Skip to main content
Glama
vmware-skills

io.github.zw008/vmware-log-insight

get_log_alert

Read-onlyIdempotent

Retrieve a single log alert's stored definition by ID, including enabled status, info, and raw keys, to inspect its configuration. Use after listing alerts.

Instructions

[READ] Get the stored definition of one alert. Use this after list_log_alerts.

Returns the same sanitized {id, name, enabled, info} projection as an list_log_alerts row plus 'raw_keys' — the sorted key names the appliance actually sent — so you can see what else the definition carries without this skill guessing at its shape. For when the alert fired, use get_log_alert_history. Read-only.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
targetNoLog Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names.
alert_idYesThe alert id exactly as returned in an list_log_alerts row's 'id' field (not the alert's name). An empty or malformed id (anything with '/', '?', spaces, or '..') is refused before any call; an unknown id comes back as HTTP 404 (500 for an id that is not a UUID) on 8.18.7, reported as "copy an exact id", not "retry".

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv2.4.1

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive, so the safety profile is covered; the description adds real value with the return projection ({id, name, enabled, info} plus raw_keys) and how raw_keys exposes previously unseen fields. It does not need to restate 'Read-only' since annotations carry that, but the return-shape disclosure is substantive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with a [READ] tag and the core action, then supporting detail. Every sentence carries information (routing, return shape, raw_keys rationale), though the closing 'Read-only.' slightly duplicates the annotation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description usefully describes what comes back, including raw_keys, so an agent knows the response shape. Combined with the thorough schema error descriptions, the definition is nearly complete for a simple two-parameter read.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both target and alert_id are fully documented in the schema, including error behavior (404/500, malformed-id refusal). The description adds no parameter-level detail beyond the schema, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Get the stored definition of one alert') and names the sibling it follows from (list_log_alerts). It is clearly distinguishable from get_log_alert_history, which it explicitly routes to for firing data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit sequencing guidance ('Use this after list_log_alerts') and names the alternative for a different question ('For when the alert fired, use get_log_alert_history'). Both when-to-use and when-to-use-something-else are covered.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.