vmware-avi
This server provides comprehensive management and operational tools for VMware AVI (NSX Advanced Load Balancer) and AKO (AVI Kubernetes Operator), exposing 28 tools across 10 categories.
Virtual Service Management: List all Virtual Services, check detailed status (VIP, pool, health, connections), and enable/disable Virtual Services.
Pool Member Management: Discover pools, list members with health info, and enable or gracefully drain/disable individual pool members for maintenance.
SSL Certificate Management: List all SSL/TLS certificates with expiry info and check for certificates expiring within a specified timeframe.
Analytics & Logging: View VS analytics (throughput, latency percentiles, error rates) and retrieve recent request error logs (HTTP status, client IPs, URIs).
Service Engine Monitoring: List Service Engines and check health status including CPU, memory, disk usage, and connectivity.
AKO Pod Operations: Check AKO pod status, view logs, restart pods (with confirmation), and retrieve version/image info.
AKO Configuration Management: View current Helm values, preview pending configuration changes (diff), and apply Helm upgrades (dry-run by default).
Ingress Diagnostics: Validate Ingress annotations, map Ingress resources to AVI Virtual Services, diagnose missing VS issues, and get actionable fix suggestions.
Sync Diagnostics: Check sync status between Kubernetes resources and the AVI Controller, identify drift/inconsistencies, and force a resync.
Multi-cluster Operations: List clusters with AKO deployed, view cross-cluster health overviews (VS/pool counts), and show AMKO GSLB federation status.
Safety features include double confirmation for destructive operations, dry-run defaults for critical actions, audit trails, secure password handling, and input validation.
Enables AKO (Avi Kubernetes Operator) operations on Kubernetes clusters, including pod status, logs, restart, Helm config, ingress diagnostics, sync diagnostics, and multi-cluster management.
Allows management of VMware AVI (NSX Advanced Load Balancer) controllers, including virtual services, pool members, SSL certificates, analytics, service engines, and AKO (Avi Kubernetes Operator) operations.
VMware AVI
Author: Wei Zhou, VMware by Broadcom — wei-wz.zhou@broadcom.com This is a community-driven project by a VMware engineer, not an official VMware product. For official VMware developer tools see developer.broadcom.com.
English | 中文
AVI (NSX Advanced Load Balancer) management and AKO Kubernetes operations tool — 28 tools across 10 categories.
Dual mode: Traditional AVI Controller management + AKO K8s operations in one skill.
Companion skills handle everything else:
Skill
Scope
Install
VM lifecycle, deployment, guest ops, cluster
uv tool install vmware-aiopsRead-only: inventory, health, alarms, events
uv tool install vmware-monitorDatastores, iSCSI, vSAN management
uv tool install vmware-storageTanzu Namespaces, TKC cluster lifecycle
uv tool install vmware-vksNSX networking: segments, gateways, NAT
uv tool install vmware-nsx-mgmtDFW firewall rules, security groups
uv tool install vmware-nsx-securityAria Ops: metrics, alerts, capacity
uv tool install vmware-aria
Quick Install
# Via uv (recommended)
uv tool install vmware-avi
# Or via pip
pip install vmware-avi
# China mainland mirror
pip install vmware-avi -i https://pypi.tuna.tsinghua.edu.cn/simple
# Verify installation
vmware-avi doctorOffline / Air-Gapped Install (from source)
This project uses the modern PEP 517 build system (hatchling), so there is no
setup.py by design — that is expected, not a missing file. If you cloned the
source and hit ERROR: File "setup.py" or "setup.cfg" not found ... editable mode currently requires a setuptools-based build, your pip is older than 21.3 and
cannot do an editable (-e) install with a non-setuptools backend. Editable
mode is a developer convenience, not needed to run the tool — do one of:
# From the source tree — a normal (non-editable) install builds a wheel:
pip install . # NOT pip install -e .
# ...or upgrade pip first, and editable works too:
pip install --upgrade pip && pip install -e .For a truly air-gapped host, build the wheels on a connected machine and copy them over — the target then needs no network:
# On a connected machine, collect this package + its dependencies as wheels:
pip wheel . -w dist # → dist/*.whl (or: uv build, for just this package)
# Copy dist/ to the air-gapped host, then install offline:
pip install --no-index --find-links dist vmware-aviRelated MCP server: vSphere-MCP-Pro
Capabilities Overview
What This Skill Does
Category | Tools | Count |
Virtual Service | list, status, enable/disable | 3 |
Pool Member | pool discovery, member list, enable/disable member (drain/restore traffic) | 4 |
SSL Certificate | list, expiry check | 2 |
Analytics | VS metrics overview, request error logs | 2 |
Service Engine | list, health check | 2 |
AKO Pod Ops | status, logs, restart, version info | 4 |
AKO Config | values.yaml view, Helm diff, Helm upgrade | 3 |
Ingress Diagnostics | annotation validation, VS mapping, error diagnosis, fix recommendation | 4 |
Sync Diagnostics | K8s-Controller comparison, inconsistency list, force resync | 3 |
Multi-cluster | cluster list, cross-cluster AKO overview, AMKO status | 3 |
CLI vs MCP: Which Mode to Use
Scenario | Recommended | Why |
Local/small models (Ollama, Qwen) | CLI | ~2K tokens vs ~8K for MCP |
Cloud models (Claude, GPT-4o) | Either | MCP gives structured JSON I/O |
Automated pipelines | MCP | Type-safe parameters, structured output |
AKO troubleshooting | CLI | Interactive log tailing, Helm diff output |
Rule of thumb: Use CLI for cost efficiency and small models. Use MCP for structured automation with large models.
Architecture
User (Natural Language)
|
AI CLI Tool (Claude Code / Gemini / Codex / Cursor / Trae)
| reads SKILL.md
|
vmware-avi CLI
|--- avisdk (AVI REST API) ---> AVI Controller ---> Virtual Services / Pools / SEs
|--- kubectl / kubernetes ---> K8s Cluster ---> AKO Pods / Ingress / ServicesConfiguration
Step 1: Create Config Directory
mkdir -p ~/.vmware-avi
vmware-avi init # generates config.yaml and .env templates
chmod 600 ~/.vmware-avi/.envStep 2: Edit config.yaml
controllers:
- name: prod-avi
host: avi-controller.example.com
username: admin
api_version: "22.1.4"
tenant: admin
port: 443
verify_ssl: true
default_controller: prod-avi
ako:
kubeconfig: ~/.kube/config
default_context: ""
namespace: avi-systemStep 3: Set Passwords
Create ~/.vmware-avi/.env:
# AVI Controller passwords
# Format: {CONTROLLER_NAME_UPPER}_PASSWORD
PROD_AVI_PASSWORD=your-password-herePassword environment variable naming convention:
{CONTROLLER_NAME_UPPER}_PASSWORD
# Replace hyphens with underscores, UPPERCASE
# Example: controller "prod-avi" -> PROD_AVI_PASSWORD
# Example: controller "staging-alb" -> STAGING_ALB_PASSWORDStep 4: Verify
vmware-avi doctor # checks Controller connectivity + kubeconfig + avisdkCLI Usage
Virtual Service Management
# List all virtual services
vmware-avi vs list [--controller prod-avi]
# Check status of a specific VS
vmware-avi vs status my-webapp-vs
# Enable / disable a VS (disable requires double confirmation)
vmware-avi vs enable my-webapp-vs
vmware-avi vs disable my-webapp-vsPool Member Drain / Restore
# List pool members and health status
vmware-avi pool members my-pool
# Graceful drain (disable) — double confirmation required
vmware-avi pool disable my-pool 10.1.1.5
# Restore traffic (enable)
vmware-avi pool enable my-pool 10.1.1.5SSL Certificate Expiry Check
# List all certificates
vmware-avi ssl list
# Check certificates expiring within 30 days
vmware-avi ssl expiry --days 30Analytics and Error Logs
# VS analytics: throughput, latency, error rates
vmware-avi analytics my-webapp-vs
# Request error logs
vmware-avi logs my-webapp-vs --since 1hService Engine Health
# Name, mgmt IP, operational status, SE group — status sourced from the
# serviceengine-inventory endpoint (config + runtime merged)
vmware-avi se list
# Per-SE operational status + connected-VS counts
vmware-avi se healthAKO Troubleshooting
# Check AKO pod status
vmware-avi ako status [--context my-k8s-context]
# View AKO logs
vmware-avi ako logs [--tail 100] [--since 30m]
# Restart AKO pod (double confirmation)
vmware-avi ako restart
# Show AKO version
vmware-avi ako versionAKO Helm Config Management
The AKO Helm release is discovered automatically (official installs use
helm install --generate-name, so the release is not named ako). Upgrades pull
the official Broadcom OCI chart
oci://projects.packages.broadcom.com/ako/helm-charts/ako with --reuse-values.
# View current AKO Helm values (release auto-discovered)
vmware-avi ako config show
# Show pending changes (diff against the official OCI chart)
vmware-avi ako config diff
# Helm upgrade (double confirmation + --dry-run default)
vmware-avi ako config upgradeIngress Diagnostics
# Validate Ingress annotations
vmware-avi ako ingress check <namespace>
# Show Ingress-to-VS mapping
vmware-avi ako ingress map
# Diagnose why an Ingress has no VS
vmware-avi ako ingress diagnose <ingress-name>Sync Diagnostics
# Check K8s-Controller sync status
vmware-avi ako sync status
# Show inconsistencies between K8s and Controller
vmware-avi ako sync diff
# Force AKO resync (double confirmation)
vmware-avi ako sync forceMulti-cluster AKO
# List clusters with AKO deployed
vmware-avi ako clusters
# Cross-cluster AKO status overview
vmware-avi ako cluster-overview
# AMKO GSLB status
vmware-avi ako amko statusMCP Server
The MCP server exposes all 28 tools via the Model Context Protocol. Works with any MCP-compatible client.
After uv tool install vmware-avi, start the MCP server with one command (v1.5.15+):
# Recommended — single command, no network re-resolve
vmware-avi mcp
# With custom config path
VMWARE_AVI_CONFIG=/path/to/config.yaml vmware-avi mcpClaude Desktop Config
Add to claude_desktop_config.json:
{
"mcpServers": {
"vmware-avi": {
"command": "vmware-avi",
"args": ["mcp"],
"env": {
"VMWARE_AVI_CONFIG": "~/.vmware-avi/config.yaml"
}
}
}
}# Run without installing (requires PyPI access each launch)
uvx --from vmware-avi vmware-avi mcp
# Legacy entry point (still works, kept for backward compatibility)
vmware-avi-mcpBehind a corporate TLS proxy? uvx may fail with
invalid peer certificate: UnknownIssuer. Use the recommendedvmware-avi mcpform above (no network needed), or setUV_NATIVE_TLS=true.
MCP Tools (28)
Category | Tools |
Virtual Service (3) |
|
Pool Member (4) |
|
SSL Certificate (2) |
|
Analytics (2) |
|
Service Engine (2) |
|
AKO Pod (4) |
|
AKO Config (3) |
|
Ingress Diagnostics (3) |
|
Sync Diagnostics (3) |
|
Multi-cluster (2) |
|
Common Workflows
1. Maintenance Window -- Drain a Pool Member
When taking a backend server offline for patching:
List pool members and health status
vmware-avi pool members my-poolDisable the target server (graceful drain)
vmware-avi pool disable my-pool 10.1.1.5Monitor analytics to confirm active connections are draining
vmware-avi analytics my-vsPerform maintenance on the server
Re-enable the server
vmware-avi pool enable my-pool 10.1.1.5Verify health status is green
vmware-avi pool members my-pool
2. AKO Ingress Not Creating VS
When a developer reports their Ingress is not producing a Virtual Service:
Verify AKO is running
vmware-avi ako statusValidate Ingress annotations
vmware-avi ako ingress check <namespace>Check sync status between K8s and Controller
vmware-avi ako sync statusIf annotations are wrong, diagnose the specific Ingress
vmware-avi ako ingress diagnose <ingress-name>If sync drift is detected, review the diff and force resync if needed
vmware-avi ako sync diff vmware-avi ako sync force
3. SSL Certificate Expiry Audit
Expired certificates cause outages. Run periodic checks:
Check all certificates expiring within 30 days
vmware-avi ssl expiry --days 30Review which VS uses each expiring certificate (output includes VS mapping)
Plan renewal with the certificate team
After renewal, verify the new certificate is in place
vmware-avi ssl list
Troubleshooting
"Controller unreachable" error
Run
vmware-avi doctorto verify connectivityCheck if the controller address and port are correct in
~/.vmware-avi/config.yamlFor self-signed certs: set
verify_ssl: falsein config.yaml (lab environments only)
AKO Pod in CrashLoopBackOff
Check logs:
vmware-avi ako logs --tail 50Common causes: wrong controller IP in values.yaml, network policy blocking AKO to Controller, expired credentials
Fix config:
vmware-avi ako config showto inspect, thenvmware-avi ako config upgradewith corrected values (release auto-discovered; pulls the official Broadcom OCI chart)
Ingress created but no VS on Controller
Validate annotations:
vmware-avi ako ingress check <namespace>Check AKO logs for rejection reason:
vmware-avi ako logs --since 5mRun sync diff:
vmware-avi ako sync diffto see if the object is stuck
Pool member shows "down" after enable
Health monitor may still be failing. The member is enabled but unhealthy. Check the actual health status on the Controller side. Fix the backend service first, then the health status will auto-recover.
SSL expiry check shows 0 certificates
Verify the controller connection has tenant-level access. Certificates are tenant-scoped in AVI. The configured user may only see certs in their tenant.
AKO sync force has no effect
Force resync triggers AKO to re-reconcile all K8s objects. If the drift persists, the issue is likely in the K8s resource definition itself (bad annotation, missing secret). Use vmware-avi ako ingress diagnose to pinpoint the root cause.
Safety Features
Feature | Details |
Double Confirmation | Destructive ops (VS disable, pool member disable, AKO restart, Helm upgrade, force resync) require 2 sequential confirmations |
Dry-Run Default |
|
Audit Trail | All operations logged to |
Password Protection |
|
SSL Support |
|
Prompt Injection Protection | All API-sourced text truncated (500 chars max) and C0/C1 control characters stripped |
Input Validation | Pool names, VS names, IP addresses, and namespace names validated before API calls |
Security Details
Source Code: github.com/vmware-skills/VMware-AVI
Config File Contents:
config.yamlstores controller addresses, usernames, and AKO settings. No passwords or tokens. All secrets stored exclusively in.envWebhook Data Scope: Disabled by default. No third-party data transmission
TLS Verification: Enabled by default. Disable only for self-signed certificate environments
Prompt Injection Protection:
_sanitize()truncation + control character cleanup on all AVI API responsesLeast Privilege: Use a dedicated AVI service account with minimal permissions. AKO operations require only namespace-scoped kubeconfig access
Companion Skills
Skill | Scope | Tools | Install |
AVI load balancer, AKO K8s operations | 28 |
| |
VM lifecycle, deployment, guest ops, cluster | 49 |
| |
Read-only monitoring, alarms, events | 27 |
| |
Datastores, iSCSI, vSAN | 11 |
| |
Tanzu Namespaces, TKC cluster lifecycle | 20 |
| |
NSX segments, gateways, NAT, routing | 33 |
| |
DFW firewall, security groups, IDS/IPS | 21 |
| |
Aria Ops: metrics, alerts, capacity | 28 |
| |
Compliance baselines, drift detection | 6 |
|
Version Compatibility
AVI Controller / Environment | Support | Notes |
AVI 30.x in VCF 9.1 | ✅ Full | avisdk 30.x line covers VCF 9.1 bundle |
AVI 30.x in VCF 9.0 | ✅ Full | Standard AVI / NSX ALB integration |
AVI 22.x — 31.x standalone | ✅ Full | Pin |
AKO 1.10+ | ✅ Full | Kubernetes integration via AKO ConfigMap / GatewayClass |
Official Broadcom References
SDKs: https://developer.broadcom.com/sdks — VCF Python SDK
REST APIs: https://developer.broadcom.com/xapis — AVI Controller REST API
CLI Tools: https://developer.broadcom.com/tools — VCF PowerCLI 9.1
Troubleshooting & Contributing
If you encounter any errors or issues, please send the error message, logs, or screenshots to zhouwei008@gmail.com. Contributions are welcome -- feel free to join us in maintaining and improving this project!
License
MIT
Available Tools
28 toolsako_amko_statusARead-onlyIdempotent
[READ] AMKO (AVI Multi-Cluster Kubernetes Operator) GSLB status.
Returns raw kubectl output: the AMKO pods in avi-system, then the GSLBConfig YAML if one exists. Use this only for multi-cluster GSLB questions — for single-cluster AKO health use ako_status instead. Always reads the current kubectl context; see ako_clusters.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark it read-only and idempotent; the description adds what is actually returned (AMKO pods in avi-system followed by the GSLBConfig YAML if present) and the reliance on the current kubectl context. This behavior is disclosed beyond the structured hints, though it omits possible failure modes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences front-load the purpose, then give the return payload and usage routing. Every sentence contributes information; there is no filler or repetition of schema data.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter read-only tool with an output schema and rich sibling context, this description is complete: it states what is returned, when to use it, and the context caveat. No additional guidance is needed for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters (0% schema requirement), so the baseline is 4 and the description does not need to document inputs. The only implicit input, the current kubectl context, is called out explicitly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Starts with '[READ]' and names the exact resource: AMKO (AVI Multi-Cluster Kubernetes Operator) GSLB status. It specifies the action (returns status) and differentiates from the single-cluster ako_status sibling, so an agent can select it correctly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'Use this only for multi-cluster GSLB questions' and directs the agent to ako_status for single-cluster AKO health. It also cautions that the tool always reads the current kubectl context, with a pointer to ako_clusters.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ako_clustersARead-onlyIdempotent
[READ] List every Kubernetes context in the active kubeconfig and whether AKO is deployed there.
Returns Context, AKO Status (pod phase or 'Not deployed') and Version per context. Requires kubectl on PATH; every context is probed, so unreachable clusters add latency. Start here for context names, then pass one to ako_status, ako_logs or ako_ingress_diagnose.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark it read-only and idempotent, and the description adds important behavioral detail beyond that: every context is probed, kubectl must be on PATH, and unreachable clusters cause latency. It also clarifies the AKO Status values ('pod phase or Not deployed') and that Version is returned per context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three concise, front-loaded sentences cover purpose, return values, prerequisites, side effects, and routing to sibling tools. No sentence is wasted and the '[READ]' prefix immediately signals the operation type.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter discovery tool, the description is complete: it explains what is returned, what is required to run it, what behavioral caveat exists, and how to proceed next. The presence of an output schema reduces the need to describe return structures further.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and 100% schema coverage, so the baseline of 4 applies. The description adds no param-specific meaning, but none is needed because the input schema is empty and the call requires no arguments.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List') and resource ('every Kubernetes context in the active kubeconfig') and clarifies the output includes AKO deployment status. The 'Start here' phrase and mentions of sibling tools like ako_status define its distinct role among the many AKO-related tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly says to use this tool first to get context names, then pass one to ako_status, ako_logs, or ako_ingress_diagnose. It also gives practical usage conditions: requires kubectl on PATH and warns that unreachable clusters add latency.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ako_config_diffARead-onlyIdempotent
[READ] Pending Helm value changes that have not been applied yet.
Returns helm's diff output; empty means nothing would change. Credential
values in it read <redacted> — that is this skill blanking them, not the
configured value.
Use this before ako_config_upgrade — it runs the same command, so the
preview is real. Note: with chart_version empty the registry's moving latest
is resolved, so two runs can differ with no local change; read ako_version
and pass it to both.
| Name | Required | Description | Default |
|---|---|---|---|
| chart_version | No | Pin the chart, e.g. "1.11.1". Empty = registry latest. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds behavior beyond annotations: redacted credentials, empty output semantics, and non-deterministic output when chart_version is empty due to moving latest. These are operational details an agent needs to interpret results correctly and do not contradict the read-only/idempotent effect annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but every sentence carries necessary information: purpose, output semantics, redaction caveat, relationship to upgrade, and the version-pinning caveat. It is front-loaded with purpose and avoids filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the one optional parameter, the read-only annotations, and the presence of an output schema, the description covers usage timing, output interpretation, credential masking, and the non-determinism caveat. Nothing essential is missing for selecting and invoking this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema already documents chart_version, so the baseline is 3. The description adds value by explaining the practical effect of an empty value: the registry's moving latest is resolved and two runs can differ, plus the recommendation to pin using ako_version.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with the marker '[READ]' and states a specific verb+resource: 'Pending Helm value changes that have not been applied yet,' then clarifies it returns 'helm's diff output.' This distinguishes it from read/show tools (ako_config_show) and aligns with the diff/upgrade family.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit usage context: use before ako_config_upgrade, and says both run 'the same command,' so the preview is real. It also instructs the agent to read ako_version and pass it when chart_version is empty, providing a concrete safe invocation path.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ako_config_showARead-onlyIdempotent
[READ] The AKO Helm release's values — controller IP, cloud name, network settings, feature flags.
Returns YAML as helm reports it. Use this first to read the live config; use ako_config_diff instead to see what an upgrade would change. Only values supplied at install time appear; chart defaults do not.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint false. The description adds valuable behavior beyond that: it returns YAML as Helm reports it and explicitly notes that chart defaults are excluded, which is useful and not redundant with the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Every sentence earns its place: the [READ] marker, the resource and content summary, the output format, the usage order, the alternative tool, and the critical install-time-only caveat are all packed into three tight sentences. No fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a no-parameter read-only tool with a rich annotation set and an output schema, the description fully covers what an agent needs: what it returns, how to invoke it first, when to choose the sibling, and a key data limitation. Nothing important is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so per the rubric the baseline is 4. There is no parameter ambiguity, and the schema is fully covered vacuously. The description appropriately focuses on behavior instead of parameter details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states a clear verb ('read') and specific resource ('AKO Helm release's values'), with examples such as controller IP, cloud name, and network settings. It is clearly distinguished from the sibling ako_config_diff, which reads as a comparison tool for upgrades.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit guidance says 'Use this first to read the live config' and directs the agent to ako_config_diff instead 'to see what an upgrade would change.' It also clarifies the limitation that only install-time values appear, not chart defaults, which helps set expectations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ako_config_upgradeA
[WRITE] Apply an AKO Helm upgrade (dry_run=true by default).
Returns helm's output, with credential values blanked to <redacted> by this
skill. Run ako_config_diff first to review the change. Finds
the avi-system release automatically and upgrades the Broadcom OCI chart
with --reuse-values.
SAFETY: applying (dry_run=False) requires confirmed=True, else preview only.
| Name | Required | Description | Default |
|---|---|---|---|
| dry_run | No | Preview without applying (default true). | |
| confirmed | No | Gates the real upgrade only. With dry_run=false, the default false returns a preview naming the chart version and changes nothing; true runs `helm upgrade --reuse-values` against the avi-system release, rolling the AKO pod. Ignored while dry_run=true, which never writes. | |
| chart_version | No | Pin the chart, e.g. "1.11.1". Empty = registry latest. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only mark this as a non-read operation; the description adds substantial behavior: dry_run defaults to true, output credentials are redacted, the avi-system release is found automatically, the Broadcom OCI chart is upgraded with --reuse-values, and confirmed gates the real upgrade. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact, front-loaded with purpose and default behavior, and each sentence adds needed context: what it does, what output looks like, the recommended prior step, and the safety gate. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present and all parameters fully described in the schema, the description covers the remaining essential context: safety mode, prerequisite diff, automatic release discovery, and redaction behavior. Nothing critical is missing for an agent to call this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, including defaults and cross-parameter behavior for confirmed and dry_run. The description reinforces the key gate "applying (dry_run=False) requires confirmed=True" but does not add much beyond what the schema already documents.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with "[WRITE] Apply an AKO Helm upgrade," which states a specific verb, resource, and action. It further clarifies the default dry-run behavior and distinguishes the tool from read-only siblings like ako_config_diff by framing it as the applying step.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly tells the agent to run ako_config_diff first to review the change, creating a clear workflow. The SAFETY line explains when preview-only vs actual applying occurs: applying requires confirmed=True. It does not explicitly name alternative tools for other situations, but the prerequisite and gating conditions are clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ako_ingress_checkARead-onlyIdempotent
[READ] Validate every Ingress in one namespace: IngressClass and TLS secret references that would stop AKO creating a Virtual Service.
Returns name, IngressClass, issues and OK/ISSUES per Ingress. Run ako_ingress_map first for namespace names; use ako_ingress_diagnose instead for one named Ingress. Covers one namespace only, and TLS checks are skipped when its secrets cannot be listed.
| Name | Required | Description | Default |
|---|---|---|---|
| context | No | K8s context name (optional). | |
| namespace | Yes | K8s namespace to check. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already convey readOnly, idempotent, and non-destructive behavior, so the description does not need to repeat those. It adds genuinely useful behavioral detail beyond annotations: TLS checks are skipped when secrets cannot be listed, and results are per-Ingress with OK/ISSUES status.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: purpose first, then return content, then usage routing, then scope and edge-case behavior. Every sentence adds value, with no filler or repetition of schema content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only diagnostic tool with an output schema, the description covers all essential information: what is validated, what is returned, which sibling tool to use for single-Ingress analysis, prerequisite tooling, namespace scope, and a known edge case.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with both namespace and context already documented. The description adds no parameter-level detail beyond the schema, which is acceptable because the schema carries the full burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Validate') and precisely defines the resource and scope: every Ingress in one namespace, checking IngressClass and TLS secret references that would block AKO from creating a Virtual Service. It also distinguishes itself from the sibling tool ako_ingress_diagnose by clarifying it handles all Ingresses rather than one.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit routing guidance: run ako_ingress_map first for namespace names and use ako_ingress_diagnose instead for a single named Ingress. It also sets clear scope expectations ('Covers one namespace only') and notes the TLS-check limitation when secrets cannot be listed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ako_ingress_diagnoseARead-onlyIdempotent
[READ] Diagnose why one Ingress has no corresponding AVI Virtual Service.
Validates IngressClass ('avi'/'avi-lb'), TLS secrets and backend Services. Returns annotations, a numbered issue list and kubectl fixes. Use ako_ingress_map first to find Ingresses lacking a VS. Checks configuration only; when it is clean, try ako_logs and ako_sync_status.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Exact Ingress resource name. | |
| context | No | kubeconfig context (optional), from ako_clusters. | |
| namespace | No | Namespace holding the Ingress (default 'default'). | default |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish read-only/idempotent/non-destructive, and the description reinforces with 'Checks configuration only'. It additionally discloses validation targets and output shape, with no hidden side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three compact sentences front-load the core diagnostic purpose, then add validation scope, output, and routing to siblings. No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Between annotations, 100% schema coverage, and output schema, the description fills the remaining gaps: diagnostic scope, output content, and next-step tools. An agent can invoke it correctly without further inference.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers all three parameters with descriptions, so description need not repeat them. It only broadly references validated resources and doesn't add parameter-specific semantics beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific diagnostic action on a single Ingress resource ('no corresponding AVI Virtual Service') and lists what it validates. The [READ] prefix and focus on causes/issues distinguish it from map/logs siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly sequences the tool: run ako_ingress_map first to identify affected Ingresses, and fall back to ako_logs/ako_sync_status when config is clean. This provides a clear decision path and alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ako_ingress_mapARead-onlyIdempotent
[READ] Inventory Kubernetes Ingresses across all namespaces.
Returns Namespace, Ingress name, Host(s) and IngressClass per Ingress. Start here for namespace and Ingress names, then pass them to ako_ingress_check or ako_ingress_diagnose. Lists the K8s side only — use ako_sync_diff for Ingresses with no Controller object.
| Name | Required | Description | Default |
|---|---|---|---|
| context | No | K8s context name (optional). |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and non-destructive behavior, so the '[READ]' marker adds little. However, the description adds meaningful context beyond annotations: it returns only the K8s-side perspective, not controller-side state, and explicitly scopes the inventory to all namespaces. This helps the agent understand what the operation does and does not cover.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded with '[READ]' and the primary purpose. Every sentence earns its place: one states scope and output, one gives the follow-up workflow, and one clarifies the boundary against a sibling tool. There is no extraneous text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the low complexity, single optional parameter, existing output schema, and rich annotations, the description provides everything an agent needs to select and invoke this tool correctly. It states the target resource, the returned fields, the follow-up tools, and the exclusion for missing Controller objects.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents the single parameter 'context' as 'K8s context name (optional)' with 100% coverage. The description adds no additional parameter detail, so the baseline of 3 applies; it neither clarifies nor obscures the parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('Inventory'), a clear resource ('Kubernetes Ingresses'), and a scope ('across all namespaces'). It also differentiates itself from siblings by stating this returns Namespace, Ingress name, Host(s), and IngressClass, and by referring to ako_ingress_check, ako_ingress_diagnose, and ako_sync_diff as alternatives for different steps.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says to start here for namespace and Ingress names, then pass them to ako_ingress_check or ako_ingress_diagnose. It also states the boundary: 'Lists the K8s side only' and directs the agent to use ako_sync_diff for Ingresses with no Controller object, making when-to-use and when-not-to-use clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ako_logsARead-onlyIdempotent
[READ] AKO pod logs — Ingress creation failures, sync errors, Controller connectivity.
Returns raw log text, not a table. Use when ako_status shows the pod unhealthy or ako_sync_diff reports a missing Ingress. Only the running container's logs are returned.
| Name | Required | Description | Default |
|---|---|---|---|
| tail | No | Number of log lines (default 100). | |
| since | No | Narrows the window, e.g. '30m', '1h'. | |
| context | No | K8s context (optional, uses current). |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint false, so the safety profile is covered. The description adds valuable behavioral context beyond annotations: 'Returns raw log text, not a table' and 'Only the running container's logs are returned,' which alerts the agent to output format and scope limitations. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three short, purposeful sentences. It front-loads the tool's purpose, states the return format, gives usage triggers, and notes a scope limitation. Every sentence earns its place with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only log retrieval tool, the description covers purpose, trigger conditions, return format, and container scope. Combined with rich annotations, a full parameter schema, and an output schema, nothing essential is missing for an agent to select and invoke this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameter meanings are already fully documented. The description does not add parameter-specific guidance (e.g., how tail/since/context interact), but because the schema covers all parameters with defaults and examples, baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with '[READ] AKO pod logs' and specifies concrete use cases: 'Ingress creation failures, sync errors, Controller connectivity.' It also distinguishes the tool from table-returning siblings by stating 'Returns raw log text, not a table,' so an agent can disambiguate from tools like vs_error_logs or ako_status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit trigger conditions: 'Use when ako_status shows the pod unhealthy or ako_sync_diff reports a missing Ingress.' This names sibling tools as decision points and provides clear context. However, it does not state when not to use this tool or name alternatives beyond the implied conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ako_restartADestructive
[WRITE] Restart the AKO pod by deleting it — its StatefulSet recreates it.
Returns a one-line result. Use when AKO is stuck or after config changes; brief traffic disruption is possible. Run ako_status afterwards, and ako_logs if the pod is not Running.
SAFETY: requires confirmed=True; without it you get a preview only.
| Name | Required | Description | Default |
|---|---|---|---|
| context | No | K8s context name (optional). | |
| confirmed | No | false (the default) returns a preview and changes nothing; true deletes the AKO pod. The StatefulSet recreates it, so this is a restart rather than a removal, but ingress programming pauses until the new pod is Running and brief traffic disruption is possible. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the destructiveHint annotation, the description discloses the deletion-and-recreation mechanism, preview behavior without confirmed=True, possibility of traffic disruption, and expected post-restart workflow. This is strong behavioral transparency that matches and enriches the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact, front-loaded with the core action, and organized into clear sections: action, result, use cases, follow-up, and safety. Every sentence adds value with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive restart tool with annotations and schema coverage, the description supplies all needed context: how the restart works, what changes require confirmation, what side effects occur, and what to do next. No critical operational detail is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description adds meaningful semantics for the confirmed parameter: false returns a preview and changes nothing, while true deletes the pod and triggers recreation. This goes beyond the schema description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: restarting the AKO pod by deleting it, with the StatefulSet recreating it. This verb-object-resource structure is specific and distinguishes it from sibling AKO tools like ako_status and ako_logs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit use cases ('Use when AKO is stuck or after config changes') and prescribes follow-ups (run ako_status, then ako_logs if not Running). It does not provide explicit when-not-to-use guidance or alternatives, so it stops just short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ako_statusARead-onlyIdempotent
[READ] Check AKO (AVI Kubernetes Operator) pod status in Kubernetes.
Returns pod name, phase, ready flag, restart count and namespace. First step for Ingress or LoadBalancer issues in Tanzu/K8s; follow with ako_logs when it is not Running. Looks in one context's AKO namespace only — run ako_clusters if not found.
| Name | Required | Description | Default |
|---|---|---|---|
| context | No | K8s context name (optional, uses current context). |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already cover read-only, idempotent, and non-destructive behavior, so the description doesn't need to restate those. It adds useful behavioral context beyond annotations: the tool checks only one context's AKO namespace, returns specific status fields, and is designed as the first diagnostic step. This gives the agent a clearer picture of operational behavior without over-explaining.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact yet information-dense: every sentence earns its place. It front-loads the core purpose and read-only marker, then delivers output details, usage context, and fallback guidance without repetition or filler. The structure moves from 'what' to 'when' to 'what's next', which is easy for an agent to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one optional parameter and a single narrow purpose, the description is fully sufficient. It covers the expected inputs, outputs, scope limitation, and next-step tools, and an output schema is already available for return-value details. Nothing an agent needs to select and invoke this tool correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% since the single optional 'context' parameter is already documented as 'K8s context name (optional, uses current context)'. The description adds some relevant scope nuance by saying the tool 'Looks in one context's AKO namespace only', but it does not materially expand on the parameter's format or default behavior. A baseline of 3 is appropriate here as the schema already carries the parameter meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a clear action: 'Check AKO pod status in Kubernetes', and it names the concrete resource (AKO pod) and what is returned (pod name, phase, ready flag, restart count, namespace). It also distinguishes itself from related AKO tools by positioning itself as the 'First step for Ingress or LoadBalancer issues' and pointing to ako_logs and ako_clusters as follow-ups. This is a specific, well-scoped purpose with no ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says when to use this tool ('First step for Ingress or LoadBalancer issues') and what to do afterward ('follow with ako_logs when it is not Running'). It also explains a boundary case: 'Looks in one context's AKO namespace only — run ako_clusters if not found.' This gives the agent clear routing to alternatives without leaving it to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ako_sync_diffARead-onlyIdempotent
[READ] List Ingresses with no matching Virtual Service or pool on the Controller.
Returns Type, namespace/name and Status per suspect Ingress. Use when ako_sync_status reports a mismatch; ako_sync_force reconciles. Shard-mode Ingresses are matched heuristically against AKO pool names, so confirm a 'Missing' result with pool_list before acting.
| Name | Required | Description | Default |
|---|---|---|---|
| context | No | K8s context name (optional). |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover read-only, idempotent, non-destructive behavior. The description adds valuable behavioral context: the heuristic shard-mode matching, the need to confirm 'Missing' results, and the output shape (Type, namespace/name, Status). No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three dense sentences: purpose first, return value second, usage and caveat third. No filler or repeated schema information. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one optional parameter, strong annotations, an output schema, and explicit sibling context, this description fully equips an agent to select and invoke it correctly, including a critical heuristic-matching caveat.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single optional context parameter, so the baseline of 3 applies. The description does not elaborate on the parameter, but it does not need to because the schema already provides a clear description and default.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'List Ingresses with no matching Virtual Service or pool on the Controller.' This clearly distinguishes it from the sibling tools ako_sync_status and ako_sync_force by focusing on diff detection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says when to use it ('Use when ako_sync_status reports a mismatch'), names the reconciliatory alternative (ako_sync_force), and directs confirmation of shard-mode results via pool_list. This gives an agent unambiguous routing criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ako_sync_forceADestructive
[WRITE] Force AKO to resync all K8s resources with the AVI Controller.
Returns a one-line result. Use when drift is detected; may cause brief traffic disruption. Run ako_sync_diff first to see what is out of sync, then ako_sync_status.
SAFETY: requires confirmed=True; without it you get a preview only.
| Name | Required | Description | Default |
|---|---|---|---|
| context | No | K8s context name (optional). | |
| confirmed | No | false (the default) returns a preview and changes nothing; true forces the resync, which restarts the AKO pod so it rebuilds every Virtual Service, pool and VS-VIP from the cluster's current resources — brief traffic disruption is possible. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark this destructive and non-read-only, but the description adds concrete consequences: brief traffic disruption, a preview-only mode unless confirmed=true, and a one-line result. It does not contradict annotations and adds safety-relevant behavior beyond the flags.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: core action first, then result type, usage trigger, safety warning, and required confirmation. Every sentence contributes either use-case guidance or a behavioral warning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive resync tool with annotations, a rich confirmed parameter description, and an output schema, this definition gives all essential context: what it does, when to use it, what to run first, and the safety gate. No necessary operational detail is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the confirmed parameter already explains the default preview behavior and the restart/rebuild consequence. The tool description reinforces the confirmed requirement but adds no new meaning beyond the schema's parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with '[WRITE] Force AKO to resync all K8s resources with the AVI Controller', naming a specific verb, resource, and effect. It also positions the tool against siblings by referencing ako_sync_diff and ako_sync_status, so an agent can tell it apart.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly says to use when drift is detected, warns of brief traffic disruption, and instructs running ako_sync_diff first to inspect out-of-sync state. It also states the safety gate: confirmed=true is required, and without it only a preview is returned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ako_sync_statusARead-onlyIdempotent
[READ] Compare the number of K8s Ingresses with the number of AVI Virtual Services.
Returns both counts and a match/mismatch verdict. Use this first as a cheap check, then ako_sync_diff for which objects differ. A count comparison only — in AKO shard mode many Ingresses share one VS, so a mismatch does not by itself mean trouble.
| Name | Required | Description | Default |
|---|---|---|---|
| context | No | K8s context name (optional). |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, but the description adds meaningful behavioral nuance: this is a cheap preliminary count comparison, not a full diff, and shard mode can produce false mismatches. It also states exactly what the tool returns, going beyond the structured safety hints without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences, each earning its place: the operation and resources, the returned verdict, and the critical usage caveat. It is front-loaded with the purpose and avoids any filler or redundant restatement of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one optional parameter, rich annotations, an existing output schema, and clear sibling guidance, this description is complete. It tells the agent what the tool does, what it returns, when to use it as a first check, and what caveat to keep in mind—nothing needed for correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is only one optional context parameter, and the input schema already describes it as 'K8s context name (optional)' with 100% coverage. The description adds no further parameter detail, but none is needed since the schema fully documents the parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('Compare') and two concrete resources (K8s Ingresses and AVI Virtual Services), and states the output (counts plus a match/mismatch verdict). It also distinguishes itself from the sibling ako_sync_diff by noting the latter identifies which objects differ, so an agent can tell them apart.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit usage direction: 'Use this first as a cheap check, then ako_sync_diff for which objects differ.' It also sets expectations by explaining the comparison is count-only and that a mismatch is not necessarily a problem in AKO shard mode, which prevents the agent from over-trusting the result.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ako_versionARead-onlyIdempotent
[READ] AKO version running in a cluster, read from the pod's image tag.
Returns the pod name and an Image/Version pair per container. Use it to check compatibility with the Controller, and before ako_config_diff or ako_config_upgrade so both target the installed chart. The tag is the only source, so 'latest' reports 'latest', not a number.
| Name | Required | Description | Default |
|---|---|---|---|
| context | No | K8s context name (optional). |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark this as read-only, idempotent, and non-destructive, so the description adds meaningful context beyond them: the version source is the pod's image tag, and the edge case that 'latest' is reported literally rather than resolved to a numeric version. This gives the agent an accurate mental model of the tool's behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is tight and front-loaded: the action and source appear in the first line, followed by output shape, use cases, and a critical caveat. Every sentence earns its place and there is no redundant elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having an output schema, the description covers the essential non-schema context: what the version is derived from, the returned fields, the use-before-config workflows, and the 'latest' ambiguity. For a simple read-only tool with one optional parameter, nothing needed for correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The sole parameter, context, is fully documented in the schema as the optional K8s context name (100% coverage). With coverage that high, the description does not need to add parameter detail, and it does not meaningfully enrich the parameter's semantics beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description leads with a specific verb and resource: '[READ] AKO version running in a cluster, read from the pod's image tag.' It clearly defines the output (pod name and Image/Version pair per container) and distinguishes the tool from siblings by framing it as a foundational compatibility check referenced by ako_config_diff and ako_config_upgrade.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use: to check Controller compatibility and before running ako_config_diff or ako_config_upgrade so both target the installed chart. It gives concrete usage triggers but does not explicitly mention when not to use this tool or name a direct alternative for version queries.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pool_listARead-onlyIdempotent
[READ] Discover pools on the Controller.
Returns Name, member count, Enabled and short UUID per pool. Use this before pool_members: pools are often named differently from the VS that use them.
| Name | Required | Description | Default |
|---|---|---|---|
| vs_filter | No | Substring matching VS names (e.g. 'web') — returns only the pools those VS reference. Omit for all pools. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the read-only nature is covered. The description adds a domain caveat about pool naming that helps interpret results, plus '[READ]' reinforces the safety profile. No contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with purpose, then return fields and usage. Every sentence adds information and there is no redundancy with the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only list tool with one optional parameter, a full output schema, and rich annotations, the description covers purpose, expected results, and sequencing relative to pool_members. Nothing else is needed for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%; vs_filter is fully described with substring matching semantics and default behavior. The description adds no parameter-level details beyond that, so the schema carries the burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific action ('Discover pools') and a resource ('Controller'), then enumerates the exact fields returned (Name, member count, Enabled, short UUID). The contrast with sibling pool_members makes distinguishing easy.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly directs the agent to call this before pool_members and gives the reason (pool names often differ from VS names). This is a clear when and names the alternative, so no inference is needed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pool_member_disableADestructive
[WRITE] Disable a pool member with graceful drain — existing connections complete, no new traffic.
Returns a one-line result. Use for maintenance or rolling deployments; run pool_members first for the server IP, pool_member_enable to reverse it.
SAFETY: requires confirmed=True; without it you get a preview only.
| Name | Required | Description | Default |
|---|---|---|---|
| pool | Yes | Exact pool name as shown by pool_list — matched literally, not fuzzily, and an unknown name is refused rather than ignored. Pools are often named differently from the Virtual Services that use them, so do not infer it from a VS name. | |
| server | Yes | Server IP address. | |
| confirmed | No | false (the default) returns a preview naming the member and pool, and changes nothing; true disables the member, draining it so existing connections finish while new traffic stops. Reverse it with pool_member_enable. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (destructiveHint=true, readOnlyHint=false), the description discloses the graceful drain behavior, the one-line return result, and the safe preview mode when confirmed is not true. It clearly explains the destructive action and its confirmation requirement without contradicting annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: purpose and effect first, then usage guidance, then safety. Every sentence adds distinct value, with no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the action's purpose, usage context, prerequisites, reversal command, return style, and safety confirmation. With an output schema and complete parameter schema present, no essential information is missing for the agent to call this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and each parameter already has detailed semantics, including confirmed's preview vs. actual disable behavior. The description adds little parameter-level detail beyond reinforcing the confirmed=True safety requirement, which is already present in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Disable a pool member with graceful drain' and immediately explains the behavioral effect: existing connections complete, no new traffic. It clearly distinguishes from the sibling pool_member_enable by noting it reverses the action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit usage context: 'Use for maintenance or rolling deployments' and instructs the agent to 'run pool_members first for the server IP' and use 'pool_member_enable to reverse it.' This tells the agent both when to use the tool and what to do before/after.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pool_member_enableA
[WRITE] Enable a pool member so it receives traffic again.
Returns a one-line confirmation. Use pool_members first to verify the server IP. The server must already belong to the pool — this adds nothing.
| Name | Required | Description | Default |
|---|---|---|---|
| pool | Yes | Exact pool name as shown by pool_list — matched literally, not fuzzily, and an unknown name is refused rather than ignored. Pools are often named differently from the Virtual Services that use them, so do not infer it from a VS name. | |
| server | Yes | Server IP address. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses the return format ('one-line confirmation'), marks the operation as [WRITE], and clarifies that no membership addition occurs. These details go beyond what the annotations alone convey. It does not contradict the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences: the action and outcome are first, followed by return format and a necessary precondition. There is no redundant wording or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, both parameters are required and fully described in the schema, an output schema exists, and the description covers the key behavioral nuance. An agent has enough information to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already explains that pool must be an exact literal name and server is an IP address. The description adds the practical note to verify via pool_members, but does not substantially expand parameter meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Enable a pool member so it receives traffic again.' This clearly differentiates it from pool_member_disable and states the intended effect. The [WRITE] prefix reinforces the action type.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly instructs to 'Use pool_members first to verify the server IP' and states that 'The server must already belong to the pool — this adds nothing.' This gives useful context and a precondition, though it does not explicitly mention the sibling pool_member_disable as the inverse alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pool_membersARead-onlyIdempotent
[READ] List the members of a pool.
Returns Server IP, Port, Enabled and Ratio per member. Use before pool_member_enable or pool_member_disable; run pool_list first for the pool name. Reports configured state only, not live health-monitor results.
| Name | Required | Description | Default |
|---|---|---|---|
| pool | Yes | Exact pool name as shown by pool_list — matched literally, not fuzzily, and an unknown name is refused rather than ignored. Pools are often named differently from the Virtual Services that use them, so do not infer it from a VS name. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint and destructiveHint annotations, the description adds a valuable behavioral caveat: it reflects configured state, not live health-monitor results. It also discloses exactly which output fields are returned. No contradiction with the annotations exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: the action and result fields come first, followed by workflow context and a caveat. Every sentence earns its place, with no filler or repeated schema information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only, single-parameter listing tool with an output schema, the description fully covers what it returns, prerequisites, sibling-tool relationships, and an important limitation. Nothing an agent needs to decide when or how to call it is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the pool parameter is already richly documented in the schema with exact-match semantics, literal matching, and a warning not to infer the pool name from a Virtual Service name. The description only reinforces this by saying to run pool_list first, so it adds little beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description starts with a clear action and object: 'List the members of a pool.' It also names the specific returned fields (Server IP, Port, Enabled, Ratio), and the '[READ]' prefix reinforces its read-only nature. The tool is distinguished from siblings by explicitly positioning it relative to pool_member_enable/pool_member_disable and pool_list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit workflow guidance: 'Use before pool_member_enable or pool_member_disable' and 'run pool_list first for the pool name.' It also states an exclusion — 'Reports configured state only, not live health-monitor results' — so an agent knows when not to rely on this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
se_healthARead-onlyIdempotent
[READ] Health of every Service Engine — operational status and VS counts.
Returns name, operational state and the number of VSes placed on each SE. Use when VS health degrades to check if the issue is at the SE level; se_list gives the management IP and SE Group, vs_status the affected VS. An SE hosting no VS reports 0, not an error.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish the read-only, idempotent, non-destructive profile, so the description's '[READ]' tag adds a little. More valuable is the explicit edge case that an SE with no VS reports 0 rather than an error, which is useful behavioral context beyond the structured annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and well-structured: purpose is front-loaded, followed by return fields, usage guidance, alternatives, and a critical edge case. Every sentence contributes information an agent needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no parameters, an output schema present, and comprehensive annotations, the description covers the remaining practical concerns: what fields are returned, when to use the tool, and the zero-VS reporting behavior. Nothing an agent needs to invoke or interpret the result is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the description does not need to explain any. Per the calibration, zero param count starts at baseline 4, and the description correctly avoids inventing parameter details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reports the health of every Service Engine, including name, operational status, and VS counts. It also distinguishes itself from related tools like se_list and vs_status, so an agent can identify its role without ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says when to use this tool: when VS health degrades and the agent needs to determine whether the issue is at the SE level. It also names se_list and vs_status as alternatives and explains what each provides, making the routing decision clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
se_listARead-onlyIdempotent
[READ] List Service Engines (AVI data-plane VMs) on the Controller.
Returns Name, management IP, status (e.g. OPER_UP) and SE Group per SE, in one call that cannot be paged or filtered. Use to inventory capacity or find an SE's name and IP — use se_health instead for degraded VS health.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnly, idempotent, and non-destructive behavior. The description adds useful behavioral context by stating the call cannot be paged or filtered and enumerates what it returns, going beyond the annotation signal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact, front-loaded with the [READ] intent, and each sentence adds meaningful information. There is no fluff or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter read-only list operation with an output schema present, the description covers the purpose, usage, limitations, and alternative. Nothing essential is missing for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline is 4. The description adds no parameter details because none are needed; it instead explains the output fields and constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource ('List Service Engines ... on the Controller') and states the returned fields. It also differentiates this tool from se_health by noting the health-focused sibling.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit use cases ('inventory capacity or find an SE's name and IP') and explicitly directs the agent to se_health for degraded VS health. This provides clear when-to-use and when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssl_expiry_checkARead-onlyIdempotent
[READ] Check which SSL certificates expire within N days (default 30).
Returns name, expiry date and days remaining, soonest first. Use this instead of ssl_list when you only want certificates near expiry. Expired certs are included, with negative days remaining.
| Name | Required | Description | Default |
|---|---|---|---|
| days | No | Report certs expiring within this many days (default 30). |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already carry the safety profile (readOnlyHint=true, idempotentHint=true, destructiveHint=false), and the description adds genuine result behavior on top: soonest-first ordering and the edge case that 'Expired certs are included, with negative days remaining.' This goes beyond what the annotations disclose, though it stops short of covering pagination or rate limits, which are likely non-issues for a filtered read tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each earning its place: purpose, return contract, and sibling routing. The '[READ]' prefix and 'soonest first' flag are efficient front-loaded signals with zero filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-optional-parameter read tool with an output schema and safety annotations, the description covers the return fields, ordering, default behavior, edge case (expired certs), and the alternative tool. Nothing an agent needs to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%: the schema already documents 'days' with a description and default of 30. The tool description repeats the default ('within N days (default 30)') but adds no meaning beyond the schema, so the baseline of 3 is correct.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('Check') and resource ('SSL certificates expire within N days'), and immediately distinguishes itself from siblings: 'Use this instead of ssl_list when you only want certificates near expiry.' An agent can tell this apart from the 28 sibling tools without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly names the alternative (ssl_list) and gives the selection condition ('when you only want certificates near expiry'), which implies the inverse condition for the sibling. This is exactly the explicit when/alternative guidance the rubric rewards.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssl_listARead-onlyIdempotent
[READ] List SSL/TLS certificates stored on the AVI Controller.
Returns Name, Subject, Expiry and Type per certificate, in one call that cannot be paged or filtered. Use for inventory or a certificate's exact name — use ssl_expiry_check instead for only the ones expiring soon.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, covering the safety profile. The description adds meaningful behavioral context beyond annotations: the call "cannot be paged or filtered" and returns specific fields. The [READ] prefix reinforces the non-mutating nature.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three tight sentences with no filler. The main purpose is front-loaded, followed by the return fields, the key limitation, and the sibling alternative. Every sentence adds distinct value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter read-only list tool with an output schema, the description is complete: it names the resource, states the returned fields, notes the pagination/filtering limitation, and directs the agent to the appropriate alternative. Nothing an agent needs to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there are no parameter semantics for the description to clarify. The description adds that the call is unfilterable, which implicitly confirms that no filtering parameters exist. The baseline for zero-parameter tools is 4, and no deductions are warranted.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: "List SSL/TLS certificates stored on the AVI Controller." It clearly distinguishes the tool from the sibling ssl_expiry_check by stating that this one is for inventory or exact name lookup while the sibling is for certificates expiring soon.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says when to use this tool: "Use for inventory or a certificate's exact name — use ssl_expiry_check instead for only the ones expiring soon." This provides both a positive use case and an explicit alternative, leaving no ambiguity about selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vs_analyticsARead-onlyIdempotent
[READ] Performance metrics for one Virtual Service over the last hour.
Returns L4 (bandwidth, connections) and L7 (latency, % errors, responses) averages over a fixed window that cannot be changed (12 samples, 5 min apart). Empty output means no traffic, not an error. Use when vs_status shows degraded health; vs_error_logs gives per-request detail.
| Name | Required | Description | Default |
|---|---|---|---|
| vs_name | Yes | Exact Virtual Service name, case-sensitive, from vs_list. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, openWorld, and idempotent behavior, and the description adds valuable context beyond them: the fixed 12-sample/5-minute window that cannot be changed, and the non-obvious empty-output semantics meaning no traffic rather than an error. This fully informs the agent of behavioral edge cases.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences each earn their place: the purpose, the metric/window detail, the empty-output signal, and the usage guidance. It is front-loaded and has no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter read-only tool with a full output schema, the description is complete. It covers what the tool returns, the fixed time window, empty result behavior, and when to choose this tool versus its sibling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already fully documents vs_name as an exact, case-sensitive Virtual Service name from vs_list. The description adds no meaning for the parameter beyond the schema, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific action and resource: returns performance metrics for one Virtual Service over the last hour. It differentiates itself from siblings by specifying L4 and L7 metric categories, making it clear this is the analytics tool rather than vs_status or vs_error_logs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly instructs when to use this tool: when vs_status shows degraded health. It also names the alternative for per-request detail (vs_error_logs), giving the agent clear routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vs_error_logsARead-onlyIdempotent
[READ] Recent request error logs for one Virtual Service.
Returns up to 50 lines — timestamp, HTTP status, URI path, client IP — for status 400 and above. Use this instead of vs_analytics for per-request detail. An empty result may mean no errors, or capture disabled on the VS.
| Name | Required | Description | Default |
|---|---|---|---|
| since | No | Window — seconds or '30m', '1h', '2d' (default '1h'). | 1h |
| vs_name | Yes | Exact Virtual Service name, from vs_list. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and non-destructive, and the description adds complementary context: the 50-line limit, status >=400 filter, the exact returned fields, and the ambiguity of empty results (no errors vs capture disabled). No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences, each earning its place. The READ intent is front-loaded, followed by return details, sibling distinction, and an important caveat about empty results. Zero wasteful wording.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return fields are further specified there. The description covers the critical operational details: scope, result cap, status filter, alternative tool, and the empty-result ambiguity. Nothing an agent needs to correctly invoke or interpret the tool is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters are fully documented in the schema; the description adds no additional parameter semantics beyond the general purpose of the tool. Baseline 3 is appropriate because the schema carries the parameter documentation burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb, resource, and scope: 'Returns... error logs for one Virtual Service' with explicit detail on line limit, status threshold, and fields. It directly names the alternative vs_analytics, so an agent can distinguish without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'Use this instead of vs_analytics for per-request detail', naming the alternative and the condition that selects this tool. It also adds interpretation guidance for empty results, which helps decide whether to escalate or check configuration.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vs_listARead-onlyIdempotent
[READ] List Virtual Services on the AVI Controller.
Returns Name, Enabled, VIP and short UUID for every VS in one call; it cannot be paged or filtered, and carries no health score. Use this before drilling into one VS with vs_status.
| Name | Required | Description | Default |
|---|---|---|---|
| controller | No | Controller name from config (optional, uses default). |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare the tool read-only, idempotent, and non-destructive, but the description adds operational behavior beyond that: it returns every VS in one call, cannot be paged or filtered, and intentionally omits health scores. This is exactly the contextual disclosure an agent needs to invoke it correctly.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Every sentence earns its place: a clear purpose, a compact summary of returned data and limitations, and an explicit next-step recommendation. The information is front-loaded and there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only list tool with one optional parameter, an output schema, and a clear sibling relationship, this description is complete. It covers return contents, the all-at-once nature, limitations, and the recommended follow-up tool, so an agent can choose and call it correctly without opening the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter, 'controller', is fully described in the input schema with its default and meaning. Schema description coverage is 100%, so the description does not need to repeat parameter details. The baseline 3 applies since no additional parameter-level nuance is provided.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'List Virtual Services on the AVI Controller.' It then enumerates the returned fields (Name, Enabled, VIP, short UUID), so an agent knows precisely what this tool does. It also distinguishes itself from vs_status via the final sentence.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly places this tool in a workflow: 'Use this before drilling into one VS with vs_status.' It also states the key limitations—no pagination, no filtering, no health score—so an agent knows when not to rely on it and can route to the more specific sibling.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vs_statusARead-onlyIdempotent
[READ] Detailed status for one Virtual Service: VIP, pool, health, connections, throughput.
Returns one detail block, not a list. Use vs_list first for the exact name — a name that does not match exactly fails. Then vs_analytics for metrics, vs_error_logs for 5xx.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Exact Virtual Service name. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover read-only, idempotent, and non-destructive behavior. The description adds useful behavioral specifics beyond annotations: exact-name matching is required, a mismatch fails, and the response is one detail block, not a list. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded with the [READ] marker and the key purpose. Every sentence contributes either core semantics, a failure condition, or routing to alternatives, with no filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter read tool with a rich output schema and strong annotations, this description is complete. It covers prerequisite ordering, exact-match failure, the shape of the return (one block), and sibling tool routing, so an agent has everything needed to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the name parameter already has the description 'Exact Virtual Service name.' The tool description reinforces the exact-match requirement, but adds no new parameter format or syntax details beyond what the schema provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool's function: detailed status for one Virtual Service including VIP, pool, health, connections, and throughput. It differentiates from siblings by noting it returns a single detail block rather than a list, and specifies that vs_analytics and vs_error_logs serve complementary purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells the agent to call vs_list first to obtain an exact name, warns that a non-exact name fails, and directs metrics to vs_analytics and 5xx to vs_error_logs. This is clear when-to-use and when-not-to-use guidance beyond what annotations provide.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vs_toggleADestructive
[WRITE] Enable or disable a Virtual Service. Disabling stops all traffic to it.
Returns a one-line result. Use vs_status first to check current state.
SAFETY: disabling requires confirmed=True; without it you get a preview only. Enabling is always safe.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Exact Virtual Service name. | |
| enable | Yes | true to enable, false to disable. | |
| confirmed | No | Gates the disable only. With enable=false, the default false returns a preview naming the VS that would stop serving traffic and changes nothing; true performs the disable. Ignored when enable=true — enabling always executes. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds safety-critical behavior beyond the destructiveHint annotation: disabling stops all traffic, an unconfirmed disable is preview-only and changes nothing, confirmed=True is required to actually disable, and enabling always executes. It also discloses the one-line result format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: purpose, then result, then prerequisite, then safety. Every sentence contributes essential selection or invocation guidance without filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, non-idempotent tool, the description covers purpose, effect, prerequisite check, result shape, and the critical confirmation gate. Combined with the fully-documented schema and output schema, an agent has enough to invoke it correctly and safely.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides 100% coverage for all three parameters, including the confirmed flag semantics. The description reinforces that confirmed gates only disable and is ignored for enable, but does not add substantial new meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the specific action ('Enable or disable a Virtual Service') and the concrete effect ('Disabling stops all traffic to it'). This clearly distinguishes vs_toggle from read-only siblings like vs_status and vs_list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly directs the agent to use vs_status first to check current state, and it explains the preview-vs-execute behavior for disabling based on the confirmed flag. It does not explicitly enumerate when-not-to-use conditions, but the context is clear enough for correct selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
28 tool updates
v1.8.14- Added
ako_amko_status - Changed
ako_clusters1 field changed- added
Input schema / additionalPropertiesfalse
- Changed
ako_config_diff2 fields changed- added
Input schema / additionalPropertiesfalse
- added
Input schema / properties / chart_version / description"Pin the chart, e.g. \"1.11.1\". Empty = registry latest."
- Added
ako_config_show - Added
ako_config_upgrade - Added
ako_ingress_check - Added
ako_ingress_diagnose - Added
ako_ingress_map - Changed
ako_logs4 fields changed- added
Input schema / additionalPropertiesfalse
- added
Input schema / properties / context / description"K8s context (optional, uses current)."
- added
Input schema / properties / since / description"Narrows the window, e.g. '30m', '1h'."
- added
Input schema / properties / tail / description"Number of log lines (default 100)."
- Added
ako_restart - Added
ako_status - Changed
ako_sync_diff2 fields changed- added
Input schema / additionalPropertiesfalse
- added
Input schema / properties / context / description"K8s context name (optional)."
- Changed
ako_sync_force3 fields changed- added
Input schema / additionalPropertiesfalse
- added
Input schema / properties / confirmed / description"false (the default) returns a preview and changes nothing; true forces the resync, which restarts the AKO pod so it rebuilds every Virtual Service, pool and VS-VIP from the cluster's current resources — brief traffic disruption is possible."
- added
Input schema / properties / context / description"K8s context name (optional)."
- Added
ako_sync_status - Added
ako_version - Changed
pool_list2 fields changed- added
Input schema / additionalPropertiesfalse
- added
Input schema / properties / vs_filter / description"Substring matching VS names (e.g. 'web') — returns only the pools those VS reference. Omit for all pools."
- Added
pool_member_disable - Changed
pool_member_enable3 fields changed- added
Input schema / additionalPropertiesfalse
- added
Input schema / properties / pool / description"Exact pool name as shown by pool_list — matched literally, not fuzzily, and an unknown name is refused rather than ignored. Pools are often named differently from the Virtual Services that use them, so do not infer it from a VS name."
- added
Input schema / properties / server / description"Server IP address."
- Changed
pool_members2 fields changed- added
Input schema / additionalPropertiesfalse
- added
Input schema / properties / pool / description"Exact pool name as shown by pool_list — matched literally, not fuzzily, and an unknown name is refused rather than ignored. Pools are often named differently from the Virtual Services that use them, so do not infer it from a VS name."
- Added
se_health - Changed
se_list1 field changed- added
Input schema / additionalPropertiesfalse
- Changed
ssl_expiry_check2 fields changed- added
Input schema / additionalPropertiesfalse
- added
Input schema / properties / days / description"Report certs expiring within this many days (default 30)."
- Added
ssl_list - Added
vs_analytics - Changed
vs_error_logs3 fields changed- added
Input schema / additionalPropertiesfalse
- added
Input schema / properties / since / description"Window — seconds or '30m', '1h', '2d' (default '1h')."
- added
Input schema / properties / vs_name / description"Exact Virtual Service name, from vs_list."
- Changed
vs_list2 fields changed- added
Input schema / additionalPropertiesfalse
- added
Input schema / properties / controller / description"Controller name from config (optional, uses default)."
- Added
vs_status - Changed
vs_toggle4 fields changed- added
Input schema / additionalPropertiesfalse
- added
Input schema / properties / confirmed / description"Gates the disable only. With enable=false, the default false returns a preview naming the VS that would stop serving traffic and changes nothing; true performs the disable. Ignored when enable=true — enabling always executes."
- added
Input schema / properties / enable / description"true to enable, false to disable."
- added
Input schema / properties / name / description"Exact Virtual Service name."
10 tool updates
v1.8.8- Added
ako_clusters - Added
ako_config_diff - Removed
ako_ingress_check - Added
ako_sync_force - Removed
ako_sync_status - Added
pool_list - Removed
pool_member_disable - Added
pool_members - Added
se_list - Added
ssl_expiry_check
19 tool updates
v1.8.8- Removed
ako_amko_status - Removed
ako_clusters - Removed
ako_config_diff - Removed
ako_config_show - Removed
ako_config_upgrade - Removed
ako_ingress_diagnose - Removed
ako_ingress_map - Removed
ako_restart - Removed
ako_status - Removed
ako_sync_force - Removed
ako_version - Removed
pool_list - Removed
pool_members - Removed
se_health - Removed
se_list - Removed
ssl_expiry_check - Removed
ssl_list - Removed
vs_analytics - Removed
vs_status
4 tool updates
v1.5.38- Removed
ako_cluster_overview - Changed
ako_config_upgrade1 field changed- added
Input schema / properties / confirmed{ "default": false, "title": "Confirmed", "type": "boolean" }
- Removed
ako_ingress_fix_suggest - Changed
ako_logs1 field changed- added
Input schema / properties / context{ "anyOf": [ { "type": "string" }, { "type": "null" } ], "default": null, "title": "Context" }
30 tool updates
v1.5.29- Added
ako_amko_status - Added
ako_cluster_overview - Added
ako_clusters - Added
ako_config_diff - Added
ako_config_show - Added
ako_config_upgrade - Added
ako_ingress_check - Added
ako_ingress_diagnose - Added
ako_ingress_fix_suggest - Added
ako_ingress_map - Added
ako_logs - Added
ako_restart - Added
ako_status - Added
ako_sync_diff - Added
ako_sync_force - Added
ako_sync_status - Added
ako_version - Added
pool_list - Added
pool_member_disable - Added
pool_member_enable - Added
pool_members - Added
se_health - Added
se_list - Added
ssl_expiry_check - Added
ssl_list - Added
vs_analytics - Added
vs_error_logs - Added
vs_list - Added
vs_status - Added
vs_toggle
30 tool updates
v1.5.28- Removed
ako_amko_status - Removed
ako_cluster_overview - Removed
ako_clusters - Removed
ako_config_diff - Removed
ako_config_show - Removed
ako_config_upgrade - Removed
ako_ingress_check - Removed
ako_ingress_diagnose - Removed
ako_ingress_fix_suggest - Removed
ako_ingress_map - Removed
ako_logs - Removed
ako_restart - Removed
ako_status - Removed
ako_sync_diff - Removed
ako_sync_force - Removed
ako_sync_status - Removed
ako_version - Removed
pool_list - Removed
pool_member_disable - Removed
pool_member_enable - Removed
pool_members - Removed
se_health - Removed
se_list - Removed
ssl_expiry_check - Removed
ssl_list - Removed
vs_analytics - Removed
vs_error_logs - Removed
vs_list - Removed
vs_status - Removed
vs_toggle
30 tool updates
v1.5.22- First observed
ako_amko_status - First observed
ako_cluster_overview - First observed
ako_clusters - First observed
ako_config_diff - First observed
ako_config_show - First observed
ako_config_upgrade - First observed
ako_ingress_check - First observed
ako_ingress_diagnose - First observed
ako_ingress_fix_suggest - First observed
ako_ingress_map - First observed
ako_logs - First observed
ako_restart - First observed
ako_status - First observed
ako_sync_diff - First observed
ako_sync_force - First observed
ako_sync_status - First observed
ako_version - First observed
pool_list - First observed
pool_member_disable - First observed
pool_member_enable - First observed
pool_members - First observed
se_health - First observed
se_list - First observed
ssl_expiry_check - First observed
ssl_list - First observed
vs_analytics - First observed
vs_error_logs - First observed
vs_list - First observed
vs_status - First observed
vs_toggle
TDQS
Each tool targets a distinct resource or operation. VS tools deal with virtual services, pool tools with pools, SSL tools with certificates, SE tools with service engines, AKO tools with Kubernetes integration, and vs_error_logs with logs. No two tools overlap in purpose.
Tool names use snake_case and follow a resource-prefix pattern (vs_, pool_, ssl_, ako_, se_). However, word order varies: some are resource_action (vs_list), others resource_noun (pool_members), or prefix_action_noun (ako_sync_diff). Minor inconsistency but still readable.
With 13 tools, the set is well-scoped for a domain-specific server. Each tool serves a clear purpose without redundancy, and the count is within the typical 3-15 range.
The server covers common read operations and some writes (toggle, enable, force sync), but lacks counterpart writes like pool_member_disable, VS creation/update/delete, and pool management operations. There is also no tool to apply pending Helm configs despite a diff tool. These gaps may cause agent failures in workflows requiring full lifecycle management.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Governed MCP gateway: one endpoint for your tools, with credential custody and audit log.
Remote MCP for Copilot CLI switch gate MCP, structured receipts, audit logs, and reviewer-ready evid
One MCP URL for all your connectors — scoped writes, enforced constraints, and a full audit trail.
Related MCP Servers
- AlicenseNot gradedqualityAmaintenanceProvides MCP multi-cluster Kubernetes management and operations, featuring a management interface, logging, and nearly 50 built-in tools covering common DevOps and development scenarios. Supports both standard and CRD resources.878MIT
- AlicenseNot gradedqualityDmaintenanceEnables secure management of VMware vCenter 8.0+ environments through controlled operations including VM lifecycle management, snapshots, and resource discovery with built-in RBAC authorization, audit logging, and rate limiting.5MIT
- AlicenseAqualityAmaintenanceAI-powered VMware vSphere with Tanzu (VKS) management. Create and manage Supervisor Namespaces and TanzuKubernetesClusters with 20 MCP tools.235MIT
- AlicenseAqualityAmaintenanceMCP server for managing VMware vCenter (vSphere 7/8) with 39 tools covering VMs, clusters, and ESXi hosts. Supports direct and jump host deployment modes.20MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/vmware-skills/VMware-AVI'
If you have feedback or need assistance with the MCP directory API, please join our Discord server