Skip to main content
Glama
srewoo

needle-mcp

by srewoo

needle-mcp

A generic, credential-free MCP server that gives any Claude session (Claude Code, Claude Desktop, claude.ai) RCA-investigation building blocks — plus a ported, vendor-agnostic investigation methodology. It runs no LLM loop of its own and holds no Anthropic API key: the host Claude session you already have open does all the reasoning, using its own credentials for whatever vendor MCPs (Datadog, Splunk, GitLab, Sourcegraph, PagerDuty, ...) you already have connected.

What it is NOT

  • Not a Datadog/Splunk/GitLab client — it never talks to those vendors directly. If you have a vendor MCP connected, your host Claude uses that, with your own credentials for it.

  • Not a server-side agent — no orchestration loop, no Anthropic API key, no server cost.

  • Not stateful — no query history, no cache, no session store. Every tool call is independent.

Related MCP server: claude-code-mcp

Install

Published to npm, so no checkout is needed:

npx needle-mcp --help

Requires Node.js 18.17 or newer. There are no runtime credentials to configure — needle-mcp has none of its own.

claude mcp add needle-mcp -- npx -y needle-mcp

That registers the 7 tools. For the full experience, install it as a plugin instead — this additionally bundles the rca-methodology skill and a Stop hook that validates any RCA envelope your session claims to have produced, before the turn can end.

A plugin is installed from a marketplace, not from a bare path, so the repo ships its own one-entry marketplace manifest and you add that first:

git clone <this repo> ~/needle-mcp
cd ~/needle-mcp && npm install && npm run build   # required: the plugin runs dist/
claude plugin marketplace add ~/needle-mcp
claude plugin install needle-mcp@needle-mcp

Then restart Claude Code. MCP tool connections are established at session start, so a plugin installed mid-session is not picked up until the next one.

npm run build is not optional here: plugin.json launches dist/index.js and the Stop hook imports dist/tools/validateRca.js. Without it you get a server that will not start and a hook that fails open — enforcement silently off.

The plugin path needs a checkout because the hook and skill are files Claude Code loads from disk, not things the MCP protocol can deliver.

Claude Desktop / other MCP hosts

Add to your MCP config (e.g. claude_desktop_config.json):

{
  "mcpServers": {
    "needle-mcp": {
      "command": "npx",
      "args": ["-y", "needle-mcp"],
      "env": { "NEEDLE_MCP_CONFIG_DIR": "/absolute/path/to/your/config/dir" }
    }
  }
}

No plugin mechanism exists on these hosts, so there's no Stop-hook enforcement — validate_rca is a tool your session can call (and the methodology is delivered via the server's MCP instructions/prompts), but following it is best-effort, not guaranteed. This is a known, accepted tradeoff, not parity with the Claude Code experience.

claude.ai

Run with the HTTP transport and register it as a remote MCP server:

npx needle-mcp --http 8000

Developing

npm install
npm test          # vitest, 207 tests
npm run typecheck # tsc --noEmit, strict
npm run build     # emits dist/

Configure your own sources (optional)

You almost certainly already have MCPs for your vendors — needle-mcp is designed to compose with those, not replace them. Only fill in adapters.yaml for a backend that genuinely has no MCP (an in-house log API, for example):

cp adapters.example.yaml adapters.yaml
cp topology.example.yaml topology.yaml
# edit both — adapters.yaml has 3 working reference configs (Loki, OpenSearch,
# Splunk-style) to copy from; topology.yaml already has vendor-generic
# coverage facts, add your own resource types as needed.

Both files are read from NEEDLE_MCP_CONFIG_DIR (falling back to CLAUDE_PROJECT_DIR, then the process cwd). Set it explicitly — an MCP server launched by a desktop host inherits an unpredictable working directory, so relying on cwd usually means your config is silently never found.

How you actually use it

Ask a question. The common case. You already have your vendor MCPs connected; needle-mcp supplies the method and the final check.

"Why is checkout 500ing in prod since 10am?"

Claude establishes the environment and window, queries your own Datadog/Splunk/ Loki tools, applies the five rules from the bundled methodology, and calls validate_rca on its own draft before answering.

Start from an identifier. A session id, request id, or trace id and nothing else.

"RCA for session sess_abc123XYZ"

Claude calls plan_investigation, which classifies the id, lists every vendor spelling it may appear under, names which sources can answer for it, and sets the right time window — then fans out across your connected tools.

Start from a screenshot. Paste it. Claude reads it directly (it is multimodal), pulls the failing URL/status/timestamp out of the image, and goes from there. There is no tool call needed for this and you should not make one.

Start from a HAR. Export the browser's Network tab, then:

"Run analyze_visual_evidence on ~/Downloads/checkout.har"

You get back only the failed and slow requests with their correlation headers, redacted — the fastest path from "the UI is broken" to a backend trace id.

5-minute first run (zero vendor MCPs required)

  1. Install needle-mcp as above — no other MCP needed for this walkthrough.

  2. Export your browser's Network tab as a HAR for the failing request.

  3. Ask Claude: "use analyze_visual_evidence on this HAR to find what failed."

  4. Feed the returned correlation headers/request id into correlate_ids if you have more log snippets to tie together.

  5. If you have an in-house log API, add it to adapters.yaml and ask Claude to query_generic_source it with the request id.

  6. Ask Claude to write the RCA — it calls validate_rca on its own draft and emits a fenced BEGIN_NEEDLE_MCP_RESULT_JSON envelope before finalizing.

Tools

Tool

Purpose

plan_investigation

Start here from a bare session/request/trace id: classifies it, gives every vendor spelling, names which sources can answer, sets the window

correlate_ids

Extract & rank correlation IDs across log snippets you've already collected, including async (message/job id) hops

analyze_visual_evidence

Parse a HAR/network-tab export (redacted). Not needed for screenshots — read those directly

query_generic_source

Config-templated REST query for a backend with no dedicated MCP — use only as a last resort

list_generic_sources

List what's declared in adapters.yaml

get_coverage

Look up whether a surface covers/is blind to a resource type, from topology.yaml

validate_rca

Deterministically lint a draft RCA envelope before you post it

Known limitations (v1)

  • query_generic_source supports static-header and HTTP-basic auth only — no OAuth client-credentials flows. Write a small dedicated MCP server for those instead.

  • analyze_visual_evidence's raw-image path can approach the ~1MB single-message size ceiling most MCP transports impose, on large screenshots.

  • validate_rca's investigation_log is self-reported by the host, not independently observed — a fabricated log cannot be caught here.

  • Enforcement is only non-optional on Claude Code (via the plugin's Stop hook). On Claude Desktop and claude.ai, validate_rca is a tool the session can decline to call.

  • Pinned to mcp>=1.9.0,<2: mcp 2.x renamed FastMCP to MCPServer. Porting is tracked as a follow-up.

Available Tools

7 tools
analyze_visual_evidenceA

Extract structured evidence from a HAR / browser network-tab export: failed and slow requests, with correlation headers, redacted.

If you already have a screenshot in your own context, reason about it directly — do NOT pass it here. The image_base64 parameter returns the image unchanged (this tool runs no vision model), so round-tripping one you can already see just puts a second copy in your context. Pass it only if you need the image echoed back alongside HAR findings.

ParametersJSON Schema
NameRequiredDescriptionDefault
contextNo
har_jsonNo
har_pathNo
image_base64No
slow_threshold_msNo

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden, and it does so well. It discloses that the tool runs no vision model, returns images unchanged, redacts evidence, and focuses on failed/slow requests. This prevents false expectations about image analysis.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded. The first sentence states the core function, and the second paragraph adds a necessary and behaviorally important caveat. Every sentence earns its place without filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the core behavior and a major misuse case clearly. The main gap is that it does not explain how an agent should supply HAR data via har_json versus har_path, or what the context parameter is for.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description partially compensates: it explains image_base64's echo-only behavior and implies slow_threshold_ms relates to slow requests. However, the roles of context, har_json, and har_path are left implicit, relying on parameter names alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action and resource: extract structured evidence from a HAR / browser network-tab export, listing failed and slow requests, correlation headers, and redaction. It also corrects the misleading 'visual' in the tool name by explicitly saying it runs no vision model.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use guidance: use it to extract HAR-based evidence, and explicitly warns against passing a screenshot the model already has. It also explains the only case where image_base64 should be passed, which is clear usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

correlate_idsB

Extract and rank correlation IDs (request/trace/span/message/job) shared across log snippets you've already collected elsewhere. Use this to carry an identifier forward across a sync-to-async hop (e.g. an HTTP request into a Kafka consumer).

ParametersJSON Schema
NameRequiredDescriptionDefault
evidence_snippetsYes

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden for behavioral disclosure. It implies the tool mutates no state ('extract and rank' is read-only) but doesn't explicitly state it's non-destructive. More importantly, it doesn't disclose what happens if evidence_snippets contains no shared IDs, how ranking works, or whether it has side effects. For a tool with no annotation coverage, this is a notable gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with zero waste. The core action is stated first, followed by a concrete use case. Every word earns its place, and it's appropriately sized for a simple tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity (one required param, no output schema, no annotations), the description is mostly complete for calling the tool. It covers what it does and when to use it. However, it lacks detail on the output format (what 'rank' means) and edge cases (e.g., empty input), which would be useful but not critical. It's adequate but could be enhanced.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but there's only one parameter, evidence_snippets, and the description clarifies it means log snippets already collected elsewhere. This adds meaning beyond the mere array-of-strings type. However, the description doesn't clarify expected format (e.g., raw log lines vs. structured JSON), which would help. Baseline 3 is appropriate given the single parameter and minimal description coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (extract and rank correlation IDs) and the resource (correlation IDs across log snippets), and it gives a concrete example use case (sync-to-async hop). This distinguishes it from the listed siblings, which are investigation planning, visual evidence analysis, querying sources, coverage, and RCA validation. However, it does not explicitly name a sibling to contrast with, and the verb 'correlate' is slightly less specific than 'extract and rank.'

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides context on when to use it: when you have log snippets already collected and need to carry an identifier forward across an async hop. It implies it's for analysis after evidence collection, differentiating from query_generic_source and list_generic_sources which are for gathering sources. However, it doesn't explicitly say when NOT to use it or mention alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_coverageA

Look up which observability surfaces cover (or are blind to) a resource type, from topology.yaml. If unknown_coverage is true, you may NOT conclude absence from an empty query result for this resource type.

ParametersJSON Schema
NameRequiredDescriptionDefault
resource_typeYes

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It discloses a non-obvious behavior: an empty query result does not prove absence when unknown_coverage is true. This is a valuable caveat beyond the schema. It does not mention return format or side effects, but the core behavioral risk is addressed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two focused sentences: the first states what the tool does and its data source; the second adds a crucial edge-case warning. Every sentence earns its place, and the most important caveat is clearly highlighted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is adequate for a one-parameter lookup, and the unknown_coverage caveat is valuable. However, there is no output schema, and the description does not explain the shape of the response, how unknown_coverage is represented in the result, or how this tool relates to the sibling query/list tools. This leaves some burden on the agent to infer behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides only a bare 'resource_type' string with no description. The tool description clarifies that the value refers to a resource type known to topology.yaml Icaria, which adds some context. However, it does not give allowed values, examples, or details on how the resource_type must be formatted, so compensation for the 0% schema coverage is only partial.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific operation ('look up which observability surfaces cover') and a concrete data source ('from topology.yaml'). It also distinguishes itself from siblings like query_generic_source and list_generic_sources by focusing on coverage rather than generic querying or listing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The intended use is clear: call this tool when you need coverage information for a resource type. It even includes an important interpretive rule about empty results when unknown_coverage is true. It stops short of explicitly naming sibling alternatives or stating when not to use it, but the context is strong.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_generic_sourcesB

List the sources declared in adapters.yaml for this deployment.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It only says 'list' without specifying read-only nature, return format, or side effects. The existence of an output schema partially mitigates this, but the description itself adds no behavioral context beyond the verb.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that states the purpose with no filler. It is concise and structured exactly as needed for a zero-parameter tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple listing tool with no parameters and an output schema, the description is adequate. It does not mention limitations or clarify the exact meaning of 'sources,' but given the low complexity, this is acceptable. The output schema likely covers return values.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and the schema coverage is 100%. According to the rubric, a baseline of 4 is appropriate since there is no parameter information needed. The description does not need to add parameter semantics because there are none.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'list' and the resource 'sources declared in adapters.yaml', making the purpose unambiguous. It doesn't explicitly contrast with sibling tools, but the verb 'list' vs 'query' suggests a read-only enumeration, which is sufficient for purpose clarity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives like query_generic_source. The description merely states what it does without any context on selection criteria or exclusions, leaving the agent to infer usage from the name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plan_investigationA

START HERE when the user hands you a bare identifier — a session id, request id, trace id, or correlation id — with no logs yet. Classifies the identifier's shape, returns every vendor spelling it may appear under, names which configured sources and coverage surfaces can answer for it, and suggests a time window (widened when the id looks async). Use correlate_ids instead once you already have log snippets in hand.

ParametersJSON Schema
NameRequiredDescriptionDefault
identifierYes
environmentNo

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It reveals meaningful behavior: classification, vendor spellings, source mapping, and time-window widening for async ids. It stops short of explicitly stating whether any underlying source queries are executed or whether the operation is strictly read-only, leaving a small but not critical gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is tight and front-loaded. The first words 'START HERE' immediately signal the primary use case, the middle sentence enumerates the tool's outputs efficiently, and the final sentence names the alternative. No filler or tautological phrasing exists.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema and no annotations, yet the description covers the main triggering scenario, the outputs, and the key sibling. The only notable gaps are the undocumented environment parameter and the lack of an explicit statement that the tool does not perform direct source queries, preventing a perfect score.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It richly explains the required identifier parameter with examples like 'session id, request id, trace id, or correlation id.' However, the optional environment parameter is never mentioned, so its role and accepted values remain unclear.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states what the tool does: it classifies the identifier's shape, returns vendor spellings, names answering sources and coverage surfaces, and suggests a time window. It also distinguishes itself from the sibling correlate_ids, so an agent can tell them apart without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It opens with an explicit trigger condition: 'START HERE when the user hands you a bare identifier... with no logs yet.' It also gives a clear alternative path: 'Use correlate_ids instead once you already have log snippets in hand,' which is direct guidance for choosing among siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

query_generic_sourceA

Query a source declared in adapters.yaml via a config-templated REST call. Use ONLY when no vendor MCP (Datadog/Splunk/Loki/etc.) already covers this source — prefer your own connected MCPs first.

ParametersJSON Schema
NameRequiredDescriptionDefault
endYes
startYes
cursorNo
paramsYes
sourceYes

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries the full behavioral burden. It reveals the tool is a config-templated REST query, but does not state whether it is read-only, how pagination/cursor works, what the response looks like, or what failures/errors may occur. Too much behavior is left undisclosed for a tool with zero annotation support.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences, front-loaded with the core purpose and immediately followed by the critical usage constraint. Every sentence earns its place with no redundant filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers purpose and tool selection but leaves essential invocation context missing: parameter semantics, cursor/pagination behavior, expected request shape, and return format. With no annotations and no output schema, this is insufficient for an agent to call the tool confidently on its first attempt.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the description provides no explanation of source, params, start, end, or cursor. The params object is open-ended (additionalProperties: true), so an agent has no idea what keys or value formats to supply. The description does nothing to compensate for the schema's silence.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('Query') and a specific resource ('a source declared in adapters.yaml'), plus the mechanism ('config-templated REST call'). This clearly distinguishes the tool from siblings like list_generic_sources and makes its scope unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit when-to-use rule: 'Use ONLY when no vendor MCP (Datadog/Splunk/Loki/etc.) already covers this source' and tells the agent to prefer connected MCPs first. This is direct, actionable routing guidance with no ambiguity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

validate_rcaA

Deterministically lint a draft RCA's structured claim before you post it. Call this before finalizing any RCA, and emit the envelope fenced between BEGIN_NEEDLE_MCP_RESULT_JSON and END_NEEDLE_MCP_RESULT_JSON — on Claude Code a Stop hook re-runs this check against that block regardless.

ParametersJSON Schema
NameRequiredDescriptionDefault
claim_jsonYes
investigation_logNo

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral burden. It discloses that validation is deterministic, that the result should be emitted inside a specific envelope, and that a Stop hook re-runs the check. This is valuable context beyond what the schema provides, though it does not describe failure behavior or side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: the primary purpose comes first, followed by the crucial calling convention. Every sentence earns its place, and there is no redundant restatement of the tool name or schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers when to call the tool and how to format the output envelope, which is useful. However, with no output schema and no parameter explanations, the agent still lacks enough detail to know what a valid 'structured claim' looks like or how to populate investigation_log correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description never explicitly explains claim_json or investigation_log. The phrase 'structured claim' hints at claim_json's purpose, but the agent is left without guidance on the expected claim structure, required fields, or how investigation_log affects validation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action and resource: 'deterministically lint a draft RCA's structured claim before you post it.' This clearly differentiates validate_rca from the sibling tools, which handle correlation, investigation planning, source queries, and visual evidence — none of which are about validating a draft claim.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit usage context: 'Call this before finalizing any RCA.' It also explains the special Stop-hook behavior on Claude Code. It does not name alternative tools or exclusions, but the timing guidance is clear enough for an agent to know when to invoke it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 7 tool updatesv0.1.0
    • First observedanalyze_visual_evidence
    • First observedcorrelate_ids
    • First observedget_coverage
    • First observedlist_generic_sources
    • First observedplan_investigation
    • First observedquery_generic_source
    • First observedvalidate_rca

TDQS

A4.1/5.0

Scored across 7 tools

Disambiguation5/5

Each tool targets a distinct stage of the investigation workflow: plan_investigation starts from a bare identifier, correlate_ids handles already-collected snippets, generic source query/list handle adapter access, get_coverage handles topology, analyze_visual_evidence handles HAR, and validate_rca handles output. The only near pair is explicitly disambiguated in the descriptions.

Naming Consistency5/5

All tool names follow a consistent verb_noun snake_case pattern (plan_investigation, query_generic_source, list_generic_sources, validate_rca). There is no style mixing or vague verb usage.

Tool Count5/5

Seven tools is a well-scoped set for an observability/RCA investigation server. Each tool maps to a distinct workflow step without redundancy or bloat.

Completeness5/5

The tool surface covers the full investigation lifecycle: identifying a trace ID, querying sources, listing sources, checking coverage, correlating IDs across snippets, analyzing HAR evidence, and validating the final RCA. Vendor-specific log retrieval is intentionally deferred to connected MCPs, so there is no obvious dead-end in the intended workflow.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • F
    license
    Not graded
    quality
    D
    maintenance
    Enables AI-driven incident response by connecting Claude to monitoring tools like Prometheus, Grafana, Loki, PagerDuty, and Slack for automated investigation and runbook generation.
    9
    -
  • A
    license
    A
    quality
    D
    maintenance
    Wraps Claude Code as tools for MCP clients, enabling autonomous coding tasks via a 4-tool lifecycle with session management, async polling, and permission controls.
    4
    43 npm
    20
    MIT
  • A
    license
    A
    quality
    A
    maintenance
    Enables causal root cause analysis with 56 tools covering causal graph construction, 10 RCA model families plus 3 dedicated PyRCA algorithms (Salesforce PyRCA, BSD-3-Clause), multi-model consensus, and PDF/HTML/Excel/Markdown report generation. Works with Claude, Ollama, Groq, OpenAI, Gemini, LangChain, Cursor — 10 providers.
    2
    56
    407 PyPI
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables searching and browsing past Claude Code sessions via hybrid FTS5 and vector search, with tools for session search, drill-down, coverage, and health reporting.
    26 npm
    1
    Apache 2.0