vmware-avi
This server manages VMware AVI (NSX Advanced Load Balancer) and AKO Kubernetes operations, offering 28 read/write tools across 10 categories.
Virtual Service management: list VS, view detailed status, enable/disable with blast-radius preview and confirmation.
Pool member operations: discover pools, list members, enable/disable members with graceful drain and safety guards.
SSL certificate management: list certificates, check expiry within N days.
Analytics and logs: view VS performance metrics and recent request error logs.
Service Engine health: list SEs and per-SE operational health with VS counts.
AKO pod operations: check status, view logs, restart pod, read AKO version.
AKO Helm config: show values, diff pending changes, upgrade with dry-run and confirmation.
Ingress diagnostics: validate annotations, map Ingresses to VS, diagnose missing VS, get fixes.
Sync diagnostics: compare K8s/Controller counts, list inconsistencies, force resync.
Multi-cluster: list clusters with AKO, check AMKO GSLB status.
Enables AKO (Avi Kubernetes Operator) operations on Kubernetes clusters, including pod status, logs, restart, Helm config, ingress diagnostics, sync diagnostics, and multi-cluster management.
Allows management of VMware AVI (NSX Advanced Load Balancer) controllers, including virtual services, pool members, SSL certificates, analytics, service engines, and AKO (Avi Kubernetes Operator) operations.
VMware AVI
Author: Wei Zhou, VMware by Broadcom — wei-wz.zhou@broadcom.com This is a community-driven project by a VMware engineer, not an official VMware product. For official VMware developer tools see developer.broadcom.com.
English | 中文
AVI (NSX Advanced Load Balancer) management and AKO Kubernetes operations tool — 28 tools across 10 categories.
Dual mode: Traditional AVI Controller management + AKO K8s operations in one skill.
Companion skills handle everything else:
Skill
Scope
Install
VM lifecycle, deployment, guest ops, cluster
uv tool install vmware-aiopsRead-only: inventory, health, alarms, events
uv tool install vmware-monitorDatastores, iSCSI, vSAN management
uv tool install vmware-storageTanzu Namespaces, TKC cluster lifecycle
uv tool install vmware-vksNSX networking: segments, gateways, NAT
uv tool install vmware-nsx-mgmtDFW firewall rules, security groups
uv tool install vmware-nsx-securityAria Ops: metrics, alerts, capacity
uv tool install vmware-aria
Quick Install
# Via uv (recommended)
uv tool install vmware-avi
# Or via pip
pip install vmware-avi
# China mainland mirror
pip install vmware-avi -i https://pypi.tuna.tsinghua.edu.cn/simple
# Verify installation
vmware-avi doctorOffline / Air-Gapped Install (from source)
This project uses the modern PEP 517 build system (hatchling), so there is no
setup.py by design — that is expected, not a missing file. If you cloned the
source and hit ERROR: File "setup.py" or "setup.cfg" not found ... editable mode currently requires a setuptools-based build, your pip is older than 21.3 and
cannot do an editable (-e) install with a non-setuptools backend. Editable
mode is a developer convenience, not needed to run the tool — do one of:
# From the source tree — a normal (non-editable) install builds a wheel:
pip install . # NOT pip install -e .
# ...or upgrade pip first, and editable works too:
pip install --upgrade pip && pip install -e .For a truly air-gapped host, build the wheels on a connected machine and copy them over — the target then needs no network:
# On a connected machine, collect this package + its dependencies as wheels:
pip wheel . -w dist # → dist/*.whl (or: uv build, for just this package)
# Copy dist/ to the air-gapped host, then install offline:
pip install --no-index --find-links dist vmware-aviRelated MCP server: vSphere-MCP-Pro
Capabilities Overview
What This Skill Does
Category | Tools | Count |
Virtual Service | list, status, enable/disable | 3 |
Pool Member | pool discovery, member list, enable/disable member (drain/restore traffic) | 4 |
SSL Certificate | list, expiry check | 2 |
Analytics | VS metrics overview, request error logs | 2 |
Service Engine | list, health check | 2 |
AKO Pod Ops | status, logs, restart, version info | 4 |
AKO Config | values.yaml view, Helm diff, Helm upgrade | 3 |
Ingress Diagnostics | annotation validation, VS mapping, error diagnosis, fix recommendation | 4 |
Sync Diagnostics | K8s-Controller comparison, inconsistency list, force resync | 3 |
Multi-cluster | cluster list, cross-cluster AKO overview, AMKO status | 3 |
CLI vs MCP: Which Mode to Use
Scenario | Recommended | Why |
Local/small models (Ollama, Qwen) | CLI | ~2K tokens vs ~8K for MCP |
Cloud models (Claude, GPT-4o) | Either | MCP gives structured JSON I/O |
Automated pipelines | MCP | Type-safe parameters, structured output |
AKO troubleshooting | CLI | Interactive log tailing, Helm diff output |
Rule of thumb: Use CLI for cost efficiency and small models. Use MCP for structured automation with large models.
Architecture
User (Natural Language)
|
AI CLI Tool (Claude Code / Gemini / Codex / Cursor / Trae)
| reads SKILL.md
|
vmware-avi CLI
|--- avisdk (AVI REST API) ---> AVI Controller ---> Virtual Services / Pools / SEs
|--- kubectl / kubernetes ---> K8s Cluster ---> AKO Pods / Ingress / ServicesConfiguration
Step 1: Create Config Directory
mkdir -p ~/.vmware-avi
vmware-avi init # generates config.yaml and .env templates
chmod 600 ~/.vmware-avi/.envStep 2: Edit config.yaml
controllers:
- name: prod-avi
host: avi-controller.example.com
username: admin
api_version: "22.1.4"
tenant: admin
port: 443
verify_ssl: true
default_controller: prod-avi
ako:
kubeconfig: ~/.kube/config
default_context: ""
namespace: avi-systemStep 3: Set Passwords
Create ~/.vmware-avi/.env:
# AVI Controller passwords
# Format: {CONTROLLER_NAME_UPPER}_PASSWORD
PROD_AVI_PASSWORD=your-password-herePassword environment variable naming convention:
{CONTROLLER_NAME_UPPER}_PASSWORD
# Replace hyphens with underscores, UPPERCASE
# Example: controller "prod-avi" -> PROD_AVI_PASSWORD
# Example: controller "staging-alb" -> STAGING_ALB_PASSWORDStep 4: Verify
vmware-avi doctor # checks Controller connectivity + kubeconfig + avisdkCLI Usage
Virtual Service Management
# List all virtual services
vmware-avi vs list [--controller prod-avi]
# Check status of a specific VS
vmware-avi vs status my-webapp-vs
# Enable / disable a VS (disable requires double confirmation)
vmware-avi vs enable my-webapp-vs
vmware-avi vs disable my-webapp-vsPool Member Drain / Restore
# List pool members and health status
vmware-avi pool members my-pool
# Graceful drain (disable) — double confirmation required
vmware-avi pool disable my-pool 10.1.1.5
# Restore traffic (enable)
vmware-avi pool enable my-pool 10.1.1.5SSL Certificate Expiry Check
# List all certificates
vmware-avi ssl list
# Check certificates expiring within 30 days
vmware-avi ssl expiry --days 30Analytics and Error Logs
# VS analytics: throughput, latency, error rates
vmware-avi analytics my-webapp-vs
# Request error logs
vmware-avi logs my-webapp-vs --since 1hService Engine Health
# Name, mgmt IP, operational status, SE group — status sourced from the
# serviceengine-inventory endpoint (config + runtime merged)
vmware-avi se list
# Per-SE operational status + connected-VS counts
vmware-avi se healthAKO Troubleshooting
# Check AKO pod status
vmware-avi ako status [--context my-k8s-context]
# View AKO logs
vmware-avi ako logs [--tail 100] [--since 30m]
# Restart AKO pod (double confirmation)
vmware-avi ako restart
# Show AKO version
vmware-avi ako versionAKO Helm Config Management
The AKO Helm release is discovered automatically (official installs use
helm install --generate-name, so the release is not named ako). Upgrades pull
the official Broadcom OCI chart
oci://projects.packages.broadcom.com/ako/helm-charts/ako with --reuse-values.
# View current AKO Helm values (release auto-discovered)
vmware-avi ako config show
# Show pending changes (diff against the official OCI chart)
vmware-avi ako config diff
# Helm upgrade (double confirmation + --dry-run default)
vmware-avi ako config upgradeIngress Diagnostics
# Validate Ingress annotations
vmware-avi ako ingress check <namespace>
# Show Ingress-to-VS mapping
vmware-avi ako ingress map
# Diagnose why an Ingress has no VS
vmware-avi ako ingress diagnose <ingress-name>Sync Diagnostics
# Check K8s-Controller sync status
vmware-avi ako sync status
# Show inconsistencies between K8s and Controller
vmware-avi ako sync diff
# Force AKO resync (double confirmation)
vmware-avi ako sync forceMulti-cluster AKO
# List clusters with AKO deployed
vmware-avi ako clusters
# Cross-cluster AKO status overview
vmware-avi ako cluster-overview
# AMKO GSLB status
vmware-avi ako amko statusMCP Server
The MCP server exposes all 28 tools via the Model Context Protocol. Works with any MCP-compatible client.
After uv tool install vmware-avi, start the MCP server with one command (v1.5.15+):
# Recommended — single command, no network re-resolve
vmware-avi mcp
# With custom config path
VMWARE_AVI_CONFIG=/path/to/config.yaml vmware-avi mcpClaude Desktop Config
Add to claude_desktop_config.json:
{
"mcpServers": {
"vmware-avi": {
"command": "vmware-avi",
"args": ["mcp"],
"env": {
"VMWARE_AVI_CONFIG": "~/.vmware-avi/config.yaml"
}
}
}
}# Run without installing (requires PyPI access each launch)
uvx --from vmware-avi vmware-avi mcp
# Legacy entry point (still works, kept for backward compatibility)
vmware-avi-mcpBehind a corporate TLS proxy? uvx may fail with
invalid peer certificate: UnknownIssuer. Use the recommendedvmware-avi mcpform above (no network needed), or setUV_NATIVE_TLS=true.
MCP Tools (28)
Category | Tools |
Virtual Service (3) |
|
Pool Member (4) |
|
SSL Certificate (2) |
|
Analytics (2) |
|
Service Engine (2) |
|
AKO Pod (4) |
|
AKO Config (3) |
|
Ingress Diagnostics (3) |
|
Sync Diagnostics (3) |
|
Multi-cluster (2) |
|
Common Workflows
1. Maintenance Window -- Drain a Pool Member
When taking a backend server offline for patching:
List pool members and health status
vmware-avi pool members my-poolDisable the target server (graceful drain)
vmware-avi pool disable my-pool 10.1.1.5Monitor analytics to confirm active connections are draining
vmware-avi analytics my-vsPerform maintenance on the server
Re-enable the server
vmware-avi pool enable my-pool 10.1.1.5Verify health status is green
vmware-avi pool members my-pool
2. AKO Ingress Not Creating VS
When a developer reports their Ingress is not producing a Virtual Service:
Verify AKO is running
vmware-avi ako statusValidate Ingress annotations
vmware-avi ako ingress check <namespace>Check sync status between K8s and Controller
vmware-avi ako sync statusIf annotations are wrong, diagnose the specific Ingress
vmware-avi ako ingress diagnose <ingress-name>If sync drift is detected, review the diff and force resync if needed
vmware-avi ako sync diff vmware-avi ako sync force
3. SSL Certificate Expiry Audit
Expired certificates cause outages. Run periodic checks:
Check all certificates expiring within 30 days
vmware-avi ssl expiry --days 30Review which VS uses each expiring certificate (output includes VS mapping)
Plan renewal with the certificate team
After renewal, verify the new certificate is in place
vmware-avi ssl list
Troubleshooting
"Controller unreachable" error
Run
vmware-avi doctorto verify connectivityCheck if the controller address and port are correct in
~/.vmware-avi/config.yamlFor self-signed certs: set
verify_ssl: falsein config.yaml (lab environments only)
AKO Pod in CrashLoopBackOff
Check logs:
vmware-avi ako logs --tail 50Common causes: wrong controller IP in values.yaml, network policy blocking AKO to Controller, expired credentials
Fix config:
vmware-avi ako config showto inspect, thenvmware-avi ako config upgradewith corrected values (release auto-discovered; pulls the official Broadcom OCI chart)
Ingress created but no VS on Controller
Validate annotations:
vmware-avi ako ingress check <namespace>Check AKO logs for rejection reason:
vmware-avi ako logs --since 5mRun sync diff:
vmware-avi ako sync diffto see if the object is stuck
Pool member shows "down" after enable
Health monitor may still be failing. The member is enabled but unhealthy. Check the actual health status on the Controller side. Fix the backend service first, then the health status will auto-recover.
SSL expiry check shows 0 certificates
Verify the controller connection has tenant-level access. Certificates are tenant-scoped in AVI. The configured user may only see certs in their tenant.
AKO sync force has no effect
Force resync triggers AKO to re-reconcile all K8s objects. If the drift persists, the issue is likely in the K8s resource definition itself (bad annotation, missing secret). Use vmware-avi ako ingress diagnose to pinpoint the root cause.
Safety Features
Feature | Details |
Double Confirmation | Destructive ops (VS disable, pool member disable, AKO restart, Helm upgrade, force resync) require 2 sequential confirmations |
Dry-Run Default |
|
MCP Blast Radius |
|
Audit Trail | All operations logged to |
Password Protection |
|
SSL Support |
|
Prompt Injection Protection | All API-sourced text truncated (500 chars max) and C0/C1 control characters stripped |
Input Validation | Pool names, VS names, IP addresses, and namespace names validated before API calls |
Security Details
Source Code: github.com/vmware-skills/VMware-AVI
Config File Contents:
config.yamlstores controller addresses, usernames, and AKO settings. No passwords or tokens. All secrets stored exclusively in.envWebhook Data Scope: Disabled by default. No third-party data transmission
TLS Verification: Enabled by default. Disable only for self-signed certificate environments
Prompt Injection Protection:
_sanitize()truncation + control character cleanup on all AVI API responsesLeast Privilege: Use a dedicated AVI service account with minimal permissions. AKO operations require only namespace-scoped kubeconfig access
Companion Skills
Skill | Scope | Tools | Install |
AVI load balancer, AKO K8s operations | 28 |
| |
VM lifecycle, deployment, guest ops, cluster | 49 |
| |
Read-only monitoring, alarms, events | 27 |
| |
Datastores, iSCSI, vSAN | 11 |
| |
Tanzu Namespaces, TKC cluster lifecycle | 20 |
| |
NSX segments, gateways, NAT, routing | 33 |
| |
DFW firewall, security groups, IDS/IPS | 21 |
| |
Aria Ops: metrics, alerts, capacity | 28 |
| |
Compliance baselines, drift detection | 6 |
|
Version Compatibility
AVI Controller / Environment | Support | Notes |
AVI 30.x in VCF 9.1 | ✅ Full | avisdk 30.x line covers VCF 9.1 bundle |
AVI 30.x in VCF 9.0 | ✅ Full | Standard AVI / NSX ALB integration |
AVI 22.x — 31.x standalone | ✅ Full | Pin |
AKO 1.10+ | ✅ Full | Kubernetes integration via AKO ConfigMap / GatewayClass |
Official Broadcom References
SDKs: https://developer.broadcom.com/sdks — VCF Python SDK
REST APIs: https://developer.broadcom.com/xapis — AVI Controller REST API
CLI Tools: https://developer.broadcom.com/tools — VCF PowerCLI 9.1
Troubleshooting & Contributing
If you encounter any errors or issues, please send the error message, logs, or screenshots to zhouwei008@gmail.com. Contributions are welcome -- feel free to join us in maintaining and improving this project!
License
MIT
Available Tools
28 toolsako_amko_statusARead-onlyIdempotent
[READ] AMKO (AVI Multi-Cluster Kubernetes Operator) GSLB status.
Returns raw kubectl output: the AMKO pods in avi-system, then the GSLBConfig YAML if one exists. Use this only for multi-cluster GSLB questions — for single-cluster AKO health use ako_status instead. Always reads the current kubectl context; see ako_clusters.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark it read-only and idempotent; the description adds what is actually returned (AMKO pods in avi-system followed by the GSLBConfig YAML if present) and the reliance on the current kubectl context. This behavior is disclosed beyond the structured hints, though it omits possible failure modes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences front-load the purpose, then give the return payload and usage routing. Every sentence contributes information; there is no filler or repetition of schema data.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter read-only tool with an output schema and rich sibling context, this description is complete: it states what is returned, when to use it, and the context caveat. No additional guidance is needed for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters (0% schema requirement), so the baseline is 4 and the description does not need to document inputs. The only implicit input, the current kubectl context, is called out explicitly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Starts with '[READ]' and names the exact resource: AMKO (AVI Multi-Cluster Kubernetes Operator) GSLB status. It specifies the action (returns status) and differentiates from the single-cluster ako_status sibling, so an agent can select it correctly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'Use this only for multi-cluster GSLB questions' and directs the agent to ako_status for single-cluster AKO health. It also cautions that the tool always reads the current kubectl context, with a pointer to ako_clusters.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ako_clustersARead-onlyIdempotent
[READ] List every Kubernetes context in the active kubeconfig and whether AKO is deployed there.
Returns Context, AKO Status (pod phase or 'Not deployed') and Version per context. Requires kubectl on PATH; every context is probed, so unreachable clusters add latency. Start here for context names, then pass one to ako_status, ako_logs or ako_ingress_diagnose.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark it read-only and idempotent, and the description adds important behavioral detail beyond that: every context is probed, kubectl must be on PATH, and unreachable clusters cause latency. It also clarifies the AKO Status values ('pod phase or Not deployed') and that Version is returned per context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three concise, front-loaded sentences cover purpose, return values, prerequisites, side effects, and routing to sibling tools. No sentence is wasted and the '[READ]' prefix immediately signals the operation type.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter discovery tool, the description is complete: it explains what is returned, what is required to run it, what behavioral caveat exists, and how to proceed next. The presence of an output schema reduces the need to describe return structures further.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and 100% schema coverage, so the baseline of 4 applies. The description adds no param-specific meaning, but none is needed because the input schema is empty and the call requires no arguments.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List') and resource ('every Kubernetes context in the active kubeconfig') and clarifies the output includes AKO deployment status. The 'Start here' phrase and mentions of sibling tools like ako_status define its distinct role among the many AKO-related tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly says to use this tool first to get context names, then pass one to ako_status, ako_logs, or ako_ingress_diagnose. It also gives practical usage conditions: requires kubectl on PATH and warns that unreachable clusters add latency.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ako_config_diffARead-onlyIdempotent
[READ] Pending Helm value changes that have not been applied yet.
Returns helm's diff output; empty means nothing would change. Credential
values in it read <redacted> — that is this skill blanking them, not the
configured value.
Use this before ako_config_upgrade — it runs the same command, so the
preview is real. Note: with chart_version empty the registry's moving latest
is resolved, so two runs can differ with no local change; read ako_version
and pass it to both.
| Name | Required | Description | Default |
|---|---|---|---|
| chart_version | No | Pin the chart, e.g. "1.11.1". Empty = registry latest. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds behavior beyond annotations: redacted credentials, empty output semantics, and non-deterministic output when chart_version is empty due to moving latest. These are operational details an agent needs to interpret results correctly and do not contradict the read-only/idempotent effect annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but every sentence carries necessary information: purpose, output semantics, redaction caveat, relationship to upgrade, and the version-pinning caveat. It is front-loaded with purpose and avoids filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the one optional parameter, the read-only annotations, and the presence of an output schema, the description covers usage timing, output interpretation, credential masking, and the non-determinism caveat. Nothing essential is missing for selecting and invoking this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema already documents chart_version, so the baseline is 3. The description adds value by explaining the practical effect of an empty value: the registry's moving latest is resolved and two runs can differ, plus the recommendation to pin using ako_version.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with the marker '[READ]' and states a specific verb+resource: 'Pending Helm value changes that have not been applied yet,' then clarifies it returns 'helm's diff output.' This distinguishes it from read/show tools (ako_config_show) and aligns with the diff/upgrade family.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit usage context: use before ako_config_upgrade, and says both run 'the same command,' so the preview is real. It also instructs the agent to read ako_version and pass it when chart_version is empty, providing a concrete safe invocation path.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ako_config_showARead-onlyIdempotent
[READ] The AKO Helm release's values — controller IP, cloud name, network settings, feature flags.
Returns YAML as helm reports it. Use this first to read the live config; use ako_config_diff instead to see what an upgrade would change. Only values supplied at install time appear; chart defaults do not.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint false. The description adds valuable behavior beyond that: it returns YAML as Helm reports it and explicitly notes that chart defaults are excluded, which is useful and not redundant with the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Every sentence earns its place: the [READ] marker, the resource and content summary, the output format, the usage order, the alternative tool, and the critical install-time-only caveat are all packed into three tight sentences. No fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a no-parameter read-only tool with a rich annotation set and an output schema, the description fully covers what an agent needs: what it returns, how to invoke it first, when to choose the sibling, and a key data limitation. Nothing important is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so per the rubric the baseline is 4. There is no parameter ambiguity, and the schema is fully covered vacuously. The description appropriately focuses on behavior instead of parameter details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states a clear verb ('read') and specific resource ('AKO Helm release's values'), with examples such as controller IP, cloud name, and network settings. It is clearly distinguished from the sibling ako_config_diff, which reads as a comparison tool for upgrades.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit guidance says 'Use this first to read the live config' and directs the agent to ako_config_diff instead 'to see what an upgrade would change.' It also clarifies the limitation that only install-time values appear, not chart defaults, which helps set expectations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ako_config_upgradeA
[WRITE] Apply an AKO Helm upgrade to the avi-system release.
Finds the avi-system release automatically and upgrades the Broadcom OCI
chart with --reuse-values. Without confirm=True this only previews: it
returns blast_radius (release, the chart and app version it is on, revision
and status, the chart it would move to) plus helm_dry_run, the output of
helm upgrade --dry-run, and changes nothing. Show that to the user and get
their explicit decision. Do not set confirm=True on your own because the
user asked earlier: they have not seen what it changes yet.
Refused with confirm=True: a failing dry-run (the real upgrade would fail
too), a release with another helm operation pending, and a release whose
status cannot be read. Helm output has credential values blanked to
<redacted> by this skill. Run ako_config_diff first to review the change.
| Name | Required | Description | Default |
|---|---|---|---|
| confirm | No | False (default) returns the blast radius and changes nothing. True applies it. | |
| dry_run | No | Deprecated alias; removed in the next minor release. The old contract applied only with dry_run=false and confirmed=true; dry_run=true holds even when confirm=True. | |
| confirmed | No | Deprecated alias for confirm; removed in the next minor release. confirmed=False holds even when confirm=True. | |
| chart_version | No | Pin the chart, e.g. "1.11.1". Empty = registry latest, resolved at apply time, so it can differ from the preview. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already carry readOnlyHint=false and destructiveHint=false, and the description builds on them with rich context: the default preview-only contract that changes nothing, the refusal conditions under confirm=True, credential redaction, and the chart_version resolution-at-apply-time caveat. Nothing contradicts the annotations; the description deepens the safety profile substantially.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Longer than average, but every sentence earns its place given the complexity of a confirm-gated write operation. The [WRITE] tag and core purpose are front-loaded, and the safety contract, refusals, and workflow are each worth stating. Slightly dense but not bloated.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description does explain return values (blast_radius, helm_dry_run) and covers the preview/apply contract, refusals, redaction, and prerequisite workflow. Minor gap: it doesn't contrast with apply-like siblings such as ako_restart or ako_sync_force, but for a complex 4-param write tool this is nearly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all four parameters, including chart_version resolution semantics and the deprecated aliases. The description reinforces the confirm gating contract but doesn't add new parameter meaning beyond what the schema provides. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (upgrade), resource (avi-system release / Broadcom OCI chart), and mechanism (Helm with --reuse-values). The [WRITE] tag and the find-automatically detail make it immediately distinguishable from preview/read siblings like ako_config_diff, ako_config_show, and ako_restart.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Strong workflow guidance: run ako_config_diff first, preview by default, show blast radius, and get an explicit user decision before setting confirm=True. The refusal conditions clarify when it should not be applied. It doesn't explicitly name an alternative to pick instead, but the diff-first prerequisite and the guardrail about not self-confirming give clear context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ako_ingress_checkARead-onlyIdempotent
[READ] Validate every Ingress in one namespace: IngressClass and TLS secret references that would stop AKO creating a Virtual Service.
Returns name, IngressClass, issues and OK/ISSUES per Ingress. Run ako_ingress_map first for namespace names; use ako_ingress_diagnose instead for one named Ingress. Covers one namespace only, and TLS checks are skipped when its secrets cannot be listed.
| Name | Required | Description | Default |
|---|---|---|---|
| context | No | K8s context name (optional). | |
| namespace | Yes | K8s namespace to check. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already convey readOnly, idempotent, and non-destructive behavior, so the description does not need to repeat those. It adds genuinely useful behavioral detail beyond annotations: TLS checks are skipped when secrets cannot be listed, and results are per-Ingress with OK/ISSUES status.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: purpose first, then return content, then usage routing, then scope and edge-case behavior. Every sentence adds value, with no filler or repetition of schema content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only diagnostic tool with an output schema, the description covers all essential information: what is validated, what is returned, which sibling tool to use for single-Ingress analysis, prerequisite tooling, namespace scope, and a known edge case.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with both namespace and context already documented. The description adds no parameter-level detail beyond the schema, which is acceptable because the schema carries the full burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Validate') and precisely defines the resource and scope: every Ingress in one namespace, checking IngressClass and TLS secret references that would block AKO from creating a Virtual Service. It also distinguishes itself from the sibling tool ako_ingress_diagnose by clarifying it handles all Ingresses rather than one.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit routing guidance: run ako_ingress_map first for namespace names and use ako_ingress_diagnose instead for a single named Ingress. It also sets clear scope expectations ('Covers one namespace only') and notes the TLS-check limitation when secrets cannot be listed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ako_ingress_diagnoseARead-onlyIdempotent
[READ] Diagnose why one Ingress has no corresponding AVI Virtual Service.
Validates IngressClass ('avi'/'avi-lb'), TLS secrets and backend Services. Returns annotations, a numbered issue list and kubectl fixes. Use ako_ingress_map first to find Ingresses lacking a VS. Checks configuration only; when it is clean, try ako_logs and ako_sync_status.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Exact Ingress resource name. | |
| context | No | kubeconfig context (optional), from ako_clusters. | |
| namespace | No | Namespace holding the Ingress (default 'default'). | default |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish read-only/idempotent/non-destructive, and the description reinforces with 'Checks configuration only'. It additionally discloses validation targets and output shape, with no hidden side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three compact sentences front-load the core diagnostic purpose, then add validation scope, output, and routing to siblings. No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Between annotations, 100% schema coverage, and output schema, the description fills the remaining gaps: diagnostic scope, output content, and next-step tools. An agent can invoke it correctly without further inference.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers all three parameters with descriptions, so description need not repeat them. It only broadly references validated resources and doesn't add parameter-specific semantics beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific diagnostic action on a single Ingress resource ('no corresponding AVI Virtual Service') and lists what it validates. The [READ] prefix and focus on causes/issues distinguish it from map/logs siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly sequences the tool: run ako_ingress_map first to identify affected Ingresses, and fall back to ako_logs/ako_sync_status when config is clean. This provides a clear decision path and alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ako_ingress_mapARead-onlyIdempotent
[READ] Inventory Kubernetes Ingresses across all namespaces.
Returns Namespace, Ingress name, Host(s) and IngressClass per Ingress. Start here for namespace and Ingress names, then pass them to ako_ingress_check or ako_ingress_diagnose. Lists the K8s side only — use ako_sync_diff for Ingresses with no Controller object.
| Name | Required | Description | Default |
|---|---|---|---|
| context | No | K8s context name (optional). |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and non-destructive behavior, so the '[READ]' marker adds little. However, the description adds meaningful context beyond annotations: it returns only the K8s-side perspective, not controller-side state, and explicitly scopes the inventory to all namespaces. This helps the agent understand what the operation does and does not cover.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded with '[READ]' and the primary purpose. Every sentence earns its place: one states scope and output, one gives the follow-up workflow, and one clarifies the boundary against a sibling tool. There is no extraneous text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the low complexity, single optional parameter, existing output schema, and rich annotations, the description provides everything an agent needs to select and invoke this tool correctly. It states the target resource, the returned fields, the follow-up tools, and the exclusion for missing Controller objects.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents the single parameter 'context' as 'K8s context name (optional)' with 100% coverage. The description adds no additional parameter detail, so the baseline of 3 applies; it neither clarifies nor obscures the parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('Inventory'), a clear resource ('Kubernetes Ingresses'), and a scope ('across all namespaces'). It also differentiates itself from siblings by stating this returns Namespace, Ingress name, Host(s), and IngressClass, and by referring to ako_ingress_check, ako_ingress_diagnose, and ako_sync_diff as alternatives for different steps.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says to start here for namespace and Ingress names, then pass them to ako_ingress_check or ako_ingress_diagnose. It also states the boundary: 'Lists the K8s side only' and directs the agent to use ako_sync_diff for Ingresses with no Controller object, making when-to-use and when-not-to-use clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ako_logsARead-onlyIdempotent
[READ] AKO pod logs — Ingress creation failures, sync errors, Controller connectivity.
Returns raw log text, not a table. Use when ako_status shows the pod unhealthy or ako_sync_diff reports a missing Ingress. Only the running container's logs are returned.
| Name | Required | Description | Default |
|---|---|---|---|
| tail | No | Number of log lines (default 100). | |
| since | No | Narrows the window, e.g. '30m', '1h'. | |
| context | No | K8s context (optional, uses current). |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint false, so the safety profile is covered. The description adds valuable behavioral context beyond annotations: 'Returns raw log text, not a table' and 'Only the running container's logs are returned,' which alerts the agent to output format and scope limitations. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three short, purposeful sentences. It front-loads the tool's purpose, states the return format, gives usage triggers, and notes a scope limitation. Every sentence earns its place with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only log retrieval tool, the description covers purpose, trigger conditions, return format, and container scope. Combined with rich annotations, a full parameter schema, and an output schema, nothing essential is missing for an agent to select and invoke this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameter meanings are already fully documented. The description does not add parameter-specific guidance (e.g., how tail/since/context interact), but because the schema covers all parameters with defaults and examples, baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with '[READ] AKO pod logs' and specifies concrete use cases: 'Ingress creation failures, sync errors, Controller connectivity.' It also distinguishes the tool from table-returning siblings by stating 'Returns raw log text, not a table,' so an agent can disambiguate from tools like vs_error_logs or ako_status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit trigger conditions: 'Use when ako_status shows the pod unhealthy or ako_sync_diff reports a missing Ingress.' This names sibling tools as decision points and provides clear context. However, it does not state when not to use this tool or name alternatives beyond the implied conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ako_restartADestructive
[WRITE] Restart the AKO pod by deleting it — its StatefulSet recreates it.
Without confirm=True this only previews: it returns blast_radius (context, namespace, the pod's name, uid, phase and restarts, and the Ingresses whose programming pauses until the new pod is Running) and changes nothing. Show that to the user and get their explicit decision. Do not set confirm=True on your own because the user asked earlier: they have not seen what it changes yet. The pod deleted is the one measured (uid precondition).
Refused with confirm=True: a pod already terminating, and a pod or Ingress list that cannot be read. Use when AKO is stuck or after config changes; brief traffic disruption is possible. Run ako_status afterwards, and ako_logs if the pod is not Running.
| Name | Required | Description | Default |
|---|---|---|---|
| confirm | No | False (default) returns the blast radius and changes nothing. True applies it. | |
| context | No | K8s context name (optional). | |
| confirmed | No | Deprecated alias for confirm; removed in the next minor release. confirmed=False holds even when confirm=True. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes far beyond the annotations. It explains the two-phase behavior (preview vs. apply), the blast_radius return fields, the uid precondition, the refusal conditions (pod already terminating, unreadable pod/Ingress list), and the traffic disruption risk. This is rich behavioral context that the annotations (destructiveHint=true, readOnlyHint=false) only hint at.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but well-organized. It front-loads the core action and the critical safety warning, then covers refusal conditions, usage context, and follow-up steps. Every sentence carries meaningful information, though the density could be slightly overwhelming for a quick read.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive write tool with no output schema, the description is remarkably complete. It covers the action, the preview/confirm flow, the blast radius contents, refusal conditions, usage context, and post-conditions. An agent has everything needed to invoke it correctly and safely.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents all three parameters. The description adds critical semantics for 'confirm': it explains the preview/apply distinction and warns against setting confirm=True without showing the user the blast radius. It also clarifies the deprecated 'confirmed' alias behavior. This adds value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Restart the AKO pod by deleting it — its StatefulSet recreates it.' This clearly distinguishes the tool from siblings like ako_status, ako_logs, and ako_config_show, which are read-only or config-related. The '[WRITE]' prefix and the explicit deletion mechanism make the tool's purpose unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit when-to-use guidance: 'Use when AKO is stuck or after config changes.' It also states what to do after using the tool ('Run ako_status afterwards, and ako_logs if the pod is not Running'). It warns about traffic disruption and explains the preview/confirm flow, which is essential for safe usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ako_statusARead-onlyIdempotent
[READ] Check AKO (AVI Kubernetes Operator) pod status in Kubernetes.
Returns pod name, phase, ready flag, restart count and namespace. First step for Ingress or LoadBalancer issues in Tanzu/K8s; follow with ako_logs when it is not Running. Looks in one context's AKO namespace only — run ako_clusters if not found.
| Name | Required | Description | Default |
|---|---|---|---|
| context | No | K8s context name (optional, uses current context). |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already cover read-only, idempotent, and non-destructive behavior, so the description doesn't need to restate those. It adds useful behavioral context beyond annotations: the tool checks only one context's AKO namespace, returns specific status fields, and is designed as the first diagnostic step. This gives the agent a clearer picture of operational behavior without over-explaining.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact yet information-dense: every sentence earns its place. It front-loads the core purpose and read-only marker, then delivers output details, usage context, and fallback guidance without repetition or filler. The structure moves from 'what' to 'when' to 'what's next', which is easy for an agent to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one optional parameter and a single narrow purpose, the description is fully sufficient. It covers the expected inputs, outputs, scope limitation, and next-step tools, and an output schema is already available for return-value details. Nothing an agent needs to select and invoke this tool correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% since the single optional 'context' parameter is already documented as 'K8s context name (optional, uses current context)'. The description adds some relevant scope nuance by saying the tool 'Looks in one context's AKO namespace only', but it does not materially expand on the parameter's format or default behavior. A baseline of 3 is appropriate here as the schema already carries the parameter meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a clear action: 'Check AKO pod status in Kubernetes', and it names the concrete resource (AKO pod) and what is returned (pod name, phase, ready flag, restart count, namespace). It also distinguishes itself from related AKO tools by positioning itself as the 'First step for Ingress or LoadBalancer issues' and pointing to ako_logs and ako_clusters as follow-ups. This is a specific, well-scoped purpose with no ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says when to use this tool ('First step for Ingress or LoadBalancer issues') and what to do afterward ('follow with ako_logs when it is not Running'). It also explains a boundary case: 'Looks in one context's AKO namespace only — run ako_clusters if not found.' This gives the agent clear routing to alternatives without leaving it to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ako_sync_diffARead-onlyIdempotent
[READ] List Ingresses with no matching Virtual Service or pool on the Controller.
Returns Type, namespace/name and Status per suspect Ingress. Use when ako_sync_status reports a mismatch; ako_sync_force reconciles. Shard-mode Ingresses are matched heuristically against AKO pool names, so confirm a 'Missing' result with pool_list before acting.
| Name | Required | Description | Default |
|---|---|---|---|
| context | No | K8s context name (optional). |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover read-only, idempotent, non-destructive behavior. The description adds valuable behavioral context: the heuristic shard-mode matching, the need to confirm 'Missing' results, and the output shape (Type, namespace/name, Status). No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three dense sentences: purpose first, return value second, usage and caveat third. No filler or repeated schema information. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one optional parameter, strong annotations, an output schema, and explicit sibling context, this description fully equips an agent to select and invoke it correctly, including a critical heuristic-matching caveat.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single optional context parameter, so the baseline of 3 applies. The description does not elaborate on the parameter, but it does not need to because the schema already provides a clear description and default.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'List Ingresses with no matching Virtual Service or pool on the Controller.' This clearly distinguishes it from the sibling tools ako_sync_status and ako_sync_force by focusing on diff detection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says when to use it ('Use when ako_sync_status reports a mismatch'), names the reconciliatory alternative (ako_sync_force), and directs confirmation of shard-mode results via pool_list. This gives an agent unambiguous routing criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ako_sync_forceADestructive
[WRITE] Force AKO to resync all K8s resources with the AVI Controller.
The resync restarts the AKO pod so it rebuilds every Virtual Service, pool and VS-VIP from the cluster's current resources. Without confirm=True this only previews: it returns blast_radius (context, namespace, the pod's name, uid and phase, and the Ingresses it re-programs) and changes nothing. Show that to the user and get their explicit decision. Do not set confirm=True on your own because the user asked earlier: they have not seen what it changes yet.
Refused with confirm=True: a pod already terminating, and a pod or Ingress list that cannot be read. Use when drift is detected; may cause brief traffic disruption. Run ako_sync_diff first to see what is out of sync, then ako_sync_status.
| Name | Required | Description | Default |
|---|---|---|---|
| confirm | No | False (default) returns the blast radius and changes nothing. True applies it. | |
| context | No | K8s context name (optional). | |
| confirmed | No | Deprecated alias for confirm; removed in the next minor release. confirmed=False holds even when confirm=True. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already flag destructiveHint=true, but the description goes well beyond that: it discloses that the resync restarts the pod, that without confirm=True it only previews and changes nothing, what the blast_radius contains, and the refusal conditions. No contradiction exists between description and annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the action and label, then organized into preview behavior, safety guidance, refusal cases, and workflow. Every sentence contributes either a safety constraint, a usage condition, or an outcome description. It is detailed but not padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is thorough for a destructive tool: it explains preview returns, refusal cases, traffic impact, and the recommended prior command. The only noticeable gap is that it does not state what a confirmed execution returns once applied, especially since no output schema exists. This is a minor omission given how much else is covered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is already 100% for all three parameters, so the baseline is 3. The description adds meaningful semantics for confirm: without it the tool is a no-op changing nothing, and it warns not to set confirm=True unilaterally. It also explains what a preview return looks like, which deepens the confirm parameter's meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Force AKO to resync all K8s resources with the AVI Controller.' It then clarifies the mechanism (pod restart, rebuilding every Virtual Service, pool, and VS-VIP), making the tool's function unmistakable and distinct from read-only siblings like ako_sync_status and ako_sync_diff.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit usage context: 'Use when drift is detected,' warns about traffic disruption, and prescribes a workflow: 'Run ako_sync_diff first... then ako_sync_status.' It also states a clear safety rule about not setting confirm=True without showing the user the preview, which is strong when-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ako_sync_statusARead-onlyIdempotent
[READ] Compare the number of K8s Ingresses with the number of AVI Virtual Services.
Returns both counts and a match/mismatch verdict. Use this first as a cheap check, then ako_sync_diff for which objects differ. A count comparison only — in AKO shard mode many Ingresses share one VS, so a mismatch does not by itself mean trouble.
| Name | Required | Description | Default |
|---|---|---|---|
| context | No | K8s context name (optional). |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, but the description adds meaningful behavioral nuance: this is a cheap preliminary count comparison, not a full diff, and shard mode can produce false mismatches. It also states exactly what the tool returns, going beyond the structured safety hints without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences, each earning its place: the operation and resources, the returned verdict, and the critical usage caveat. It is front-loaded with the purpose and avoids any filler or redundant restatement of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one optional parameter, rich annotations, an existing output schema, and clear sibling guidance, this description is complete. It tells the agent what the tool does, what it returns, when to use it as a first check, and what caveat to keep in mind—nothing needed for correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is only one optional context parameter, and the input schema already describes it as 'K8s context name (optional)' with 100% coverage. The description adds no further parameter detail, but none is needed since the schema fully documents the parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('Compare') and two concrete resources (K8s Ingresses and AVI Virtual Services), and states the output (counts plus a match/mismatch verdict). It also distinguishes itself from the sibling ako_sync_diff by noting the latter identifies which objects differ, so an agent can tell them apart.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit usage direction: 'Use this first as a cheap check, then ako_sync_diff for which objects differ.' It also sets expectations by explaining the comparison is count-only and that a mismatch is not necessarily a problem in AKO shard mode, which prevents the agent from over-trusting the result.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ako_versionARead-onlyIdempotent
[READ] AKO version running in a cluster, read from the pod's image tag.
Returns the pod name and an Image/Version pair per container. Use it to check compatibility with the Controller, and before ako_config_diff or ako_config_upgrade so both target the installed chart. The tag is the only source, so 'latest' reports 'latest', not a number.
| Name | Required | Description | Default |
|---|---|---|---|
| context | No | K8s context name (optional). |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark this as read-only, idempotent, and non-destructive, so the description adds meaningful context beyond them: the version source is the pod's image tag, and the edge case that 'latest' is reported literally rather than resolved to a numeric version. This gives the agent an accurate mental model of the tool's behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is tight and front-loaded: the action and source appear in the first line, followed by output shape, use cases, and a critical caveat. Every sentence earns its place and there is no redundant elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having an output schema, the description covers the essential non-schema context: what the version is derived from, the returned fields, the use-before-config workflows, and the 'latest' ambiguity. For a simple read-only tool with one optional parameter, nothing needed for correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The sole parameter, context, is fully documented in the schema as the optional K8s context name (100% coverage). With coverage that high, the description does not need to add parameter detail, and it does not meaningfully enrich the parameter's semantics beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description leads with a specific verb and resource: '[READ] AKO version running in a cluster, read from the pod's image tag.' It clearly defines the output (pod name and Image/Version pair per container) and distinguishes the tool from siblings by framing it as a foundational compatibility check referenced by ako_config_diff and ako_config_upgrade.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use: to check Controller compatibility and before running ako_config_diff or ako_config_upgrade so both target the installed chart. It gives concrete usage triggers but does not explicitly mention when not to use this tool or name a direct alternative for version queries.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pool_listARead-onlyIdempotent
[READ] Discover pools on the Controller.
Returns Name, member count, Enabled and short UUID per pool. Use this before pool_members: pools are often named differently from the VS that use them.
| Name | Required | Description | Default |
|---|---|---|---|
| vs_filter | No | Substring matching VS names (e.g. 'web') — returns only the pools those VS reference. Omit for all pools. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the read-only nature is covered. The description adds a domain caveat about pool naming that helps interpret results, plus '[READ]' reinforces the safety profile. No contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with purpose, then return fields and usage. Every sentence adds information and there is no redundancy with the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only list tool with one optional parameter, a full output schema, and rich annotations, the description covers purpose, expected results, and sequencing relative to pool_members. Nothing else is needed for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%; vs_filter is fully described with substring matching semantics and default behavior. The description adds no parameter-level details beyond that, so the schema carries the burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific action ('Discover pools') and a resource ('Controller'), then enumerates the exact fields returned (Name, member count, Enabled, short UUID). The contrast with sibling pool_members makes distinguishing easy.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly directs the agent to call this before pool_members and gives the reason (pool names often differ from VS names). This is a clear when and names the alternative, so no inference is needed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pool_member_disableADestructive
[WRITE] Disable a pool member with graceful drain — existing connections complete, no new traffic.
Without confirm=True this only previews: it returns blast_radius (pool name and uuid, the member's IP/port/state, and how many members are enabled before and after) and changes nothing. Show that to the user and get their explicit decision. Do not set confirm=True on your own because the user asked earlier: they have not seen what it changes yet. An already disabled member returns action "noop".
Refused with confirm=True: the pool's only enabled member (the pool would serve nothing — enable another first, or use vs_toggle on purpose), an IP that matches more than one member, and a pool whose members cannot be read. Use for maintenance or rolling deployments; run pool_members first for the server IP, pool_member_enable to reverse it.
| Name | Required | Description | Default |
|---|---|---|---|
| pool | Yes | Exact pool name as shown by pool_list — matched literally, not fuzzily, and an unknown name is refused rather than ignored. Pools are often named differently from the Virtual Services that use them, so do not infer it from a VS name. | |
| server | Yes | Server IP address. | |
| confirm | No | False (default) returns the blast radius and changes nothing. True applies it. | |
| confirmed | No | Deprecated alias for confirm; removed in the next minor release. confirmed=False holds even when confirm=True. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With readOnlyHint=false and destructiveHint=true, the description adds crucial behavior beyond annotations: graceful drain semantics, preview vs. apply modes, noop on already-disabled members, refusal cases, and the deprecated confirmed=True override. No annotation contradiction exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the write/drain action and every sentence carries operational value: preview behavior, refusal conditions, and alternatives. Despite its length, it is structured and dense rather than redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, confirmation-gated tool with no output schema, the description fully covers return behavior, blast radius contents, failure/refusal cases, and how to proceed safely. An agent has enough context to invoke it correctly and to know when not to.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents pool, server, confirm, and confirmed. The description reinforces the confirm semantics but does not add much parameter-level detail beyond what already exists, which is appropriate at high coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Disable a pool member with graceful drain'. It also explains the central preview/confirm behavior and clearly differentiates from the sibling pool_member_enable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly says when to use the tool ('maintenance or rolling deployments'), instructs to run pool_members first, and names pool_member_enable as the reverse operation. It also gives strong procedural guidance: do not set confirm=True until the user has seen the blast radius.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pool_member_enableA
[WRITE] Enable a pool member so it receives traffic again.
Returns a one-line confirmation. Use pool_members first to verify the server IP. The server must already belong to the pool — this adds nothing.
| Name | Required | Description | Default |
|---|---|---|---|
| pool | Yes | Exact pool name as shown by pool_list — matched literally, not fuzzily, and an unknown name is refused rather than ignored. Pools are often named differently from the Virtual Services that use them, so do not infer it from a VS name. | |
| server | Yes | Server IP address. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses the return format ('one-line confirmation'), marks the operation as [WRITE], and clarifies that no membership addition occurs. These details go beyond what the annotations alone convey. It does not contradict the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences: the action and outcome are first, followed by return format and a necessary precondition. There is no redundant wording or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, both parameters are required and fully described in the schema, an output schema exists, and the description covers the key behavioral nuance. An agent has enough information to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already explains that pool must be an exact literal name and server is an IP address. The description adds the practical note to verify via pool_members, but does not substantially expand parameter meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Enable a pool member so it receives traffic again.' This clearly differentiates it from pool_member_disable and states the intended effect. The [WRITE] prefix reinforces the action type.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly instructs to 'Use pool_members first to verify the server IP' and states that 'The server must already belong to the pool — this adds nothing.' This gives useful context and a precondition, though it does not explicitly mention the sibling pool_member_disable as the inverse alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pool_membersARead-onlyIdempotent
[READ] List the members of a pool.
Returns Server IP, Port, Enabled and Ratio per member. Use before pool_member_enable or pool_member_disable; run pool_list first for the pool name. Reports configured state only, not live health-monitor results.
| Name | Required | Description | Default |
|---|---|---|---|
| pool | Yes | Exact pool name as shown by pool_list — matched literally, not fuzzily, and an unknown name is refused rather than ignored. Pools are often named differently from the Virtual Services that use them, so do not infer it from a VS name. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint and destructiveHint annotations, the description adds a valuable behavioral caveat: it reflects configured state, not live health-monitor results. It also discloses exactly which output fields are returned. No contradiction with the annotations exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: the action and result fields come first, followed by workflow context and a caveat. Every sentence earns its place, with no filler or repeated schema information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only, single-parameter listing tool with an output schema, the description fully covers what it returns, prerequisites, sibling-tool relationships, and an important limitation. Nothing an agent needs to decide when or how to call it is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the pool parameter is already richly documented in the schema with exact-match semantics, literal matching, and a warning not to infer the pool name from a Virtual Service name. The description only reinforces this by saying to run pool_list first, so it adds little beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description starts with a clear action and object: 'List the members of a pool.' It also names the specific returned fields (Server IP, Port, Enabled, Ratio), and the '[READ]' prefix reinforces its read-only nature. The tool is distinguished from siblings by explicitly positioning it relative to pool_member_enable/pool_member_disable and pool_list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit workflow guidance: 'Use before pool_member_enable or pool_member_disable' and 'run pool_list first for the pool name.' It also states an exclusion — 'Reports configured state only, not live health-monitor results' — so an agent knows when not to rely on this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
se_healthARead-onlyIdempotent
[READ] Health of every Service Engine — operational status and VS counts.
Returns name, operational state and the number of VSes placed on each SE. Use when VS health degrades to check if the issue is at the SE level; se_list gives the management IP and SE Group, vs_status the affected VS. An SE hosting no VS reports 0, not an error.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish the read-only, idempotent, non-destructive profile, so the description's '[READ]' tag adds a little. More valuable is the explicit edge case that an SE with no VS reports 0 rather than an error, which is useful behavioral context beyond the structured annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and well-structured: purpose is front-loaded, followed by return fields, usage guidance, alternatives, and a critical edge case. Every sentence contributes information an agent needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no parameters, an output schema present, and comprehensive annotations, the description covers the remaining practical concerns: what fields are returned, when to use the tool, and the zero-VS reporting behavior. Nothing an agent needs to invoke or interpret the result is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the description does not need to explain any. Per the calibration, zero param count starts at baseline 4, and the description correctly avoids inventing parameter details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reports the health of every Service Engine, including name, operational status, and VS counts. It also distinguishes itself from related tools like se_list and vs_status, so an agent can identify its role without ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says when to use this tool: when VS health degrades and the agent needs to determine whether the issue is at the SE level. It also names se_list and vs_status as alternatives and explains what each provides, making the routing decision clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
se_listARead-onlyIdempotent
[READ] List Service Engines (AVI data-plane VMs) on the Controller.
Returns Name, management IP, status (e.g. OPER_UP) and SE Group per SE, in one call that cannot be paged or filtered. Use to inventory capacity or find an SE's name and IP — use se_health instead for degraded VS health.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnly, idempotent, and non-destructive behavior. The description adds useful behavioral context by stating the call cannot be paged or filtered and enumerates what it returns, going beyond the annotation signal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact, front-loaded with the [READ] intent, and each sentence adds meaningful information. There is no fluff or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter read-only list operation with an output schema present, the description covers the purpose, usage, limitations, and alternative. Nothing essential is missing for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline is 4. The description adds no parameter details because none are needed; it instead explains the output fields and constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource ('List Service Engines ... on the Controller') and states the returned fields. It also differentiates this tool from se_health by noting the health-focused sibling.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit use cases ('inventory capacity or find an SE's name and IP') and explicitly directs the agent to se_health for degraded VS health. This provides clear when-to-use and when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssl_expiry_checkARead-onlyIdempotent
[READ] Check which SSL certificates expire within N days (default 30).
Returns name, expiry date and days remaining, soonest first. Use this instead of ssl_list when you only want certificates near expiry. Expired certs are included, with negative days remaining.
| Name | Required | Description | Default |
|---|---|---|---|
| days | No | Report certs expiring within this many days (default 30). |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already carry the safety profile (readOnlyHint=true, idempotentHint=true, destructiveHint=false), and the description adds genuine result behavior on top: soonest-first ordering and the edge case that 'Expired certs are included, with negative days remaining.' This goes beyond what the annotations disclose, though it stops short of covering pagination or rate limits, which are likely non-issues for a filtered read tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each earning its place: purpose, return contract, and sibling routing. The '[READ]' prefix and 'soonest first' flag are efficient front-loaded signals with zero filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-optional-parameter read tool with an output schema and safety annotations, the description covers the return fields, ordering, default behavior, edge case (expired certs), and the alternative tool. Nothing an agent needs to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%: the schema already documents 'days' with a description and default of 30. The tool description repeats the default ('within N days (default 30)') but adds no meaning beyond the schema, so the baseline of 3 is correct.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('Check') and resource ('SSL certificates expire within N days'), and immediately distinguishes itself from siblings: 'Use this instead of ssl_list when you only want certificates near expiry.' An agent can tell this apart from the 28 sibling tools without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly names the alternative (ssl_list) and gives the selection condition ('when you only want certificates near expiry'), which implies the inverse condition for the sibling. This is exactly the explicit when/alternative guidance the rubric rewards.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssl_listARead-onlyIdempotent
[READ] List SSL/TLS certificates stored on the AVI Controller.
Returns Name, Subject, Expiry and Type per certificate, in one call that cannot be paged or filtered. Use for inventory or a certificate's exact name — use ssl_expiry_check instead for only the ones expiring soon.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, covering the safety profile. The description adds meaningful behavioral context beyond annotations: the call "cannot be paged or filtered" and returns specific fields. The [READ] prefix reinforces the non-mutating nature.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three tight sentences with no filler. The main purpose is front-loaded, followed by the return fields, the key limitation, and the sibling alternative. Every sentence adds distinct value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter read-only list tool with an output schema, the description is complete: it names the resource, states the returned fields, notes the pagination/filtering limitation, and directs the agent to the appropriate alternative. Nothing an agent needs to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there are no parameter semantics for the description to clarify. The description adds that the call is unfilterable, which implicitly confirms that no filtering parameters exist. The baseline for zero-parameter tools is 4, and no deductions are warranted.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: "List SSL/TLS certificates stored on the AVI Controller." It clearly distinguishes the tool from the sibling ssl_expiry_check by stating that this one is for inventory or exact name lookup while the sibling is for certificates expiring soon.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says when to use this tool: "Use for inventory or a certificate's exact name — use ssl_expiry_check instead for only the ones expiring soon." This provides both a positive use case and an explicit alternative, leaving no ambiguity about selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vs_analyticsARead-onlyIdempotent
[READ] Performance metrics for one Virtual Service over the last hour.
Returns L4 (bandwidth, connections) and L7 (latency, % errors, responses) averages over a fixed window that cannot be changed (12 samples, 5 min apart). Empty output means no traffic, not an error. Use when vs_status shows degraded health; vs_error_logs gives per-request detail.
| Name | Required | Description | Default |
|---|---|---|---|
| vs_name | Yes | Exact Virtual Service name, case-sensitive, from vs_list. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, openWorld, and idempotent behavior, and the description adds valuable context beyond them: the fixed 12-sample/5-minute window that cannot be changed, and the non-obvious empty-output semantics meaning no traffic rather than an error. This fully informs the agent of behavioral edge cases.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences each earn their place: the purpose, the metric/window detail, the empty-output signal, and the usage guidance. It is front-loaded and has no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter read-only tool with a full output schema, the description is complete. It covers what the tool returns, the fixed time window, empty result behavior, and when to choose this tool versus its sibling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already fully documents vs_name as an exact, case-sensitive Virtual Service name from vs_list. The description adds no meaning for the parameter beyond the schema, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific action and resource: returns performance metrics for one Virtual Service over the last hour. It differentiates itself from siblings by specifying L4 and L7 metric categories, making it clear this is the analytics tool rather than vs_status or vs_error_logs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly instructs when to use this tool: when vs_status shows degraded health. It also names the alternative for per-request detail (vs_error_logs), giving the agent clear routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vs_error_logsARead-onlyIdempotent
[READ] Recent request error logs for one Virtual Service.
Returns up to 50 lines — timestamp, HTTP status, URI path, client IP — for status 400 and above. Use this instead of vs_analytics for per-request detail. An empty result may mean no errors, or capture disabled on the VS.
| Name | Required | Description | Default |
|---|---|---|---|
| since | No | Window — seconds or '30m', '1h', '2d' (default '1h'). | 1h |
| vs_name | Yes | Exact Virtual Service name, from vs_list. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and non-destructive, and the description adds complementary context: the 50-line limit, status >=400 filter, the exact returned fields, and the ambiguity of empty results (no errors vs capture disabled). No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences, each earning its place. The READ intent is front-loaded, followed by return details, sibling distinction, and an important caveat about empty results. Zero wasteful wording.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return fields are further specified there. The description covers the critical operational details: scope, result cap, status filter, alternative tool, and the empty-result ambiguity. Nothing an agent needs to correctly invoke or interpret the tool is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters are fully documented in the schema; the description adds no additional parameter semantics beyond the general purpose of the tool. Baseline 3 is appropriate because the schema carries the parameter documentation burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb, resource, and scope: 'Returns... error logs for one Virtual Service' with explicit detail on line limit, status threshold, and fields. It directly names the alternative vs_analytics, so an agent can distinguish without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'Use this instead of vs_analytics for per-request detail', naming the alternative and the condition that selects this tool. It also adds interpretation guidance for empty results, which helps decide whether to escalate or check configuration.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vs_listARead-onlyIdempotent
[READ] List Virtual Services on the AVI Controller.
Returns Name, Enabled, VIP and short UUID for every VS in one call; it cannot be paged or filtered, and carries no health score. Use this before drilling into one VS with vs_status.
| Name | Required | Description | Default |
|---|---|---|---|
| controller | No | Controller name from config (optional, uses default). |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare the tool read-only, idempotent, and non-destructive, but the description adds operational behavior beyond that: it returns every VS in one call, cannot be paged or filtered, and intentionally omits health scores. This is exactly the contextual disclosure an agent needs to invoke it correctly.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Every sentence earns its place: a clear purpose, a compact summary of returned data and limitations, and an explicit next-step recommendation. The information is front-loaded and there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only list tool with one optional parameter, an output schema, and a clear sibling relationship, this description is complete. It covers return contents, the all-at-once nature, limitations, and the recommended follow-up tool, so an agent can choose and call it correctly without opening the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter, 'controller', is fully described in the input schema with its default and meaning. Schema description coverage is 100%, so the description does not need to repeat parameter details. The baseline 3 applies since no additional parameter-level nuance is provided.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'List Virtual Services on the AVI Controller.' It then enumerates the returned fields (Name, Enabled, VIP, short UUID), so an agent knows precisely what this tool does. It also distinguishes itself from vs_status via the final sentence.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly places this tool in a workflow: 'Use this before drilling into one VS with vs_status.' It also states the key limitations—no pagination, no filtering, no health score—so an agent knows when not to rely on it and can route to the more specific sibling.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vs_statusARead-onlyIdempotent
[READ] Detailed status for one Virtual Service: VIP, pool, health, connections, throughput.
Returns one detail block, not a list. Use vs_list first for the exact name — a name that does not match exactly fails. Then vs_analytics for metrics, vs_error_logs for 5xx.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Exact Virtual Service name. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover read-only, idempotent, and non-destructive behavior. The description adds useful behavioral specifics beyond annotations: exact-name matching is required, a mismatch fails, and the response is one detail block, not a list. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded with the [READ] marker and the key purpose. Every sentence contributes either core semantics, a failure condition, or routing to alternatives, with no filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter read tool with a rich output schema and strong annotations, this description is complete. It covers prerequisite ordering, exact-match failure, the shape of the return (one block), and sibling tool routing, so an agent has everything needed to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the name parameter already has the description 'Exact Virtual Service name.' The tool description reinforces the exact-match requirement, but adds no new parameter format or syntax details beyond what the schema provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool's function: detailed status for one Virtual Service including VIP, pool, health, connections, and throughput. It differentiates from siblings by noting it returns a single detail block rather than a list, and specifies that vs_analytics and vs_error_logs serve complementary purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells the agent to call vs_list first to obtain an exact name, warns that a non-exact name fails, and directs metrics to vs_analytics and 5xx to vs_error_logs. This is clear when-to-use and when-not-to-use guidance beyond what annotations provide.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vs_toggleADestructive
[WRITE] Enable or disable a Virtual Service. Disabling stops all traffic to it.
Without confirm=True this only previews: it returns blast_radius (the VS name and uuid, whether it is enabled now, its VIPs and oper status, and the pools and member counts behind it) and changes nothing. Show that to the user and get their explicit decision. Do not set confirm=True on your own because the user asked earlier: they have not seen what it changes yet. A VS already in the requested state returns action "noop".
Refused with confirm=True: a VS whose uuid or pools cannot be read (the change would be blind). Use vs_status first to check current state.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Exact Virtual Service name. | |
| enable | Yes | true to enable, false to disable. | |
| confirm | No | False (default) returns the blast radius and changes nothing. True applies it. | |
| confirmed | No | Deprecated alias for confirm; removed in the next minor release. confirmed=False holds even when confirm=True. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already carry destructiveHint=true and readOnlyHint=false, but the description adds substantial behavioral context: the two-phase preview/confirm flow, the 'noop' response for already-requested state, and the refusal condition when the VS cannot be read. These are not derivable from annotations or schema, and they give the agent a precise model of side effects and edge cases.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense and well-structured: purpose first, then preview behavior, then warnings and refusal. It is a little long, but every sentence carries critical information; there is no filler. A 4 is fair because it could be tightened slightly without losing meaning, but it is far from verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no output schema, the description covers everything an agent needs: it details the return payload of the preview (blast_radius fields), the noop case, the refusal condition, and the interaction with vs_status. Given the tool's complexity and the absence of an output schema, this is remarkably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers all parameters with descriptions, but the tool description deepens meaning: it explains that confirm=False is a dry-run that returns blast_radius, that confirm=True applies the change, and that the deprecated 'confirmed' alias behaves unexpectedly (confirmed=False overrides confirm=True). This level of nuance is essential for correct invocation and goes well beyond the schema text.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a clear verb and resource ('Enable or disable a Virtual Service') and specifies the exact effect ('Disabling stops all traffic to it'). It also includes a [WRITE] tag, which flags mutation, and distinguishes this from read-only siblings like vs_status and vs_list by focusing on the state change action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit when-to-use guidance: without confirm=True it is a preview, and the agent must show the blast radius to the user and get their decision before applying. It explicitly warns against setting confirm=True prematurely and even mentions using vs_status first to check current state. This is textbook alternative routing and preconditioning.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v1.10.0- Changed
ako_config_upgrade11 fields changed- changed
Input schema / properties / chart_version / descriptionPrevious value: -"Pin the chart, e.g. \"1.11.1\". Empty = registry latest."New value: +"Pin the chart, e.g. \"1.11.1\". Empty = registry latest, resolved at apply time, so it can differ from the preview." - added
Input schema / properties / confirmAdded value: +{ + "default": false, + "description": "False (default) returns the blast radius and changes nothing. True applies it.", + "title": "Confirm", + "type": "boolean" +} - added
Input schema / properties / confirmed / anyOfAdded value: +[ + { + "type": "boolean" + }, + { + "type": "null" + } +] - changed
Input schema / properties / confirmed / defaultPrevious value: -falseNew value: +null - changed
Input schema / properties / confirmed / descriptionPrevious value: -"Gates the real upgrade only. With dry_run=false, the default false returns a preview naming the chart version and changes nothing; true runs `helm upgrade --reuse-values` against the avi-system release, rolling the AKO pod. Ignored while dry_run=true, which never writes."New value: +"Deprecated alias for confirm; removed in the next minor release. confirmed=False holds even when confirm=True." - removed
Input schema / properties / confirmed / typeRemoved value: -"boolean" - added
Input schema / properties / dry_run / anyOfAdded value: +[ + { + "type": "boolean" + }, + { + "type": "null" + } +] - changed
Input schema / properties / dry_run / defaultPrevious value: -trueNew value: +null - changed
Input schema / properties / dry_run / descriptionPrevious value: -"Preview without applying (default true)."New value: +"Deprecated alias; removed in the next minor release. The old contract applied only with dry_run=false and confirmed=true; dry_run=true holds even when confirm=True." - removed
Input schema / properties / dry_run / typeRemoved value: -"boolean" - changed
Output schema / (root)Previous value: -{ - "properties": { - "result": { - "title": "Result", - "type": "string" - } - }, - "required": [ - "result" - ], - "title": "ako_config_upgradeOutput", - "type": "object" -}New value: +null
- Changed
ako_restart6 fields changed- added
Input schema / properties / confirmAdded value: +{ + "default": false, + "description": "False (default) returns the blast radius and changes nothing. True applies it.", + "title": "Confirm", + "type": "boolean" +} - added
Input schema / properties / confirmed / anyOfAdded value: +[ + { + "type": "boolean" + }, + { + "type": "null" + } +] - changed
Input schema / properties / confirmed / defaultPrevious value: -falseNew value: +null - changed
Input schema / properties / confirmed / descriptionPrevious value: -"false (the default) returns a preview and changes nothing; true deletes the AKO pod. The StatefulSet recreates it, so this is a restart rather than a removal, but ingress programming pauses until the new pod is Running and brief traffic disruption is possible."New value: +"Deprecated alias for confirm; removed in the next minor release. confirmed=False holds even when confirm=True." - removed
Input schema / properties / confirmed / typeRemoved value: -"boolean" - changed
Output schema / (root)Previous value: -{ - "properties": { - "result": { - "title": "Result", - "type": "string" - } - }, - "required": [ - "result" - ], - "title": "ako_restartOutput", - "type": "object" -}New value: +null
- Changed
ako_sync_force6 fields changed- added
Input schema / properties / confirmAdded value: +{ + "default": false, + "description": "False (default) returns the blast radius and changes nothing. True applies it.", + "title": "Confirm", + "type": "boolean" +} - added
Input schema / properties / confirmed / anyOfAdded value: +[ + { + "type": "boolean" + }, + { + "type": "null" + } +] - changed
Input schema / properties / confirmed / defaultPrevious value: -falseNew value: +null - changed
Input schema / properties / confirmed / descriptionPrevious value: -"false (the default) returns a preview and changes nothing; true forces the resync, which restarts the AKO pod so it rebuilds every Virtual Service, pool and VS-VIP from the cluster's current resources — brief traffic disruption is possible."New value: +"Deprecated alias for confirm; removed in the next minor release. confirmed=False holds even when confirm=True." - removed
Input schema / properties / confirmed / typeRemoved value: -"boolean" - changed
Output schema / (root)Previous value: -{ - "properties": { - "result": { - "title": "Result", - "type": "string" - } - }, - "required": [ - "result" - ], - "title": "ako_sync_forceOutput", - "type": "object" -}New value: +null
- Changed
pool_member_disable6 fields changed- added
Input schema / properties / confirmAdded value: +{ + "default": false, + "description": "False (default) returns the blast radius and changes nothing. True applies it.", + "title": "Confirm", + "type": "boolean" +} - added
Input schema / properties / confirmed / anyOfAdded value: +[ + { + "type": "boolean" + }, + { + "type": "null" + } +] - changed
Input schema / properties / confirmed / defaultPrevious value: -falseNew value: +null - changed
Input schema / properties / confirmed / descriptionPrevious value: -"false (the default) returns a preview naming the member and pool, and changes nothing; true disables the member, draining it so existing connections finish while new traffic stops. Reverse it with pool_member_enable."New value: +"Deprecated alias for confirm; removed in the next minor release. confirmed=False holds even when confirm=True." - removed
Input schema / properties / confirmed / typeRemoved value: -"boolean" - changed
Output schema / (root)Previous value: -{ - "properties": { - "result": { - "title": "Result", - "type": "string" - } - }, - "required": [ - "result" - ], - "title": "pool_member_disableOutput", - "type": "object" -}New value: +null
- Changed
vs_toggle6 fields changed- added
Input schema / properties / confirmAdded value: +{ + "default": false, + "description": "False (default) returns the blast radius and changes nothing. True applies it.", + "title": "Confirm", + "type": "boolean" +} - added
Input schema / properties / confirmed / anyOfAdded value: +[ + { + "type": "boolean" + }, + { + "type": "null" + } +] - changed
Input schema / properties / confirmed / defaultPrevious value: -falseNew value: +null - changed
Input schema / properties / confirmed / descriptionPrevious value: -"Gates the disable only. With enable=false, the default false returns a preview naming the VS that would stop serving traffic and changes nothing; true performs the disable. Ignored when enable=true — enabling always executes."New value: +"Deprecated alias for confirm; removed in the next minor release. confirmed=False holds even when confirm=True." - removed
Input schema / properties / confirmed / typeRemoved value: -"boolean" - changed
Output schema / (root)Previous value: -{ - "properties": { - "result": { - "title": "Result", - "type": "string" - } - }, - "required": [ - "result" - ], - "title": "vs_toggleOutput", - "type": "object" -}New value: +null
28 tool updates
v1.8.14- Added
ako_amko_status - Changed
ako_clusters1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
ako_config_diff2 fields changed- added
Input schema / additionalPropertiesAdded value: +false - added
Input schema / properties / chart_version / descriptionAdded value: +"Pin the chart, e.g. \"1.11.1\". Empty = registry latest."
- Added
ako_config_show - Added
ako_config_upgrade - Added
ako_ingress_check - Added
ako_ingress_diagnose - Added
ako_ingress_map - Changed
ako_logs4 fields changed- added
Input schema / additionalPropertiesAdded value: +false - added
Input schema / properties / context / descriptionAdded value: +"K8s context (optional, uses current)." - added
Input schema / properties / since / descriptionAdded value: +"Narrows the window, e.g. '30m', '1h'." - added
Input schema / properties / tail / descriptionAdded value: +"Number of log lines (default 100)."
- Added
ako_restart - Added
ako_status - Changed
ako_sync_diff2 fields changed- added
Input schema / additionalPropertiesAdded value: +false - added
Input schema / properties / context / descriptionAdded value: +"K8s context name (optional)."
- Changed
ako_sync_force3 fields changed- added
Input schema / additionalPropertiesAdded value: +false - added
Input schema / properties / confirmed / descriptionAdded value: +"false (the default) returns a preview and changes nothing; true forces the resync, which restarts the AKO pod so it rebuilds every Virtual Service, pool and VS-VIP from the cluster's current resources — brief traffic disruption is possible." - added
Input schema / properties / context / descriptionAdded value: +"K8s context name (optional)."
- Added
ako_sync_status - Added
ako_version - Changed
pool_list2 fields changed- added
Input schema / additionalPropertiesAdded value: +false - added
Input schema / properties / vs_filter / descriptionAdded value: +"Substring matching VS names (e.g. 'web') — returns only the pools those VS reference. Omit for all pools."
- Added
pool_member_disable - Changed
pool_member_enable3 fields changed- added
Input schema / additionalPropertiesAdded value: +false - added
Input schema / properties / pool / descriptionAdded value: +"Exact pool name as shown by pool_list — matched literally, not fuzzily, and an unknown name is refused rather than ignored. Pools are often named differently from the Virtual Services that use them, so do not infer it from a VS name." - added
Input schema / properties / server / descriptionAdded value: +"Server IP address."
- Changed
pool_members2 fields changed- added
Input schema / additionalPropertiesAdded value: +false - added
Input schema / properties / pool / descriptionAdded value: +"Exact pool name as shown by pool_list — matched literally, not fuzzily, and an unknown name is refused rather than ignored. Pools are often named differently from the Virtual Services that use them, so do not infer it from a VS name."
- Added
se_health - Changed
se_list1 field changed- added
Input schema / additionalPropertiesAdded value: +false
- Changed
ssl_expiry_check2 fields changed- added
Input schema / additionalPropertiesAdded value: +false - added
Input schema / properties / days / descriptionAdded value: +"Report certs expiring within this many days (default 30)."
- Added
ssl_list - Added
vs_analytics - Changed
vs_error_logs3 fields changed- added
Input schema / additionalPropertiesAdded value: +false - added
Input schema / properties / since / descriptionAdded value: +"Window — seconds or '30m', '1h', '2d' (default '1h')." - added
Input schema / properties / vs_name / descriptionAdded value: +"Exact Virtual Service name, from vs_list."
- Changed
vs_list2 fields changed- added
Input schema / additionalPropertiesAdded value: +false - added
Input schema / properties / controller / descriptionAdded value: +"Controller name from config (optional, uses default)."
- Added
vs_status - Changed
vs_toggle4 fields changed- added
Input schema / additionalPropertiesAdded value: +false - added
Input schema / properties / confirmed / descriptionAdded value: +"Gates the disable only. With enable=false, the default false returns a preview naming the VS that would stop serving traffic and changes nothing; true performs the disable. Ignored when enable=true — enabling always executes." - added
Input schema / properties / enable / descriptionAdded value: +"true to enable, false to disable." - added
Input schema / properties / name / descriptionAdded value: +"Exact Virtual Service name."
10 tool updates
v1.8.8- Added
ako_clusters - Added
ako_config_diff - Removed
ako_ingress_check - Added
ako_sync_force - Removed
ako_sync_status - Added
pool_list - Removed
pool_member_disable - Added
pool_members - Added
se_list - Added
ssl_expiry_check
19 tool updates
v1.8.8- Removed
ako_amko_status - Removed
ako_clusters - Removed
ako_config_diff - Removed
ako_config_show - Removed
ako_config_upgrade - Removed
ako_ingress_diagnose - Removed
ako_ingress_map - Removed
ako_restart - Removed
ako_status - Removed
ako_sync_force - Removed
ako_version - Removed
pool_list - Removed
pool_members - Removed
se_health - Removed
se_list - Removed
ssl_expiry_check - Removed
ssl_list - Removed
vs_analytics - Removed
vs_status
4 tool updates
v1.5.38- Removed
ako_cluster_overview - Changed
ako_config_upgrade1 field changed- added
Input schema / properties / confirmedAdded value: +{ + "default": false, + "title": "Confirmed", + "type": "boolean" +}
- Removed
ako_ingress_fix_suggest - Changed
ako_logs1 field changed- added
Input schema / properties / contextAdded value: +{ + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "default": null, + "title": "Context" +}
30 tool updates
v1.5.29- Added
ako_amko_status - Added
ako_cluster_overview - Added
ako_clusters - Added
ako_config_diff - Added
ako_config_show - Added
ako_config_upgrade - Added
ako_ingress_check - Added
ako_ingress_diagnose - Added
ako_ingress_fix_suggest - Added
ako_ingress_map - Added
ako_logs - Added
ako_restart - Added
ako_status - Added
ako_sync_diff - Added
ako_sync_force - Added
ako_sync_status - Added
ako_version - Added
pool_list - Added
pool_member_disable - Added
pool_member_enable - Added
pool_members - Added
se_health - Added
se_list - Added
ssl_expiry_check - Added
ssl_list - Added
vs_analytics - Added
vs_error_logs - Added
vs_list - Added
vs_status - Added
vs_toggle
30 tool updates
v1.5.28- Removed
ako_amko_status - Removed
ako_cluster_overview - Removed
ako_clusters - Removed
ako_config_diff - Removed
ako_config_show - Removed
ako_config_upgrade - Removed
ako_ingress_check - Removed
ako_ingress_diagnose - Removed
ako_ingress_fix_suggest - Removed
ako_ingress_map - Removed
ako_logs - Removed
ako_restart - Removed
ako_status - Removed
ako_sync_diff - Removed
ako_sync_force - Removed
ako_sync_status - Removed
ako_version - Removed
pool_list - Removed
pool_member_disable - Removed
pool_member_enable - Removed
pool_members - Removed
se_health - Removed
se_list - Removed
ssl_expiry_check - Removed
ssl_list - Removed
vs_analytics - Removed
vs_error_logs - Removed
vs_list - Removed
vs_status - Removed
vs_toggle
30 tool updates
v1.5.22- First observed
ako_amko_status - First observed
ako_cluster_overview - First observed
ako_clusters - First observed
ako_config_diff - First observed
ako_config_show - First observed
ako_config_upgrade - First observed
ako_ingress_check - First observed
ako_ingress_diagnose - First observed
ako_ingress_fix_suggest - First observed
ako_ingress_map - First observed
ako_logs - First observed
ako_restart - First observed
ako_status - First observed
ako_sync_diff - First observed
ako_sync_force - First observed
ako_sync_status - First observed
ako_version - First observed
pool_list - First observed
pool_member_disable - First observed
pool_member_enable - First observed
pool_members - First observed
se_health - First observed
se_list - First observed
ssl_expiry_check - First observed
ssl_list - First observed
vs_analytics - First observed
vs_error_logs - First observed
vs_list - First observed
vs_status - First observed
vs_toggle
TDQS
Scored across 28 tools
Each tool targets a distinct resource or action, with cross-references guiding selection (e.g., pool_list before pool_members, vs_list before vs_status). Even similar-sounding tools like ako_sync_status vs ako_sync_diff are clearly differentiated by purpose and output.
All tools follow a consistent verb_noun snake_case pattern (e.g., pool_list, vs_toggle, ako_config_upgrade). Verbs are descriptive and nouns match the domain resources, making the surface predictable and easy to navigate.
At 28 tools, the count is above the ideal range, but the server spans two related domains (AVI Controller and AKO/Kubernetes), justifying the breadth. Each tool serves a distinct operational or diagnostic purpose, though some consolidation could reduce overhead.
The tool set covers the full operational lifecycle for monitoring and managing AVI resources and AKO deployments, including reads, writes (toggles, restarts, upgrades), and diagnostics. Minor gaps exist, such as no tool for creating pools or VSes, but these fall outside the apparent operational focus.
Maintenance
Related MCP Connectors
Governed MCP gateway: one endpoint for your tools, with credential custody and audit log.
Hosted MCP catalog with 30 tenant-isolated browser, RAG, AI, mail and media tools.
- ZopDev MCPOAuthdev.zop
Cloud cost, inventory and governance on AWS/Azure/GCP. Read-only by default, optional scoped writes
Remote MCP for Copilot CLI switch gate MCP, structured receipts, audit logs, and reviewer-ready evid
Related MCP Servers
- AlicenseNot gradedqualityAmaintenanceProvides MCP multi-cluster Kubernetes management and operations, featuring a management interface, logging, and nearly 50 built-in tools covering common DevOps and development scenarios. Supports both standard and CRD resources.884MIT
- AlicenseNot gradedqualityDmaintenanceEnables secure management of VMware vCenter 8.0+ environments through controlled operations including VM lifecycle management, snapshots, and resource discovery with built-in RBAC authorization, audit logging, and rate limiting.6MIT
- AlicenseAqualityAmaintenanceAI-powered VMware vSphere with Tanzu (VKS) management. Create and manage Supervisor Namespaces and TanzuKubernetesClusters with 20 MCP tools.23579 PyPI5MIT
- AlicenseAqualityAmaintenanceMCP server for managing VMware vCenter (vSphere 7/8) with 39 tools covering VMs, clusters, and ESXi hosts. Supports direct and jump host deployment modes.20MIT