List all managed clusters with availability, version, labels, and capacity.

Full view of one ManagedCluster.

Args: cluster: managed cluster name as the hub knows it (see list_clusters).

Returns acceptance (hubAcceptsClient), taints, hub conditions, Kubernetes version, capacity/allocatable, and the cluster's ClusterClaims.

List ManagedClusterSets with their selector type and member clusters.

List ManagedClusterSetBindings (which ClusterSets a namespace's Placements may use).

Args: namespace: limit to one namespace; empty lists bindings across all namespaces.

Every cluster's ClusterClaims (id, platform, region, version) rolled up from status.

Extended inventory for one cluster from the hub: OpenShift version, nodes, console URL.

Args: cluster: managed cluster name.

Reads ManagedClusterInfo on the hub, so it needs no spoke access and works for any spoke - external OpenShift, HCP, or cloud. Needs the ACM/MCE multicloud-operators-foundation add-on; reports clearly if it is not present.

Health summary for one cluster: hub conditions, unhealthy pods, degraded deployments.

Args: cluster: managed cluster name. Pod/deployment detail requires a read-only spoke context (OCM_MCP_SPOKE_CONTEXTS); hub conditions work without one.

Health of the WHOLE fleet in one call: hub conditions for every cluster plus concurrent pod/deployment scans of each spoke that has a read context.

Args: clusters: optional comma-separated managed-cluster names to scope the sweep; empty means every cluster on the hub.

Clusters with problems sort first. A broken spoke shows an 'error' entry instead of failing the sweep. Prefer this over calling get_cluster_health in a loop.

Recent Kubernetes events from a managed cluster, newest first.

Args: cluster: managed cluster name. namespace: optional namespace filter; empty means all namespaces. limit: maximum number of events to return (default 40).

Use this to find the 'why' behind unhealthy pods.

Tail logs from a pod on a managed cluster.

Args: cluster: managed cluster name. namespace: pod namespace. pod: pod name. container: container name; empty picks the default container. lines: number of trailing log lines (default 80).

Falls back to the previous container instance if the current one is crashing.

List Placements and how many clusters each currently selects.

Args: namespace: limit to one namespace; empty lists across all namespaces.

Which clusters a Placement actually selected (reads its PlacementDecisions).

Args: placement: Placement name. namespace: the namespace the Placement lives in.

List AddOnPlacementScores in a cluster's namespace (custom scores prioritizers consume).

Args: cluster: managed cluster name (its hub namespace holds the scores).

List ManifestWorks targeting a cluster (what the hub is managing there).

Args: cluster: managed cluster name.

Detailed ManifestWork status: top-level conditions and per-resource status feedback.

Args: cluster: managed cluster name. name: ManifestWork name.

Use this to answer 'why is this ManifestWork not Applied/Available' and to read status feedback (for example replica counts) reported back from the spoke.

List ManifestWorkReplicaSets (a template fanned across a Placement) with rollout summary.

Args: namespace: limit to one namespace; empty lists across all namespaces.

Propose a change to one cluster as an OCM ManifestWork. Does NOT apply anything.

Args: cluster: target managed cluster name. name: a short kebab-case name for the ManifestWork. summary: one or two sentences a human approver will read. Be precise about what changes and why. manifests_json: JSON array of complete Kubernetes manifests (allowed kinds only; all namespaced; images pinned).

The proposal must pass static guardrails and a Kyverno dry-run on the hub. On success it is stored pending and the human operator must run ocm-mcp approve <id> to mint an approval token.

Apply a previously proposed ManifestWork. Requires a human-minted approval token.

Args: proposal_id: id returned by propose_manifestwork. approval_token: token the operator produced with ocm-mcp approve <id>.

Propose rolling back an applied ManifestWork. Applies nothing; needs its own approval.

Args: proposal_id: id of an already-applied ManifestWork proposal.

Creates a distinct rollback proposal bound to the exact ManifestWork name and UID. The human approves it separately (ocm-mcp approve <rollback-id>), and the token can only authorize a rollback - an old apply token can never delete a workload.

Delete a ManifestWork after a rollback proposal has been approved.

Args: rollback_proposal_id: id returned by propose_rollback. approval_token: a rollback token from ocm-mcp approve <rollback-id>.

List fleet-level add-on definitions (ClusterManagementAddOn) and their install strategy.

Per-cluster add-on health across the fleet (ManagedClusterAddOn Available / Degraded).

Every add-on installed on one cluster, with health (ManagedClusterAddOn in its namespace).

Args: cluster: managed cluster name.

List pending cluster-join / add-on registration CSRs awaiting hub approval.

Propose an OCM cluster lifecycle action. Does NOT apply anything.

Args: cluster: target managed cluster name. action: one of 'cordon' (taint out of scheduling), 'uncordon' (undo cordon), 'set_label' (params: {"key","value"}; empty value removes the label), 'accept' (set hubAcceptsClient=true and approve pending join CSRs), 'enable_addon' (params: {"addon","install_namespace"?}; create a ManagedClusterAddOn), 'disable_addon' (params: {"addon"}; delete it). summary: one or two sentences the human approver will read. params_json: JSON object of action parameters (set_label and the addon actions need it; cordon/uncordon/accept do not).

The action is validated with a server-side dry-run, then stored pending. The human operator must run ocm-mcp approve <id> to mint the approval token.

Apply a previously proposed cluster lifecycle action. Requires a human-minted token.

Args: proposal_id: id returned by propose_cluster_action. approval_token: token the operator produced with ocm-mcp approve <id>.

List governance Policies and per-cluster compliance (only if the add-on is installed).

Args: namespace: limit to one namespace; empty lists across all namespaces.

Only the NonCompliant / Pending Policy-cluster pairs across the fleet - the open risks.

List HyperShift HostedClusters, when the hub is the HCP hosting cluster.

Args: namespace: limit to one namespace; empty lists across all namespaces.

HostedCluster objects live on whichever cluster hosts the control plane. If your HCPs are hosted on a separate management cluster, they are not on this hub - this reports that clearly, and the spokes still appear via list_clusters.

Detailed HostedCluster: version, conditions, and its NodePools.

Args: name: HostedCluster name. namespace: the namespace the HostedCluster lives in (its hosting namespace).

List HyperShift NodePools (worker groups), optionally filtered to one HostedCluster.

Args: namespace: limit to one namespace; empty lists across all namespaces. cluster: optional HostedCluster name to filter node pools by.

Generic list over an allow-list of OCM API types (identity + conditions only).

Args: resource: an OCM resource type, e.g. managedclusters, placements, placementdecisions, manifestworks, managedclusteraddons, clustermanagementaddons, managedclustersets, policies, klusterlets. namespace: for namespaced types, limit to one namespace; empty lists all.

Only Open Cluster Management types are allowed. Secrets and other credential resources are not on the allow-list and cannot be read through this tool.

Generic get of one allow-listed OCM resource, in full.

Args: resource: an OCM resource type (see list_resources for the allow-list). name: object name. namespace: required for namespaced types (usually the cluster namespace).

Never returns a Secret: Secrets are not on the allow-list, so this capability does not exist rather than being merely restricted.

List proposals (ManifestWorks and cluster actions) waiting for human approval.

Return the last N entries of this server's own tool-call audit log.

Args: last_n: number of trailing audit entries to return (default 30).

Use this at the end of an incident to write an accurate post-incident report of what was inspected, proposed, approved, and applied - from the record, not from memory.