grounded-kql-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| PYTHONPATH | No | Path to the src directory, needed when running from source without installing the package. | |
| KQLMCP_BACKEND | No | Set to 'local' to run with no Azure dependency, or 'azure' to run against a real Log Analytics workspace. | |
| KQLMCP_LA_WORKSPACE_ID | No | The customer id of the Log Analytics workspace. Required when KQLMCP_BACKEND is 'azure'. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| describe_environmentA | Describe the network topology and the available log tables. Call this first when you are unsure which addresses, VMs or tables exist. |
| trace_connectionA | Trace one conversation across every log source on its path and report where it stopped. Use this for 'why can't A reach B' questions. Correlates Cisco ISE identity, on-premises Cisco IOS ACLs, hub PaloAlto firewall sessions and VNet flow logs at both NICs. |
| search_flowsC | Search Azure VNet flow logs. direction is Inbound or Outbound; action is Allow or Deny. Answers whether traffic left or arrived at a NIC. |
| search_firewall_sessionsC | Search PaloAlto sessions on the hub firewalls. action is allow, deny, drop or reset-both. Returns the security rule that made the decision. |
| search_onprem_device_logsC | Search Cisco IOS syslog from on-premises routers and switches: ACL permit and deny hits, interface state changes. action is permitted or denied. |
| lookup_user_sessionsB | Cisco ISE authentication events. Give an endpoint_ip to find who was using an on-premises address, or a user_name to find their endpoints. result is Passed or Failed. |
| top_denied_trafficC | Rank firewall denies. group_by is one of RuleName, SrcIp, DstIp, Application, DstPort. |
| traffic_volumeB | Top talkers by bytes from the flow logs. group_by is one of VmName, VnetName, SrcIp, DstIp, DstPort, Direction. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 8 tools
Each tool has a distinct purpose: environment discovery, connection tracing, and specialized searches on different log sources. The two flow log tools (search_flows and traffic_volume) differ in scope (detailed search vs. aggregate top talkers), but an agent might occasionally confuse them when seeking traffic summaries. Overall boundaries are clear.
Most names follow a verb_noun pattern (describe_environment, trace_connection, search_flows, etc.), but 'traffic_volume' lacks a verb and 'top_denied_traffic' uses a different structure. The inconsistency is minor and names remain readable.
8 tools are well-scoped for a network troubleshooting server covering multiple log sources. Each tool serves a distinct investigative need without redundancy, fitting the typical 3-15 range.
The set covers discovery, tracing, and searches across logs, but lacks operations for modifying or configuring network elements (e.g., create/update rules, manage devices). For a diagnostic-focused server, completeness is partial; it's read-only and missing lifecycle operations.