismatches ("Catches the classic 'selector matches nothing'") but does not explicitly state when to use this tool over alternatives like diagnose_service or get_service_overview. It gives a clear context hint but lacks exclusions or comparisons to sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_eventsA
Kubernetes events, warnings first, deduplicated with counts. Filter by object name prefix.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| since | No | Time window like 15m, 2h, 1d (default 1h) | |
| object | No | Object name prefix (e.g. a deployment or pod name) | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) | |
| warnings_only | No | Default true |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Since there are no annotations, the description carries the behavioral burden and meaningfully discloses ordering ('warnings first') and aggregation ('deduplicated with counts'). It does not describe return shape or how deduplication keys are chosen, but the core behavioral contract is visible.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two information-dense sentences with no filler; the primary behavior is front-loaded and each phrase ('warnings first', 'deduplicated with counts', 'filter by object name prefix') adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 5-parameter tool with no output schema and no annotations, the description plus schema is adequate for a basic call: namespace, time window, filtering, and warnings-only default are covered. It leaves limit behavior and return format implicit, so an agent has to infer some details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 80%, so most parameter meaning is already in the input schema. The description restates the object-prefix filter but adds no semantics for limit, since, namespace, or warnings_only beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies the resource as 'Kubernetes events' and adds distinctive behavior ('warnings first, deduplicated with counts'), which separates it from log/error/metric siblings. It lacks an explicit verb beyond the tool name, so it stops short of a fully specified verb+resource definition.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The only guidance is 'Filter by object name prefix', which addresses how to narrow results rather than when to choose this tool. It never names alternatives such as get_logs or summarize_log_errors, nor does it give exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_exposureA
What is reachable from outside: LoadBalancer/NodePort Services, Ingress routes (TLS or not), hostNetwork pods, management paths exposed.
| Name | Required | Description | Default |
|---|---|---|---|
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It discloses the scope of the result by listing what is included, but it does not explicitly state that the operation is read-only, whether namespace is effectively required, or any caveats about visibility limits. The get prefix and category list add some transparency but leave room for assumptions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, densely informative fragment: the leading phrase 'What is reachable from outside' immediately frames the tool, and each listed item contributes distinct scope with no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter tool with no output schema, the description conveys the main output categories well. However, it does not explain the role of namespace, behavior when namespace is omitted, or output format, leaving an agent to infer those details from the schema and context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%; the namespace parameter is already described in the input schema as a Kubernetes namespace with no default configured. The tool description itself adds no parameter-level meaning, so the baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool surfaces externally reachable resources and enumerates specific categories: LoadBalancer/NodePort Services, Ingress routes, hostNetwork pods, and management paths. This distinguishes it from siblings like get_ingress_routes or get_network_policies by focusing on external exposure rather than individual resource types.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied: use when you need to know what is reachable from outside the cluster. However, there is no explicit when-to-use or when-not-to-use guidance, and no alternatives are mentioned despite close siblings such as get_ingress_routes, get_network_policies, and security_posture.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_frontend_errorsB
[probe RUM] JavaScript errors grouped by signature with counts, first/last seen, routes.
| Name | Required | Description | Default |
|---|---|---|---|
| route | No | ||
| service | No | Proxy workload whose probe ingests RUM (auto-discovered if omitted) | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses the output structure (grouped by signature with counts, first/last seen, routes), implying a read-only operation, but does not explicitly state read-only behavior, rate limits, authentication, or side effects. It provides some behavioral context but leaves gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, tightly written sentence with no filler. It front-loads the key context (probe RUM) and immediately states the output content. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has three optional parameters, no output schema, and no annotations. The description mentions output structure but does not explain whether namespace is required (despite the schema hinting it may be), how to discover it (though list_namespaces is mentioned in the schema), or any limits or pagination. For a simple query tool, this is minimal but leaves important gaps for an agent to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 67% (service and namespace described, route not). The tool description does not clarify the 'route' parameter, which appears in the output but not as an input explanation. Since coverage is moderate and the description adds no extra meaning for the undocumented parameter, it fails to compensate for the gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it retrieves JavaScript errors from RUM, grouped by signature, with counts, first/last seen, and routes. It uses a specific verb-resource pair and differentiates from sibling tools like get_web_vitals (performance) and get_page_views (page views).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description offers no guidance on when to use this tool versus alternatives. It does not mention any exclusions, prerequisites, or contexts where another tool would be more appropriate. The only hint is the 'probe RUM' prefix, which is insufficient for an agent to decide between this and other frontend analytics tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_golden_signalsB
Request rate, error rate, latency percentiles (and per endpoint) from the best available provider: Prometheus (windowed) or Actuator via the probe (cumulative).
| Name | Required | Description | Default |
|---|---|---|---|
| window | No | Time window like 15m, 2h, 1d (default 15m) | |
| service | Yes | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It mentions that it automatically selects between Prometheus (windowed) and Actuator (cumulative), which is useful behavioral context. However, it does not disclose what happens if both providers are unavailable, how 'best' is determined, or whether there are any side effects or rate limits. This is a partial disclosure but not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is clear and front-loaded with the core metrics. It is concise with no filler. However, it could benefit from a more structured format (e.g., bullet points) to separate the providers and the per-endpoint aspect, but it remains efficient and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This tool has 3 parameters, no output schema, and no annotations. The description does not describe the return format or structure beyond listing the metric types, nor does it mention any prerequisites, error handling, or pagination. Given the complexity and lack of annotations, the description leaves significant gaps that an agent would need to infer or discover.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all three parameters (window, service, namespace) already have descriptions. The tool description adds minimal value beyond that, only referencing the time window concept but not clarifying format or constraints. The description does not compensate for the low need since coverage is high, so a baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns request rate, error rate, latency percentiles, and per-endpoint data. It names two providers (Prometheus and Actuator) which adds specificity. However, it does not explicitly differentiate from sibling tools like get_endpoint_metrics or query_metrics, which could also return similar metrics. The verb 'get' and resource 'golden signals' is specific enough.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. It does not mention any exclusions, prerequisites, or scenarios where another sibling like get_actuator_health or query_metrics would be more appropriate. The phrase 'best available provider' implies automatic selection but doesn't explain when to prefer this tool over others.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_hpa_statusB
HorizontalPodAutoscalers: current/target metrics, at-max, unable-to-scale conditions.
| Name | Required | Description | Default |
|---|---|---|---|
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description bears the full burden. It does disclose the nature of the output by naming the status categories returned. However, it does not clarify whether all HPAs in the namespace are returned, how missing data is represented, or whether any read permissions are needed; this is acceptable for a simple getter but not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single compact, front-loaded line with no filler. Every component listed (current/target metrics, at-max, unable-to-scale conditions) adds meaningful information an agent needs to understand the tool's output.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter, read-only status tool with no output schema, the description covers the resource and the key status categories sufficiently. It could add a bit more context about the meaning of 'at-max' or the shape of conditions, but those are reasonably inferable from Kubernetes HPA terminology.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the namespace parameter is already fully documented in the schema, including a pointer to list_namespaces. The tool description adds no additional parameter meaning beyond the resource context, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies the resource (HorizontalPodAutoscalers) and the specific status information returned: current/target metrics, at-max, and unable-to-scale conditions. This clearly differentiates it from general metrics tools like query_metrics, though it does not explicitly name or contrast sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives such as get_pod_status or get_golden_signals. The only usage hint, 'see list_namespaces', lives inside the parameter schema rather than the description and concerns argument lookup rather than tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_image_inventoryB
Images, registries, tags, running digests per workload with unpinned/latest/moved-tag findings. Input for a CVE scanner.
| Name | Required | Description | Default |
|---|---|---|---|
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden of behavioral disclosure. It discloses the scope (per workload, running digests) and the kind of findings (unpinned/latest/moved-tag), which is useful. However, it does not disclose whether this is a read-only operation, whether it aggregates across namespaces, or what the output format looks like. With no annotations, a 3 is appropriate – it adds some behavioral context but not a full picture.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no waste. The first sentence front-loads the core content and scope, and the second sentence states the purpose. The parenthetical about list_namespaces is a useful pointer, though it could be considered slightly tangential.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter tool with 100% schema coverage, the description is reasonably complete. It states the content, scope, and purpose. However, with no output schema and no annotations, it doesn't describe the return format, whether the tool is read-only, or how findings are structured, which an agent might need to interpret the result correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents the namespace parameter. The description adds context that the namespace is a Kubernetes namespace and references list_namespaces for discovery, which is helpful. However, it doesn't explain how the namespace filters the inventory or what happens if omitted, so it adds only marginal value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('get') and resource ('image inventory') and lists concrete content: images, registries, tags, running digests per workload, plus findings about unpinned/latest/moved tags. It clearly distinguishes itself from sibling tools like get_pod_status or get_config, though it doesn't explicitly name a sibling alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context: it is 'input for a CVE scanner,' which suggests when an agent needs vulnerability-scanning input. However, it does not state when to use this tool versus alternatives, nor does it mention exclusions or prerequisites beyond the namespace parameter.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_ingress_routesB
Ingress hosts/paths -> Services, TLS coverage, dangling backends.
| Name | Required | Description | Default |
|---|---|---|---|
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions the tool returns TLS coverage and dangling backends, but it does not state whether the operation is read-only, if it could be expensive on large clusters, or if it requires special permissions. The description lacks any explicit behavioral traits beyond the output summary.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, terse phrase that conveys the core functionality without waste. It is front-loaded with the primary mapping and adds secondary aspects. It is appropriately concise, though it is a fragment rather than a full sentence, which slightly reduces clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no output schema, so the description should clarify what the agent can expect as a return value (e.g., a list of routes with fields). It also does not explain terms like 'dangling backends' or the exact scope of TLS coverage. Given the complexity of ingress routing and the presence of many related tools, the description is too minimal for an agent to fully understand its capabilities and limitations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool description itself does not mention parameters, but the schema already documents the namespace parameter with a description (including a note about it being required despite schema not marking it so). Since schema coverage is 100%, the baseline is 3. The description adds no additional parameter semantics, but it does not need to because the schema is adequate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: mapping ingress hosts/paths to services, reporting TLS coverage, and identifying dangling backends. This is specific and distinct from sibling tools like get_tls_status (focused solely on TLS) and get_endpoints (endpoint-level data). The purpose is immediately understandable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention any exclusions, prerequisites, or scenarios where another tool would be more appropriate. The agent must infer usage from the purpose alone, which is insufficient given the large set of networking siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_jvm_configA
Effective JVM flags and Spring env from the pod spec (redacted) with heap-vs-limit and GC findings; Actuator /info if a probe exists.
| Name | Required | Description | Default |
|---|---|---|---|
| service | Yes | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that the pod spec is redacted and that Actuator /info is included only if a probe exists. It does not mention read-only status, side effects, or error conditions, but it adds meaningful behavioral context beyond the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that efficiently packs a lot of information: main purpose, source, redaction, and conditional actuator info. It is front-loaded and contains no fluff, though it could be split for readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a config retrieval tool with two well-documented parameters and no output schema, the description adequately covers what the tool returns: JVM flags, Spring env, heap/GC findings, and optional actuator info. It does not detail output format or errors, but those are not critical for this read-only inspection tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for both parameters, and the schema already provides clear descriptions. The tool description does not add any additional meaning about parameters, so the baseline of 3 applies. A minor inconsistency exists in the namespace property (claimed required but optional in schema), but that is not the description's fault.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves effective JVM flags and Spring environment from the pod spec, along with heap-vs-limit and GC findings, and optionally Actuator /info. It is specific about the resource (pod spec) and the data returned, distinguishing it from siblings like get_jvm_health and get_thread_dump_summary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for JVM configuration inspection, and the mention of 'Effective JVM flags and Spring env' gives clear context. However, it does not explicitly compare with alternatives or state when not to use this tool, leaving the agent to infer from the content.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_jvm_healthA
[probe] Heap used/committed/max vs container limit, GC pause count/total/max, threads, classes, CPU seen by the JVM - from Actuator on localhost.
| Name | Required | Description | Default |
|---|---|---|---|
| pod | No | Exact pod name (alternative to service) | |
| service | No | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the behavioral disclosure burden. It usefully reveals the data source ('Actuator on localhost') and lists measured areas, implying a read-only probe. However, it does not explicitly state read-only semantics, prerequisites such as Actuator being enabled, or failure behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single compact sentence with no filler. It front-loads the key metric categories, uses a dash to separate the data source, and every segment earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description lists the metric categories it returns, which is helpful given there is no output schema. Still, with no annotations and no output schema, it lacks details on exact return shape, failure modes, or whether metrics are per-pod or aggregated. The namespace required/optional inconsistency also adds ambiguity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameters are already documented. The tool description adds no parameter-specific meaning beyond what the schema provides. Baseline of 3 is appropriate, though note the namespace description in the schema claims 'required' while context signals list zero required parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb-resource pairing: it is a probe of JVM health metrics from Actuator. It enumerates distinct metric categories (heap vs container limit, GC pauses, threads, classes, CPU) that clearly separate it from sibling tools like get_actuator_health, get_jvm_config, and get_thread_dump_summary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies its use for JVM health inspection via Actuator, but it never states when to use this tool over overlapping siblings like get_actuator_health or get_jvm_config. No alternatives or exclusion conditions are mentioned, leaving usage decisions to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_listening_portsB
[probe] What the application actually binds (vs what the Service targets).
| Name | Required | Description | Default |
|---|---|---|---|
| pod | No | Exact pod name (alternative to service) | |
| service | No | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of disclosing behavior. It clarifies that the tool reports actual application bindings rather than Service targets, but it does not state whether the operation is read-only, what permissions are needed, whether it could have side effects, or what the output will contain.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single compact sentence with no wasted words, and the core distinction is front-loaded. It earns its place by communicating the essential purpose and key contrast efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple probe with well-documented parameters, the description gives enough purpose for a basic call. However, with no output schema and no annotations, it leaves output format, error behavior, namespace requirements, and access concerns unspecified, so the context is adequate but not complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already fully documents pod, service, and namespace parameters. The description adds no additional parameter-level meaning, which is acceptable but does not exceed the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states that the tool probes what the application actually binds, and the parenthetical 'vs what the Service targets' gives a useful contrast against service-level views. It is clear enough for an agent to understand the tool's core purpose, though it does not use an explicit verb like 'list' or 'get' and stops short of naming a sibling differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'vs what the Service targets' phrasing implies a diagnostic use case: check actual bound ports rather than the declared Service target. However, it never explicitly says when to use this tool over siblings like get_endpoints or get_open_connections, and there are no exclusions or alternative recommendations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_logsA
Sanitized, size-capped container logs for a service (up to 10 pods) or a pod. Use previous=true for the crashed container. grep accepts a substring or /regex/i.
| Name | Required | Description | Default |
|---|---|---|---|
| pod | No | Exact pod name (alternative to service) | |
| grep | No | ||
| tail | No | Lines per pod (max 500) | |
| since | No | Time window like 15m, 2h, 1d (default all recent) | |
| service | No | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| previous | No | ||
| container | No | ||
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries disclosure. It reveals sanitization, size-capping, per-service pod limit, and the previous-container behavior, which go beyond the schema. It does not describe output format or pagination, but for a read-only logs tool the disclosed traits are substantive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, each adding a distinct fact and no filler. Essential scope and edge-case usage are front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given eight parameters, no annotations, and no output schema, the description is adequate but incomplete: it lacks explicit namespace guidance, output shape, and alternative-tool routing. The schema fills some gaps (namespace required, tail max), but the description alone would not fully support a confident call.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is about 63%, and the description adds semantics for grep ('substring or /regex/i') and previous ('crashed container'). It does not clarify container, namespace, or tail defaults beyond the schema, leaving some burden unmet.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States the resource (container logs) and scope (a service up to 10 pods or a pod), with important qualifiers (sanitized, size-capped). It does not use an explicit verb and does not name sibling tools, but the resource and scope are specific enough to separate it from access-log or error-summary tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives actionable conditions: use previous=true for crashed-container logs and grep accepts a substring or /regex/i. It does not explicitly discuss when to prefer this over siblings like summarize_access_log or summarize_log_errors, so the guidance is context rather than exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_network_policiesA
NetworkPolicies in a namespace, decoded; whether a given workload's ingress/egress is restricted; flags 'no policy = wide open'.
| Name | Required | Description | Default |
|---|---|---|---|
| service | No | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It adds useful context: the tool decodes policies and flags 'no policy = wide open', indicating how it interprets absence of policies. However, it does not disclose whether the operation is read-only, any authentication requirements, or the return format, leaving some behavioral aspects unexplained.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, dense sentence that packs the core purpose, a key behavior (decoding), and an important semantic flag ('no policy = wide open'). It front-loads the essential information with zero fluff, making it highly efficient for an agent to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with two parameters (both documented), no output schema, and no annotations, the description covers the primary functionality and one behavioral nuance. However, it does not specify the exact output structure (e.g., list of policies plus a boolean for restriction) or any edge cases like namespace not found. While sufficient for basic invocation, an agent might need to infer the exact return format, leaving some gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both parameters (service and namespace) are already documented in the schema. The description adds no additional parameter-level meaning beyond what the schema provides. The baseline of 3 applies because the schema handles the parameter documentation effectively.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves NetworkPolicies in a namespace, decodes them, and evaluates a given workload's ingress/egress restriction status. It also highlights a distinctive flag for 'no policy = wide open', which differentiates it from sibling tools like get_egress_destinations or get_exposure. The verb 'get' is implicit, but the resource and action are specific enough for an agent to infer purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is used when you need to check whether a workload's network traffic is restricted by policies, but it does not explicitly state when to use it versus alternatives like get_egress_destinations or security_posture. It also does not mention prerequisites or exclusions, relying on the reader to infer the use case from the purpose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_node_pressureC
Node conditions (Memory/Disk/PID pressure), allocatable vs requested vs used, overcommit, taints, cordons.
| Name | Required | Description | Default |
|---|---|---|---|
| node | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden of explaining behavior. It lists the output content in useful detail, but it does not disclose whether a node parameter is required, whether data is live or cached, or what happens when no node is specified. This is adequate but has clear gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a compact, front-loaded phrase that packs many relevant terms into one sentence. It is efficiently written, though its fragmented structure is more of a tag cloud than a proper explanatory sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, no annotations, and a potentially ambiguous sibling tool, the description is incomplete. It lacks parameter semantics, usage context, return format, and clarification of the relationship to get_resource_pressure, so an agent cannot reliably invoke it correctly based on this description alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has a single 'node' parameter with no description and 0% schema coverage. The tool description does not mention the parameter at all, so it fails to clarify whether the node name is required, what format it should take, or what omitting it means. The parameter name is self-explanatory but the description adds no semantic value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the resource (node) and the specific data categories returned: memory/disk/PID pressure, allocatable vs requested vs used, overcommit, taints, and cordons. It is more than a tautology and gives an agent a concrete idea of what the tool covers, though it lacks an explicit verb.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives such as the closely named get_resource_pressure sibling. No context, prerequisites, or exclusions are provided, leaving the agent to guess which pressure-related tool is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_open_connectionsA
[probe] Established connections by destination (resolved to Services/pods), socket state counts (TIME_WAIT/CLOSE_WAIT storms), listening ports - from /proc/net inside the pod's network namespace. Passive.
| Name | Required | Description | Default |
|---|---|---|---|
| pod | No | Exact pod name (alternative to service) | |
| service | No | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. The description discloses that the tool is passive and reads from /proc/net inside the pod's network namespace, which implies it does not modify state. However, it does not clarify what happens if the namespace is inaccessible, authentication requirements, or how destination resolution to Services/pods is performed. The description adds 'Passive' as a behavioral trait, which is useful, but lacks depth on edge cases and side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and efficiently packed into a single sentence with a few parenthetical clarifications. It front-loads the core purpose ('Established connections by destination') and follows with key details (socket states, listening ports, data source). Every clause adds informative value—the data source, the network namespace, and the behavioral note 'Passive'—without unnecessary fluff. The word count is appropriate for the complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 3 parameters with 100% schema coverage, no output schema, and no annotations. The description covers the core functionality but omits practical details an agent might need: how to specify the target (pod vs. service) is in the schema, but the description does not explain the resolution mechanism from destination to Services/pods. There is no mention of the output shape or how to interpret the socket state counts (e.g., thresholds for storms). The complexity is moderate, and while the description is sufficient to understand what it does, it is not complete enough to anticipate edge cases or output semantics without further investigation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage for all three parameters (pod, service, namespace), so the baseline is 3. The description does not add additional meaning beyond the schema's definitions, but it does mention that the tool operates within a pod's network namespace, which indirectly suggests that 'pod' or 'service' identifies the target pod. However, it does not clarify the relationship between 'pod' and 'service' (e.g., if both are provided, which takes precedence) or any parameter syntax details, so there is no added value over the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb and resource: 'Established connections by destination' and 'listening ports' from /proc/net in the pod's network namespace. It also identifies the tool as a probe, distinguishing it from sibling tools like get_endpoints or get_connection_pool_status that may have different focuses. The scope is precise, covering socket state counts and destination resolution, making it unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage in network diagnostics (e.g., TIME_WAIT/CLOSE_WAIT storms) but does not explicitly state when to use this tool over siblings like get_endpoints or get_listening_ports. There is no clear when-not-to-use guidance or mention of alternatives. The '[probe]' and 'Passive' hints give some context but are not explicit usage instructions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_outbound_client_metricsB
[probe] Latency/error rate per downstream target from http.client.requests: which dependency is slow, from the caller's view.
| Name | Required | Description | Default |
|---|---|---|---|
| pod | No | Exact pod name (alternative to service) | |
| service | No | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It usefully reveals the metric source and that it reflects the caller's view, adding context beyond the name, but it does not describe aggregation, time range behavior, or potential response characteristics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single compact sentence that conveys the metric source, what is measured, and the analytical perspective. There is no filler or repetition, and the key differentiating details are presented up front.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only metrics tool with fully documented parameters, the description covers the core semantics well. However, it does not mention output format or how this relates to other metric tools, and with no output schema or behavioral annotations, an agent is left to infer some expectations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameters are already well documented. The description does add the notion of 'downstream target' and dependency perspective, which helps interpret results, but it does not add substantive parameter-level meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as providing latency and error rate metrics per downstream target, sourced from http.client.requests, with a specific caller's perspective. It is distinct enough from generic metrics tools, though it lacks an explicit action verb.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus alternatives like get_golden_signals, get_endpoint_metrics, or query_metrics. It states what the tool reports but does not provide selection criteria or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_page_load_breakdownB
[probe RUM] Navigation Timing phases per route (dns, connect, tls, ttfb, download, domInteractive, DCL, load) with a diagnosis of where full-page loads spend time.
| Name | Required | Description | Default |
|---|---|---|---|
| route | No | ||
| service | No | Proxy workload whose probe ingests RUM (auto-discovered if omitted) | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the behavioral transparency burden. It adds useful context by naming the data source ('probe RUM') and noting the output includes a diagnosis of where page-load time is spent, implying a read-only analytical tool. However, it omits behavior like aggregation window, auth requirements, side effects, or error conditions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence: it states the source, scope, output phase list, and diagnostic value without filler. Every element earns its place and the key scoping term 'per route' appears near the beginning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, this description is moderately informative but incomplete for a 3-parameter diagnostic tool. It lists what the output covers but does not explain route semantics or how this differs from overlapping siblings like get_web_vitals or diagnose_slow_page. The namespace required note also conflicts with the actual schema, leaving an agent slightly unsure about invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 67%, and the description adds meaning only to the route parameter by framing the output as 'per route.' Route itself still lacks syntax or value format in both the schema and description. Additionally, the namespace property description says 'required: no default configured' while the schema's required array is empty, creating a confusing signal for the agent.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as a RUM-based breakdown of Navigation Timing phases per route and lists the concrete phases returned (dns, connect, tls, ttfb, download, etc.). This is specific enough to distinguish it from generic metrics tools, though it does not explicitly name or name-difference siblings like get_web_vitals or diagnose_slow_page.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives, no mention of prerequisites, and no exclusions. The description says what it returns, but an agent is left to infer when it should be selected over diagnose_slow_page or get_web_vitals.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_page_viewsB
[probe RUM] Most visited routes, entry routes, sessions, device split.
| Name | Required | Description | Default |
|---|---|---|---|
| service | No | Proxy workload whose probe ingests RUM (auto-discovered if omitted) | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden. It opens with '[probe RUM]' indicating the data source is a probe ingesting RUM, which is useful context. It lists output categories but does not disclose side effects, permissions, read-only nature, or limitations such as probe configuration requirements. It adds some context but not comprehensive transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, consisting of a single line with the probe tag front-loaded. Every word earns its place, and it avoids redundancy. It is well-structured for quick scanning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple with two optional parameters and no output schema. The description lists the data categories returned but omits details like time range, aggregation method, or how to interpret the data. Given the simplicity and existing schema, it is adequate but lacks depth that would help an agent fully understand the output.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for both parameters, so the schema already documents them. The tool description does not add any parameter-specific information, remaining silent on service and namespace. Baseline 3 is appropriate given the schema handles parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns most visited routes, entry routes, sessions, and device split, which is specific and distinct from siblings like get_web_vitals or get_page_load_breakdown that focus on performance. The 'get' prefix implies retrieval. It does not explicitly say 'returns', but the intent is clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. It does not mention context such as needing traffic analytics or route popularity, nor does it exclude scenarios where other RUM tools would be more appropriate. The description leaves usage entirely to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_pod_statusA
Pod phases, container states and waiting/terminated reasons (CrashLoopBackOff, OOMKilled, ImagePullBackOff...), restart counts, exit codes, unschedulable conditions. Give a service, a pod, or neither for the whole namespace.
| Name | Required | Description | Default |
|---|---|---|---|
| pod | No | Exact pod name (alternative to service) | |
| service | No | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavioral traits. It does describe the return content comprehensively (phases, reasons, counts, exit codes, unschedulable conditions) and explains the targeting logic. However, it does not state that the operation is read-only, mention permission requirements, or describe error/edge-case behavior (e.g., unknown pod). This leaves some ambiguity for an agent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with zero filler. The first sentence lists the returned data, front-loading the core value; the second gives concise targeting instructions. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the burden of explaining return values. It lists the key data fields (phases, states, reasons, counts, exit codes, unschedulable conditions) which gives an agent a solid expectation. It does not specify the exact structure (e.g., whether containers are nested, how multiple pods are presented), but for a status tool this is adequate. Minor gaps exist but are not critical.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds value by clarifying the relationship between parameters: 'Give a service, a pod, or neither for the whole namespace' makes it explicit that service and pod are mutually exclusive alternatives, and that omitting both targets the entire namespace. This goes beyond the individual parameter descriptions in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the exact resource (pod status) and the specific data returned: pod phases, container states, waiting/terminated reasons, restart counts, exit codes, unschedulable conditions. It also explains the targeting options (service, pod, or whole namespace), making it distinct from the many sibling tools focused on metrics, logs, or configuration.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear usage context: 'Give a service, a pod, or neither for the whole namespace.' This explains how to scope the query but does not mention when to use this tool over alternatives like get_resource_pressure or get_events, nor any exclusions. No explicit routing or comparison to siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_process_statsA
[probe] RSS, threads, file descriptors vs limit, state, uptime per process (needs shareProcessNamespace on the pod to see the app).
| Name | Required | Description | Default |
|---|---|---|---|
| pod | No | Exact pod name (alternative to service) | |
| service | No | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full disclosure burden. It adds one key behavioral caveat - the shareProcessNamespace requirement - which is essential for setting expectations. It does not state whether the operation is read-only or what happens if the requirement is unmet, leaving a partial picture.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence front-loads the metric list and appends the prerequisite in parentheses with no filler. Every element earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the core purpose and the critical prerequisite, which is enough for an agent to decide whether the tool is viable. There is no output schema, so the return format is not described, and potential failure modes are not mentioned, leaving moderate gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All three parameters (pod, service, namespace) have 100% schema description coverage, so the schema already documents their meaning. The description adds no parameter-specific detail, matching the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description specifies exactly which metrics are retrieved (RSS, threads, file descriptors vs limit, state, uptime) and scopes them per process, making the tool's purpose unambiguous. The '[probe]' marker signals a diagnostic read. It does not explicitly contrast with sibling tools, though the metric list separates it from JVM- or network-focused siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use when OS-level process statistics are needed and adds a concrete prerequisite (shareProcessNamespace) for seeing the app, which is useful contextual guidance. It does not state when to prefer an alternative tool or when not to use this one, so the guidance is implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_proxy_config_summaryA
Parses the nginx config from the workload's ConfigMap: upstreams, locations, timeouts, buffering, gzip, cache headers for assets vs index.html, security headers, rate limits - with findings.
| Name | Required | Description | Default |
|---|---|---|---|
| service | Yes | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden of behavioral disclosure. It does convey that the tool reads and parses config, and it names the specific config areas it inspects, but it does not explicitly state that it is read-only, nor does it mention prerequisites, failure behavior, or whether findings include severity or recommendations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, dense sentence with a colon-separated list of covered areas. It is front-loaded with the core action and contains no filler, though the list is somewhat long and could be slightly more scannable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description must convey what the tool returns. It does list the config areas and mentions 'with findings', giving an agent a reasonable sense of the return content. It does not describe the exact response structure or how findings are presented, but the coverage is adequate for a read-only summary tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and both parameters have meaningful descriptions. The tool description adds context about what the config is parsed from ('the workload's ConfigMap') but does not add significant new parameter-level semantics beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Parses') and resource ('nginx config from the workload's ConfigMap') and enumerates the distinct aspects it covers (upstreams, locations, timeouts, rate limits, etc.). This clearly differentiates it from siblings like get_proxy_status or get_config.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The intended use is implied by the description: call this when you need a parsed summary of nginx configuration from a workload's ConfigMap. However, there is no explicit guidance about when not to use it, or when to prefer a sibling like get_proxy_status or diagnose_service.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_proxy_statusA
[probe] nginx stub_status per pod: active/reading/writing/waiting, accepts vs handled (drops).
| Name | Required | Description | Default |
|---|---|---|---|
| service | Yes | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It states the tool is a probe and lists the data it returns, giving some transparency. However, it does not disclose whether the operation is read-only, any required permissions, or behavior on missing pods or services, which is a gap given the lack of annotation support.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that efficiently conveys the tool's purpose and the key metrics. It wastes no words and is easily scannable, making it ideal for an agent to quickly grasp its function.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity, the description covers the core data but omits details like whether results are aggregated across pods or returned individually, error handling, and the actual necessity of the namespace parameter. The schema description for namespace conflicts with the required list, adding ambiguity that the tool description does not resolve. With no output schema or annotations, this leaves some gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Both parameters have descriptions in the schema, achieving 100% coverage. The tool description itself does not add any extra meaning beyond what the schema already provides. It does not clarify the apparent discrepancy that namespace is described as required but not marked as required in the schema, so no additional value is added.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific purpose: probing nginx stub_status per pod, listing the exact metrics (active/reading/writing/waiting) and the comparison of accepts vs handled (drops). This distinguishes it from sibling tools like get_proxy_config_summary or get_connection_pool_status by focusing on nginx stub_status data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description only has a '[probe]' label, implying it's for diagnostics, but there is no explicit guidance on when to use this tool versus alternatives. It does not mention any exclusion criteria or direct the agent to other tools for different scenarios, leaving the selection ambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_rbac_for_workloadA
Effective RBAC of the workload's ServiceAccount, with an over-privilege verdict.
| Name | Required | Description | Default |
|---|---|---|---|
| service | Yes | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It does not state whether the operation is read-only, what permissions are required to invoke it, how the effective RBAC is computed (e.g., aggregating roles and bindings), or what the 'over-privilege verdict' format looks like. This is a significant gap for a security-related tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that conveys the core purpose without any fluff. Every word earns its place, and the most critical information (the tool's function and outcome) appears immediately. No redundant details or irrelevant caveats are present.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is a security analysis function with no output schema and no annotations. The description provides only a minimal statement of purpose, lacking essential context such as the expected output structure, any prerequisites (e.g., namespace), how the verdict is derived, or what constitutes 'effective' RBAC. Given the complexity of RBAC analysis, this is inadequate for an agent to fully understand what it will receive or how to interpret the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100%, with both 'service' and 'namespace' already well-documented. The tool description adds no additional parameter context, so the baseline score of 3 applies. It neither enhances nor detracts from the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('get'), a precise resource ('effective RBAC of the workload's ServiceAccount'), and an additional outcome ('over-privilege verdict'). This clearly distinguishes it from sibling tools like get_network_policies or get_secret_usage, none of which compute RBAC or provide a privilege verdict.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly implies when to use this tool: to obtain effective RBAC and an over-privilege assessment for a workload's service account. It does not explicitly mention alternatives or exclusions, but given the unique nature of RBAC analysis among siblings, the context is sufficient for an agent to select it without confusion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_resource_pressureB
CPU/memory usage vs requests and limits per container, CFS throttling ratio when known, OOM kills, restarts, with findings.
| Name | Required | Description | Default |
|---|---|---|---|
| pod | No | Exact pod name (alternative to service) | |
| window | No | Time window like 15m, 2h, 1d (default 5m) | |
| service | No | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It does mention that CFS throttling is reported 'when known' and that the result includes 'findings', which adds some transparency about data availability. However, it does not explicitly state that the operation is read-only, whether any permissions are required, or what happens when no matching pod/service is found. It is partially transparent but leaves significant gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise line that front-loads the core purpose and lists the key data points without any fluff. Every word contributes to understanding what the tool returns, and it is appropriately sized for a tool with four well-documented parameters.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having four parameters and no output schema, the description does not explain how to select the target (pod vs service) or that a namespace is required (as noted in the schema). It also does not describe the response format beyond listing metrics. For an agent to call this tool correctly, it needs to know that it must specify either pod or service and that namespace is mandatory. These omissions make the description incomplete for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents each parameter. The description does not add meaning beyond what the schema provides; it merely lists the metric categories. It does not clarify the relationship between pod and service parameters (e.g., mutual exclusivity) or the required namespace. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as reporting CPU/memory usage vs requests/limits per container, along with CFS throttling, OOM kills, restarts, and findings. It is specific to resource pressure and distinguishes itself from siblings like get_node_pressure (node-level) and query_metrics (generic metrics). However, it lacks an explicit verb, making it a noun phrase rather than a full action statement.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention that it is for per-container resource pressure, nor does it name any sibling tools or exclusion conditions. The only implicit hint is the metric names, but the agent has to infer the use case.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_rollout_historyB
Deployment revisions with image/env/resource diffs between them. Answers 'what changed in the last deploy?'.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) | |
| deployment | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It describes the output content (revisions with diffs) but does not disclose ordering, history depth, default limits, namespace requirements, or whether any cluster access or side effects are involved.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: the first sentence states the resource and content, and the second gives a concrete usage question. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no output schema, no annotations, and limited parameter descriptions, this description is not complete enough for reliable invocation. Important details such as default limit behavior, ordering, return format, and how deployment/namespace should be supplied are missing, and the schema's namespace note hints at a required-but-optional inconsistency.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 33%, and the description adds no meaningful explanation for deployment or limit beyond what the schema already states. It does not compensate for the low schema coverage, leaving two parameters essentially undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the resource (deployment revisions) and the question it answers ('what changed in the last deploy?'). It is distinct in intent from other siblings, though it lacks an explicit verb and does not differentiate itself from the similarly named what_changed sibling.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Answers what changed in the last deploy?' implies a clear use case for this tool. However, it provides no explicit guidance about when not to use it or how it compares to alternatives such as what_changed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_secret_usageB
Which Secrets are referenced by which workloads and how (env vs volume). Names/keys only, never values.
| Name | Required | Description | Default |
|---|---|---|---|
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does disclose a key behavioral trait: it never returns secret values, only names/keys. That is valuable for an agent deciding whether this tool is safe for a given task. It does not mention output shape, pagination, or permissions, but the no-values guarantee is the most important behavior here.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, no filler; the core question is front-loaded and the values caveat follows immediately. Every phrase contributes to the agent's decision.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter read-only lookup, the description covers purpose, output scope, and the key constraint. It does not define the exact return structure, but the description's 'names/keys only' plus the simple namespace parameter make that omission minor. It is largely complete for the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the one parameter (namespace) is described in the schema as required with no default and pointing to list_namespaces. The description does not independently add parameter semantics, but none are needed given the schema coverage. The baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool's function: mapping Secrets to workloads and distinguishing env vs volume usage. It also clarifies output scope (names/keys, not values), which helps distinguish it from secret-value retrieval. However, it lacks an explicit verb like 'list' or 'show', so it is clear but not maximally specific.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool over siblings such as get_rbac_for_workload or scan_logs_for_sensitive_data. The only usage hint is the namespace prerequisite ('see list_namespaces'), which is parameter-level rather than tool-selection guidance. This leaves the agent to infer the appropriate call context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_service_overviewA
One-call digest for a service: replicas, pod problems, recent warning events, usage vs requests/limits, golden signals if available. The first tool to call for 'is X healthy?'.
| Name | Required | Description | Default |
|---|---|---|---|
| service | Yes | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full disclosure responsibility. It explains what the tool returns (replicas, pod problems, events, usage, golden signals) and notes that golden signals are included 'if available', which is honest. However, it does not mention side effects (though it is clearly read-only), error conditions, pagination, or any rate limits. For a read-only digest, this is acceptable but not exhaustive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, front-loaded with the core purpose and contents, and includes a practical usage hint. Every word earns its place; there is no fluff or repetition of schema details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is a high-level digest with no output schema and no annotations, so the description must explain return value semantics. It lists the major components (replicas, pod problems, events, usage, golden signals) and qualifies the golden signals as conditional. It does not specify formats or ordering, but for an entry-point health check this is reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both parameters: service and namespace. The description adds no extra parameter semantics beyond what the schema provides, so the baseline score of 3 is appropriate. It doesn't clarify types or formats beyond schema, but nothing more is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('get') and resource ('service overview') and enumerates the concrete contents (replicas, pod problems, warning events, usage vs limits, golden signals). It also explicitly positions itself as 'the first tool to call for is X healthy?', distinguishing it from sibling tools like get_pod_status or get_golden_signals, which focus on narrower slices.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly states when to use the tool ('first tool to call for is X healthy?') and hints at its broad scope. It does not explicitly list when not to use it or name specific alternatives for deeper dives, but the context is strong enough for an agent to select it as an entry point.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_static_bundle_statsC
[probe] Served frontend build: JS/CSS/image bytes, largest files, hashed vs unhashed chunks, source maps shipped.
| Name | Required | Description | Default |
|---|---|---|---|
| service | Yes | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations, so the description carries the full burden of behavioral disclosure. It lists data categories but does not say whether the tool is read-only, what source it probes, whether it has side effects, or how it handles missing build artifacts. The '[probe]' prefix hints at inspection but does not meaningfully disclose behavior beyond the output list.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded, packing the resource and output categories into one short fragment. The '[probe]' prefix is minor noise)Skip but doesn't hurt understanding. It is appropriately sized for a simple stats retrieval tool, though the fragmentary phrasing could be tightened into a complete sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description does provide a useful list of return categories, but it omits units, formatting, and whether all categories are always present. It also does not clarify how the service/namespace parameters map to the 'served frontend build.' The tool is simple enough that this is adequate, but there are clear gaps for an agent invoking it without prior knowledge.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents 'service' and 'namespace' in detail. The description adds no parameter-specific guidance, such as clarifying that the service should correspond to a frontend workload or that namespace is required. This meets the baseline for a fully documented schema but adds no extra semantic value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific resource ('served frontend build') and enumerates concrete outputs: JS/CSS/image bytes, largest files, hashed vs unhashed chunks, and source maps shipped. This makes the tool's function clear and distinguishable from related runtime-oriented siblings like get_web_vitals or get_page_load_breakdown. It could be more explicit by stating 'Returns statistics about...', but the meaning is still evident.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No usage guidance is provided. The description does not state when to prefer this tool over alternatives, nor does it mention any exclusions such as 'use get_web_vitals for runtime performance' or 'only for frontend workloads serving static assets.' The frontend-build wording implies a context, but the agent is left to infer when this tool is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_thread_dump_summaryB
[probe] Actuator threaddump reduced to: threads by state, pool busy/total, lock contention, DEADLOCK detection, top stack signatures. Never the raw dump.
| Name | Required | Description | Default |
|---|---|---|---|
| pod | No | Exact pod name (alternative to service) | |
| service | No | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses the output is a reduced summary ('Never the raw dump') and enumerates content, but does not explicitly state it is read-only, mention potential errors, or describe how the summary is generated. The behavior is somewhat transparent but lacks depth.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the core function and lists output components. Every word contributes, with no redundancy or filler. It is well-structured and easy to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given it's a read-only summary tool with no output schema, the description adequately lists the key output categories and explicitly notes the absence of raw dump. It lacks details on error conditions or how to interpret DEADLOCK detection, but covers the essential information an agent needs to decide and invoke the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all three parameters (pod, service, namespace) are documented in the schema. The description adds no additional meaning about parameter usage or relationships, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it retrieves an Actuator threaddump summary, listing specific components (threads by state, pool busy/total, lock contention, DEADLOCK detection, top stack signatures) and explicitly notes it is 'Never the raw dump'. While it doesn't name sibling tools, the purpose is unambiguous and distinct from a generic health check.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. The description only explains what it does, not the conditions that warrant calling it. It doesn't mention when not to use it or point to sibling tools for related diagnostics, leaving the agent to infer usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_tls_statusC
Ingress TLS coverage; with host (+port) and active checks enabled, performs a TLS handshake and reports expiry, issuer, protocol, chain trust.
| Name | Required | Description | Default |
|---|---|---|---|
| host | No | ||
| port | No | ||
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description must fully disclose behavior. It states that it performs a TLS handshake (an active network operation) and reports results, but it does not mention permissions, potential side effects, failure modes, or whether it is read-only. The agent is left to infer safety and operational implications.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, dense sentence that front-loads the main purpose and lists the output fields. It contains no filler or redundant information, making it efficient and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of an output schema, the description usefully enumerates the returned fields (expiry, issuer, protocol, chain trust). However, it omits prerequisites (e.g., whether host is required), error handling, and how namespace interacts with the handshake. The description is adequate but leaves gaps for an agent to make assumptions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema documents only the namespace parameter; host and port have no descriptions. The description mentions 'host (+port)' but does not explain their meaning, defaults, or relationships. With only 33% schema coverage, the description fails to compensate for the undocumented parameters, leaving the agent uncertain about how to populate them.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool performs a TLS handshake and reports specific fields (expiry, issuer, protocol, chain trust). It distinguishes itself from ingress route or other network tools by focusing on TLS coverage. The initial phrase 'Ingress TLS coverage' is somewhat vague but the subsequent clarification resolves it.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. It does not reference any sibling tools or mention conditions under which it should be used or avoided. The only hint is in the schema for namespace, but the description itself offers no usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_topologyB
Service -> pods -> workload graph plus inferred dependencies (from env/ConfigMap references to Service names, and from probe-observed connections if include_connections=true). Flags Services with no ready endpoints.
| Name | Required | Description | Default |
|---|---|---|---|
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) | |
| include_connections | No | Also ask probe sidecars for established connections (slower) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It does reveal that dependencies are inferred from env/ConfigMap references and probe-observed connections, and that it flags Services with no ready endpoints. It also notes include_connections makes it slower. However, it doesn't state whether this is a read-only operation or if it has side effects, which would be useful given the lack of annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single but dense sentence that front-loads the primary purpose (graph) before elaborating on dependency inference and flagging behavior. It is efficient, though the long sentence could be split for easier parsing, but it conveys all necessary information without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool of moderate complexity, the description covers the main output (graph), the optional parameter behavior, and a notable flag. There is no output schema, so the description should hint at what the response looks like, which it does by describing the graph and flags. It doesn't mention pagination or limits, but that's likely not critical for this tool. Overall, it's adequate for an agent to know when and how to call it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters (namespace and include_connections) are already documented in the schema. The description adds the note that include_connections=true is slower, which is extra value beyond the schema. Since coverage is high, the baseline of 3 is appropriate, with the minor addition not pushing it higher.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: generating a Service->pods->workload graph with inferred dependencies, and flagging Services without ready endpoints. It uses a specific verb 'get' and identifies the resource. While it doesn't explicitly name sibling tools for differentiation, the specificity of the graph and dependency inference makes it distinct enough.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide explicit guidance on when to use this tool versus alternatives. It mentions include_connections for optional behavior but doesn't explain when this tool is preferable to other diagnostic tools like get_service_overview or get_network_policies. No when-not-to-use conditions are stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_traceC
Critical-path view of one trace (needs a tracing provider).
| Name | Required | Description | Default |
|---|---|---|---|
| trace_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It only reveals a prerequisite (tracing provider) and implies read-only behavior via 'view', but does not disclose error handling, return format, or side effects. This is minimal transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Excellent verbosity discipline – a single short sentence front-loads the core function. There is no filler or redundant repetition of schema details, though the brevity leaves informational gaps.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter tool with no annotations and no output schema, the description must carry more weight. It omits what the output looks like, what happens if the tracing provider is unavailable, and how this relates to find_slow_traces. Incomplete for reliable autonomous selection.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description never mentions 'trace_id' or its format. It only implies the tool works on 'one trace' and relies on the schema's property name to connect the parameter. It does not explain what values are valid or how to obtain a trace_id.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Critical-path view of one trace' – a specific verb ('view') and resource ('trace') with a scope qualifier ('one'). It clearly signals a per-trace retrieval operation and is distinguishable from list/search siblings like find_slow_traces, though it does not explicitly name that alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. The parenthetical '(needs a tracing provider)' is a prerequisite, not a usage condition. It does not mention when to prefer this over find_slow_traces or how to proceed when trace_id is unknown.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_web_vitalsB
[probe RUM] Core Web Vitals p75/p95 per route (LCP, INP, CLS, FCP, TTFB) with good/needs-improvement/poor ratings.
| Name | Required | Description | Default |
|---|---|---|---|
| route | No | ||
| service | No | Proxy workload whose probe ingests RUM (auto-discovered if omitted) | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that the tool returns p75/p95 values and quality ratings, but does not explain whether it is read-only, what time window is used, how the route parameter behaves when omitted, or any aggregation logic. These are significant gaps for a metrics tool without annotation support.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single dense sentence that front-loads the source ('[probe RUM]') and packs all key details—metric names, percentiles, and rating categories—without any wasted words. It is highly scannable and information-efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no output schema and no annotations, the description explains the core returned metrics and ratings, but omits output structure, time range, and behavior of the optional route parameter. Given the tool's moderate complexity and the lack of structured support, the description is adequate but leaves notable gaps that an agent would need to infer.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides descriptions for service and namespace, but not for route. The description only mentions 'per route' without explaining the route parameter's format, default, or whether it is required. With schema coverage at 67%, the description fails to compensate for the undocumented route parameter, and adds no new meaning for service or namespace beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: it retrieves Core Web Vitals (LCP, INP, CLS, FCP, TTFB) at p75/p95 per route, with quality ratings. This is clearly distinct from siblings like get_golden_signals or get_page_views, which target other metric sets.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no explicit guidance on when to use this tool versus alternatives. The '[probe RUM]' prefix hints at a data source, but there is no mention of when to prefer this over get_page_load_breakdown or get_browser_api_latency, nor any conditions or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
health_reportA
RUNBOOK 'Monday morning' digest for a namespace: unhealthy pods, restarts, warnings, resource pressure, HPA at max, node pressure, endpoint problems, missing NetworkPolicies, security findings, TLS gaps, with suggested actions.
| Name | Required | Description | Default |
|---|---|---|---|
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses a wide range of checks (network policies, TLS, security findings, etc.) and mentions 'suggested actions', giving a good sense of behavior. It does not explicitly state that it is read-only or discuss permissions/rate limits, but the digest nature implies no side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single long sentence that front-loads the purpose ('RUNBOOK Monday morning digest') and then lists many covered items. It is dense but informative; while it could be broken into structured bullets, the information is efficiently packed without fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity, the description covers the scope of checks and suggests actions, which is helpful. However, it does not describe the output format (text, JSON, structured list) or any prerequisites beyond a namespace. Since there is no output schema, the agent is left guessing about the return structure, which is a notable gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has one parameter 'namespace' with a description stating it is required with no default and references list_namespaces. The tool description only mentions 'for a namespace', adding no additional syntax, format, or edge-case details beyond the schema. With 100% schema coverage, the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool produces a 'digest' for a namespace, listing specific health aspects (unhealthy pods, restarts, warnings, resource pressure, etc.). The verb 'digest' and the resource 'namespace' are explicit, and it distinguishes itself from sibling tools by being a comprehensive overview rather than a focused metric query.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'RUNBOOK Monday morning digest' implies a routine health check, and the long list of covered areas suggests it is for a broad overview. However, it does not explicitly state when to use this over more specific siblings (e.g., get_hpa_status, get_node_pressure), nor does it mention exclusions. The implied use is clear but not formally contrasted.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_namespacesA
List namespaces this hub may inspect. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden of behavioral disclosure. It clearly states 'Read-only,' informing the agent that this operation is non-mutating and safe, and scopes the behavior to namespaces the hub may inspect.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences with zero redundant phrasing. The primary action and resource are front-loaded, and the behavioral note is concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless list operation with no output schema, the description provides the resource, scope, and safety profile. Nothing essential is missing for an agent to decide to invoke it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, so there is nothing for the description to add beyond what the schema already shows. The baseline of 4 applies because the parameter surface is empty and no semantic elaboration is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') with a clear resource ('namespaces') and a scope qualifier ('this hub may inspect'). This differentiates it from sibling list tools like list_providers and list_workloads without ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context: call it when you need the set of namespaces the hub can inspect, and it is explicitly read-only. However, it does not name any alternatives or state when not to use it, leaving some inference to the agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_providersA
Show which signal providers (metrics-server/probe, Prometheus, Datadog, Splunk) are configured and reachable, and what each can answer. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the behavioral transparency burden throughout. It explicitly states 'Read-only' and implies active reachability checking through 'configured and reachable,' which adds useful behavioral context. It does not detail output structure, but the read-only, zero-parameter nature limits risk.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted words. It clearly communicates action, scope, examples, and result content in a compact form.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter discovery tool, this description covers purpose, scope, and read-only behavior completely enough. No output schema exists, but the description's 'what each can answer' conveys the expected result type; explicit output format documentation is a minor omission.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool accepts zero parameters, so the description has no parameter-documentation burden; the baseline of 4 applies. The mention of what the tool returns is sufficient for a no-argument invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Show') with a clear resource ('signal providers') and names concrete examples (metrics-server/probe, Prometheus, Datadog, Splunk). It also states the outcome ('what each can answer'), which distinguishes it from sibling metric-query tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly establishes the discovery context: call this tool to learn which providers are configured, reachable, and capable of answering. It does not explicitly name alternatives or exclusions, but no sibling tool covers provider discovery, so the usage context is clear enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_workloadsA
Deployments/StatefulSets/DaemonSets/Jobs/CronJobs in a namespace with ready counts, restarts, images, and age. Start here when you do not know what runs where.
| Name | Required | Description | Default |
|---|---|---|---|
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden of explaining behavior. It discloses the scope and returned fields, but does not explicitly state read-only behavior or how results are aggregated across workload types. This is adequate but not fully transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences deliver the resource scope, returned data, and usage guidance with no filler. The key information is front-loaded and every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter listing tool with no output schema, the description covers what it returns and when to use it. It does not describe sorting, limits, or empty-state behavior, but these are not critical for an agent to invoke this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, with the single namespace parameter already documented. The description adds only the context that workloads are listed 'in a namespace,' which does not materially expand on the schema's explanation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific set of Kubernetes workload resources and the exact fields returned (ready counts, restarts, images, age). It clearly distinguishes itself as the workload inventory tool, especially with the 'Start here when you do not know what runs where' framing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly says to use this tool as the starting point when the user is unsure what workloads exist. It does not explicitly name alternatives or exclusions, but the usage context is clear enough to route an agent appropriately.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
query_metricsA
Escape hatch: raw PromQL range query against the configured Prometheus, compacted (first/last/min/max/avg + 12 samples per series).
| Name | Required | Description | Default |
|---|---|---|---|
| step | No | ||
| query | Yes | ||
| window | No | Time window like 15m, 2h, 1d (default 1h) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must disclose behavioral traits itself. It reveals a key behavior: results are compacted to first/last/min/max/avg plus 12 samples per series, which is not obvious from the schema. However, it does not mention whether the operation is read-only (likely, but not stated), potential performance implications, or failure modes for malformed queries. It provides some transparency but leaves important aspects unaddressed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that front-loads the core purpose ('Escape hatch: raw PromQL range query') and then provides the compaction detail. It is efficient and avoids redundancy. It loses a point because the opening 'Escape hatch' is colloquial and could be more explicit about the tool's role, but overall it is well-structured and succinct.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no output schema and only three parameters, the description covers the purpose and a key behavior (compaction) but leaves gaps: it does not explain the return format beyond the compaction detail, does not clarify the meaning of 'step', and provides no usage examples. As an escape hatch, an agent would benefit from more guidance on constructing queries, but the description is not entirely inadequate for a power user.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 33% (only 'window' has a description). The description does not compensate for the missing semantics of 'query' and 'step'. It does not explain that 'query' expects a PromQL expression, nor what 'step' represents (e.g., seconds). Given the low coverage, the description was expected to add meaning to these parameters but adds none beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool performs a raw PromQL range query against a configured Prometheus, distinguishing it from all specialized sibling tools. It names the specific verb (query), the resource (Prometheus), and the exact nature (raw PromQL range query with compaction). This unambiguously identifies its purpose and sets it apart from siblings like get_golden_signals or get_web_vitals.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Escape hatch' implies this tool is meant for cases not covered by other metric tools, but it does not explicitly state when to use it or when to prefer a sibling. It offers no direct comparison or condition like 'use this when you need arbitrary PromQL not exposed by other endpoints.' Usage is only implied through the escape-hatch label, which is weak guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
resolve_dnsB
[probe, ACTIVE] Resolve a name from inside the pod (its resolv.conf, search domains, ndots). Requires DIAG_ALLOW_ACTIVE_CHECKS.
| Name | Required | Description | Default |
|---|---|---|---|
| pod | No | Exact pod name (alternative to service) | |
| name | Yes | ||
| service | No | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses that this is an active probe ('[probe, ACTIVE]') and requires DIAG_ALLOW_ACTIVE_CHECKS, which is important behavioral context. With no annotations provided, the description carries the burden, and it does disclose the active nature and permission requirement. However, it doesn't mention potential side effects, rate limits, or what happens if the check is not allowed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the key facts: it's an active probe, it resolves from inside the pod, and it requires a permission flag. No wasted words, though the '[probe, ACTIVE]' prefix is a bit cryptic.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple DNS resolution tool with 4 params and no output schema, the description covers the essential context: what it does, where it runs, and the permission requirement. It doesn't explain the return format or how the name parameter interacts with search domains, but those are minor gaps for a probe tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 75%, so the schema already documents pod, service, and namespace. The description adds context for 'name' (the thing to resolve) and clarifies 'service' means 'workload name as you would say it'. The description doesn't add much beyond the schema, but the schema is fairly clear. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Resolve') and resource ('a name from inside the pod'), and clarifies it uses the pod's resolv.conf, search domains, and ndots. It doesn't explicitly differentiate from sibling tools like check_connectivity or get_endpoints, but the 'from inside the pod' scoping is distinctive enough.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use it (when you need DNS resolution from the pod's perspective) and mentions the DIAG_ALLOW_ACTIVE_CHECKS requirement, which is a usage gate. However, it doesn't explicitly state when not to use it or name alternatives like check_connectivity for general connectivity checks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scan_logs_for_sensitive_dataA
Scans recent logs for PII (emails, cards with Luhn, SSNs, phones) and secrets (JWTs, cloud keys, Bearer/Basic, connection strings, PEM). Returns counts and masked samples only.
| Name | Required | Description | Default |
|---|---|---|---|
| pod | No | Exact pod name (alternative to service) | |
| since | No | Time window like 15m, 2h, 1d (default 1h) | |
| service | No | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden. It adds meaningful transparency by stating that only counts and masked samples are returned, preventing an agent from expecting raw sensitive data. It also scopes the behavior to 'recent logs.' It does not mention access/permission requirements, but 'scans' strongly implies a read-only, non-destructive operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one focused sentence that front-loads the action and scope, enumerates categories compactly, and ends with the output constraint. Every clause adds information; there is no repetition of the tool name or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is complete enough for invocation: it defines the scan scope, the output format, and the recent-log time notion, while the schema documents the parameters. It could mention the namespace requirement or that output is grouped by category, but these are minor gaps given the schema coverage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the parameters are already documented and the baseline is 3. The description does not add parameter-level detail beyond the schema, such as explaining the pod-vs-service relationship or the since format, but it does not need to fully compensate because the schema handles it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('scans recent logs') and enumerates exact detection categories (PII types and secret types), plus the output form (counts and masked samples). This clearly distinguishes it from sibling tools like get_logs, summarize_log_errors, and get_secret_usage.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The intended use case is inferable from 'scans recent logs for PII... and secrets,' but the description never explicitly says when to use this tool over alternatives such as get_secret_usage or security_posture. No when-not-to-use guidance is provided, leaving the agent to infer trade-offs.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
security_postureA
Static security findings with severity for workloads: privileged/root/host namespaces/capabilities/seccomp/rootfs, secrets in env, unpinned images, no limits, SA token automount, missing NetworkPolicy, over-privileged RBAC. No Secret contents are read.
| Name | Required | Description | Default |
|---|---|---|---|
| service | No | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) | |
| min_severity | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It explicitly states that no Secret contents are read, which is a valuable safety disclosure. It also clarifies that findings are static, implying no live probing or mutation. It does not mention whether the tool requires special permissions or whether it performs any cluster-wide scanning, but the static and non-secret-reading disclosures are meaningful behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, dense sentence that front-loads the core purpose and lists the finding categories compactly. The safety note about Secret contents is appended efficiently. No wasted words, though the long list of categories makes it slightly dense.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only security findings tool with no output schema, the description covers the main input semantics and a key safety behavior. However, it does not describe the output format, severity levels, or how findings are grouped, and it does not mention whether the tool requires any special permissions. Given the tool's complexity (multiple finding categories, severity filter), a bit more detail on output or severity behavior would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 67%, so the schema already documents service and namespace. The description adds context for the service parameter by listing workload types (Deployment, StatefulSet, DaemonSet, Service, Pod), which is helpful. However, it does not explain min_severity semantics beyond the enum values, and the description does not compensate for the undocumented parameter (min_severity) beyond what the enum provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: it returns static security findings for workloads, and enumerates the categories of findings (privileged/root, host namespaces, secrets in env, etc.). It is clear about what the tool does, though it does not explicitly differentiate it from sibling tools like get_rbac_for_workload or get_secret_usage. The scope is clear enough that an agent can tell it is a security posture assessment tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage: call it to get security findings for a workload. It mentions the namespace parameter is required and references list_namespaces, which gives a hint about prerequisites. However, it does not explicitly state when to use this tool versus alternatives like get_rbac_for_workload, get_secret_usage, or get_network_policies, nor does it state when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
summarize_access_logA
[probe] Proxy access log aggregated: status classes, top paths with p50/p95, per-upstream latency and 504s, 499s (clients giving up), proxy-vs-upstream gap, scanner-like paths, sensitive data in the log. Never raw lines.
| Name | Required | Description | Default |
|---|---|---|---|
| since | No | Time window like 15m, 2h, 1d (default 15m) | |
| service | Yes | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral disclosure burden. It states the tool returns only aggregated data, lists the computed analytical dimensions, and sets a clear constraint with 'Never raw lines.' It could add edge-case behavior, but it is transparent about the main behavioral contract.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence that packs the operation, output facets, and a key exclusion into a compact form. There is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description usefully tells the agent what the summary will include and what it will never return. It could be more explicit about the response structure or when to prefer this over summarize_log_errors, but it gives enough context for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline applies. The description does not add parameter-specific semantics beyond the schema, but it does not need to since since, service, and namespace are already well documented in the input schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly names the resource (proxy access log) and the operation (aggregated summary), and enumerates concrete outputs such as status classes, p50/p95 top paths, per-upstream latency, and 504/499 counts. 'Never raw lines' explicitly distinguishes it from raw log tools like get_logs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use when an aggregated, analytical view of proxy access logs is neededestrategy. 'Never raw lines' hints that raw-line retrieval is out of scope, but it does not explicitly name alternatives or give a when-not-to-use condition, leaving the agent to infer the choice.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
summarize_log_errorsA
Groups ERROR (and optionally WARN) log lines by signature (Java stack traces by exception + first app frame) with counts, first/last seen, and one redacted sample each. Read this instead of raw logs.
| Name | Required | Description | Default |
|---|---|---|---|
| pod | No | Exact pod name (alternative to service) | |
| since | No | Time window like 15m, 2h, 1d (default 1h) | |
| service | No | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) | |
| include_warnings | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that it groups by signature, provides counts, first/last seen, and one redacted sample each, which is useful. However, it does not mention the required namespace parameter (though the schema does), potential performance characteristics, or whether results are sorted or limited. The redaction detail is a positive, but more behavioral context (e.g., read-only nature, output format details) would be expected.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the action and outcome. It includes the essential detail (redacted samples, counts, time window implication) without waste. Every word contributes to understanding the tool's purpose and value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description explains the tool's core behavior and output fields (counts, first/last seen, redacted sample). It distinguishes from raw logs and implies a read-only summary. While it doesn't mention required namespace or the pod/service alternative, those are covered in the schema. For a moderate-complexity tool with no output schema and no annotations, this is adequate, though a bit more on output structure or sorting would push it higher.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 80%, so the schema already documents most parameters. The description does not add extra meaning beyond what the schema provides; it only implies 'optionally WARN' which maps to include_warnings but doesn't explicitly tie it. The schema covers pod/service/namespace well, so the description adds little value here. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Groups') and resource ('ERROR and optionally WARN log lines'), with a clear outcome (signature-based grouping with counts, first/last seen, redacted samples). It explicitly differentiates from raw logs by saying 'Read this instead of raw logs', which distinguishes it from the sibling get_logs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a clear directive ('Read this instead of raw logs') that tells the agent when to prefer this tool. It does not explicitly mention exclusions or alternatives like summarize_access_log, but the scope (error vs access logs) is implied. It would benefit from noting when raw logs are still needed (e.g., full details), but the guidance is clear enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
what_changedB
One timeline of rollouts, scaling, HPA actions, ConfigMap updates, restarts, and notable events in a window. The first question in any incident.
| Name | Required | Description | Default |
|---|---|---|---|
| since | No | Time window like 15m, 2h, 1d (default 6h) | |
| service | No | Workload name as you would say it: a Deployment, StatefulSet, DaemonSet, Service, or Pod name | |
| namespace | No | Kubernetes namespace (required: no default configured; see list_namespaces) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It only states what the tool does (creates a timeline) without revealing whether it is read-only, whether it has side effects, how it handles missing parameters, or what happens when no changes exist. For an incident tool, this is a notable gap, though the implied read-only nature is weak evidence.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences, with the core purpose front-loaded ('One timeline...') and a memorable usage tagline ('The first question in any incident'). Every word earns its place; there is no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with only 3 well-documented parameters and no output schema, the description adequately conveys the primary function. However, it does not clarify that parameters are optional (required parameters: 0) or how the tool behaves without a namespace, nor does it mention the return format. Given the simplicity, it is minimally complete but could be improved with a note about scope and defaults.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, meaning the schema already documents all three parameters (since, service, namespace) with their meanings and examples. The description adds no additional semantic detail beyond what the schema provides. Baseline 3 is appropriate given the high coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it provides a timeline of changes (rollouts, scaling, HPA actions, etc.) and positions it as the first question in an incident. It is specific about the resource (a timeline) and the verb (what changed). However, it does not explicitly differentiate from siblings like get_rollout_history or get_events, which cover overlapping types of changes, so it loses a point.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'The first question in any incident' gives clear context for when to use it (initial triage) but does not mention when not to use it or suggest alternatives for deeper investigation. There is no explicit exclusion or guidance on how it relates to sibling tools, so it relies on the agent inferring that other tools handle specifics.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
57 tool updates
v0.1.0- First observed
check_connectivity - First observed
check_security_headers - First observed
compare_replicas - First observed
diagnose_service - First observed
diagnose_slow_page - First observed
diagnose_slow_requests - First observed
find_slow_traces - First observed
get_actuator_health - First observed
get_browser_api_latency - First observed
get_config - First observed
get_connection_pool_status - First observed
get_egress_destinations - First observed
get_endpoint_metrics - First observed
get_endpoints - First observed
get_events - First observed
get_exposure - First observed
get_frontend_errors - First observed
get_golden_signals - First observed
get_hpa_status - First observed
get_image_inventory - First observed
get_ingress_routes - First observed
get_jvm_config - First observed
get_jvm_health - First observed
get_listening_ports - First observed
get_logs - First observed
get_network_policies - First observed
get_node_pressure - First observed
get_open_connections - First observed
get_outbound_client_metrics - First observed
get_page_load_breakdown - First observed
get_page_views - First observed
get_pod_status - First observed
get_process_stats - First observed
get_proxy_config_summary - First observed
get_proxy_status - First observed
get_rbac_for_workload - First observed
get_resource_pressure - First observed
get_rollout_history - First observed
get_secret_usage - First observed
get_service_overview - First observed
get_static_bundle_stats - First observed
get_thread_dump_summary - First observed
get_tls_status - First observed
get_topology - First observed
get_trace - First observed
get_web_vitals - First observed
health_report - First observed
list_namespaces - First observed
list_providers - First observed
list_workloads - First observed
query_metrics - First observed
resolve_dns - First observed
scan_logs_for_sensitive_data - First observed
security_posture - First observed
summarize_access_log - First observed
summarize_log_errors - First observed
what_changed
TDQS
Scored across 57 tools
Most tools have detailed, distinct descriptions, but the large surface creates several near-overlaps: get_endpoints vs get_endpoint_metrics, get_exposure vs get_ingress_routes, get_open_connections vs get_egress_destinations, and get_web_vitals vs get_page_load_breakdown. An agent could plausibly select the wrong tool without reading descriptions carefully.
The dominant pattern is get_verb_noun in snake_case, with list_, summarize_, check_, and diagnose_ used predictably for their categories. Minor outliers like health_report, security_posture, and what_changed break the verb-first convention but are still readable.
57 tools is far beyond the typical well-scoped MCP surface and will impose significant selection burden on agents. While the domain is broad, the count exceeds even the 25+ threshold for 'too many' in the calibration.
The surface covers Kubernetes diagnostics remarkably thoroughly: metrics, logs, events, traces, JVM internals, proxy behavior, RUM, network, security, config, and runbooks. Minor gaps remain around direct node inventory, Prometheus alert evaluation, and storage/PVC status, but agents can usually work around them.
Maintenance
Related MCP Connectors
- SuperlogOAuthsh.superlog
Open-source agent that observes and fixes your application. Query logs, traces, metrics, incidents.
- emisarOAuthdev.emisar
Let AI operate servers without SSH. Choose actions, approve risky changes, and audit every step.
Read-only AI coding tools for change verification, release readiness, capacity, and guidance.
- mcpOAuthcom.vibgrate
Query your team's drift, vulnerability, and upgrade data from any AI assistant. OAuth 2.1, 51 tools.
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceEnables interactive Kubernetes cluster monitoring and troubleshooting through natural language queries. Users can diagnose pod issues, check service status, and investigate cluster problems using conversational AI.-
- AlicenseBqualityDmaintenanceAI-powered Kubernetes diagnostics that analyzes pod crashes, logs, and cluster health to provide root cause analysis and actionable solutions for common issues like CrashLoopBackOff, OOM kills, and connection errors.84 npm1MIT
- AlicenseNot gradedqualityBmaintenanceEnables natural language Kubernetes operations, including smart resource queries, pod root-cause analysis, cross-environment diffs, and manifest generation.MIT
- AlicenseNot gradedqualityCmaintenanceEnables querying Prometheus metrics, performing cluster diagnostics, and analyzing resource usage through natural language, with automatic Kubernetes connectivity.MIT