Skip to main content
Glama

VMware AVI

Author: Wei Zhou, VMware by Broadcom — wei-wz.zhou@broadcom.com This is a community-driven project by a VMware engineer, not an official VMware product. For official VMware developer tools see developer.broadcom.com.

English | 中文

AVI (NSX Advanced Load Balancer) management and AKO Kubernetes operations tool — 28 tools across 10 categories.

Dual mode: Traditional AVI Controller management + AKO K8s operations in one skill.

Companion skills handle everything else:

Skill

Scope

Install

vmware-aiops

VM lifecycle, deployment, guest ops, cluster

uv tool install vmware-aiops

vmware-monitor

Read-only: inventory, health, alarms, events

uv tool install vmware-monitor

vmware-storage

Datastores, iSCSI, vSAN management

uv tool install vmware-storage

vmware-vks

Tanzu Namespaces, TKC cluster lifecycle

uv tool install vmware-vks

vmware-nsx

NSX networking: segments, gateways, NAT

uv tool install vmware-nsx-mgmt

vmware-nsx-security

DFW firewall rules, security groups

uv tool install vmware-nsx-security

vmware-aria

Aria Ops: metrics, alerts, capacity

uv tool install vmware-aria

PyPI Python License: MIT ClawHub


Quick Install

# Via uv (recommended)
uv tool install vmware-avi

# Or via pip
pip install vmware-avi

# China mainland mirror
pip install vmware-avi -i https://pypi.tuna.tsinghua.edu.cn/simple

# Verify installation
vmware-avi doctor

Offline / Air-Gapped Install (from source)

This project uses the modern PEP 517 build system (hatchling), so there is no setup.py by design — that is expected, not a missing file. If you cloned the source and hit ERROR: File "setup.py" or "setup.cfg" not found ... editable mode currently requires a setuptools-based build, your pip is older than 21.3 and cannot do an editable (-e) install with a non-setuptools backend. Editable mode is a developer convenience, not needed to run the tool — do one of:

# From the source tree — a normal (non-editable) install builds a wheel:
pip install .              # NOT  pip install -e .

# ...or upgrade pip first, and editable works too:
pip install --upgrade pip && pip install -e .

For a truly air-gapped host, build the wheels on a connected machine and copy them over — the target then needs no network:

# On a connected machine, collect this package + its dependencies as wheels:
pip wheel . -w dist        # → dist/*.whl   (or: uv build, for just this package)

# Copy dist/ to the air-gapped host, then install offline:
pip install --no-index --find-links dist vmware-avi

Related MCP server: vSphere-MCP-Pro

Capabilities Overview

What This Skill Does

Category

Tools

Count

Virtual Service

list, status, enable/disable

3

Pool Member

pool discovery, member list, enable/disable member (drain/restore traffic)

4

SSL Certificate

list, expiry check

2

Analytics

VS metrics overview, request error logs

2

Service Engine

list, health check

2

AKO Pod Ops

status, logs, restart, version info

4

AKO Config

values.yaml view, Helm diff, Helm upgrade

3

Ingress Diagnostics

annotation validation, VS mapping, error diagnosis, fix recommendation

4

Sync Diagnostics

K8s-Controller comparison, inconsistency list, force resync

3

Multi-cluster

cluster list, cross-cluster AKO overview, AMKO status

3

CLI vs MCP: Which Mode to Use

Scenario

Recommended

Why

Local/small models (Ollama, Qwen)

CLI

~2K tokens vs ~8K for MCP

Cloud models (Claude, GPT-4o)

Either

MCP gives structured JSON I/O

Automated pipelines

MCP

Type-safe parameters, structured output

AKO troubleshooting

CLI

Interactive log tailing, Helm diff output

Rule of thumb: Use CLI for cost efficiency and small models. Use MCP for structured automation with large models.

Architecture

User (Natural Language)
  |
AI CLI Tool (Claude Code / Gemini / Codex / Cursor / Trae)
  | reads SKILL.md
  |
vmware-avi CLI
  |--- avisdk (AVI REST API) ---> AVI Controller ---> Virtual Services / Pools / SEs
  |--- kubectl / kubernetes ---> K8s Cluster ---> AKO Pods / Ingress / Services

Configuration

Step 1: Create Config Directory

mkdir -p ~/.vmware-avi
vmware-avi init          # generates config.yaml and .env templates
chmod 600 ~/.vmware-avi/.env

Step 2: Edit config.yaml

controllers:
  - name: prod-avi
    host: avi-controller.example.com
    username: admin
    api_version: "22.1.4"
    tenant: admin
    port: 443
    verify_ssl: true

default_controller: prod-avi

ako:
  kubeconfig: ~/.kube/config
  default_context: ""
  namespace: avi-system

Step 3: Set Passwords

Create ~/.vmware-avi/.env:

# AVI Controller passwords
# Format: {CONTROLLER_NAME_UPPER}_PASSWORD
PROD_AVI_PASSWORD=your-password-here

Password environment variable naming convention:

{CONTROLLER_NAME_UPPER}_PASSWORD
# Replace hyphens with underscores, UPPERCASE
# Example: controller "prod-avi" -> PROD_AVI_PASSWORD
# Example: controller "staging-alb" -> STAGING_ALB_PASSWORD

Step 4: Verify

vmware-avi doctor    # checks Controller connectivity + kubeconfig + avisdk

CLI Usage

Virtual Service Management

# List all virtual services
vmware-avi vs list [--controller prod-avi]

# Check status of a specific VS
vmware-avi vs status my-webapp-vs

# Enable / disable a VS (disable requires double confirmation)
vmware-avi vs enable my-webapp-vs
vmware-avi vs disable my-webapp-vs

Pool Member Drain / Restore

# List pool members and health status
vmware-avi pool members my-pool

# Graceful drain (disable) — double confirmation required
vmware-avi pool disable my-pool 10.1.1.5

# Restore traffic (enable)
vmware-avi pool enable my-pool 10.1.1.5

SSL Certificate Expiry Check

# List all certificates
vmware-avi ssl list

# Check certificates expiring within 30 days
vmware-avi ssl expiry --days 30

Analytics and Error Logs

# VS analytics: throughput, latency, error rates
vmware-avi analytics my-webapp-vs

# Request error logs
vmware-avi logs my-webapp-vs --since 1h

Service Engine Health

# Name, mgmt IP, operational status, SE group — status sourced from the
# serviceengine-inventory endpoint (config + runtime merged)
vmware-avi se list

# Per-SE operational status + connected-VS counts
vmware-avi se health

AKO Troubleshooting

# Check AKO pod status
vmware-avi ako status [--context my-k8s-context]

# View AKO logs
vmware-avi ako logs [--tail 100] [--since 30m]

# Restart AKO pod (double confirmation)
vmware-avi ako restart

# Show AKO version
vmware-avi ako version

AKO Helm Config Management

The AKO Helm release is discovered automatically (official installs use helm install --generate-name, so the release is not named ako). Upgrades pull the official Broadcom OCI chart oci://projects.packages.broadcom.com/ako/helm-charts/ako with --reuse-values.

# View current AKO Helm values (release auto-discovered)
vmware-avi ako config show

# Show pending changes (diff against the official OCI chart)
vmware-avi ako config diff

# Helm upgrade (double confirmation + --dry-run default)
vmware-avi ako config upgrade

Ingress Diagnostics

# Validate Ingress annotations
vmware-avi ako ingress check <namespace>

# Show Ingress-to-VS mapping
vmware-avi ako ingress map

# Diagnose why an Ingress has no VS
vmware-avi ako ingress diagnose <ingress-name>

Sync Diagnostics

# Check K8s-Controller sync status
vmware-avi ako sync status

# Show inconsistencies between K8s and Controller
vmware-avi ako sync diff

# Force AKO resync (double confirmation)
vmware-avi ako sync force

Multi-cluster AKO

# List clusters with AKO deployed
vmware-avi ako clusters

# Cross-cluster AKO status overview
vmware-avi ako cluster-overview

# AMKO GSLB status
vmware-avi ako amko status

MCP Server

The MCP server exposes all 28 tools via the Model Context Protocol. Works with any MCP-compatible client.

After uv tool install vmware-avi, start the MCP server with one command (v1.5.15+):

# Recommended — single command, no network re-resolve
vmware-avi mcp

# With custom config path
VMWARE_AVI_CONFIG=/path/to/config.yaml vmware-avi mcp

Claude Desktop Config

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "vmware-avi": {
      "command": "vmware-avi",
      "args": ["mcp"],
      "env": {
        "VMWARE_AVI_CONFIG": "~/.vmware-avi/config.yaml"
      }
    }
  }
}
# Run without installing (requires PyPI access each launch)
uvx --from vmware-avi vmware-avi mcp

# Legacy entry point (still works, kept for backward compatibility)
vmware-avi-mcp

Behind a corporate TLS proxy? uvx may fail with invalid peer certificate: UnknownIssuer. Use the recommended vmware-avi mcp form above (no network needed), or set UV_NATIVE_TLS=true.

MCP Tools (28)

Category

Tools

Virtual Service (3)

vs_list, vs_status, vs_toggle

Pool Member (4)

pool_list, pool_members, pool_member_enable, pool_member_disable

SSL Certificate (2)

ssl_list, ssl_expiry_check

Analytics (2)

vs_analytics, vs_error_logs

Service Engine (2)

se_list, se_health

AKO Pod (4)

ako_status, ako_logs, ako_restart, ako_version

AKO Config (3)

ako_config_show, ako_config_diff, ako_config_upgrade

Ingress Diagnostics (3)

ako_ingress_check, ako_ingress_map, ako_ingress_diagnose

Sync Diagnostics (3)

ako_sync_status, ako_sync_diff, ako_sync_force

Multi-cluster (2)

ako_clusters, ako_amko_status


Common Workflows

1. Maintenance Window -- Drain a Pool Member

When taking a backend server offline for patching:

  1. List pool members and health status

    vmware-avi pool members my-pool
  2. Disable the target server (graceful drain)

    vmware-avi pool disable my-pool 10.1.1.5
  3. Monitor analytics to confirm active connections are draining

    vmware-avi analytics my-vs
  4. Perform maintenance on the server

  5. Re-enable the server

    vmware-avi pool enable my-pool 10.1.1.5
  6. Verify health status is green

    vmware-avi pool members my-pool

2. AKO Ingress Not Creating VS

When a developer reports their Ingress is not producing a Virtual Service:

  1. Verify AKO is running

    vmware-avi ako status
  2. Validate Ingress annotations

    vmware-avi ako ingress check <namespace>
  3. Check sync status between K8s and Controller

    vmware-avi ako sync status
  4. If annotations are wrong, diagnose the specific Ingress

    vmware-avi ako ingress diagnose <ingress-name>
  5. If sync drift is detected, review the diff and force resync if needed

    vmware-avi ako sync diff
    vmware-avi ako sync force

3. SSL Certificate Expiry Audit

Expired certificates cause outages. Run periodic checks:

  1. Check all certificates expiring within 30 days

    vmware-avi ssl expiry --days 30
  2. Review which VS uses each expiring certificate (output includes VS mapping)

  3. Plan renewal with the certificate team

  4. After renewal, verify the new certificate is in place

    vmware-avi ssl list

Troubleshooting

"Controller unreachable" error

  1. Run vmware-avi doctor to verify connectivity

  2. Check if the controller address and port are correct in ~/.vmware-avi/config.yaml

  3. For self-signed certs: set verify_ssl: false in config.yaml (lab environments only)

AKO Pod in CrashLoopBackOff

  1. Check logs: vmware-avi ako logs --tail 50

  2. Common causes: wrong controller IP in values.yaml, network policy blocking AKO to Controller, expired credentials

  3. Fix config: vmware-avi ako config show to inspect, then vmware-avi ako config upgrade with corrected values (release auto-discovered; pulls the official Broadcom OCI chart)

Ingress created but no VS on Controller

  1. Validate annotations: vmware-avi ako ingress check <namespace>

  2. Check AKO logs for rejection reason: vmware-avi ako logs --since 5m

  3. Run sync diff: vmware-avi ako sync diff to see if the object is stuck

Pool member shows "down" after enable

Health monitor may still be failing. The member is enabled but unhealthy. Check the actual health status on the Controller side. Fix the backend service first, then the health status will auto-recover.

SSL expiry check shows 0 certificates

Verify the controller connection has tenant-level access. Certificates are tenant-scoped in AVI. The configured user may only see certs in their tenant.

AKO sync force has no effect

Force resync triggers AKO to re-reconcile all K8s objects. If the drift persists, the issue is likely in the K8s resource definition itself (bad annotation, missing secret). Use vmware-avi ako ingress diagnose to pinpoint the root cause.


Safety Features

Feature

Details

Double Confirmation

Destructive ops (VS disable, pool member disable, AKO restart, Helm upgrade, force resync) require 2 sequential confirmations

Dry-Run Default

ako config upgrade defaults to --dry-run mode -- user must explicitly confirm to apply

Audit Trail

All operations logged to ~/.vmware/audit.db via vmware-policy (@vmware_tool decorator)

Password Protection

.env file loading with permission check; never in shell history

SSL Support

verify_ssl: false for self-signed certs in isolated lab environments only

Prompt Injection Protection

All API-sourced text truncated (500 chars max) and C0/C1 control characters stripped

Input Validation

Pool names, VS names, IP addresses, and namespace names validated before API calls

Security Details

  • Source Code: github.com/vmware-skills/VMware-AVI

  • Config File Contents: config.yaml stores controller addresses, usernames, and AKO settings. No passwords or tokens. All secrets stored exclusively in .env

  • Webhook Data Scope: Disabled by default. No third-party data transmission

  • TLS Verification: Enabled by default. Disable only for self-signed certificate environments

  • Prompt Injection Protection: _sanitize() truncation + control character cleanup on all AVI API responses

  • Least Privilege: Use a dedicated AVI service account with minimal permissions. AKO operations require only namespace-scoped kubeconfig access


Companion Skills

Skill

Scope

Tools

Install

vmware-avi

AVI load balancer, AKO K8s operations

28

uv tool install vmware-avi

vmware-aiops

VM lifecycle, deployment, guest ops, cluster

49

uv tool install vmware-aiops

vmware-monitor

Read-only monitoring, alarms, events

27

uv tool install vmware-monitor

vmware-storage

Datastores, iSCSI, vSAN

11

uv tool install vmware-storage

vmware-vks

Tanzu Namespaces, TKC cluster lifecycle

20

uv tool install vmware-vks

vmware-nsx

NSX segments, gateways, NAT, routing

33

uv tool install vmware-nsx-mgmt

vmware-nsx-security

DFW firewall, security groups, IDS/IPS

21

uv tool install vmware-nsx-security

vmware-aria

Aria Ops: metrics, alerts, capacity

28

uv tool install vmware-aria

vmware-harden

Compliance baselines, drift detection

6

uv tool install vmware-harden


Version Compatibility

AVI Controller / Environment

Support

Notes

AVI 30.x in VCF 9.1

✅ Full

avisdk 30.x line covers VCF 9.1 bundle

AVI 30.x in VCF 9.0

✅ Full

Standard AVI / NSX ALB integration

AVI 22.x — 31.x standalone

✅ Full

Pin avisdk>=22.1,<31.0

AKO 1.10+

✅ Full

Kubernetes integration via AKO ConfigMap / GatewayClass

Official Broadcom References


Troubleshooting & Contributing

If you encounter any errors or issues, please send the error message, logs, or screenshots to zhouwei008@gmail.com. Contributions are welcome -- feel free to join us in maintaining and improving this project!

License

MIT

Available Tools

28 tools
ako_amko_statusA
Read-onlyIdempotent

[READ] AMKO (AVI Multi-Cluster Kubernetes Operator) GSLB status.

Returns raw kubectl output: the AMKO pods in avi-system, then the GSLBConfig YAML if one exists. Use this only for multi-cluster GSLB questions — for single-cluster AKO health use ako_status instead. Always reads the current kubectl context; see ako_clusters.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark it read-only and idempotent; the description adds what is actually returned (AMKO pods in avi-system followed by the GSLBConfig YAML if present) and the reliance on the current kubectl context. This behavior is disclosed beyond the structured hints, though it omits possible failure modes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences front-load the purpose, then give the return payload and usage routing. Every sentence contributes information; there is no filler or repetition of schema data.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter read-only tool with an output schema and rich sibling context, this description is complete: it states what is returned, when to use it, and the context caveat. No additional guidance is needed for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters (0% schema requirement), so the baseline is 4 and the description does not need to document inputs. The only implicit input, the current kubectl context, is called out explicitly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Starts with '[READ]' and names the exact resource: AMKO (AVI Multi-Cluster Kubernetes Operator) GSLB status. It specifies the action (returns status) and differentiates from the single-cluster ako_status sibling, so an agent can select it correctly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'Use this only for multi-cluster GSLB questions' and directs the agent to ako_status for single-cluster AKO health. It also cautions that the tool always reads the current kubectl context, with a pointer to ako_clusters.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ako_clustersA
Read-onlyIdempotent

[READ] List every Kubernetes context in the active kubeconfig and whether AKO is deployed there.

Returns Context, AKO Status (pod phase or 'Not deployed') and Version per context. Requires kubectl on PATH; every context is probed, so unreachable clusters add latency. Start here for context names, then pass one to ako_status, ako_logs or ako_ingress_diagnose.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark it read-only and idempotent, and the description adds important behavioral detail beyond that: every context is probed, kubectl must be on PATH, and unreachable clusters cause latency. It also clarifies the AKO Status values ('pod phase or Not deployed') and that Version is returned per context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three concise, front-loaded sentences cover purpose, return values, prerequisites, side effects, and routing to sibling tools. No sentence is wasted and the '[READ]' prefix immediately signals the operation type.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter discovery tool, the description is complete: it explains what is returned, what is required to run it, what behavioral caveat exists, and how to proceed next. The presence of an output schema reduces the need to describe return structures further.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and 100% schema coverage, so the baseline of 4 applies. The description adds no param-specific meaning, but none is needed because the input schema is empty and the call requires no arguments.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('List') and resource ('every Kubernetes context in the active kubeconfig') and clarifies the output includes AKO deployment status. The 'Start here' phrase and mentions of sibling tools like ako_status define its distinct role among the many AKO-related tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says to use this tool first to get context names, then pass one to ako_status, ako_logs, or ako_ingress_diagnose. It also gives practical usage conditions: requires kubectl on PATH and warns that unreachable clusters add latency.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ako_config_diffA
Read-onlyIdempotent

[READ] Pending Helm value changes that have not been applied yet.

Returns helm's diff output; empty means nothing would change. Credential values in it read <redacted> — that is this skill blanking them, not the configured value. Use this before ako_config_upgrade — it runs the same command, so the preview is real. Note: with chart_version empty the registry's moving latest is resolved, so two runs can differ with no local change; read ako_version and pass it to both.

ParametersJSON Schema
NameRequiredDescriptionDefault
chart_versionNoPin the chart, e.g. "1.11.1". Empty = registry latest.

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds behavior beyond annotations: redacted credentials, empty output semantics, and non-deterministic output when chart_version is empty due to moving latest. These are operational details an agent needs to interpret results correctly and do not contradict the read-only/idempotent effect annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every sentence carries necessary information: purpose, output semantics, redaction caveat, relationship to upgrade, and the version-pinning caveat. It is front-loaded with purpose and avoids filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the one optional parameter, the read-only annotations, and the presence of an output schema, the description covers usage timing, output interpretation, credential masking, and the non-determinism caveat. Nothing essential is missing for selecting and invoking this tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the schema already documents chart_version, so the baseline is 3. The description adds value by explaining the practical effect of an empty value: the registry's moving latest is resolved and two runs can differ, plus the recommendation to pin using ako_version.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with the marker '[READ]' and states a specific verb+resource: 'Pending Helm value changes that have not been applied yet,' then clarifies it returns 'helm's diff output.' This distinguishes it from read/show tools (ako_config_show) and aligns with the diff/upgrade family.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit usage context: use before ako_config_upgrade, and says both run 'the same command,' so the preview is real. It also instructs the agent to read ako_version and pass it when chart_version is empty, providing a concrete safe invocation path.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ako_config_showA
Read-onlyIdempotent

[READ] The AKO Helm release's values — controller IP, cloud name, network settings, feature flags.

Returns YAML as helm reports it. Use this first to read the live config; use ako_config_diff instead to see what an upgrade would change. Only values supplied at install time appear; chart defaults do not.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint false. The description adds valuable behavior beyond that: it returns YAML as Helm reports it and explicitly notes that chart defaults are excluded, which is useful and not redundant with the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Every sentence earns its place: the [READ] marker, the resource and content summary, the output format, the usage order, the alternative tool, and the critical install-time-only caveat are all packed into three tight sentences. No fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a no-parameter read-only tool with a rich annotation set and an output schema, the description fully covers what an agent needs: what it returns, how to invoke it first, when to choose the sibling, and a key data limitation. Nothing important is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so per the rubric the baseline is 4. There is no parameter ambiguity, and the schema is fully covered vacuously. The description appropriately focuses on behavior instead of parameter details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description states a clear verb ('read') and specific resource ('AKO Helm release's values'), with examples such as controller IP, cloud name, and network settings. It is clearly distinguished from the sibling ako_config_diff, which reads as a comparison tool for upgrades.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit guidance says 'Use this first to read the live config' and directs the agent to ako_config_diff instead 'to see what an upgrade would change.' It also clarifies the limitation that only install-time values appear, not chart defaults, which helps set expectations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ako_config_upgradeA

[WRITE] Apply an AKO Helm upgrade (dry_run=true by default).

Returns helm's output, with credential values blanked to <redacted> by this skill. Run ako_config_diff first to review the change. Finds the avi-system release automatically and upgrades the Broadcom OCI chart with --reuse-values.

SAFETY: applying (dry_run=False) requires confirmed=True, else preview only.

ParametersJSON Schema
NameRequiredDescriptionDefault
dry_runNoPreview without applying (default true).
confirmedNoGates the real upgrade only. With dry_run=false, the default false returns a preview naming the chart version and changes nothing; true runs `helm upgrade --reuse-values` against the avi-system release, rolling the AKO pod. Ignored while dry_run=true, which never writes.
chart_versionNoPin the chart, e.g. "1.11.1". Empty = registry latest.

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only mark this as a non-read operation; the description adds substantial behavior: dry_run defaults to true, output credentials are redacted, the avi-system release is found automatically, the Broadcom OCI chart is upgraded with --reuse-values, and confirmed gates the real upgrade. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact, front-loaded with purpose and default behavior, and each sentence adds needed context: what it does, what output looks like, the recommended prior step, and the safety gate. No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present and all parameters fully described in the schema, the description covers the remaining essential context: safety mode, prerequisite diff, automatic release discovery, and redaction behavior. Nothing critical is missing for an agent to call this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, including defaults and cross-parameter behavior for confirmed and dry_run. The description reinforces the key gate "applying (dry_run=False) requires confirmed=True" but does not add much beyond what the schema already documents.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with "[WRITE] Apply an AKO Helm upgrade," which states a specific verb, resource, and action. It further clarifies the default dry-run behavior and distinguishes the tool from read-only siblings like ako_config_diff by framing it as the applying step.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly tells the agent to run ako_config_diff first to review the change, creating a clear workflow. The SAFETY line explains when preview-only vs actual applying occurs: applying requires confirmed=True. It does not explicitly name alternative tools for other situations, but the prerequisite and gating conditions are clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ako_ingress_checkA
Read-onlyIdempotent

[READ] Validate every Ingress in one namespace: IngressClass and TLS secret references that would stop AKO creating a Virtual Service.

Returns name, IngressClass, issues and OK/ISSUES per Ingress. Run ako_ingress_map first for namespace names; use ako_ingress_diagnose instead for one named Ingress. Covers one namespace only, and TLS checks are skipped when its secrets cannot be listed.

ParametersJSON Schema
NameRequiredDescriptionDefault
contextNoK8s context name (optional).
namespaceYesK8s namespace to check.

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already convey readOnly, idempotent, and non-destructive behavior, so the description does not need to repeat those. It adds genuinely useful behavioral detail beyond annotations: TLS checks are skipped when secrets cannot be listed, and results are per-Ingress with OK/ISSUES status.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: purpose first, then return content, then usage routing, then scope and edge-case behavior. Every sentence adds value, with no filler or repetition of schema content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only diagnostic tool with an output schema, the description covers all essential information: what is validated, what is returned, which sibling tool to use for single-Ingress analysis, prerequisite tooling, namespace scope, and a known edge case.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with both namespace and context already documented. The description adds no parameter-level detail beyond the schema, which is acceptable because the schema carries the full burden.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Validate') and precisely defines the resource and scope: every Ingress in one namespace, checking IngressClass and TLS secret references that would block AKO from creating a Virtual Service. It also distinguishes itself from the sibling tool ako_ingress_diagnose by clarifying it handles all Ingresses rather than one.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit routing guidance: run ako_ingress_map first for namespace names and use ako_ingress_diagnose instead for a single named Ingress. It also sets clear scope expectations ('Covers one namespace only') and notes the TLS-check limitation when secrets cannot be listed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ako_ingress_diagnoseA
Read-onlyIdempotent

[READ] Diagnose why one Ingress has no corresponding AVI Virtual Service.

Validates IngressClass ('avi'/'avi-lb'), TLS secrets and backend Services. Returns annotations, a numbered issue list and kubectl fixes. Use ako_ingress_map first to find Ingresses lacking a VS. Checks configuration only; when it is clean, try ako_logs and ako_sync_status.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesExact Ingress resource name.
contextNokubeconfig context (optional), from ako_clusters.
namespaceNoNamespace holding the Ingress (default 'default').default

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish read-only/idempotent/non-destructive, and the description reinforces with 'Checks configuration only'. It additionally discloses validation targets and output shape, with no hidden side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three compact sentences front-load the core diagnostic purpose, then add validation scope, output, and routing to siblings. No filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Between annotations, 100% schema coverage, and output schema, the description fills the remaining gaps: diagnostic scope, output content, and next-step tools. An agent can invoke it correctly without further inference.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers all three parameters with descriptions, so description need not repeat them. It only broadly references validated resources and doesn't add parameter-specific semantics beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific diagnostic action on a single Ingress resource ('no corresponding AVI Virtual Service') and lists what it validates. The [READ] prefix and focus on causes/issues distinguish it from map/logs siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly sequences the tool: run ako_ingress_map first to identify affected Ingresses, and fall back to ako_logs/ako_sync_status when config is clean. This provides a clear decision path and alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ako_ingress_mapA
Read-onlyIdempotent

[READ] Inventory Kubernetes Ingresses across all namespaces.

Returns Namespace, Ingress name, Host(s) and IngressClass per Ingress. Start here for namespace and Ingress names, then pass them to ako_ingress_check or ako_ingress_diagnose. Lists the K8s side only — use ako_sync_diff for Ingresses with no Controller object.

ParametersJSON Schema
NameRequiredDescriptionDefault
contextNoK8s context name (optional).

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and non-destructive behavior, so the '[READ]' marker adds little. However, the description adds meaningful context beyond annotations: it returns only the K8s-side perspective, not controller-side state, and explicitly scopes the inventory to all namespaces. This helps the agent understand what the operation does and does not cover.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded with '[READ]' and the primary purpose. Every sentence earns its place: one states scope and output, one gives the follow-up workflow, and one clarifies the boundary against a sibling tool. There is no extraneous text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the low complexity, single optional parameter, existing output schema, and rich annotations, the description provides everything an agent needs to select and invoke this tool correctly. It states the target resource, the returned fields, the follow-up tools, and the exclusion for missing Controller objects.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already documents the single parameter 'context' as 'K8s context name (optional)' with 100% coverage. The description adds no additional parameter detail, so the baseline of 3 applies; it neither clarifies nor obscures the parameter semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ('Inventory'), a clear resource ('Kubernetes Ingresses'), and a scope ('across all namespaces'). It also differentiates itself from siblings by stating this returns Namespace, Ingress name, Host(s), and IngressClass, and by referring to ako_ingress_check, ako_ingress_diagnose, and ako_sync_diff as alternatives for different steps.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says to start here for namespace and Ingress names, then pass them to ako_ingress_check or ako_ingress_diagnose. It also states the boundary: 'Lists the K8s side only' and directs the agent to use ako_sync_diff for Ingresses with no Controller object, making when-to-use and when-not-to-use clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ako_logsA
Read-onlyIdempotent

[READ] AKO pod logs — Ingress creation failures, sync errors, Controller connectivity.

Returns raw log text, not a table. Use when ako_status shows the pod unhealthy or ako_sync_diff reports a missing Ingress. Only the running container's logs are returned.

ParametersJSON Schema
NameRequiredDescriptionDefault
tailNoNumber of log lines (default 100).
sinceNoNarrows the window, e.g. '30m', '1h'.
contextNoK8s context (optional, uses current).

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint false, so the safety profile is covered. The description adds valuable behavioral context beyond annotations: 'Returns raw log text, not a table' and 'Only the running container's logs are returned,' which alerts the agent to output format and scope limitations. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three short, purposeful sentences. It front-loads the tool's purpose, states the return format, gives usage triggers, and notes a scope limitation. Every sentence earns its place with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only log retrieval tool, the description covers purpose, trigger conditions, return format, and container scope. Combined with rich annotations, a full parameter schema, and an output schema, nothing essential is missing for an agent to select and invoke this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the parameter meanings are already fully documented. The description does not add parameter-specific guidance (e.g., how tail/since/context interact), but because the schema covers all parameters with defaults and examples, baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with '[READ] AKO pod logs' and specifies concrete use cases: 'Ingress creation failures, sync errors, Controller connectivity.' It also distinguishes the tool from table-returning siblings by stating 'Returns raw log text, not a table,' so an agent can disambiguate from tools like vs_error_logs or ako_status.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit trigger conditions: 'Use when ako_status shows the pod unhealthy or ako_sync_diff reports a missing Ingress.' This names sibling tools as decision points and provides clear context. However, it does not state when not to use this tool or name alternatives beyond the implied conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ako_restartA
Destructive

[WRITE] Restart the AKO pod by deleting it — its StatefulSet recreates it.

Returns a one-line result. Use when AKO is stuck or after config changes; brief traffic disruption is possible. Run ako_status afterwards, and ako_logs if the pod is not Running.

SAFETY: requires confirmed=True; without it you get a preview only.

ParametersJSON Schema
NameRequiredDescriptionDefault
contextNoK8s context name (optional).
confirmedNofalse (the default) returns a preview and changes nothing; true deletes the AKO pod. The StatefulSet recreates it, so this is a restart rather than a removal, but ingress programming pauses until the new pod is Running and brief traffic disruption is possible.

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the destructiveHint annotation, the description discloses the deletion-and-recreation mechanism, preview behavior without confirmed=True, possibility of traffic disruption, and expected post-restart workflow. This is strong behavioral transparency that matches and enriches the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact, front-loaded with the core action, and organized into clear sections: action, result, use cases, follow-up, and safety. Every sentence adds value with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive restart tool with annotations and schema coverage, the description supplies all needed context: how the restart works, what changes require confirmation, what side effects occur, and what to do next. No critical operational detail is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds meaningful semantics for the confirmed parameter: false returns a preview and changes nothing, while true deletes the pod and triggers recreation. This goes beyond the schema description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action: restarting the AKO pod by deleting it, with the StatefulSet recreating it. This verb-object-resource structure is specific and distinguishes it from sibling AKO tools like ako_status and ako_logs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit use cases ('Use when AKO is stuck or after config changes') and prescribes follow-ups (run ako_status, then ako_logs if not Running). It does not provide explicit when-not-to-use guidance or alternatives, so it stops just short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ako_statusA
Read-onlyIdempotent

[READ] Check AKO (AVI Kubernetes Operator) pod status in Kubernetes.

Returns pod name, phase, ready flag, restart count and namespace. First step for Ingress or LoadBalancer issues in Tanzu/K8s; follow with ako_logs when it is not Running. Looks in one context's AKO namespace only — run ako_clusters if not found.

ParametersJSON Schema
NameRequiredDescriptionDefault
contextNoK8s context name (optional, uses current context).

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already cover read-only, idempotent, and non-destructive behavior, so the description doesn't need to restate those. It adds useful behavioral context beyond annotations: the tool checks only one context's AKO namespace, returns specific status fields, and is designed as the first diagnostic step. This gives the agent a clearer picture of operational behavior without over-explaining.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact yet information-dense: every sentence earns its place. It front-loads the core purpose and read-only marker, then delivers output details, usage context, and fallback guidance without repetition or filler. The structure moves from 'what' to 'when' to 'what's next', which is easy for an agent to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with one optional parameter and a single narrow purpose, the description is fully sufficient. It covers the expected inputs, outputs, scope limitation, and next-step tools, and an output schema is already available for return-value details. Nothing an agent needs to select and invoke this tool correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% since the single optional 'context' parameter is already documented as 'K8s context name (optional, uses current context)'. The description adds some relevant scope nuance by saying the tool 'Looks in one context's AKO namespace only', but it does not materially expand on the parameter's format or default behavior. A baseline of 3 is appropriate here as the schema already carries the parameter meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear action: 'Check AKO pod status in Kubernetes', and it names the concrete resource (AKO pod) and what is returned (pod name, phase, ready flag, restart count, namespace). It also distinguishes itself from related AKO tools by positioning itself as the 'First step for Ingress or LoadBalancer issues' and pointing to ako_logs and ako_clusters as follow-ups. This is a specific, well-scoped purpose with no ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says when to use this tool ('First step for Ingress or LoadBalancer issues') and what to do afterward ('follow with ako_logs when it is not Running'). It also explains a boundary case: 'Looks in one context's AKO namespace only — run ako_clusters if not found.' This gives the agent clear routing to alternatives without leaving it to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ako_sync_diffA
Read-onlyIdempotent

[READ] List Ingresses with no matching Virtual Service or pool on the Controller.

Returns Type, namespace/name and Status per suspect Ingress. Use when ako_sync_status reports a mismatch; ako_sync_force reconciles. Shard-mode Ingresses are matched heuristically against AKO pool names, so confirm a 'Missing' result with pool_list before acting.

ParametersJSON Schema
NameRequiredDescriptionDefault
contextNoK8s context name (optional).

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only, idempotent, non-destructive behavior. The description adds valuable behavioral context: the heuristic shard-mode matching, the need to confirm 'Missing' results, and the output shape (Type, namespace/name, Status). No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences: purpose first, return value second, usage and caveat third. No filler or repeated schema information. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with one optional parameter, strong annotations, an output schema, and explicit sibling context, this description fully equips an agent to select and invoke it correctly, including a critical heuristic-matching caveat.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% for the single optional context parameter, so the baseline of 3 applies. The description does not elaborate on the parameter, but it does not need to because the schema already provides a clear description and default.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'List Ingresses with no matching Virtual Service or pool on the Controller.' This clearly distinguishes it from the sibling tools ako_sync_status and ako_sync_force by focusing on diff detection.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says when to use it ('Use when ako_sync_status reports a mismatch'), names the reconciliatory alternative (ako_sync_force), and directs confirmation of shard-mode results via pool_list. This gives an agent unambiguous routing criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ako_sync_forceA
Destructive

[WRITE] Force AKO to resync all K8s resources with the AVI Controller.

Returns a one-line result. Use when drift is detected; may cause brief traffic disruption. Run ako_sync_diff first to see what is out of sync, then ako_sync_status.

SAFETY: requires confirmed=True; without it you get a preview only.

ParametersJSON Schema
NameRequiredDescriptionDefault
contextNoK8s context name (optional).
confirmedNofalse (the default) returns a preview and changes nothing; true forces the resync, which restarts the AKO pod so it rebuilds every Virtual Service, pool and VS-VIP from the cluster's current resources — brief traffic disruption is possible.

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark this destructive and non-read-only, but the description adds concrete consequences: brief traffic disruption, a preview-only mode unless confirmed=true, and a one-line result. It does not contradict annotations and adds safety-relevant behavior beyond the flags.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: core action first, then result type, usage trigger, safety warning, and required confirmation. Every sentence contributes either use-case guidance or a behavioral warning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive resync tool with annotations, a rich confirmed parameter description, and an output schema, this definition gives all essential context: what it does, when to use it, what to run first, and the safety gate. No necessary operational detail is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the confirmed parameter already explains the default preview behavior and the restart/rebuild consequence. The tool description reinforces the confirmed requirement but adds no new meaning beyond the schema's parameter descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with '[WRITE] Force AKO to resync all K8s resources with the AVI Controller', naming a specific verb, resource, and effect. It also positions the tool against siblings by referencing ako_sync_diff and ako_sync_status, so an agent can tell it apart.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says to use when drift is detected, warns of brief traffic disruption, and instructs running ako_sync_diff first to inspect out-of-sync state. It also states the safety gate: confirmed=true is required, and without it only a preview is returned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ako_sync_statusA
Read-onlyIdempotent

[READ] Compare the number of K8s Ingresses with the number of AVI Virtual Services.

Returns both counts and a match/mismatch verdict. Use this first as a cheap check, then ako_sync_diff for which objects differ. A count comparison only — in AKO shard mode many Ingresses share one VS, so a mismatch does not by itself mean trouble.

ParametersJSON Schema
NameRequiredDescriptionDefault
contextNoK8s context name (optional).

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, but the description adds meaningful behavioral nuance: this is a cheap preliminary count comparison, not a full diff, and shard mode can produce false mismatches. It also states exactly what the tool returns, going beyond the structured safety hints without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences, each earning its place: the operation and resources, the returned verdict, and the critical usage caveat. It is front-loaded with the purpose and avoids any filler or redundant restatement of the tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with one optional parameter, rich annotations, an existing output schema, and clear sibling guidance, this description is complete. It tells the agent what the tool does, what it returns, when to use it as a first check, and what caveat to keep in mind—nothing needed for correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is only one optional context parameter, and the input schema already describes it as 'K8s context name (optional)' with 100% coverage. The description adds no further parameter detail, but none is needed since the schema fully documents the parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ('Compare') and two concrete resources (K8s Ingresses and AVI Virtual Services), and states the output (counts plus a match/mismatch verdict). It also distinguishes itself from the sibling ako_sync_diff by noting the latter identifies which objects differ, so an agent can tell them apart.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit usage direction: 'Use this first as a cheap check, then ako_sync_diff for which objects differ.' It also sets expectations by explaining the comparison is count-only and that a mismatch is not necessarily a problem in AKO shard mode, which prevents the agent from over-trusting the result.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ako_versionA
Read-onlyIdempotent

[READ] AKO version running in a cluster, read from the pod's image tag.

Returns the pod name and an Image/Version pair per container. Use it to check compatibility with the Controller, and before ako_config_diff or ako_config_upgrade so both target the installed chart. The tag is the only source, so 'latest' reports 'latest', not a number.

ParametersJSON Schema
NameRequiredDescriptionDefault
contextNoK8s context name (optional).

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark this as read-only, idempotent, and non-destructive, so the description adds meaningful context beyond them: the version source is the pod's image tag, and the edge case that 'latest' is reported literally rather than resolved to a numeric version. This gives the agent an accurate mental model of the tool's behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is tight and front-loaded: the action and source appear in the first line, followed by output shape, use cases, and a critical caveat. Every sentence earns its place and there is no redundant elaboration.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having an output schema, the description covers the essential non-schema context: what the version is derived from, the returned fields, the use-before-config workflows, and the 'latest' ambiguity. For a simple read-only tool with one optional parameter, nothing needed for correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The sole parameter, context, is fully documented in the schema as the optional K8s context name (100% coverage). With coverage that high, the description does not need to add parameter detail, and it does not meaningfully enrich the parameter's semantics beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description leads with a specific verb and resource: '[READ] AKO version running in a cluster, read from the pod's image tag.' It clearly defines the output (pod name and Image/Version pair per container) and distinguishes the tool from siblings by framing it as a foundational compatibility check referenced by ako_config_diff and ako_config_upgrade.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use: to check Controller compatibility and before running ako_config_diff or ako_config_upgrade so both target the installed chart. It gives concrete usage triggers but does not explicitly mention when not to use this tool or name a direct alternative for version queries.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pool_listA
Read-onlyIdempotent

[READ] Discover pools on the Controller.

Returns Name, member count, Enabled and short UUID per pool. Use this before pool_members: pools are often named differently from the VS that use them.

ParametersJSON Schema
NameRequiredDescriptionDefault
vs_filterNoSubstring matching VS names (e.g. 'web') — returns only the pools those VS reference. Omit for all pools.

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the read-only nature is covered. The description adds a domain caveat about pool naming that helps interpret results, plus '[READ]' reinforces the safety profile. No contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with purpose, then return fields and usage. Every sentence adds information and there is no redundancy with the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only list tool with one optional parameter, a full output schema, and rich annotations, the description covers purpose, expected results, and sequencing relative to pool_members. Nothing else is needed for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%; vs_filter is fully described with substring matching semantics and default behavior. The description adds no parameter-level details beyond that, so the schema carries the burden.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific action ('Discover pools') and a resource ('Controller'), then enumerates the exact fields returned (Name, member count, Enabled, short UUID). The contrast with sibling pool_members makes distinguishing easy.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly directs the agent to call this before pool_members and gives the reason (pool names often differ from VS names). This is a clear when and names the alternative, so no inference is needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pool_member_disableA
Destructive

[WRITE] Disable a pool member with graceful drain — existing connections complete, no new traffic.

Returns a one-line result. Use for maintenance or rolling deployments; run pool_members first for the server IP, pool_member_enable to reverse it.

SAFETY: requires confirmed=True; without it you get a preview only.

ParametersJSON Schema
NameRequiredDescriptionDefault
poolYesExact pool name as shown by pool_list — matched literally, not fuzzily, and an unknown name is refused rather than ignored. Pools are often named differently from the Virtual Services that use them, so do not infer it from a VS name.
serverYesServer IP address.
confirmedNofalse (the default) returns a preview naming the member and pool, and changes nothing; true disables the member, draining it so existing connections finish while new traffic stops. Reverse it with pool_member_enable.

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (destructiveHint=true, readOnlyHint=false), the description discloses the graceful drain behavior, the one-line return result, and the safe preview mode when confirmed is not true. It clearly explains the destructive action and its confirmation requirement without contradicting annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: purpose and effect first, then usage guidance, then safety. Every sentence adds distinct value, with no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the action's purpose, usage context, prerequisites, reversal command, return style, and safety confirmation. With an output schema and complete parameter schema present, no essential information is missing for the agent to call this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and each parameter already has detailed semantics, including confirmed's preview vs. actual disable behavior. The description adds little parameter-level detail beyond reinforcing the confirmed=True safety requirement, which is already present in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Disable a pool member with graceful drain' and immediately explains the behavioral effect: existing connections complete, no new traffic. It clearly distinguishes from the sibling pool_member_enable by noting it reverses the action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit usage context: 'Use for maintenance or rolling deployments' and instructs the agent to 'run pool_members first for the server IP' and use 'pool_member_enable to reverse it.' This tells the agent both when to use the tool and what to do before/after.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pool_member_enableA

[WRITE] Enable a pool member so it receives traffic again.

Returns a one-line confirmation. Use pool_members first to verify the server IP. The server must already belong to the pool — this adds nothing.

ParametersJSON Schema
NameRequiredDescriptionDefault
poolYesExact pool name as shown by pool_list — matched literally, not fuzzily, and an unknown name is refused rather than ignored. Pools are often named differently from the Virtual Services that use them, so do not infer it from a VS name.
serverYesServer IP address.

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses the return format ('one-line confirmation'), marks the operation as [WRITE], and clarifies that no membership addition occurs. These details go beyond what the annotations alone convey. It does not contradict the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences: the action and outcome are first, followed by return format and a necessary precondition. There is no redundant wording or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple, both parameters are required and fully described in the schema, an output schema exists, and the description covers the key behavioral nuance. An agent has enough information to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already explains that pool must be an exact literal name and server is an IP address. The description adds the practical note to verify via pool_members, but does not substantially expand parameter meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'Enable a pool member so it receives traffic again.' This clearly differentiates it from pool_member_disable and states the intended effect. The [WRITE] prefix reinforces the action type.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly instructs to 'Use pool_members first to verify the server IP' and states that 'The server must already belong to the pool — this adds nothing.' This gives useful context and a precondition, though it does not explicitly mention the sibling pool_member_disable as the inverse alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pool_membersA
Read-onlyIdempotent

[READ] List the members of a pool.

Returns Server IP, Port, Enabled and Ratio per member. Use before pool_member_enable or pool_member_disable; run pool_list first for the pool name. Reports configured state only, not live health-monitor results.

ParametersJSON Schema
NameRequiredDescriptionDefault
poolYesExact pool name as shown by pool_list — matched literally, not fuzzily, and an unknown name is refused rather than ignored. Pools are often named differently from the Virtual Services that use them, so do not infer it from a VS name.

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint and destructiveHint annotations, the description adds a valuable behavioral caveat: it reflects configured state, not live health-monitor results. It also discloses exactly which output fields are returned. No contradiction with the annotations exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: the action and result fields come first, followed by workflow context and a caveat. Every sentence earns its place, with no filler or repeated schema information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only, single-parameter listing tool with an output schema, the description fully covers what it returns, prerequisites, sibling-tool relationships, and an important limitation. Nothing an agent needs to decide when or how to call it is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the pool parameter is already richly documented in the schema with exact-match semantics, literal matching, and a warning not to infer the pool name from a Virtual Service name. The description only reinforces this by saying to run pool_list first, so it adds little beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description starts with a clear action and object: 'List the members of a pool.' It also names the specific returned fields (Server IP, Port, Enabled, Ratio), and the '[READ]' prefix reinforces its read-only nature. The tool is distinguished from siblings by explicitly positioning it relative to pool_member_enable/pool_member_disable and pool_list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit workflow guidance: 'Use before pool_member_enable or pool_member_disable' and 'run pool_list first for the pool name.' It also states an exclusion — 'Reports configured state only, not live health-monitor results' — so an agent knows when not to rely on this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

se_healthA
Read-onlyIdempotent

[READ] Health of every Service Engine — operational status and VS counts.

Returns name, operational state and the number of VSes placed on each SE. Use when VS health degrades to check if the issue is at the SE level; se_list gives the management IP and SE Group, vs_status the affected VS. An SE hosting no VS reports 0, not an error.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish the read-only, idempotent, non-destructive profile, so the description's '[READ]' tag adds a little. More valuable is the explicit edge case that an SE with no VS reports 0 rather than an error, which is useful behavioral context beyond the structured annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured: purpose is front-loaded, followed by return fields, usage guidance, alternatives, and a critical edge case. Every sentence contributes information an agent needs.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no parameters, an output schema present, and comprehensive annotations, the description covers the remaining practical concerns: what fields are returned, when to use the tool, and the zero-VS reporting behavior. Nothing an agent needs to invoke or interpret the result is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the description does not need to explain any. Per the calibration, zero param count starts at baseline 4, and the description correctly avoids inventing parameter details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool reports the health of every Service Engine, including name, operational status, and VS counts. It also distinguishes itself from related tools like se_list and vs_status, so an agent can identify its role without ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says when to use this tool: when VS health degrades and the agent needs to determine whether the issue is at the SE level. It also names se_list and vs_status as alternatives and explains what each provides, making the routing decision clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

se_listA
Read-onlyIdempotent

[READ] List Service Engines (AVI data-plane VMs) on the Controller.

Returns Name, management IP, status (e.g. OPER_UP) and SE Group per SE, in one call that cannot be paged or filtered. Use to inventory capacity or find an SE's name and IP — use se_health instead for degraded VS health.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnly, idempotent, and non-destructive behavior. The description adds useful behavioral context by stating the call cannot be paged or filtered and enumerates what it returns, going beyond the annotation signal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact, front-loaded with the [READ] intent, and each sentence adds meaningful information. There is no fluff or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter read-only list operation with an output schema present, the description covers the purpose, usage, limitations, and alternative. Nothing essential is missing for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the baseline is 4. The description adds no parameter details because none are needed; it instead explains the output fields and constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource ('List Service Engines ... on the Controller') and states the returned fields. It also differentiates this tool from se_health by noting the health-focused sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit use cases ('inventory capacity or find an SE's name and IP') and explicitly directs the agent to se_health for degraded VS health. This provides clear when-to-use and when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssl_expiry_checkA
Read-onlyIdempotent

[READ] Check which SSL certificates expire within N days (default 30).

Returns name, expiry date and days remaining, soonest first. Use this instead of ssl_list when you only want certificates near expiry. Expired certs are included, with negative days remaining.

ParametersJSON Schema
NameRequiredDescriptionDefault
daysNoReport certs expiring within this many days (default 30).

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already carry the safety profile (readOnlyHint=true, idempotentHint=true, destructiveHint=false), and the description adds genuine result behavior on top: soonest-first ordering and the edge case that 'Expired certs are included, with negative days remaining.' This goes beyond what the annotations disclose, though it stops short of covering pagination or rate limits, which are likely non-issues for a filtered read tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each earning its place: purpose, return contract, and sibling routing. The '[READ]' prefix and 'soonest first' flag are efficient front-loaded signals with zero filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-optional-parameter read tool with an output schema and safety annotations, the description covers the return fields, ordering, default behavior, edge case (expired certs), and the alternative tool. Nothing an agent needs to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%: the schema already documents 'days' with a description and default of 30. The tool description repeats the default ('within N days (default 30)') but adds no meaning beyond the schema, so the baseline of 3 is correct.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ('Check') and resource ('SSL certificates expire within N days'), and immediately distinguishes itself from siblings: 'Use this instead of ssl_list when you only want certificates near expiry.' An agent can tell this apart from the 28 sibling tools without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly names the alternative (ssl_list) and gives the selection condition ('when you only want certificates near expiry'), which implies the inverse condition for the sibling. This is exactly the explicit when/alternative guidance the rubric rewards.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssl_listA
Read-onlyIdempotent

[READ] List SSL/TLS certificates stored on the AVI Controller.

Returns Name, Subject, Expiry and Type per certificate, in one call that cannot be paged or filtered. Use for inventory or a certificate's exact name — use ssl_expiry_check instead for only the ones expiring soon.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, covering the safety profile. The description adds meaningful behavioral context beyond annotations: the call "cannot be paged or filtered" and returns specific fields. The [READ] prefix reinforces the non-mutating nature.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three tight sentences with no filler. The main purpose is front-loaded, followed by the return fields, the key limitation, and the sibling alternative. Every sentence adds distinct value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter read-only list tool with an output schema, the description is complete: it names the resource, states the returned fields, notes the pagination/filtering limitation, and directs the agent to the appropriate alternative. Nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so there are no parameter semantics for the description to clarify. The description adds that the call is unfilterable, which implicitly confirms that no filtering parameters exist. The baseline for zero-parameter tools is 4, and no deductions are warranted.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: "List SSL/TLS certificates stored on the AVI Controller." It clearly distinguishes the tool from the sibling ssl_expiry_check by stating that this one is for inventory or exact name lookup while the sibling is for certificates expiring soon.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says when to use this tool: "Use for inventory or a certificate's exact name — use ssl_expiry_check instead for only the ones expiring soon." This provides both a positive use case and an explicit alternative, leaving no ambiguity about selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vs_analyticsA
Read-onlyIdempotent

[READ] Performance metrics for one Virtual Service over the last hour.

Returns L4 (bandwidth, connections) and L7 (latency, % errors, responses) averages over a fixed window that cannot be changed (12 samples, 5 min apart). Empty output means no traffic, not an error. Use when vs_status shows degraded health; vs_error_logs gives per-request detail.

ParametersJSON Schema
NameRequiredDescriptionDefault
vs_nameYesExact Virtual Service name, case-sensitive, from vs_list.

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, openWorld, and idempotent behavior, and the description adds valuable context beyond them: the fixed 12-sample/5-minute window that cannot be changed, and the non-obvious empty-output semantics meaning no traffic rather than an error. This fully informs the agent of behavioral edge cases.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four short sentences each earn their place: the purpose, the metric/window detail, the empty-output signal, and the usage guidance. It is front-loaded and has no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read-only tool with a full output schema, the description is complete. It covers what the tool returns, the fixed time window, empty result behavior, and when to choose this tool versus its sibling.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already fully documents vs_name as an exact, case-sensitive Virtual Service name from vs_list. The description adds no meaning for the parameter beyond the schema, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific action and resource: returns performance metrics for one Virtual Service over the last hour. It differentiates itself from siblings by specifying L4 and L7 metric categories, making it clear this is the analytics tool rather than vs_status or vs_error_logs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly instructs when to use this tool: when vs_status shows degraded health. It also names the alternative for per-request detail (vs_error_logs), giving the agent clear routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vs_error_logsA
Read-onlyIdempotent

[READ] Recent request error logs for one Virtual Service.

Returns up to 50 lines — timestamp, HTTP status, URI path, client IP — for status 400 and above. Use this instead of vs_analytics for per-request detail. An empty result may mean no errors, or capture disabled on the VS.

ParametersJSON Schema
NameRequiredDescriptionDefault
sinceNoWindow — seconds or '30m', '1h', '2d' (default '1h').1h
vs_nameYesExact Virtual Service name, from vs_list.

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and non-destructive, and the description adds complementary context: the 50-line limit, status >=400 filter, the exact returned fields, and the ambiguity of empty results (no errors vs capture disabled). No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four short sentences, each earning its place. The READ intent is front-loaded, followed by return details, sibling distinction, and an important caveat about empty results. Zero wasteful wording.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return fields are further specified there. The description covers the critical operational details: scope, result cap, status filter, alternative tool, and the empty-result ambiguity. Nothing an agent needs to correctly invoke or interpret the tool is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters are fully documented in the schema; the description adds no additional parameter semantics beyond the general purpose of the tool. Baseline 3 is appropriate because the schema carries the parameter documentation burden.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb, resource, and scope: 'Returns... error logs for one Virtual Service' with explicit detail on line limit, status threshold, and fields. It directly names the alternative vs_analytics, so an agent can distinguish without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'Use this instead of vs_analytics for per-request detail', naming the alternative and the condition that selects this tool. It also adds interpretation guidance for empty results, which helps decide whether to escalate or check configuration.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vs_listA
Read-onlyIdempotent

[READ] List Virtual Services on the AVI Controller.

Returns Name, Enabled, VIP and short UUID for every VS in one call; it cannot be paged or filtered, and carries no health score. Use this before drilling into one VS with vs_status.

ParametersJSON Schema
NameRequiredDescriptionDefault
controllerNoController name from config (optional, uses default).

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare the tool read-only, idempotent, and non-destructive, but the description adds operational behavior beyond that: it returns every VS in one call, cannot be paged or filtered, and intentionally omits health scores. This is exactly the contextual disclosure an agent needs to invoke it correctly.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Every sentence earns its place: a clear purpose, a compact summary of returned data and limitations, and an explicit next-step recommendation. The information is front-loaded and there is no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only list tool with one optional parameter, an output schema, and a clear sibling relationship, this description is complete. It covers return contents, the all-at-once nature, limitations, and the recommended follow-up tool, so an agent can choose and call it correctly without opening the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter, 'controller', is fully described in the input schema with its default and meaning. Schema description coverage is 100%, so the description does not need to repeat parameter details. The baseline 3 applies since no additional parameter-level nuance is provided.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'List Virtual Services on the AVI Controller.' It then enumerates the returned fields (Name, Enabled, VIP, short UUID), so an agent knows precisely what this tool does. It also distinguishes itself from vs_status via the final sentence.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly places this tool in a workflow: 'Use this before drilling into one VS with vs_status.' It also states the key limitations—no pagination, no filtering, no health score—so an agent knows when not to rely on it and can route to the more specific sibling.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vs_statusA
Read-onlyIdempotent

[READ] Detailed status for one Virtual Service: VIP, pool, health, connections, throughput.

Returns one detail block, not a list. Use vs_list first for the exact name — a name that does not match exactly fails. Then vs_analytics for metrics, vs_error_logs for 5xx.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesExact Virtual Service name.

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only, idempotent, and non-destructive behavior. The description adds useful behavioral specifics beyond annotations: exact-name matching is required, a mismatch fails, and the response is one detail block, not a list. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded with the [READ] marker and the key purpose. Every sentence contributes either core semantics, a failure condition, or routing to alternatives, with no filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read tool with a rich output schema and strong annotations, this description is complete. It covers prerequisite ordering, exact-match failure, the shape of the return (one block), and sibling tool routing, so an agent has everything needed to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the name parameter already has the description 'Exact Virtual Service name.' The tool description reinforces the exact-match requirement, but adds no new parameter format or syntax details beyond what the schema provides, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool's function: detailed status for one Virtual Service including VIP, pool, health, connections, and throughput. It differentiates from siblings by noting it returns a single detail block rather than a list, and specifies that vs_analytics and vs_error_logs serve complementary purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly tells the agent to call vs_list first to obtain an exact name, warns that a non-exact name fails, and directs metrics to vs_analytics and 5xx to vs_error_logs. This is clear when-to-use and when-not-to-use guidance beyond what annotations provide.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vs_toggleA
Destructive

[WRITE] Enable or disable a Virtual Service. Disabling stops all traffic to it.

Returns a one-line result. Use vs_status first to check current state.

SAFETY: disabling requires confirmed=True; without it you get a preview only. Enabling is always safe.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesExact Virtual Service name.
enableYestrue to enable, false to disable.
confirmedNoGates the disable only. With enable=false, the default false returns a preview naming the VS that would stop serving traffic and changes nothing; true performs the disable. Ignored when enable=true — enabling always executes.

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds safety-critical behavior beyond the destructiveHint annotation: disabling stops all traffic, an unconfirmed disable is preview-only and changes nothing, confirmed=True is required to actually disable, and enabling always executes. It also discloses the one-line result format.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: purpose, then result, then prerequisite, then safety. Every sentence contributes essential selection or invocation guidance without filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive, non-idempotent tool, the description covers purpose, effect, prerequisite check, result shape, and the critical confirmation gate. Combined with the fully-documented schema and output schema, an agent has enough to invoke it correctly and safely.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides 100% coverage for all three parameters, including the confirmed flag semantics. The description reinforces that confirmed gates only disable and is ignored for enable, but does not add substantial new meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states the specific action ('Enable or disable a Virtual Service') and the concrete effect ('Disabling stops all traffic to it'). This clearly distinguishes vs_toggle from read-only siblings like vs_status and vs_list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly directs the agent to use vs_status first to check current state, and it explains the preview-vs-execute behavior for disabling based on the confirmed flag. It does not explicitly enumerate when-not-to-use conditions, but the context is clear enough for correct selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 28 tool updatesv1.8.14
    • Addedako_amko_status
    • Changedako_clusters1 field changed
      • addedInput schema / additionalProperties
        false
    • Changedako_config_diff2 fields changed
      • addedInput schema / additionalProperties
        false
      • addedInput schema / properties / chart_version / description
        "Pin the chart, e.g. \"1.11.1\". Empty = registry latest."
    • Addedako_config_show
    • Addedako_config_upgrade
    • Addedako_ingress_check
    • Addedako_ingress_diagnose
    • Addedako_ingress_map
    • Changedako_logs4 fields changed
      • addedInput schema / additionalProperties
        false
      • addedInput schema / properties / context / description
        "K8s context (optional, uses current)."
      • addedInput schema / properties / since / description
        "Narrows the window, e.g. '30m', '1h'."
      • addedInput schema / properties / tail / description
        "Number of log lines (default 100)."
    • Addedako_restart
    • Addedako_status
    • Changedako_sync_diff2 fields changed
      • addedInput schema / additionalProperties
        false
      • addedInput schema / properties / context / description
        "K8s context name (optional)."
    • Changedako_sync_force3 fields changed
      • addedInput schema / additionalProperties
        false
      • addedInput schema / properties / confirmed / description
        "false (the default) returns a preview and changes nothing; true forces the resync, which restarts the AKO pod so it rebuilds every Virtual Service, pool and VS-VIP from the cluster's current resources — brief traffic disruption is possible."
      • addedInput schema / properties / context / description
        "K8s context name (optional)."
    • Addedako_sync_status
    • Addedako_version
    • Changedpool_list2 fields changed
      • addedInput schema / additionalProperties
        false
      • addedInput schema / properties / vs_filter / description
        "Substring matching VS names (e.g. 'web') — returns only the pools those VS reference. Omit for all pools."
    • Addedpool_member_disable
    • Changedpool_member_enable3 fields changed
      • addedInput schema / additionalProperties
        false
      • addedInput schema / properties / pool / description
        "Exact pool name as shown by pool_list — matched literally, not fuzzily, and an unknown name is refused rather than ignored. Pools are often named differently from the Virtual Services that use them, so do not infer it from a VS name."
      • addedInput schema / properties / server / description
        "Server IP address."
    • Changedpool_members2 fields changed
      • addedInput schema / additionalProperties
        false
      • addedInput schema / properties / pool / description
        "Exact pool name as shown by pool_list — matched literally, not fuzzily, and an unknown name is refused rather than ignored. Pools are often named differently from the Virtual Services that use them, so do not infer it from a VS name."
    • Addedse_health
    • Changedse_list1 field changed
      • addedInput schema / additionalProperties
        false
    • Changedssl_expiry_check2 fields changed
      • addedInput schema / additionalProperties
        false
      • addedInput schema / properties / days / description
        "Report certs expiring within this many days (default 30)."
    • Addedssl_list
    • Addedvs_analytics
    • Changedvs_error_logs3 fields changed
      • addedInput schema / additionalProperties
        false
      • addedInput schema / properties / since / description
        "Window — seconds or '30m', '1h', '2d' (default '1h')."
      • addedInput schema / properties / vs_name / description
        "Exact Virtual Service name, from vs_list."
    • Changedvs_list2 fields changed
      • addedInput schema / additionalProperties
        false
      • addedInput schema / properties / controller / description
        "Controller name from config (optional, uses default)."
    • Addedvs_status
    • Changedvs_toggle4 fields changed
      • addedInput schema / additionalProperties
        false
      • addedInput schema / properties / confirmed / description
        "Gates the disable only. With enable=false, the default false returns a preview naming the VS that would stop serving traffic and changes nothing; true performs the disable. Ignored when enable=true — enabling always executes."
      • addedInput schema / properties / enable / description
        "true to enable, false to disable."
      • addedInput schema / properties / name / description
        "Exact Virtual Service name."
  2. 10 tool updatesv1.8.8
    • Addedako_clusters
    • Addedako_config_diff
    • Removedako_ingress_check
    • Addedako_sync_force
    • Removedako_sync_status
    • Addedpool_list
    • Removedpool_member_disable
    • Addedpool_members
    • Addedse_list
    • Addedssl_expiry_check
  3. 19 tool updatesv1.8.8
    • Removedako_amko_status
    • Removedako_clusters
    • Removedako_config_diff
    • Removedako_config_show
    • Removedako_config_upgrade
    • Removedako_ingress_diagnose
    • Removedako_ingress_map
    • Removedako_restart
    • Removedako_status
    • Removedako_sync_force
    • Removedako_version
    • Removedpool_list
    • Removedpool_members
    • Removedse_health
    • Removedse_list
    • Removedssl_expiry_check
    • Removedssl_list
    • Removedvs_analytics
    • Removedvs_status
  4. 4 tool updatesv1.5.38
    • Removedako_cluster_overview
    • Changedako_config_upgrade1 field changed
      • addedInput schema / properties / confirmed
        {
          "default": false,
          "title": "Confirmed",
          "type": "boolean"
        }
    • Removedako_ingress_fix_suggest
    • Changedako_logs1 field changed
      • addedInput schema / properties / context
        {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Context"
        }
  5. 30 tool updatesv1.5.29
    • Addedako_amko_status
    • Addedako_cluster_overview
    • Addedako_clusters
    • Addedako_config_diff
    • Addedako_config_show
    • Addedako_config_upgrade
    • Addedako_ingress_check
    • Addedako_ingress_diagnose
    • Addedako_ingress_fix_suggest
    • Addedako_ingress_map
    • Addedako_logs
    • Addedako_restart
    • Addedako_status
    • Addedako_sync_diff
    • Addedako_sync_force
    • Addedako_sync_status
    • Addedako_version
    • Addedpool_list
    • Addedpool_member_disable
    • Addedpool_member_enable
    • Addedpool_members
    • Addedse_health
    • Addedse_list
    • Addedssl_expiry_check
    • Addedssl_list
    • Addedvs_analytics
    • Addedvs_error_logs
    • Addedvs_list
    • Addedvs_status
    • Addedvs_toggle
  6. 30 tool updatesv1.5.28
    • Removedako_amko_status
    • Removedako_cluster_overview
    • Removedako_clusters
    • Removedako_config_diff
    • Removedako_config_show
    • Removedako_config_upgrade
    • Removedako_ingress_check
    • Removedako_ingress_diagnose
    • Removedako_ingress_fix_suggest
    • Removedako_ingress_map
    • Removedako_logs
    • Removedako_restart
    • Removedako_status
    • Removedako_sync_diff
    • Removedako_sync_force
    • Removedako_sync_status
    • Removedako_version
    • Removedpool_list
    • Removedpool_member_disable
    • Removedpool_member_enable
    • Removedpool_members
    • Removedse_health
    • Removedse_list
    • Removedssl_expiry_check
    • Removedssl_list
    • Removedvs_analytics
    • Removedvs_error_logs
    • Removedvs_list
    • Removedvs_status
    • Removedvs_toggle
  7. 30 tool updatesv1.5.22
    • First observedako_amko_status
    • First observedako_cluster_overview
    • First observedako_clusters
    • First observedako_config_diff
    • First observedako_config_show
    • First observedako_config_upgrade
    • First observedako_ingress_check
    • First observedako_ingress_diagnose
    • First observedako_ingress_fix_suggest
    • First observedako_ingress_map
    • First observedako_logs
    • First observedako_restart
    • First observedako_status
    • First observedako_sync_diff
    • First observedako_sync_force
    • First observedako_sync_status
    • First observedako_version
    • First observedpool_list
    • First observedpool_member_disable
    • First observedpool_member_enable
    • First observedpool_members
    • First observedse_health
    • First observedse_list
    • First observedssl_expiry_check
    • First observedssl_list
    • First observedvs_analytics
    • First observedvs_error_logs
    • First observedvs_list
    • First observedvs_status
    • First observedvs_toggle

TDQS

A4.4/5.0
Disambiguation5/5

Each tool targets a distinct resource or operation. VS tools deal with virtual services, pool tools with pools, SSL tools with certificates, SE tools with service engines, AKO tools with Kubernetes integration, and vs_error_logs with logs. No two tools overlap in purpose.

Naming Consistency4/5

Tool names use snake_case and follow a resource-prefix pattern (vs_, pool_, ssl_, ako_, se_). However, word order varies: some are resource_action (vs_list), others resource_noun (pool_members), or prefix_action_noun (ako_sync_diff). Minor inconsistency but still readable.

Tool Count5/5

With 13 tools, the set is well-scoped for a domain-specific server. Each tool serves a clear purpose without redundancy, and the count is within the typical 3-15 range.

Completeness3/5

The server covers common read operations and some writes (toggle, enable, force sync), but lacks counterpart writes like pool_member_disable, VS creation/update/delete, and pool management operations. There is also no tool to apply pending Helm configs despite a diff tool. These gaps may cause agent failures in workflows requiring full lifecycle management.

Maintenance

ActivityActive
ResponsivenessResponsive

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    A
    maintenance
    Provides MCP multi-cluster Kubernetes management and operations, featuring a management interface, logging, and nearly 50 built-in tools covering common DevOps and development scenarios. Supports both standard and CRD resources.
    878
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables secure management of VMware vCenter 8.0+ environments through controlled operations including VM lifecycle management, snapshots, and resource discovery with built-in RBAC authorization, audit logging, and rate limiting.
    5
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/vmware-skills/VMware-AVI'

If you have feedback or need assistance with the MCP directory API, please join our Discord server