Skip to main content
Glama

VMware AVI

Author: Wei Zhou, VMware by Broadcom — wei-wz.zhou@broadcom.com This is a community-driven project by a VMware engineer, not an official VMware product. For official VMware developer tools see developer.broadcom.com.

English | 中文

AVI (NSX Advanced Load Balancer) management and AKO Kubernetes operations tool — 28 tools across 10 categories.

Dual mode: Traditional AVI Controller management + AKO K8s operations in one skill.

Companion skills handle everything else:

Skill

Scope

Install

vmware-aiops

VM lifecycle, deployment, guest ops, cluster

uv tool install vmware-aiops

vmware-monitor

Read-only: inventory, health, alarms, events

uv tool install vmware-monitor

vmware-storage

Datastores, iSCSI, vSAN management

uv tool install vmware-storage

vmware-vks

Tanzu Namespaces, TKC cluster lifecycle

uv tool install vmware-vks

vmware-nsx

NSX networking: segments, gateways, NAT

uv tool install vmware-nsx-mgmt

vmware-nsx-security

DFW firewall rules, security groups

uv tool install vmware-nsx-security

vmware-aria

Aria Ops: metrics, alerts, capacity

uv tool install vmware-aria

PyPI Python License: MIT ClawHub


Upgrading to 2.0

2.0 renames all 28 MCP tools so every name starts with a verb (e.g. ako_amko_status → get_ako_amko_status, ako_clusters → list_ako_clusters, ako_config_diff → diff_ako_config). The full old → new table is in RELEASE_NOTES.md. Nothing else changes: same tools, parameters, safety gates and CLI commands. If an agent prompt, script or ~/.vmware/rules.yaml names a tool, update it — though deny rules written with the old names keep working with vmware-policy ≥ 1.18 (vmware-audit policy lists any rule the renames widened), and vmware-pilot ≥ 1.13 translates old names in saved workflows. If an install older than 2.0 shares that rules.yaml, give it vmware-policy ≥ 1.18.2 too: it matches each rule against both the old and the new name, so one file serves both.

Related MCP server: vSphere-MCP-Pro

Quick Install

# Via uv (recommended)
uv tool install vmware-avi

# Or via pip
pip install vmware-avi

# China mainland mirror
pip install vmware-avi -i https://pypi.tuna.tsinghua.edu.cn/simple

# Verify installation
vmware-avi doctor

Offline / Air-Gapped Install (from source)

This project uses the modern PEP 517 build system (hatchling), so there is no setup.py by design — that is expected, not a missing file. If you cloned the source and hit ERROR: File "setup.py" or "setup.cfg" not found ... editable mode currently requires a setuptools-based build, your pip is older than 21.3 and cannot do an editable (-e) install with a non-setuptools backend. Editable mode is a developer convenience, not needed to run the tool — do one of:

# From the source tree — a normal (non-editable) install builds a wheel:
pip install .              # NOT  pip install -e .

# ...or upgrade pip first, and editable works too:
pip install --upgrade pip && pip install -e .

For a truly air-gapped host, build the wheels on a connected machine and copy them over — the target then needs no network:

# On a connected machine, collect this package + its dependencies as wheels:
pip wheel . -w dist        # → dist/*.whl   (or: uv build, for just this package)

# Copy dist/ to the air-gapped host, then install offline:
pip install --no-index --find-links dist vmware-avi

Capabilities Overview

What This Skill Does

Category

Tools

Count

Virtual Service

list, status, enable/disable

3

Pool Member

pool discovery, member list, enable/disable member (drain/restore traffic)

4

SSL Certificate

list, expiry check

2

Analytics

VS metrics overview, request error logs

2

Service Engine

list, health check

2

AKO Pod Ops

status, logs, restart, version info

4

AKO Config

values.yaml view, Helm diff, Helm upgrade

3

Ingress Diagnostics

annotation validation, VS mapping, error diagnosis, fix recommendation

4

Sync Diagnostics

K8s-Controller comparison, inconsistency list, force resync

3

Multi-cluster

cluster list, cross-cluster AKO overview, AMKO status

3

CLI vs MCP: Which Mode to Use

Scenario

Recommended

Why

Local/small models (Ollama, Qwen)

CLI

~2K tokens vs ~8K for MCP

Cloud models (Claude, GPT-4o)

Either

MCP gives structured JSON I/O

Automated pipelines

MCP

Type-safe parameters, structured output

AKO troubleshooting

CLI

Interactive log tailing, Helm diff output

Rule of thumb: Use CLI for cost efficiency and small models. Use MCP for structured automation with large models.

Architecture

User (Natural Language)
  |
AI CLI Tool (Claude Code / Gemini / Codex / Cursor / Trae)
  | reads SKILL.md
  |
vmware-avi CLI
  |--- avisdk (AVI REST API) ---> AVI Controller ---> Virtual Services / Pools / SEs
  |--- kubectl / kubernetes ---> K8s Cluster ---> AKO Pods / Ingress / Services

Configuration

Step 1: Create Config Directory

mkdir -p ~/.vmware-avi
vmware-avi init          # generates config.yaml and .env templates
chmod 600 ~/.vmware-avi/.env

Step 2: Edit config.yaml

controllers:
  - name: prod-avi
    host: avi-controller.example.com
    username: admin
    api_version: "22.1.4"
    tenant: admin
    port: 443
    verify_ssl: true

default_controller: prod-avi

ako:
  kubeconfig: ~/.kube/config
  default_context: ""
  namespace: avi-system

Step 3: Set Passwords

Create ~/.vmware-avi/.env:

# AVI Controller passwords
# Format: {CONTROLLER_NAME_UPPER}_PASSWORD
PROD_AVI_PASSWORD=your-password-here

Password environment variable naming convention:

{CONTROLLER_NAME_UPPER}_PASSWORD
# Replace hyphens with underscores, UPPERCASE
# Example: controller "prod-avi" -> PROD_AVI_PASSWORD
# Example: controller "staging-alb" -> STAGING_ALB_PASSWORD

Step 4: Verify

vmware-avi doctor    # checks Controller connectivity + kubeconfig + avisdk

CLI Usage

Virtual Service Management

# List all virtual services
vmware-avi vs list [--controller prod-avi]

# Check status of a specific VS
vmware-avi vs status my-webapp-vs

# Enable / disable a VS (disable requires double confirmation)
vmware-avi vs enable my-webapp-vs
vmware-avi vs disable my-webapp-vs

Pool Member Drain / Restore

# List pool members and health status
vmware-avi pool members my-pool

# Graceful drain (disable) — double confirmation required
vmware-avi pool disable my-pool 10.1.1.5

# Restore traffic (enable)
vmware-avi pool enable my-pool 10.1.1.5

SSL Certificate Expiry Check

# List all certificates
vmware-avi ssl list

# Check certificates expiring within 30 days
vmware-avi ssl expiry --days 30

Analytics and Error Logs

# VS analytics: throughput, latency, error rates
vmware-avi analytics my-webapp-vs

# Request error logs
vmware-avi logs my-webapp-vs --since 1h

Service Engine Health

# Name, mgmt IP, operational status, SE group — status sourced from the
# serviceengine-inventory endpoint (config + runtime merged)
vmware-avi se list

# Per-SE operational status + connected-VS counts
vmware-avi se health

AKO Troubleshooting

# Check AKO pod status
vmware-avi ako status [--context my-k8s-context]

# View AKO logs
vmware-avi ako logs [--tail 100] [--since 30m]

# Restart AKO pod (double confirmation)
vmware-avi ako restart

# Show AKO version
vmware-avi ako version

AKO Helm Config Management

The AKO Helm release is discovered automatically (official installs use helm install --generate-name, so the release is not named ako). Upgrades pull the official Broadcom OCI chart oci://projects.packages.broadcom.com/ako/helm-charts/ako with --reuse-values.

# View current AKO Helm values (release auto-discovered)
vmware-avi ako config show

# Show pending changes (diff against the official OCI chart)
vmware-avi ako config diff

# Helm upgrade (double confirmation + --dry-run default)
vmware-avi ako config upgrade

Ingress Diagnostics

# Validate Ingress annotations
vmware-avi ako ingress check <namespace>

# Show Ingress-to-VS mapping
vmware-avi ako ingress map

# Diagnose why an Ingress has no VS
vmware-avi ako ingress diagnose <ingress-name>

Sync Diagnostics

# Check K8s-Controller sync status
vmware-avi ako sync status

# Show inconsistencies between K8s and Controller
vmware-avi ako sync diff

# Force AKO resync (double confirmation)
vmware-avi ako sync force

Multi-cluster AKO

# List every kube-context and whether AKO runs there
vmware-avi ako clusters

# Cross-cluster AKO status overview
vmware-avi ako cluster-overview

# AMKO GSLB status
vmware-avi ako amko status

MCP Server

The MCP server exposes all 28 tools via the Model Context Protocol. Works with any MCP-compatible client.

After uv tool install vmware-avi, start the MCP server with one command (v1.5.15+):

# Recommended — single command, no network re-resolve
vmware-avi mcp

# With custom config path
VMWARE_AVI_CONFIG=/path/to/config.yaml vmware-avi mcp

Claude Desktop Config

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "vmware-avi": {
      "command": "vmware-avi",
      "args": ["mcp"],
      "env": {
        "VMWARE_AVI_CONFIG": "~/.vmware-avi/config.yaml"
      }
    }
  }
}
# Run without installing (requires PyPI access each launch)
uvx --from vmware-avi vmware-avi mcp

# Legacy entry point (still works, kept for backward compatibility)
vmware-avi-mcp

Behind a corporate TLS proxy? uvx may fail with invalid peer certificate: UnknownIssuer. Use the recommended vmware-avi mcp form above (no network needed), or set UV_NATIVE_TLS=true.

MCP Tools (28)

Category

Tools

Virtual Service (3)

list_virtual_services, get_virtual_service_status, set_virtual_service_enabled

Pool Member (4)

list_lb_pools, list_lb_pool_members, enable_lb_pool_member, disable_lb_pool_member

SSL Certificate (2)

list_ssl_certs, check_ssl_cert_expiry

Analytics (2)

get_virtual_service_analytics, get_virtual_service_error_logs

Service Engine (2)

list_service_engines, get_service_engine_health

AKO Pod (4)

get_ako_status, get_ako_logs, restart_ako, get_ako_version

AKO Config (3)

get_ako_config, diff_ako_config, upgrade_ako_config

Ingress Diagnostics (3)

check_ako_ingress, list_ako_ingresses, diagnose_ako_ingress

Sync Diagnostics (3)

get_ako_sync_status, diff_ako_sync, force_ako_sync

Multi-cluster (2)

list_ako_clusters, get_ako_amko_status


Common Workflows

1. Maintenance Window -- Drain a Pool Member

When taking a backend server offline for patching:

  1. List pool members and health status

    vmware-avi pool members my-pool
  2. Disable the target server (graceful drain)

    vmware-avi pool disable my-pool 10.1.1.5
  3. Monitor analytics to confirm active connections are draining

    vmware-avi analytics my-vs
  4. Perform maintenance on the server

  5. Re-enable the server

    vmware-avi pool enable my-pool 10.1.1.5
  6. Verify health status is green

    vmware-avi pool members my-pool

2. AKO Ingress Not Creating VS

When a developer reports their Ingress is not producing a Virtual Service:

  1. Verify AKO is running

    vmware-avi ako status
  2. Validate Ingress annotations

    vmware-avi ako ingress check <namespace>
  3. Check sync status between K8s and Controller

    vmware-avi ako sync status
  4. If annotations are wrong, diagnose the specific Ingress

    vmware-avi ako ingress diagnose <ingress-name>
  5. If sync drift is detected, review the diff and force resync if needed

    vmware-avi ako sync diff
    vmware-avi ako sync force

3. SSL Certificate Expiry Audit

Expired certificates cause outages. Run periodic checks:

  1. Check all certificates expiring within 30 days

    vmware-avi ssl expiry --days 30
  2. Review which VS uses each expiring certificate (output includes VS mapping)

  3. Plan renewal with the certificate team

  4. After renewal, verify the new certificate is in place

    vmware-avi ssl list

Troubleshooting

"Controller unreachable" error

  1. Run vmware-avi doctor to verify connectivity

  2. Check if the controller address and port are correct in ~/.vmware-avi/config.yaml

  3. For self-signed certs: set verify_ssl: false in config.yaml (lab environments only)

AKO Pod in CrashLoopBackOff

  1. Check logs: vmware-avi ako logs --tail 50

  2. Common causes: wrong controller IP in values.yaml, network policy blocking AKO to Controller, expired credentials

  3. Fix config: vmware-avi ako config show to inspect, then vmware-avi ako config upgrade with corrected values (release auto-discovered; pulls the official Broadcom OCI chart)

Ingress created but no VS on Controller

  1. Validate annotations: vmware-avi ako ingress check <namespace>

  2. Check AKO logs for rejection reason: vmware-avi ako logs --since 5m

  3. Run sync diff: vmware-avi ako sync diff to see if the object is stuck

Pool member shows "down" after enable

Health monitor may still be failing. The member is enabled but unhealthy. Check the actual health status on the Controller side. Fix the backend service first, then the health status will auto-recover.

SSL expiry check shows 0 certificates

Verify the controller connection has tenant-level access. Certificates are tenant-scoped in AVI. The configured user may only see certs in their tenant.

AKO sync force has no effect

Force resync triggers AKO to re-reconcile all K8s objects. If the drift persists, the issue is likely in the K8s resource definition itself (bad annotation, missing secret). Use vmware-avi ako ingress diagnose to pinpoint the root cause.


Safety Features

Feature

Details

Double Confirmation

Destructive ops (VS disable, pool member disable, AKO restart, Helm upgrade, force resync) require 2 sequential confirmations

Dry-Run Default

ako config upgrade defaults to --dry-run mode -- user must explicitly confirm to apply

MCP Blast Radius

set_virtual_service_enabled, disable_lb_pool_member, restart_ako, force_ako_sync and upgrade_ako_config take confirm (default false): a call without confirm=true returns blast_radius (what would change: VS/pool and member counts, the AKO pod and its Ingresses, the Helm release and chart move) and changes nothing. confirm=true is refused on a blocker (the pool's only enabled member, a terminating AKO pod, a failing helm --dry-run) or an unreadable field. confirmed / dry_run are deprecated aliases

Audit Trail

All operations logged to ~/.vmware/audit.db via vmware-policy (@vmware_tool decorator)

Password Protection

.env file loading with permission check; never in shell history

SSL Support

verify_ssl: false for self-signed certs in isolated lab environments only

Prompt Injection Protection

All API-sourced text truncated (500 chars max) and C0/C1 control characters stripped

Input Validation

Pool names, VS names, IP addresses, and namespace names validated before API calls

Security Details

  • Source Code: github.com/vmware-skills/VMware-AVI

  • Config File Contents: config.yaml stores controller addresses, usernames, and AKO settings. No passwords or tokens. All secrets stored exclusively in .env

  • Webhook Data Scope: Disabled by default. No third-party data transmission

  • TLS Verification: Enabled by default. Disable only for self-signed certificate environments

  • Prompt Injection Protection: _sanitize() truncation + control character cleanup on all AVI API responses

  • Least Privilege: Use a dedicated AVI service account with minimal permissions. AKO operations require only namespace-scoped kubeconfig access


Companion Skills

Skill

Scope

Tools

Install

vmware-avi

AVI load balancer, AKO K8s operations

28

uv tool install vmware-avi

vmware-aiops

VM lifecycle, deployment, guest ops, cluster

49

uv tool install vmware-aiops

vmware-monitor

Read-only monitoring, alarms, events

27

uv tool install vmware-monitor

vmware-storage

Datastores, iSCSI, vSAN

11

uv tool install vmware-storage

vmware-vks

Tanzu Namespaces, TKC cluster lifecycle

20

uv tool install vmware-vks

vmware-nsx

NSX segments, gateways, NAT, routing

33

uv tool install vmware-nsx-mgmt

vmware-nsx-security

DFW firewall, security groups, IDS/IPS

21

uv tool install vmware-nsx-security

vmware-aria

Aria Ops: metrics, alerts, capacity

28

uv tool install vmware-aria

vmware-harden

Compliance baselines, drift detection

6

uv tool install vmware-harden


Version Compatibility

AVI Controller / Environment

Support

Notes

AVI 30.x in VCF 9.1

✅ Full

avisdk 30.x line covers VCF 9.1 bundle

AVI 30.x in VCF 9.0

✅ Full

Standard AVI / NSX ALB integration

AVI 22.x — 31.x standalone

✅ Full

Pin avisdk>=22.1,<31.0

AKO 1.10+

✅ Full

Kubernetes integration via AKO ConfigMap / GatewayClass

Official Broadcom References


Troubleshooting & Contributing

If you encounter any errors or issues, please send the error message, logs, or screenshots to zhouwei008@gmail.com. Contributions are welcome -- feel free to join us in maintaining and improving this project!

Remote access (HTTPS) and limiting tools

By default vmware-avi mcp speaks stdio to one local client and offers every tool. Two options change that (vmware-policy ≥ 1.21.0).

Serve over HTTPS so clients on other machines can connect. Every caller needs a bearer token:

vmware-audit token create alice          # prints the token once; give it to alice
vmware-audit token list                  # names only
vmware-audit token revoke alice          # refused from its next request, no restart
vmware-avi mcp --transport https --host 0.0.0.0 --port 8443 \
    --cert /etc/vmware-mcp/server.pem --key /etc/vmware-mcp/server-key.pem \
    --public-name mcp.example.com

Connect a client (Claude Code shown; any MCP client that supports streamable HTTP and custom headers works):

claude mcp add --transport http vmware-avi https://mcp.example.com:8443/mcp \
    --header "Authorization: Bearer $VMWARE_MCP_TOKEN"
{
  "mcpServers": {
    "vmware-avi": {
      "type": "http",
      "url": "https://mcp.example.com:8443/mcp",
      "headers": { "Authorization": "Bearer ${VMWARE_MCP_TOKEN}" }
    }
  }
}
  • The server will not start without a token, refuses Host/Origin values outside --public-name, and checks before it binds that unauthenticated requests get 401. Use a certificate your clients trust for those names.

  • Behind a TLS-terminating reverse proxy on the same machine use --transport http --host 127.0.0.1 --public-name mcp.example.com and pass the Authorization header through.

  • Behind a load balancer or gateway on another machine, keep --transport https (a self-signed certificate is fine), list in --public-name the host name the balancer sends as Host, and have it forward Authorization. Its health probe can use GET /healthz, which needs no token and returns only {"status": "ok"} (vmware-policy ≥ 1.23.0).

  • Send traceparent or X-Request-ID with each request to have it stored on the audit row; vmware-audit log --correlation-id ID then finds the calls behind one platform request.

  • The audit log records each caller as token:<name>. Calls run side by side: each holds its own session to a Controller (or Kubernetes context), up to VMWARE_MCP_POOL_SIZE (default 2) sessions per target. Each Controller session is a login on the Controller; a call waits at most 300 s for a free one.

  • Everyone who can reach the endpoint acts with this server's account. Tokens identify callers; they grant nothing on the platform. Run one endpoint per privilege level.

  • Several people or roles on one endpoint: run vmware-audit roles enable once, then give each token a role (vmware-audit token create NAME --role reader, or a role in roles.yaml naming tools and targets; vmware-policy ≥ 1.24.0). A role limits what the token may call on this endpoint; it cannot grant more than the account has. See vmware-policy's README, "Roles for network callers".

Offer only read tools, plus the writes you choose:

vmware-avi mcp --expose read --allow-write disable_lb_pool_member
# or: VMWARE_AVI_MCP_EXPOSE=read VMWARE_AVI_MCP_ALLOW_WRITE=disable_lb_pool_member vmware-avi mcp

Tools not offered do not appear in the client's tool list. A bad value or an unknown write tool stops the server (exit 2). This limits what clients are offered; it is not authorization, so the account itself should be least-privilege.

Details: skills/vmware-avi/references/setup-guide.md ("Serving MCP over HTTPS", "Limiting which tools are offered").

License

MIT

Available Tools

28 tools
check_ako_ingressA
Read-onlyIdempotent

[READ] Validate every Ingress in one namespace: IngressClass and TLS secret references that would stop AKO creating a Virtual Service.

Returns name, IngressClass, issues and OK/ISSUES per Ingress. Run list_ako_ingresses first for namespace names; use diagnose_ako_ingress instead for one named Ingress. Covers one namespace only, and TLS checks are skipped when its secrets cannot be listed.

ParametersJSON Schema
NameRequiredDescriptionDefault
contextNoK8s context name (optional).
namespaceYesK8s namespace to check.

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnly, idempotent, non-destructive), so the bar is lower, and the description still adds real value: it discloses a degradation mode ('TLS checks are skipped when its secrets cannot be listed'), which an agent must know to interpret a clean result. It stops short of describing pagination or failure behavior on an invalid namespace.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Every sentence earns its place — purpose, return shape, prerequisite, alternative, and scope caveat — and the core action is front-loaded in the first clause. It is dense rather than padded, though the return-field enumeration is arguably redundant given an output schema exists.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter read tool with an output schema, the description covers everything an agent needs: what is validated, how to obtain a namespace, which sibling to use for the single-Ingress case, and the scope and TLS-listing limitations. Nothing required for correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for both parameters, so the baseline is 3. The description only implies namespace scoping and points at list_ako_ingresses as a source of valid names; it adds no syntax, format, or default-value detail beyond what the schema already documents.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource with explicit scope: 'Validate every Ingress in one namespace', and immediately names the two things it checks (IngressClass and TLS secret references). It also distinguishes itself from both siblings by name, so an agent can route correctly without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit when-to-use and alternatives: 'Run list_ako_ingresses first for namespace names; use diagnose_ako_ingress instead for one named Ingress.' It also states the boundary condition ('Covers one namespace only'), which is exactly the kind of disambiguation an agent needs before invoking.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_ssl_cert_expiryA
Read-onlyIdempotent

[READ] Check which SSL certificates expire within N days (default 30).

Returns name, expiry date and days remaining, soonest first. Use this instead of list_ssl_certs when you only want certificates near expiry. Expired certs are included, with negative days remaining. Certificates whose expiry could not be read are counted and named separately — they are unknown, not "not expiring".

ParametersJSON Schema
NameRequiredDescriptionDefault
daysNoReport certs expiring within this many days (default 30).

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive, so the safety profile is covered. The description adds genuinely useful behavior beyond that: expired certs are included with negative days remaining, and unreadable-expiry certs are counted separately as 'unknown, not not expiring'. That edge-case disclosure is more than the annotations provide, though rate limits/pagination are unmentioned.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core purpose, then the routing rule, then edge cases, with no filler sentences. The 'default 30' repetition is minor and the paragraph structure is easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, yet the description still flags ordering (soonest first) and the unknown-expiry category. For a single-parameter read tool this is complete enough to call correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the single 'days' parameter is fully documented in the schema, so the baseline is 3. The description restates the default of 30 but adds no format or boundary semantics (e.g., max value) beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource+scope: 'Check which SSL certificates expire within N days'. It explicitly distinguishes itself from the sibling list_ssl_certs, so an agent can choose between them without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit when-to-use rule: 'Use this instead of list_ssl_certs when you only want certificates near expiry.' The alternative and the selecting condition are both named, leaving nothing to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

diagnose_ako_ingressA
Read-onlyIdempotent

[READ] Diagnose why one Ingress has no corresponding AVI Virtual Service.

Validates IngressClass ('avi'/'avi-lb'), TLS secrets and backend Services. Returns annotations, a numbered issue list and kubectl fixes. "Not found"/"missing" is reported only for a 404; any other error reading the Ingress, a TLS secret or a backend Service says it could not be read (with the HTTP status). Use list_ako_ingresses first to find Ingresses lacking a VS. Checks configuration only; when it is clean, try get_ako_logs and get_ako_sync_status.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesExact Ingress resource name.
contextNokubeconfig context (optional), from list_ako_clusters.
namespaceNoNamespace holding the Ingress (default 'default').default

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already carry the safety profile (readOnlyHint, idempotentHint, destructiveHint=false), but the description adds real behavioral detail beyond them: the exact validation targets (IngressClass 'avi'/'avi-lb', TLS secrets, backend Services) and a precise error contract distinguishing a true 404 'Not found' from any other failure, which is reported as 'could not be read' with the HTTP status. It stops short of describing permissions or rate limits, so 4 rather than 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose and then layered with validation scope, error semantics and routing in a logical order; every sentence carries usable information. The 'Returns annotations, a numbered issue list and kubectl fixes' clause is somewhat wasted since an output schema exists, which keeps it from a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-resource diagnostic with four annotations and an output schema, the description supplies everything an agent needs to call it correctly: when to reach for it, what it inspects, how errors are reported, and where to go next. Nothing material is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so name, namespace and context are fully documented in the schema and the description does not need to compensate. The description adds no param-level detail beyond the schema (the 'avi'/'avi-lb' values describe a validated field, not an input), so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Starts with a specific verb+resource ('Diagnose why one Ingress has no corresponding AVI Virtual Service') and immediately narrows the scope to a single Ingress rather than the fleet. It also names the siblings that frame its position (list_ako_ingresses, get_ako_logs, get_ako_sync_status), so an agent can place it in the workflow without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states the precondition ('Use list_ako_ingresses first to find Ingresses lacking a VS') and the fallback path when this tool comes back clean ('try get_ako_logs and get_ako_sync_status'). It also declares the boundary of what it covers ('Checks configuration only'), which tells the agent when this tool is the wrong lever.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

diff_ako_configA
Read-onlyIdempotent

[READ] Pending Helm value changes that have not been applied yet.

Returns helm's diff output; empty means nothing would change. Credential values in it read <redacted> — that is this skill blanking them, not the configured value. Use this before upgrade_ako_config — it runs the same command, so the preview is real. Note: with chart_version empty the registry's moving latest is resolved, so two runs can differ with no local change; read get_ako_version and pass it to both.

ParametersJSON Schema
NameRequiredDescriptionDefault
chart_versionNoPin the chart, e.g. "1.11.1". Empty = registry latest.

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds substantial context beyond the annotations: empty output means no change, credential values are shown as `<redacted>` by the skill (not the real value), and the moving-latest caveat explains why two runs can differ with no local change. That last note nuances idempotentHint honestly rather than contradicting it.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the mode tag and core purpose, then layered caveats. Every sentence earns its place: redaction note, preview guarantee, and non-idempotence warning are all actionable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

A read-only preview tool with an output schema, so return structure needn't be repeated; the description still explains the empty-diff semantics and the redaction behavior. Nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3; the description adds real meaning by explaining that empty chart_version resolves the registry's moving latest and recommending get_ako_version be read and passed to both callers. It goes beyond the schema's terse 'Empty = registry latest.'

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: pending Helm value changes not yet applied, with `[READ]` signaling the mode. It clearly distinguishes itself from upgrade_ako_config (this is the preview of it) and from get_ako_config (current config, not pending diff).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit when-to-use: 'Use this before upgrade_ako_config — it runs the same command.' It also names the exact alternative (get_ako_version) needed when chart_version is empty. Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

diff_ako_syncA
Read-onlyIdempotent

[READ] List Ingresses with no matching Virtual Service or pool on the Controller.

Returns Type, namespace/name and Status per suspect Ingress. Use when get_ako_sync_status reports a mismatch; force_ako_sync reconciles. Shard-mode Ingresses are matched heuristically against AKO pool names, so confirm a 'Missing' result with list_lb_pools before acting.

ParametersJSON Schema
NameRequiredDescriptionDefault
contextNoK8s context name (optional).

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive, openWorld, so the safety profile is covered. The description adds real behavioral context beyond that: the per-Ingress return shape, and importantly the heuristic shard-mode matching that can produce false 'Missing' results, with a mitigation (confirm via list_lb_pools). It stops short of describing volume/pagination, so not a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the [READ] tag and a one-line purpose, then usage and caveats in tight sentences. The 'Returns Type, namespace/name and Status' sentence is somewhat redundant given an output schema exists, but the rest earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given an output schema, annotations covering safety, and full schema description coverage, the definition supplies the remaining operational context an agent needs: when to invoke, what it returns, and how to validate ambiguous results. Nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and there is only one optional 'context' parameter already documented in the schema. The description adds no syntax or format detail beyond what the schema provides, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource with scope: 'List Ingresses with no matching Virtual Service or pool on the Controller.' This is clearly distinct from sibling read tools like list_ako_ingresses and check_ako_ingress, and from the reconciliation tool force_ako_sync.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says when to use it ('Use when get_ako_sync_status reports a mismatch'), names the alternative that reconciles ('force_ako_sync reconciles'), and adds a pre-condition caveat to confirm results via list_lb_pools. When/when-not/alternatives are all present.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

disable_lb_pool_memberA
Destructive

[WRITE] Disable a pool member with graceful drain — existing connections complete, no new traffic.

Without confirm=True this only previews: it returns blast_radius (pool name and uuid, the member's IP/port/state, and how many members are enabled before and after) and changes nothing. Show that to the user and get their explicit decision. Do not set confirm=True on your own because the user asked earlier: they have not seen what it changes yet. An already disabled member returns action "noop".

Refused with confirm=True: the pool's only enabled member (the pool would serve nothing — enable another first, or use set_virtual_service_enabled on purpose), an IP that matches more than one member, and a pool whose members cannot be read. Use for maintenance or rolling deployments; run list_lb_pool_members first for the server IP, enable_lb_pool_member to reverse it.

ParametersJSON Schema
NameRequiredDescriptionDefault
poolYesExact pool name as shown by list_lb_pools — matched literally, not fuzzily, and an unknown name is refused rather than ignored. Pools are often named differently from the Virtual Services that use them, so do not infer it from a VS name.
serverYesServer IP address.
confirmNoFalse (default) returns the blast radius and changes nothing. True applies it.
confirmedNoDeprecated alias for confirm; removed in the next minor release. confirmed=False holds even when confirm=True.

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare destructiveHint=true, readOnlyHint=false, idempotentHint=false, and the description goes well beyond them: it documents the two-phase preview/apply protocol, the exact contents of blast_radius, the noop outcome for an already-disabled member, and the specific refusal conditions. For a destructive mutation this is unusually complete disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the [WRITE] tag and the drain semantics, then the confirm protocol, then refusals and usage. Dense but every sentence carries decision-relevant content. The heavily nested parentheticals slightly reduce scannability, keeping it short of a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive tool with no output schema, the description covers both possible return shapes an agent will encounter (blast_radius payload on preview, "noop" on already-disabled) plus the refusal cases. Nothing needed to invoke it safely is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds real meaning by framing confirm as a preview-versus-apply gate and explaining that the preview output must be surfaced to the user before applying. The deprecated confirmed alias is documented in both places, so it adds nothing there.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb, resource, and mechanism: "Disable a pool member with graceful drain — existing connections complete, no new traffic." This is unmistakably differentiated from the sibling enable_lb_pool_member and from set_virtual_service_enabled, which it names explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use (maintenance, rolling deployments), a prerequisite (run list_lb_pool_members first for the server IP), the inverse tool (enable_lb_pool_member), and multiple when-not conditions (already disabled → noop; sole enabled member → refused; ambiguous IP → refused). The confirm workflow guidance — "Do not set confirm=True on your own" — is exactly the kind of decision rule an agent needs.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

enable_lb_pool_memberA

[WRITE] Enable a pool member so it receives traffic again.

Returns a one-line confirmation. Use list_lb_pool_members first to verify the server IP. The server must already belong to the pool — this adds nothing.

ParametersJSON Schema
NameRequiredDescriptionDefault
poolYesExact pool name as shown by list_lb_pools — matched literally, not fuzzily, and an unknown name is refused rather than ignored. Pools are often named differently from the Virtual Services that use them, so do not infer it from a VS name.
serverYesServer IP address.

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false, destructiveHint=false, and idempotentHint=false; the description reinforces the write nature and adds genuinely new context — the confirmation output and the fact that this does not add a member that isn't already present. It leaves the non-idempotent annotation unexplained, which is a minor gap for a tool an agent might expect to be repeatable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the [WRITE] tag and the action, then adds three short sentences that each carry information (return shape, prerequisite tool, precondition). No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return details need not be elaborated, and the safety profile is covered by annotations plus the description's precondition. For a two-parameter mutation with full schema coverage, nothing needed to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the 'pool' parameter's schema text is unusually rich (literal matching, refusal of unknown names, not inferable from VS names), so the schema carries most semantic load. The description only adds the pool-membership constraint on 'server', which is baseline-appropriate given full coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Enable), resource (pool member), and effect (so it receives traffic again), immediately distinguishing it from the sibling disable_lb_pool_member. The '[WRITE]' prefix signals mutation type up front, so an agent knows exactly what class of action this is.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit pre-call sequencing ('Use list_lb_pool_members first to verify the server IP') and a strong precondition ('The server must already belong to the pool — this adds nothing'). It does not explicitly name disable_lb_pool_member as the inverse or state when-not-to-use, but the routing guidance is otherwise clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

force_ako_syncA
Destructive

[WRITE] Force AKO to resync all K8s resources with the AVI Controller.

The resync restarts the AKO pod so it rebuilds every Virtual Service, pool and VS-VIP from the cluster's current resources. Without confirm=True this only previews: it returns blast_radius (context, namespace, the pod's name, uid and phase, and the Ingresses it re-programs) and changes nothing. Show that to the user and get their explicit decision. Do not set confirm=True on your own because the user asked earlier: they have not seen what it changes yet.

Refused with confirm=True: a pod already terminating, and a pod or Ingress list that cannot be read. Use when drift is detected; may cause brief traffic disruption. Run diff_ako_sync first to see what is out of sync, then get_ako_sync_status.

ParametersJSON Schema
NameRequiredDescriptionDefault
confirmNoFalse (default) returns the blast radius and changes nothing. True applies it.
contextNoK8s context name (optional).
confirmedNoDeprecated alias for confirm; removed in the next minor release. confirmed=False holds even when confirm=True.

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true and non-idempotent, but the description goes well beyond them: it discloses the dry-run default, the exact blast_radius contents, the requirement for explicit user confirmation, and specific refusal conditions (terminating pod, unreadable pod/Ingress list).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with [WRITE] and the core action, then layered with preview semantics, refusals, and workflow ordering. Dense and mostly purposeful, though the confirmation-guardrail point is stated at length and could be tightened.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive, open-world mutation tool with no output schema, the description covers what to expect (blast_radius), what gets changed, refusal cases, and traffic-disruption risk. Nothing an agent needs to invoke it safely is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% (baseline 3), and the description adds policy meaning beyond the schema: the preview-vs-apply semantics of confirm and an explicit instruction not to pre-set it without user review. It does not add syntax detail for context or the deprecated confirmed alias, which remain schema-only.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Force AKO to resync all K8s resources with the AVI Controller,' and immediately distinguishes itself from siblings by naming diff_ako_sync and get_ako_sync_status as complementary steps. The [WRITE] marker further clarifies the operation class.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit: 'Use when drift is detected,' directed to run diff_ako_sync first and get_ako_sync_status after, plus an explicit when-not ('Do not set confirm=True on your own because the user asked earlier'). Alternatives and preconditions are all named.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_ako_amko_statusA
Read-onlyIdempotent

[READ] AMKO (AVI Multi-Cluster Kubernetes Operator) GSLB status.

Returns raw kubectl output: the AMKO pods in avi-system, then the GSLBConfig YAML if one exists. 'AMKO not deployed' means kubectl answered and found no AMKO pods; if kubectl cannot read the cluster the call fails with its reason. A GSLBConfig that cannot be read is reported, not skipped. Use this only for multi-cluster GSLB questions — for single-cluster AKO health use get_ako_status instead. Always reads the current kubectl context; see list_ako_clusters.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations cover the safety profile (readOnly, idempotent, non-destructive, openWorld), and the description adds substantial behavioral context beyond them: raw kubectl output shape, the meaning of 'AMKO not deployed', failure behavior when kubectl cannot read the cluster, and that an unreadable GSLBConfig is reported rather than skipped.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the [READ] tag and purpose, then layers in output shape and routing guidance; every sentence carries information. Slightly dense and prose-heavy but no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return values needn't be re-explained, yet the description still characterizes the output and error semantics. For a zero-param read tool, nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Zero parameters, so there is nothing for the description to disambiguate; baseline is 4. The description correctly notes it always reads the current kubectl context, which is the only 'input-like' behavior an agent needs to reason about.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: retrieving AMKO (AVI Multi-Cluster Kubernetes Operator) GSLB status, and immediately contrasts it with the sibling get_ako_status. An agent can distinguish this from get_ako_status without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly scopes usage: 'Use this only for multi-cluster GSLB questions — for single-cluster AKO health use get_ako_status instead.' It names the alternative and the condition that selects it, and points to list_ako_clusters for context handling.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_ako_configA
Read-onlyIdempotent

[READ] The AKO Helm release's values — controller IP, cloud name, network settings, feature flags.

Returns YAML as helm reports it. Use this first to read the live config; use diff_ako_config instead to see what an upgrade would change. Only values supplied at install time appear; chart defaults do not.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive, so the bar is lower. The description adds real value beyond them: the return format ('YAML as helm reports it') and a scope caveat ('Only values supplied at install time appear; chart defaults do not'). It stops short of describing error behavior or pagination, but for a read tool this is solid.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the [READ] marker and purpose, followed by three tight sentences covering return format, sibling routing, and the scope caveat. Every sentence carries distinct information; no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description needn't explain return fields, and annotations already cover the safety profile. It still adds the install-time-only caveat that an agent would otherwise not know, and routes to the right sibling. Nothing needed to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Zero parameters, so per the rubric the baseline is 4. The description correctly adds no parameter guidance because there is nothing to parameterize; no gap exists to fill.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb+resource (reads the AKO Helm release's values) with enumerated content (controller IP, cloud name, network settings, feature flags). It distinguishes itself from the diff_ako_config sibling, so an agent can select it without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use it ('Use this first to read the live config') and names the alternative plus its selecting condition ('use diff_ako_config instead to see what an upgrade would change'). This is textbook when/when-not routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_ako_logsA
Read-onlyIdempotent

[READ] AKO pod logs — Ingress creation failures, sync errors, Controller connectivity.

Returns raw log text, not a table. Use when get_ako_status shows the pod unhealthy or diff_ako_sync reports a missing Ingress. Only the running container's logs are returned.

ParametersJSON Schema
NameRequiredDescriptionDefault
tailNoNumber of log lines (default 100).
sinceNoNarrows the window, e.g. '30m', '1h'.
contextNoK8s context (optional, uses current).

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/openWorld/idempotent/non-destructive, so the safety profile is covered; the description adds genuine behavioral context beyond them: output is raw log text rather than a table, and only the running container's logs are returned (previous-container logs are unavailable). The '[READ]' tag is redundant with readOnlyHint, and no auth/rate-limit caveats are given, keeping it at 4.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with the read tag and resource, then output format, then trigger conditions. Every sentence carries distinct information (scope, output shape, routing) with no repetition of the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-required-param diagnostic read with an output schema present and full annotation coverage, the description supplies everything the agent needs: what it retrieves, the output form (raw text, not tabular), the container limitation, and the upstream signals that should trigger the call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% — tail, since, and context are each documented inline with defaults and examples. The description adds no parameter syntax or defaults of its own; the 'running container only' note implicitly constrains what the params can address but is not parameter documentation. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource (AKO pod logs) plus the diagnostic scope it covers: Ingress creation failures, sync errors, Controller connectivity. This distinguishes it from siblings like get_ako_status (health summary) and get_ako_config (configuration), so an agent can route without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit trigger conditions tied to named siblings: 'Use when get_ako_status shows the pod unhealthy or diff_ako_sync reports a missing Ingress.' That is a clear diagnostic path. It stops short of stating when not to use it (e.g. use list_ako_ingresses for inventory rather than log forensics), so it is strong but not complete routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_ako_statusA
Read-onlyIdempotent

[READ] Check AKO (AVI Kubernetes Operator) pod status in Kubernetes.

Returns pod name, phase, ready flag, restart count and namespace. First step for Ingress or LoadBalancer issues in Tanzu/K8s; follow with get_ako_logs when it is not Running. Looks in one context's AKO namespace only — run list_ako_clusters if not found.

ParametersJSON Schema
NameRequiredDescriptionDefault
contextNoK8s context name (optional, uses current context).

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, openWorldHint and destructiveHint=false, so the safety profile is covered. The description adds genuine behavioral context beyond that: the returned fields, the negative-result workflow, and the scoping constraint that it only checks one namespace. It stops short of detailing failure modes or traversal behavior, so not a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the verb and resource, then scope, then workflow routing. Every sentence carries load: nothing is redundant filler despite the length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With annotations covering safety, an output schema covering return values, and the description covering scope and decision workflow, an agent has everything needed to call this correctly and route to siblings on failure.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With a single optional parameter and 100% schema coverage, the schema already documents 'context' including its default. The description doesn't add syntax or format guidance beyond noting the one-context scope, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Check) and resource (AKO pod status), clarifies it operates in Kubernetes, and names its scope. The 'one context's AKO namespace only' note distinguishes it from the sibling list_ako_clusters without needing to open any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly positions the tool as the 'First step for Ingress or LoadBalancer issues' and prescribes the follow-up path ('follow with get_ako_logs when it is not Running'). It also names the fallback tool (list_ako_clusters) and the condition ('if not found') that selects it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_ako_sync_statusA
Read-onlyIdempotent

[READ] Compare the number of K8s Ingresses with the number of AVI Virtual Services.

Returns both counts and a match/mismatch verdict. Use this first as a cheap check, then diff_ako_sync for which objects differ. A count comparison only — in AKO shard mode many Ingresses share one VS, so a mismatch does not by itself mean trouble.

ParametersJSON Schema
NameRequiredDescriptionDefault
contextNoK8s context name (optional).

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint/idempotentHint/destructiveHint=false, so safety is covered. The description adds real behavioral context beyond that: it is a cheap, count-only check, and a mismatch is a false positive in AKO shard mode where many Ingresses share one VS. It does not discuss error behavior or rate limits, so it falls just short of the top.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four short sentences, front-loaded with the operation and its return, then the workflow ordering, then the caveat. Every sentence carries distinct information with no restatement of the name or schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Output schema exists, so return values need no explanation here, and the description supplies the two things an agent cannot infer: that this is a cheap pre-check before diff_ako_sync, and that mismatches are expected in shard mode. Nothing needed to call or interpret the tool is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is a single optional 'context' parameter with 100% schema description coverage ('K8s context name (optional)'), so the schema fully documents it. The description adds nothing about the parameter, which is the expected baseline when the schema does the work.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a precise verb and two concrete resources ('Compare the number of K8s Ingresses with the number of AVI Virtual Services') and names the output ('both counts and a match/mismatch verdict'). It is clearly distinguishable from diff_ako_sync, which it explicitly names as the finer-grained sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Use this first as a cheap check, then diff_ako_sync for which objects differ' gives explicit ordering and names the alternative tool for the follow-up step. The shard-mode caveat adds a when-to-distrust condition, covering both when to use and when a result is not actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_ako_versionA
Read-onlyIdempotent

[READ] AKO version running in a cluster, read from the pod's image tag.

Returns the pod name and an Image/Version pair per container. Use it to check compatibility with the Controller, and before diff_ako_config or upgrade_ako_config so both target the installed chart. The tag is the only source, so 'latest' reports 'latest', not a number.

ParametersJSON Schema
NameRequiredDescriptionDefault
contextNoK8s context name (optional).

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, non-destructive, and open-world access. The description adds genuinely useful non-obvious context beyond them: the tag is the sole source, so a 'latest' tag is reported literally rather than resolved to a version number. That caveat materially affects how an agent interprets the result.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the [READ] marker and the core statement, then usage, then the caveat — three short sentences with no filler. Every sentence carries distinct information (what, when, gotcha).

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-value detail is unnecessary, and annotations carry the safety profile. The description still covers purpose, sequencing relative to siblings, and the tag-source limitation, which is everything an agent needs to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is one optional parameter ('context') and schema description coverage is 100%, so the schema already documents it ('K8s context name (optional)'). The description adds no semantics about context selection or defaults, leaving the baseline of 3 appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('AKO version running in a cluster') and immediately names the data source ('read from the pod's image tag'), which distinguishes it from get_ako_status, get_ako_config, and get_ako_sync_status. An agent can identify the tool's scope without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use conditions: 'check compatibility with the Controller' and 'before diff_ako_config or upgrade_ako_config so both target the installed chart.' It names the sibling tools it sequences against, so the agent knows both the trigger and the ordering.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_service_engine_healthA
Read-onlyIdempotent

[READ] Health of every Service Engine — operational status and VS counts.

Returns name, operational state and the number of VSes placed on each SE. Use when VS health degrades to check if the issue is at the SE level; list_service_engines gives the management IP and SE Group, get_virtual_service_status the affected VS. An SE hosting no VS reports 0, not an error.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive, so safety is covered. The description adds genuine behavioral context ('An SE hosting no VS reports 0, not an error'), an edge case that prevents misinterpretation, though it omits freshness/pagination behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with a '[READ]' tag, then purpose, return shape, when-to-use with alternatives, and one edge-case caveat. Every sentence carries information; no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return values need not be detailed, and the description still summarizes them. A no-param read tool with rich annotations is fully covered for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so per the rubric the baseline is 4. There is nothing for the description to clarify beyond what the empty schema already conveys.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Health of every Service Engine') and enumerates the returned fields (name, operational state, VS count). An agent can distinguish this from sibling reads like list_service_engines without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly scopes when to use it ('Use when VS health degrades to check if the issue is at the SE level') and names the alternatives (list_service_engines for management IP/SE Group, get_virtual_service_status for the affected VS), giving clear routing logic.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_virtual_service_analyticsA
Read-onlyIdempotent

[READ] Performance metrics for one Virtual Service over the last hour.

Returns L4 (bandwidth, connections) and L7 (latency, % errors, responses) averages over a fixed window that cannot be changed (12 samples, 5 min apart). Empty output means no traffic, not an error. Use when get_virtual_service_status shows degraded health; get_virtual_service_error_logs gives per-request detail.

ParametersJSON Schema
NameRequiredDescriptionDefault
vs_nameYesExact Virtual Service name, case-sensitive, from list_virtual_services.

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnly, idempotent, non-destructive, openWorld), and the description adds information annotations cannot express: the window is immutable (12 samples, 5 min apart) and an empty result means no traffic rather than an error. That last point is a genuine behavioral caveat that prevents a misread.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the one-line purpose, followed by return contents, the fixed-window constraint, the empty-result caveat, and sibling routing. Dense but every clause carries information; the only redundancy is the '[READ]' tag duplicating the readOnlyHint annotation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read tool with an output schema, the definition covers purpose, timing, output nature, the sampling-window constraint, and empty-result semantics. An agent has everything needed to call it correctly without touching the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the single parameter is fully documented in the schema (exact, case-sensitive name sourced from list_virtual_services). The description adds no parameter-level detail beyond that, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Performance metrics for one Virtual Service') and pins the scope to a fixed one-hour window, which distinguishes it from siblings like get_virtual_service_status and get_virtual_service_error_logs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly routes the agent: 'Use when get_virtual_service_status shows degraded health', and contrasts with get_virtual_service_error_logs for per-request detail. Both the trigger condition and the alternative are named.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_virtual_service_error_logsA
Read-onlyIdempotent

[READ] Recent request error logs for one Virtual Service.

Returns up to 50 lines — timestamp, HTTP status, URI path, client IP — for status 400 and above. Use this instead of get_virtual_service_analytics for per-request detail. An empty result may mean no errors, or capture disabled on the VS.

ParametersJSON Schema
NameRequiredDescriptionDefault
sinceNoWindow — seconds or '30m', '1h', '2d' (default '1h').1h
vs_nameYesExact Virtual Service name, from list_virtual_services.

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive, so the safety profile is covered. The description adds genuinely useful, non-obvious behavior: a 50-line cap, a status>=400 filter, the returned fields, and the ambiguity of empty results. It doesn't mention pagination or whether logs are cached/real-time, but for a read-only tool this is strong.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences, front-loaded with the read-only marker and the core capability, then the sibling routing and the empty-result caveat. No filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, yet the description still summarizes the returned fields for fast selection. Combined with the routing rule and empty-result caveat, an agent has everything needed to call this correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the schema already documents the window syntax ('30m', '1h', '2d') and the exact vs_name lookup source. The description adds only the implicit scoping to one Virtual Service, so baseline 3 is correct.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (get/logs) and resource (error logs for one Virtual Service), and explicitly bounds the content (status 400 and above, up to 50 lines). It names the sibling it is not (get_virtual_service_analytics), so the agent can distinguish the two without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says to use this instead of get_virtual_service_analytics for per-request detail, giving a clear selection rule between two similar tools. It also warns how to interpret an empty result (no errors vs capture disabled), which prevents a common misreading.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_virtual_service_statusA
Read-onlyIdempotent

[READ] Detailed status for one Virtual Service: VIP, pool, health, connections, throughput.

Returns one detail block, not a list. Use list_virtual_services first for the exact name — a name that does not match exactly fails. If the runtime read fails, the block says so (with the HTTP status) and health is UNKNOWN. Then get_virtual_service_analytics for metrics, get_virtual_service_error_logs for 5xx.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesExact Virtual Service name.

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover safety (readOnly, idempotent, non-destructive), but the description adds non-obvious behavior: exact-match name resolution fails otherwise, and a failed runtime read is reported in-band with HTTP status while health becomes UNKNOWN. That failure-mode disclosure is exactly the extra context annotations cannot supply.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four tight sentences, front-loaded with the read tag and purpose, then failure behavior, then alternative routing. No filler; each clause carries operational information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return values need not be spelled out, and the description still characterizes the single-block shape and degraded/failure response. Combined with the prerequisite and sibling routing, an agent has everything needed to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already defines 'name'; the description goes beyond it by specifying exact-match semantics and the list-first workflow to obtain a valid value. This adds real meaning over the schema, though it is a single well-documented parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource (detailed status for one Virtual Service) and enumerates the payload it returns (VIP, pool, health, connections, throughput). It explicitly contrasts itself with list_virtual_services ('one detail block, not a list'), so an agent can tell it apart from its siblings without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit prerequisite ('Use list_virtual_services first for the exact name') and routes to alternatives for adjacent needs ('get_virtual_service_analytics for metrics, get_virtual_service_error_logs for 5xx'). When/when-not and named alternatives are all present.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_ako_clustersA
Read-onlyIdempotent

[READ] List every Kubernetes context in the active kubeconfig and whether AKO is deployed there.

Returns Context, AKO Status (pod phase, 'Not deployed' when kubectl answered with no AKO pods, or 'Unreachable'/'Unreadable' with kubectl's reason when it could not read the context — unknown, not absent) and Version per context. Fails when no context could be read. Requires kubectl on PATH; every context is probed, so unreachable clusters add latency. Start here for context names, then pass one to get_ako_status, get_ako_logs or diagnose_ako_ingress.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the readOnly/idempotent annotations: it documents the failure mode ('Fails when no context could be read'), the semantic distinction that 'Unreachable'/'Unreadable' means unknown rather than absent, the kubectl-on-PATH prerequisite, and a latency warning because every context is probed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the [READ] tag and the core action, then the return semantics, prerequisites, and routing hint. Dense but every clause carries information an agent needs; nothing is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return values need not be re-explained, yet the description still clarifies the ambiguous status tokens and the failure condition. Nothing needed to invoke or interpret this tool correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the baseline is 4 — there is nothing parameter-wise for the description to clarify or compensate for.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource+scope: 'List every Kubernetes context in the active kubeconfig and whether AKO is deployed there.' That clearly separates it from siblings like get_ako_status (single context) and list_ako_ingresses (different resource).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly positions itself as the entry point ('Start here for context names') and names the downstream alternatives (get_ako_status, get_ako_logs, diagnose_ako_ingress) with the condition that selects them. Routing is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_ako_ingressesA
Read-onlyIdempotent

[READ] Inventory Kubernetes Ingresses across all namespaces.

Returns Namespace, Ingress name, Host(s) and IngressClass per Ingress. Start here for namespace and Ingress names, then pass them to check_ako_ingress or diagnose_ako_ingress. Lists the K8s side only — use diff_ako_sync for Ingresses with no Controller object.

ParametersJSON Schema
NameRequiredDescriptionDefault
contextNoK8s context name (optional).

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive and openWorld, so the [READ] prefix is largely redundant. However, the description adds real behavioral context beyond them: the scope is all namespaces and the result covers 'the K8s side only', which warns the agent that Controller-side objects are absent. Pagination and auth needs remain unstated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose, then returns, then routing; each sentence steers decision-making. The field enumeration is somewhat redundant with the existing output schema and the '[READ]' tag duplicates annotations, so a small amount of text could be trimmed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given a rich annotation set, an output schema covering return fields, and a single optional parameter, the description supplies everything else needed: scope, the K8s-vs-Controller boundary, and the follow-up tool path. Nothing required for correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single optional 'context' parameter is documented in the schema at 100% coverage ('K8s context name (optional)'), so the baseline of 3 applies. The description adds nothing about the parameter, such as whether omitting it uses the current context, though for one optional arg this is a minor gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Inventory Kubernetes Ingresses across all namespaces') and enumerates the returned fields (Namespace, Ingress name, Host(s), IngressClass). It is immediately distinguishable from siblings like list_virtual_services and list_ako_clusters.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly positions itself as the entry point ('Start here ... then pass them to check_ako_ingress or diagnose_ako_ingress') and names when to use a different tool ('use diff_ako_sync for Ingresses with no Controller object'). Both the primary flow and an alternative branch are covered.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_lb_pool_membersA
Read-onlyIdempotent

[READ] List the members of a pool.

Returns Server IP, Port, Enabled and Ratio per member. Use before enable_lb_pool_member or disable_lb_pool_member; run list_lb_pools first for the pool name. Reports configured state only, not live health-monitor results.

ParametersJSON Schema
NameRequiredDescriptionDefault
poolYesExact pool name as shown by list_lb_pools — matched literally, not fuzzily, and an unknown name is refused rather than ignored. Pools are often named differently from the Virtual Services that use them, so do not infer it from a VS name.

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint=false, so the safety profile is covered. The description adds that it 'Reports configured state only, not live health-monitor results,' which is useful behavioral context beyond annotations. However, it does not mention rate limits, pagination, or error behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a tight, front-loaded paragraph: first the action, then the return fields, then usage guidance, then a caveat. Every sentence is relevant and no words are wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has an output schema, so return values need not be explained. The description covers purpose, usage, and a key behavioral caveat (configured state only). The only minor gap is lack of explicit mention of what the output schema contains (e.g., member names, IP format), but that is acceptable given the output schema exists.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema fully documents the 'pool' parameter, including exact matching and the warning not to infer it from a VS name. The description reinforces this by directing users to run list_lb_pools first, adding mild value beyond the schema. Baseline is 3, but the cross-tool guidance nudges this higher.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a specific verb and resource: 'List the members of a pool.' It clearly distinguishes from sibling tools like list_lb_pools (which lists pools, not members) and enable/disable_lb_pool_member (which are mutations). The [READ] marker reinforces it as a read operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says to 'Use before enable_lb_pool_member or disable_lb_pool_member' and 'run list_lb_pools first for the pool name.' This gives both prerequisite ordering and downstream usage, leaving little inference needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_lb_poolsA
Read-onlyIdempotent

[READ] Discover pools on the Controller.

Returns Name, member count, Enabled and short UUID per pool. Use this before list_lb_pool_members: pools are often named differently from the VS that use them.

ParametersJSON Schema
NameRequiredDescriptionDefault
vs_filterNoSubstring matching VS names (e.g. 'web') — returns only the pools those VS reference. Omit for all pools.

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, openWorldHint and destructiveHint=false, and the '[READ]' tag merely restates them. The list of returned fields is real added context but is also covered by the output schema, and nothing is said about pagination, auth, or rate limits. With annotations carrying the safety profile, this is adequate but thin.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, no filler: the read tag and resource are front-loaded, the return shape follows, and the sibling routing hint closes it. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-required-param, read-only list tool with full schema coverage, an output schema and complete annotations, this is nearly sufficient. The only soft spot is that pool-related prerequisites (e.g. whether a Controller connection must exist) are left implicit, which is minor.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the single vs_filter parameter is fully documented there (substring match, omit for all pools). The description adds no syntax or filtering nuance beyond the schema, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Discover pools on the Controller') and enumerates the returned fields (Name, member count, Enabled, short UUID). It also distinguishes itself from the sibling list_lb_pool_members by positioning itself as the prerequisite call, so an agent can tell the two apart without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit sequencing guidance ('Use this before list_lb_pool_members') plus the reason pools are often named differently from the VS that use them, which tells the agent when this tool is needed. It stops short of stating when *not* to use it or naming any alternative entry point.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_service_enginesA
Read-onlyIdempotent

[READ] List Service Engines (AVI data-plane VMs) on the Controller.

Returns Name, management IP, status (e.g. OPER_UP) and SE Group per SE, in one call that cannot be paged or filtered. Use to inventory capacity or find an SE's name and IP — use get_service_engine_health instead for degraded VS health.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive and open-world behavior, so the safety profile is covered. The description adds real value beyond them by disclosing that the call 'cannot be paged or filtered' and by naming the status values returned (e.g. OPER_UP) — a genuine operational constraint an agent must plan around.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short lines, front-loaded with the verb and resource scope, then returns, then usage routing. Every sentence earns its place with no restatement of the name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With zero parameters, an output schema covering return values, and annotations covering the safety profile, nothing an agent needs is missing. The description adds the non-pageable/non-filterable constraint and the sibling routing that the structured fields cannot express.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the baseline is 4. There are no arguments whose semantics need explaining, and the description correctly implies the tool is invoked without input.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List Service Engines') and immediately disambiguates the domain term by glossing it as 'AVI data-plane VMs on the Controller'. It also enumerates the returned fields, so an agent can tell it apart from get_service_engine_health at a glance.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use ('inventory capacity or find an SE's name and IP') and names the alternative with the condition that selects it ('use get_service_engine_health instead for degraded VS health'). Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_ssl_certsA
Read-onlyIdempotent

[READ] List SSL/TLS certificates stored on the AVI Controller.

Returns Name, Subject, Expiry and Type per certificate, in one call that cannot be paged or filtered. Use for inventory or a certificate's exact name — use check_ssl_cert_expiry instead for only the ones expiring soon.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and openWorldHint, so the safety profile is covered. The description adds genuinely non-structured behavior: the call returns Name, Subject, Expiry and Type per certificate and cannot be paged or filtered, which warns the agent about unbounded result size on large inventories. Minor deduction because the returned fields partially duplicate the existing output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with the read-only nature and the resource, then the return shape, then the routing rule. Every sentence earns its place and nothing is repeated.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only list tool with full annotation coverage and an output schema, the description supplies everything needed: what it returns, that it cannot be filtered or paged, and when to prefer the sibling. No material gap remains for an agent to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so per the rubric the baseline is 4. The description correctly implies a no-argument full-enumeration call and adds no misleading parameter guidance, but there is nothing parameter-level left for it to clarify.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List SSL/TLS certificates stored on the AVI Controller') and immediately scopes the result set to the AVI Controller. The inclusion of '[READ]' plus the explicit naming of the sibling it is not (check_ssl_cert_expiry) lets an agent distinguish it from the other list_* tools without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use ('inventory or a certificate's exact name') and names the alternative with its selecting condition ('use check_ssl_cert_expiry instead for only the ones expiring soon'). It also warns that the call cannot be paged or filtered, which tells the agent not to look for filtering parameters.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_virtual_servicesA
Read-onlyIdempotent

[READ] List Virtual Services on the AVI Controller.

Returns Name, Enabled, VIP and short UUID for every VS in one call; it cannot be paged or filtered, and carries no health score. Use this before drilling into one VS with get_virtual_service_status.

ParametersJSON Schema
NameRequiredDescriptionDefault
controllerNoController name from config (optional, uses default).

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnly, idempotent, non-destructive, openWorld), so the lower bar applies. The description still adds real behavioral context beyond them: the result cannot be paged or filtered, it carries no health score, and it returns all VSes in one call. This is exactly the operational caveat an agent needs before committing to a call.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two compact sentences, front-loaded with the verb and resource, then the return shape and limits, then the routing hint. Every clause earns its place with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so the description need not document return structure in depth, yet it correctly flags the key limitations (no paging, no filtering, no health score) that the schema cannot convey. Nothing needed to call this correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only one optional parameter (controller) with 100% schema description coverage, so the schema already documents it fully. The description adds nothing about the controller argument; baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List Virtual Services on the AVI Controller') and immediately scopes what is returned (Name, Enabled, VIP, short UUID). An agent can distinguish this bulk-listing tool from the single-VS lookup sibling without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states the sequencing: 'Use this before drilling into one VS with get_virtual_service_status,' naming the alternative tool and the condition that selects it. No inference required.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

restart_akoA
Destructive

[WRITE] Restart the AKO pod by deleting it — its StatefulSet recreates it.

Without confirm=True this only previews: it returns blast_radius (context, namespace, the pod's name, uid, phase and restarts, and the Ingresses whose programming pauses until the new pod is Running) and changes nothing. Show that to the user and get their explicit decision. Do not set confirm=True on your own because the user asked earlier: they have not seen what it changes yet. The pod deleted is the one measured (uid precondition).

Refused with confirm=True: a pod already terminating, and a pod or Ingress list that cannot be read. Use when AKO is stuck or after config changes; brief traffic disruption is possible. Run get_ako_status afterwards, and get_ako_logs if the pod is not Running.

ParametersJSON Schema
NameRequiredDescriptionDefault
confirmNoFalse (default) returns the blast radius and changes nothing. True applies it.
contextNoK8s context name (optional).
confirmedNoDeprecated alias for confirm; removed in the next minor release. confirmed=False holds even when confirm=True.

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructive/non-idempotent, and the description adds substantial context beyond them: the exact blast_radius contents returned by the dry-run (context, namespace, pod name/uid/phase/restarts, Ingresses whose programming pauses), the uid precondition guaranteeing the measured pod is the deleted one, and the explicit refusal cases (pod already terminating, unreadable pod or Ingress list). It also warns of brief traffic disruption.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the operation class and verb, then the mechanism, then the safety workflow. A few clauses (the uid precondition parenthetical) are dense but each earns its place; no filler or repeated restatement of the name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, and the description compensates by enumerating the dry-run return payload. Refusal conditions, follow-up tools, and the irreversibility/traffic note are all present, so an agent has everything needed to call this destructive tool safely.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the confirm parameter is already documented as the dry-run gate, so the description mostly reinforces what the schema says rather than adding new semantics. It does usefully connect confirm=False to the concrete blast_radius payload, but the deprecated `confirmed` alias is left to the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Restart the AKO pod') and immediately explains the mechanism ('by deleting it — its StatefulSet recreates it'), which distinguishes it from the read-only siblings like get_ako_status and get_ako_logs. The [WRITE] tag front-loads the operation class.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use ('AKO is stuck or after config changes'), explicit follow-ups ('Run get_ako_status afterwards, and get_ako_logs if the pod is not Running'), and a strong when-not/safety rule ('Do not set confirm=True on your own because the user asked earlier'). The preview-then-confirm workflow is spelled out as a required sequence.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

set_virtual_service_enabledA
Destructive

[WRITE] Enable or disable a Virtual Service. Disabling stops all traffic to it.

Without confirm=True this only previews: it returns blast_radius (the VS name and uuid, whether it is enabled now, its VIPs and oper status, and the pools and member counts behind it) and changes nothing. Show that to the user and get their explicit decision. Do not set confirm=True on your own because the user asked earlier: they have not seen what it changes yet. A VS already in the requested state returns action "noop".

Refused with confirm=True: a VS whose uuid or pools cannot be read (the change would be blind). Use get_virtual_service_status first to check current state.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesExact Virtual Service name.
enableYestrue to enable, false to disable.
confirmNoFalse (default) returns the blast radius and changes nothing. True applies it.
confirmedNoDeprecated alias for confirm; removed in the next minor release. confirmed=False holds even when confirm=True.

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already flag destructiveHint=true, readOnlyHint=false and openWorldHint=true, so the safety profile is partly covered. The description nonetheless adds real behavioral value the annotations cannot: the preview/blast_radius contract, the 'noop' result for already-in-state VS, and the refusal condition. One soft tension: the 'noop' idempotency language sits awkwardly beside idempotentHint=false, though it is not a flat contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The '[WRITE]' prefix and the opening verb+resource sentence front-load the essentials, and the remaining sentences each carry a distinct rule (preview, user decision, noop, refusal). It is somewhat long and the 'they have not seen what it changes yet' clause is a mild restatement, but no sentence is pure filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, yet the description explains the return contract (blast_radius contents, 'noop' action), the preview/apply split, and the refusal precondition. For a destructive mutation tool with annotations already covering safety, nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and documents name, enable, confirm (preview vs apply) and the deprecated confirmed alias clearly, so the description is not required to carry parameter meaning. It mainly restates the confirm semantics and adds the user-decision rule, which is usage guidance rather than new parameter detail. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Enable or disable a Virtual Service') plus the consequence of the disable path ('stops all traffic to it'). It also distinguishes itself from the read-only sibling get_virtual_service_status by naming it as a prerequisite for checking state.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit workflow: without confirm=True it previews only, the agent must show blast_radius to the user and get an explicit decision, and must not set confirm=True on its own. It also names the fallback path ('Use get_virtual_service_status first') for the refusal case, leaving nothing to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

upgrade_ako_configA

[WRITE] Apply an AKO Helm upgrade to the avi-system release.

Finds the avi-system release automatically and upgrades the Broadcom OCI chart with --reuse-values. Without confirm=True this only previews: it returns blast_radius (release, the chart and app version it is on, revision and status, the chart it would move to) plus helm_dry_run, the output of helm upgrade --dry-run, and changes nothing. Show that to the user and get their explicit decision. Do not set confirm=True on your own because the user asked earlier: they have not seen what it changes yet.

Refused with confirm=True: a failing dry-run (the real upgrade would fail too), a release with another helm operation pending, and a release whose status cannot be read. Helm output has credential values blanked to <redacted> by this skill. Run diff_ako_config first to review the change.

ParametersJSON Schema
NameRequiredDescriptionDefault
confirmNoFalse (default) returns the blast radius and changes nothing. True applies it.
dry_runNoDeprecated alias; removed in the next minor release. The old contract applied only with dry_run=false and confirmed=true; dry_run=true holds even when confirm=True.
confirmedNoDeprecated alias for confirm; removed in the next minor release. confirmed=False holds even when confirm=True.
chart_versionNoPin the chart, e.g. "1.11.1". Empty = registry latest, resolved at apply time, so it can differ from the preview.

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Explicitly describes the preview mode (returns blast_radius and helm_dry_run, changes nothing), the refusal conditions (failing dry-run, pending helm op, unreadable status), and that credentials are blanked to <redacted>. This is far beyond what the annotations (readOnlyHint=false, destructiveHint=false, non-idempotent) convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured with the write marker, preview behavior, and refusal conditions front-loaded. Slightly lengthy but every section earns its place; the anti-pattern warning about confirm=True is valuable and not wasteful.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive-adjacent write tool with no output schema, the description covers preview output shape, refusal paths, credential redaction, and the recommended prerequisite. Nothing critical is missing for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents all four parameters including confirm, dry_run, confirmed, and chart_version. The description reinforces the confirm semantics but doesn't add syntax details beyond the schema. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Apply an AKO Helm upgrade) and resource (avi-system release, Broadcom OCI chart), and clearly marks it as a WRITE operation vs. sibling read tools like get_ako_config and diff_ako_config.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit when/when-not guidance: it says to run diff_ako_config first, explains preview vs. apply semantics via confirm=True, and warns not to set confirm=True on the user's behalf. Routes to the right sibling (diff_ako_config) explicitly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 56 tool updatesv2.4.0
    • Removedako_amko_status
    • Removedako_clusters
    • Removedako_config_diff
    • Removedako_config_show
    • Removedako_config_upgrade
    • Removedako_ingress_check
    • Removedako_ingress_diagnose
    • Removedako_ingress_map
    • Removedako_logs
    • Removedako_restart
    • Removedako_status
    • Removedako_sync_diff
    • Removedako_sync_force
    • Removedako_sync_status
    • Removedako_version
    • Addedcheck_ako_ingress
    • Addedcheck_ssl_cert_expiry
    • Addeddiagnose_ako_ingress
    • Addeddiff_ako_config
    • Addeddiff_ako_sync
    • Addeddisable_lb_pool_member
    • Addedenable_lb_pool_member
    • Addedforce_ako_sync
    • Addedget_ako_amko_status
    • Addedget_ako_config
    • Addedget_ako_logs
    • Addedget_ako_status
    • Addedget_ako_sync_status
    • Addedget_ako_version
    • Addedget_service_engine_health
    • Addedget_virtual_service_analytics
    • Addedget_virtual_service_error_logs
    • Addedget_virtual_service_status
    • Addedlist_ako_clusters
    • Addedlist_ako_ingresses
    • Addedlist_lb_pool_members
    • Addedlist_lb_pools
    • Addedlist_service_engines
    • Addedlist_ssl_certs
    • Addedlist_virtual_services
    • Removedpool_list
    • Removedpool_member_disable
    • Removedpool_member_enable
    • Removedpool_members
    • Addedrestart_ako
    • Removedse_health
    • Removedse_list
    • Addedset_virtual_service_enabled
    • Removedssl_expiry_check
    • Removedssl_list
    • Addedupgrade_ako_config
    • Removedvs_analytics
    • Removedvs_error_logs
    • Removedvs_list
    • Removedvs_status
    • Removedvs_toggle
  2. 5 tool updatesv1.10.0
    • Changedako_config_upgrade11 fields changed
      • changedInput schema / properties / chart_version / description
        Previous value: -"Pin the chart, e.g. \"1.11.1\". Empty = registry latest."New value: +"Pin the chart, e.g. \"1.11.1\". Empty = registry latest, resolved at apply time, so it can differ from the preview."
      • addedInput schema / properties / confirm
        Added value: +{
        +  "default": false,
        +  "description": "False (default) returns the blast radius and changes nothing. True applies it.",
        +  "title": "Confirm",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / confirmed / anyOf
        Added value: +[
        +  {
        +    "type": "boolean"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • changedInput schema / properties / confirmed / default
        Previous value: -falseNew value: +null
      • changedInput schema / properties / confirmed / description
        Previous value: -"Gates the real upgrade only. With dry_run=false, the default false returns a preview naming the chart version and changes nothing; true runs `helm upgrade --reuse-values` against the avi-system release, rolling the AKO pod. Ignored while dry_run=true, which never writes."New value: +"Deprecated alias for confirm; removed in the next minor release. confirmed=False holds even when confirm=True."
      • removedInput schema / properties / confirmed / type
        Removed value: -"boolean"
      • addedInput schema / properties / dry_run / anyOf
        Added value: +[
        +  {
        +    "type": "boolean"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • changedInput schema / properties / dry_run / default
        Previous value: -trueNew value: +null
      • changedInput schema / properties / dry_run / description
        Previous value: -"Preview without applying (default true)."New value: +"Deprecated alias; removed in the next minor release. The old contract applied only with dry_run=false and confirmed=true; dry_run=true holds even when confirm=True."
      • removedInput schema / properties / dry_run / type
        Removed value: -"boolean"
      • changedOutput schema / (root)
        Previous value: -{
        -  "properties": {
        -    "result": {
        -      "title": "Result",
        -      "type": "string"
        -    }
        -  },
        -  "required": [
        -    "result"
        -  ],
        -  "title": "ako_config_upgradeOutput",
        -  "type": "object"
        -}New value: +null
    • Changedako_restart6 fields changed
      • addedInput schema / properties / confirm
        Added value: +{
        +  "default": false,
        +  "description": "False (default) returns the blast radius and changes nothing. True applies it.",
        +  "title": "Confirm",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / confirmed / anyOf
        Added value: +[
        +  {
        +    "type": "boolean"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • changedInput schema / properties / confirmed / default
        Previous value: -falseNew value: +null
      • changedInput schema / properties / confirmed / description
        Previous value: -"false (the default) returns a preview and changes nothing; true deletes the AKO pod. The StatefulSet recreates it, so this is a restart rather than a removal, but ingress programming pauses until the new pod is Running and brief traffic disruption is possible."New value: +"Deprecated alias for confirm; removed in the next minor release. confirmed=False holds even when confirm=True."
      • removedInput schema / properties / confirmed / type
        Removed value: -"boolean"
      • changedOutput schema / (root)
        Previous value: -{
        -  "properties": {
        -    "result": {
        -      "title": "Result",
        -      "type": "string"
        -    }
        -  },
        -  "required": [
        -    "result"
        -  ],
        -  "title": "ako_restartOutput",
        -  "type": "object"
        -}New value: +null
    • Changedako_sync_force6 fields changed
      • addedInput schema / properties / confirm
        Added value: +{
        +  "default": false,
        +  "description": "False (default) returns the blast radius and changes nothing. True applies it.",
        +  "title": "Confirm",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / confirmed / anyOf
        Added value: +[
        +  {
        +    "type": "boolean"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • changedInput schema / properties / confirmed / default
        Previous value: -falseNew value: +null
      • changedInput schema / properties / confirmed / description
        Previous value: -"false (the default) returns a preview and changes nothing; true forces the resync, which restarts the AKO pod so it rebuilds every Virtual Service, pool and VS-VIP from the cluster's current resources — brief traffic disruption is possible."New value: +"Deprecated alias for confirm; removed in the next minor release. confirmed=False holds even when confirm=True."
      • removedInput schema / properties / confirmed / type
        Removed value: -"boolean"
      • changedOutput schema / (root)
        Previous value: -{
        -  "properties": {
        -    "result": {
        -      "title": "Result",
        -      "type": "string"
        -    }
        -  },
        -  "required": [
        -    "result"
        -  ],
        -  "title": "ako_sync_forceOutput",
        -  "type": "object"
        -}New value: +null
    • Changedpool_member_disable6 fields changed
      • addedInput schema / properties / confirm
        Added value: +{
        +  "default": false,
        +  "description": "False (default) returns the blast radius and changes nothing. True applies it.",
        +  "title": "Confirm",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / confirmed / anyOf
        Added value: +[
        +  {
        +    "type": "boolean"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • changedInput schema / properties / confirmed / default
        Previous value: -falseNew value: +null
      • changedInput schema / properties / confirmed / description
        Previous value: -"false (the default) returns a preview naming the member and pool, and changes nothing; true disables the member, draining it so existing connections finish while new traffic stops. Reverse it with pool_member_enable."New value: +"Deprecated alias for confirm; removed in the next minor release. confirmed=False holds even when confirm=True."
      • removedInput schema / properties / confirmed / type
        Removed value: -"boolean"
      • changedOutput schema / (root)
        Previous value: -{
        -  "properties": {
        -    "result": {
        -      "title": "Result",
        -      "type": "string"
        -    }
        -  },
        -  "required": [
        -    "result"
        -  ],
        -  "title": "pool_member_disableOutput",
        -  "type": "object"
        -}New value: +null
    • Changedvs_toggle6 fields changed
      • addedInput schema / properties / confirm
        Added value: +{
        +  "default": false,
        +  "description": "False (default) returns the blast radius and changes nothing. True applies it.",
        +  "title": "Confirm",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / confirmed / anyOf
        Added value: +[
        +  {
        +    "type": "boolean"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • changedInput schema / properties / confirmed / default
        Previous value: -falseNew value: +null
      • changedInput schema / properties / confirmed / description
        Previous value: -"Gates the disable only. With enable=false, the default false returns a preview naming the VS that would stop serving traffic and changes nothing; true performs the disable. Ignored when enable=true — enabling always executes."New value: +"Deprecated alias for confirm; removed in the next minor release. confirmed=False holds even when confirm=True."
      • removedInput schema / properties / confirmed / type
        Removed value: -"boolean"
      • changedOutput schema / (root)
        Previous value: -{
        -  "properties": {
        -    "result": {
        -      "title": "Result",
        -      "type": "string"
        -    }
        -  },
        -  "required": [
        -    "result"
        -  ],
        -  "title": "vs_toggleOutput",
        -  "type": "object"
        -}New value: +null
  3. 28 tool updatesv1.8.14
    • Addedako_amko_status
    • Changedako_clusters1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedako_config_diff2 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / chart_version / description
        Added value: +"Pin the chart, e.g. \"1.11.1\". Empty = registry latest."
    • Addedako_config_show
    • Addedako_config_upgrade
    • Addedako_ingress_check
    • Addedako_ingress_diagnose
    • Addedako_ingress_map
    • Changedako_logs4 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / context / description
        Added value: +"K8s context (optional, uses current)."
      • addedInput schema / properties / since / description
        Added value: +"Narrows the window, e.g. '30m', '1h'."
      • addedInput schema / properties / tail / description
        Added value: +"Number of log lines (default 100)."
    • Addedako_restart
    • Addedako_status
    • Changedako_sync_diff2 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / context / description
        Added value: +"K8s context name (optional)."
    • Changedako_sync_force3 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / confirmed / description
        Added value: +"false (the default) returns a preview and changes nothing; true forces the resync, which restarts the AKO pod so it rebuilds every Virtual Service, pool and VS-VIP from the cluster's current resources — brief traffic disruption is possible."
      • addedInput schema / properties / context / description
        Added value: +"K8s context name (optional)."
    • Addedako_sync_status
    • Addedako_version
    • Changedpool_list2 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / vs_filter / description
        Added value: +"Substring matching VS names (e.g. 'web') — returns only the pools those VS reference. Omit for all pools."
    • Addedpool_member_disable
    • Changedpool_member_enable3 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / pool / description
        Added value: +"Exact pool name as shown by pool_list — matched literally, not fuzzily, and an unknown name is refused rather than ignored. Pools are often named differently from the Virtual Services that use them, so do not infer it from a VS name."
      • addedInput schema / properties / server / description
        Added value: +"Server IP address."
    • Changedpool_members2 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / pool / description
        Added value: +"Exact pool name as shown by pool_list — matched literally, not fuzzily, and an unknown name is refused rather than ignored. Pools are often named differently from the Virtual Services that use them, so do not infer it from a VS name."
    • Addedse_health
    • Changedse_list1 field changed
      • addedInput schema / additionalProperties
        Added value: +false
    • Changedssl_expiry_check2 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / days / description
        Added value: +"Report certs expiring within this many days (default 30)."
    • Addedssl_list
    • Addedvs_analytics
    • Changedvs_error_logs3 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / since / description
        Added value: +"Window — seconds or '30m', '1h', '2d' (default '1h')."
      • addedInput schema / properties / vs_name / description
        Added value: +"Exact Virtual Service name, from vs_list."
    • Changedvs_list2 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / controller / description
        Added value: +"Controller name from config (optional, uses default)."
    • Addedvs_status
    • Changedvs_toggle4 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / properties / confirmed / description
        Added value: +"Gates the disable only. With enable=false, the default false returns a preview naming the VS that would stop serving traffic and changes nothing; true performs the disable. Ignored when enable=true — enabling always executes."
      • addedInput schema / properties / enable / description
        Added value: +"true to enable, false to disable."
      • addedInput schema / properties / name / description
        Added value: +"Exact Virtual Service name."
  4. 10 tool updatesv1.8.8
    • Addedako_clusters
    • Addedako_config_diff
    • Removedako_ingress_check
    • Addedako_sync_force
    • Removedako_sync_status
    • Addedpool_list
    • Removedpool_member_disable
    • Addedpool_members
    • Addedse_list
    • Addedssl_expiry_check
  5. 19 tool updatesv1.8.8
    • Removedako_amko_status
    • Removedako_clusters
    • Removedako_config_diff
    • Removedako_config_show
    • Removedako_config_upgrade
    • Removedako_ingress_diagnose
    • Removedako_ingress_map
    • Removedako_restart
    • Removedako_status
    • Removedako_sync_force
    • Removedako_version
    • Removedpool_list
    • Removedpool_members
    • Removedse_health
    • Removedse_list
    • Removedssl_expiry_check
    • Removedssl_list
    • Removedvs_analytics
    • Removedvs_status
  6. 4 tool updatesv1.5.38
    • Removedako_cluster_overview
    • Changedako_config_upgrade1 field changed
      • addedInput schema / properties / confirmed
        Added value: +{
        +  "default": false,
        +  "title": "Confirmed",
        +  "type": "boolean"
        +}
    • Removedako_ingress_fix_suggest
    • Changedako_logs1 field changed
      • addedInput schema / properties / context
        Added value: +{
        +  "anyOf": [
        +    {
        +      "type": "string"
        +    },
        +    {
        +      "type": "null"
        +    }
        +  ],
        +  "default": null,
        +  "title": "Context"
        +}
  7. 30 tool updatesv1.5.29
    • Addedako_amko_status
    • Addedako_cluster_overview
    • Addedako_clusters
    • Addedako_config_diff
    • Addedako_config_show
    • Addedako_config_upgrade
    • Addedako_ingress_check
    • Addedako_ingress_diagnose
    • Addedako_ingress_fix_suggest
    • Addedako_ingress_map
    • Addedako_logs
    • Addedako_restart
    • Addedako_status
    • Addedako_sync_diff
    • Addedako_sync_force
    • Addedako_sync_status
    • Addedako_version
    • Addedpool_list
    • Addedpool_member_disable
    • Addedpool_member_enable
    • Addedpool_members
    • Addedse_health
    • Addedse_list
    • Addedssl_expiry_check
    • Addedssl_list
    • Addedvs_analytics
    • Addedvs_error_logs
    • Addedvs_list
    • Addedvs_status
    • Addedvs_toggle
  8. 30 tool updatesv1.5.28
    • Removedako_amko_status
    • Removedako_cluster_overview
    • Removedako_clusters
    • Removedako_config_diff
    • Removedako_config_show
    • Removedako_config_upgrade
    • Removedako_ingress_check
    • Removedako_ingress_diagnose
    • Removedako_ingress_fix_suggest
    • Removedako_ingress_map
    • Removedako_logs
    • Removedako_restart
    • Removedako_status
    • Removedako_sync_diff
    • Removedako_sync_force
    • Removedako_sync_status
    • Removedako_version
    • Removedpool_list
    • Removedpool_member_disable
    • Removedpool_member_enable
    • Removedpool_members
    • Removedse_health
    • Removedse_list
    • Removedssl_expiry_check
    • Removedssl_list
    • Removedvs_analytics
    • Removedvs_error_logs
    • Removedvs_list
    • Removedvs_status
    • Removedvs_toggle
  9. 30 tool updatesv1.5.22
    • First observedako_amko_status
    • First observedako_cluster_overview
    • First observedako_clusters
    • First observedako_config_diff
    • First observedako_config_show
    • First observedako_config_upgrade
    • First observedako_ingress_check
    • First observedako_ingress_diagnose
    • First observedako_ingress_fix_suggest
    • First observedako_ingress_map
    • First observedako_logs
    • First observedako_restart
    • First observedako_status
    • First observedako_sync_diff
    • First observedako_sync_force
    • First observedako_sync_status
    • First observedako_version
    • First observedpool_list
    • First observedpool_member_disable
    • First observedpool_member_enable
    • First observedpool_members
    • First observedse_health
    • First observedse_list
    • First observedssl_expiry_check
    • First observedssl_list
    • First observedvs_analytics
    • First observedvs_error_logs
    • First observedvs_list
    • First observedvs_status
    • First observedvs_toggle

TDQS

A4.4/5.0

Scored across 28 tools

Disambiguation5/5

Each tool targets a clearly distinct resource and action, and descriptions explicitly differentiate near-neighbors like get_ako_status vs get_ako_amko_status and check_ako_ingress vs diagnose_ako_ingress. Workflow cross-references make tool selection unambiguous.

Naming Consistency5/5

All names use consistent snake_case with a leading verb (list_, get_, enable_, disable_, check_, diff_, etc.). Plural/singular variations follow resource conventions and remain predictable.

Tool Count3/5

28 tools is heavy for a single server, though the surface spans two substantial domains (AVI Controller and AKO/Kubernetes). Several granular AKO config/sync/diagnose tools could be consolidated, but each currently earns a distinct role.

Completeness4/5

The surface thoroughly covers read/diagnose and safe write operations across virtual services, pools, service engines, certificates, and AKO. However, it lacks create/delete/update for core AVI objects, which is a minor gap for an operations-focused toolkit.

Maintenance

ActivityActive
ResponsivenessResponsive

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    A
    maintenance
    Provides MCP multi-cluster Kubernetes management and operations, featuring a management interface, logging, and nearly 50 built-in tools covering common DevOps and development scenarios. Supports both standard and CRD resources.
    888
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables secure management of VMware vCenter 8.0+ environments through controlled operations including VM lifecycle management, snapshots, and resource discovery with built-in RBAC authorization, audit logging, and rate limiting.
    6
    MIT