Extract and rank correlation IDs (request/trace/span/message/job) shared across log snippets you've already collected elsewhere. Use this to carry an identifier forward across a sync-to-async hop (e.g. an HTTP request into a Kafka consumer).

START HERE when the user hands you a bare identifier — a session id, request id, trace id, or correlation id — with no logs yet. Classifies the identifier's shape, returns every vendor spelling it may appear under, names which configured sources and coverage surfaces can answer for it, and suggests a time window (widened when the id looks async). Use correlate_ids instead once you already have log snippets in hand.

Extract structured evidence from a HAR / browser network-tab export: failed and slow requests, with correlation headers, redacted.

If you already have a screenshot in your own context, reason about it directly — do NOT pass it here. The image_base64 parameter returns the image unchanged (this tool runs no vision model), so round-tripping one you can already see just puts a second copy in your context. Pass it only if you need the image echoed back alongside HAR findings.

Query a source declared in adapters.yaml via a config-templated REST call. Use ONLY when no vendor MCP (Datadog/Splunk/Loki/etc.) already covers this source — prefer your own connected MCPs first.

List the sources declared in adapters.yaml for this deployment.

Look up which observability surfaces cover (or are blind to) a resource type, from topology.yaml. If unknown_coverage is true, you may NOT conclude absence from an empty query result for this resource type.

Deterministically lint a draft RCA's structured claim before you post it. Call this before finalizing any RCA, and emit the envelope fenced between BEGIN_NEEDLE_MCP_RESULT_JSON and END_NEEDLE_MCP_RESULT_JSON — on Claude Code a Stop hook re-runs this check against that block regardless.