"Observability" matching MCP tools:

• observability-cost-calculatorA

  Model Ruler — AI Cost CalculatorsA

  Use when a user needs to budget LLM observability tooling. Returns monthly cost at given request volume with retention adjustment.

  ConnectorNo auth

• run_sqlA

  FixterA

  Execute a read-only QuerySQL SELECT against the observability data. QuerySQL is Fixter's own SQL dialect over your telemetry: standard clauses and backtick-quoted identifiers, with its own function set (listed under Functions below). Clauses and operators: WHERE, GROUP BY, HAVING, ORDER BY, LIMIT, DISTINCT, CASE WHEN, LIKE, ILIKE, BETWEEN, IN, !=, <>, IS NULL, IS NOT NULL, NOT, OR, AND, subqueries, derived tables, JOINs, aliases, COALESCE, IF. Also =~ 'pattern' (case-insensitive match, * wildcard); = / != with a *-wildcard string value behave as ILIKE / NOT ILIKE. Free-text search: matches('text') in WHERE searches the message, all attributes, and service case-insensitively (substring match; trace/span ids by exact match), e.g. SELECT * FROM logs WHERE matches('connection refused'). Searching for an error message or log tag? Call list_issues with that text as its query first: Fixter groups recurring errors into issues with their count, first and last seen and a traceId, which often answers the search or narrows it. A SELECT alias can be used in WHERE and JOIN ON (SELECT lower(service) AS svc ... WHERE svc = 'a'). A name that is a column, or that the SELECT list itself reads as a field (upper(region) AS region), stays that field. An alias of an aggregate cannot be filtered in WHERE: use HAVING. To read an attribute that shares an alias's name, qualify it with the source: logs.n. Call describe_schema first to discover available fields and dynamic attributes for your data. Sources: logs, spans, metrics. Dynamic attributes are queryable directly by name, dots included: http.request.method. Resource attributes need the resource. prefix: resource.service.name (logs and spans only; metrics does not expose resource attributes). Missing attributes read as NULL. Common fields per source: logs: timestamp, service, level, message, trace_id, span_id, parent_span_id, source_instance_id, log_id, bytes spans: timestamp, service, name, kind, status_code, status_message, trace_id, span_id, parent_span_id, source_instance_id, duration_ms, bytes metrics: metric_name, service, source_instance_id, timestamp, value, bytes bytes is the row's stored size in bytes, non-zero on every row: measure or rank data volume with SUM(bytes). raw (and payload on spans) returns the whole stored row and can only be selected, not filtered, grouped, sorted or aggregated. Functions: Aggregates: count(*), count(DISTINCT field), countIf(condition), countIf(DISTINCT field, condition), sum, avg, min, max, p50, p95, p99, quantile(field, 0.9), error_rate() (percentage, 0-100), request_count(), error_burn_rate(budget), latency_burn_rate(field, threshold, budget). Time: bucket(timestamp, '1h') per minute, hour or day; CAST(timestamp AS DATE) for the date; now(), now() - INTERVAL 1 DAY; epoch_second(timestamp). Text: substring(field, start, length), length, lower, upper, trim, concat, replace, CAST(x AS STRING), truncate_chars(field, n, '...'), contains(field, 'text') (case-insensitive substring match), regexp_extract(field, 'pattern' [, group]), regexp_replace, regexp_matches. Other: coalesce, if, nullif, greatest, least, abs, round, ceil, floor, lag(field) OVER (PARTITION BY ... ORDER BY ...). bucket(timestamp, '5m') groups by time. Intervals: <number><unit> with unit m, h, or d (e.g. 1m, 5m, 30m, 1h, 6h, 1d). For a query that selects a single aliased bucket, groups by it alone, orders by it, and has no LIMIT, empty buckets are zero-filled in the response (numeric columns 0, others null): interior gaps always, and out to the statement's literal timestamp bounds when it has them (to now when it has only a lower bound), so a series that stopped ends in zeros rather than on its last non-zero bucket. Other query shapes still return only non-empty buckets. DISTINCT is a modifier on the counting aggregates: count(DISTINCT field) counts distinct values, countIf(DISTINCT field, condition) counts the distinct values of the rows matching the condition. DISTINCT inside any other aggregate (sum, avg, p95, ...) is rejected with an error rather than ignored. regexp_extract returns the first regex match (or capture group if specified). Returns null on no match. Example: regexp_extract(message, 'status=(\d+)', 1). Burn-rate rules (declared SLO): error_burn_rate(budget) is the error share divided by your budget (0.001 = 99.9% SLO); latency_burn_rate(duration_ms, 500, 0.03) is the share of requests over 500ms divided by a 3% budget. Alert when the result exceeds a burn multiple (e.g. GT 6 over a 60-minute window). Metrics aggregation: a metric row carries one reading in its value column, so aggregate it with the ordinary functions — avg(value) for a gauge, sum(value) only where each row is already a delta. There is no rate() or value() function: a cumulative counter's rate cannot be written as one aggregate, because an aggregate cannot wrap the window function the per-point delta needs. Spell it as a subquery instead: SELECT sum(delta) / 300 AS value FROM (SELECT value - lag(value) OVER (PARTITION BY service, source_instance_id, metric_name ORDER BY timestamp) AS delta FROM metrics WHERE metric_name = 'http.server.request.count') AS deltas WHERE delta >= 0 Replace 300 with your own window in seconds and the metric name with yours. The derived table has to be aliased (AS deltas) or the outer select has no source to resolve delta against. delta >= 0 drops counter restarts. The shape is correct only where the metric carries one series per service, source_instance_id and metric_name: when attributes split it into several series, lag() steps between interleaved series and the summed rate is silently wrong. That case needs the attribute set in the PARTITION BY, which run_sql cannot express today, so pin the query to a single series in its WHERE, or use a metric alert rule, which partitions per series. This reads the metrics table directly, which does not expose temporality, so it assumes the metric is cumulative; for a delta-temporality metric sum(value) over the window is already the answer. list_metrics reports which is which. Limitations: - Read-only SELECT only (no INSERT/UPDATE/DELETE/UNION). - No CROSS JOIN (use explicit JOIN ... ON). - No SYMMETRIC BETWEEN (order the bounds and use plain BETWEEN). - JOINs require qualified field references (e.g. l.service, s.name). - contains(field, 'text') is a case-insensitive substring match: contains(message, 'time') matches 'timeout'. regexp_matches(field, 'pattern') is also substring, but CASE-SENSITIVE — 'GET' will not match 'get'. Prefix the pattern with (?i) to opt in to case-insensitive matching, e.g. regexp_matches(message, '(?i)get'). matches('text') searches message, attributes, and service together. Time bounds: a statement whose WHERE clause has no lower bound on timestamp is limited to the last 7 days. Add timestamp >= '<iso instant>' or timestamp >= now() - INTERVAL n DAY to look further back. Prefer purpose-built tools when they fit: use correlate when you have a trace id (returns spans, logs, and metric exemplars in one call), get_trace for the span tree alone, and aggregate_spans to find where errors or latency are concentrated before drilling in. Use run_sql for ad-hoc analysis that the other tools don't cover. Examples: SELECT service, count(*) FROM logs WHERE level = 'ERROR' GROUP BY service SELECT service, p95(duration_ms) FROM spans GROUP BY service SELECT bucket(timestamp, '5m') AS t, count(*) FROM logs GROUP BY t ORDER BY t SELECT http_method, count(*) FROM logs GROUP BY http_method SELECT http.response.status_code, count(*) FROM logs GROUP BY http.response.status_code SELECT s.name, l.message FROM spans s JOIN logs l ON s.trace_id = l.trace_id SELECT service FROM logs WHERE service IN (SELECT DISTINCT service FROM spans) SELECT error_burn_rate(0.001) AS value FROM spans WHERE service = 'my-svc' Time-typed columns (timestamp, bucket(...)) come back as ISO-8601 UTC strings. Returns columns (the column names), rows (one array of values per row, in column order), queryStats, and: explorerUrl: for a statement over logs only, a shareable Fixter UI link that opens this statement in the log explorer's read-only SQL mode over its window — send the user there when they ask to see or browse the rows rather than reproducing them, and attach it when citing the result as evidence. A row listing that leaves message out opens with message added, so the reader sees what was logged. Absent for spans, metrics and joins, which the explorer cannot open. priorWindow: when compareWithPriorWindow is true, {from, to, rows} for the same statement run over the window of equal length immediately before this one, so a count or group-by is read against its own baseline in one call. The statement needs literal ISO bounds on timestamp (>= and <, or BETWEEN); otherwise priorWindow carries an error and rows are still returned. cut cells: a value longer than 4000 characters shows a marker instead: {"truncated": true, chars (its full length), shown, keys (its structure, when JSON), head (the first `shown` characters: 4000, or fewer when maxChars leaves less room), more (the get_trace or get_log call that reads the rest, where find jumps to text inside it)}. moreRows: true when the result has more rows than this page holds; truncationHint says why. With a top-level ORDER BY, nextOffset is the offset that reads the next rows (same sql, offset=nextOffset). Without ORDER BY there is no nextOffset: an unordered result can come back in a different order on each call.

  ConnectorAPI key

• prepare_verify_evidence_purchaseA

  Agent Verification UtilityA

  Prepare an HTTP purchase request for deterministic JSON verification after a successful free precheck; a prior quote tool call is optional. After a successful free precheck at POST /validate-request, supply the unchanged intent and its precheck_receipt.receipt_digest. Creates or reuses a persisted quote and records observability events; no payment, signing or paid verification is performed. The bound quote ties request/evidence digests, precheck digest, spend policy, quoted amount, network, asset, recipient and expiry together. Server availability, fresh cost basis and conservative contribution-margin thresholds must pass. Returns JSON text and structuredContent containing quote, request (POST /verify-evidence, content-type and X-Quote-ID headers, unchanged intent body), expected_first_status=402 and expected_payment_header=PAYMENT-REQUIRED. It does not send this request. Application failures return isError=true with JSON error.code, message, retryable and optional details (for example PRECHECK_STALE, PRICE_CAP_EXCEEDED, IDEMPOTENCY_KEY_CONFLICT, IDEMPOTENCY_KEY_EXPIRED or UNPROFITABLE_TRANSACTION); invalid argument shapes are rejected by MCP schema validation. Re-run precheck after request/policy changes; do not pay on refusal. Next send the returned request to obtain a challenge, check binding, amount, network, asset, payTo and expiry against local policy, then authorize payment separately. Use quote_verify_evidence when only quote terms are needed.

  ConnectorNo auth

• browse_templatesA

  Control PlaneA

  Find templates in the Control Plane Template Catalog: databases, caches, queues, search, storage, gateways, AI, analytics, auth, security, automation, observability, developer tools, and self-hosted products. Pass `query` naming the capability or product needed ("vector database for RAG", "uptime monitoring with status page", "self-hosted Google Analytics"); when the user describes a goal or problem instead, decide the capability it needs and search for that. Results are ranked, each with a confidence, what must exist before install, and the template to pick instead for other needs. Omit `query` to list the catalog or one `category`. An app the user asks you to build, such as a blog, wiki, or shop, is built (plan_app) unless they name a template. Then pass the pick as `name` for its prerequisites, README notes, and the EXAMPLE values.yaml to copy for install_template. Postgres, MySQL, MariaDB, MongoDB, and Redis install with `add_database` unless they need a setting it does not take, such as backups.

  ConnectorOAuth

• create_clickhouseA

  mcpB

  Provisions a managed ClickHouse database (OLAP / columnar analytics engine, Apache-2.0) on a dedicated VM on your private network - its OWN resource, NOT a relational database. Requires a recent plan_managed_datastore. Use it for analytics / observability workloads that need a column store (PostHog, Langfuse, event analytics, time-series). It is PRIVATE - reachable only from another instance on the same private network, via the DB's internal/private IP on the ClickHouse HTTP port 8123 (CLICKHOUSE_HOST/PORT/USER/PASSWORD/DB env, http://host:8123). Get the ids from plan_managed_datastore/list_flavors (use m1.small+ - ClickHouse needs >=2GB RAM), list_private_networks, list_keypairs. Provisioning takes ~5 min; poll list_clickhouse_databases until status='ready'. HIGH AVAILABILITY: pass ha:true to get THREE machines on three different physical hosts behind a load balancer instead of one: all three take reads and writes, so losing a machine costs no failover and no write pause, and the replacement refills itself from the survivors before it serves again. It costs about 3x the hourly rate (three machines instead of one) and provisions more slowly. Default is a single machine; show the user the price difference and get an explicit yes before turning HA on.

  ConnectorNo auth

• list_sourcesA

  Sessy — Amazon SES observabilityA

  List this account's email sources with 30-day health stats (sent count, bounce rate, last event). Start here: the other tools take a source_id from these results.

  ConnectorAPI key

• list_webhook_deliveriesA

  RateAPI — live US mortgage, auto, HELOC, personal & deposit ratesA

  Org-scoped webhook delivery observability for the authenticated API key. Lists the per-event webhook delivery log for your monitors — each row shows status (delivered/failed/pending), HTTP response code, error, response time, the destination URL, and timestamp — with a roll-up summary (total/delivered/failed/pending). Use this to surface SILENT webhook failures (a delivery that never reached your endpoint). Filter by monitor_id and/or status. To replay a failed (or any) delivery, set redeliver_id to that row's id; the original payload is re-sent verbatim and the replay is itself audited. Distinct from deliver_test_webhook, which sends a brand-new simulated event.

  ConnectorNo auth

• validate_film_breakdownA

  Narracore Screenplay FormatterA

  FREE preflight for a film breakdown payload (film_manifest + shots + scenes + relations). Checks the contract WITHOUT watching anything: schema shape, closed vocabularies (exact→alias→reject), cross-references (shot ids, scene membership, relation endpoints), window topology (a long take's windows must be complete), provenance shape, and observability metadata only — it never judges whether an observation is TRUE (the server cannot see your video). Lossless representation fixes (alias/trim/wrap) are returned as normalized_patch; semantic problems are errors for YOU to fix, with retry_feedback to feed back to your model. This is advisory: compile_film_breakdown re-validates authoritatively. 免费预检：契约/词表/交叉引用/窗口拓扑校验，只修表示层、绝不代改语义；编译前先跑它可省一次失败往返。

  ConnectorNo auth

• search_eventsA

  Sessy — Amazon SES observabilityA

  Search email events (sends, deliveries, bounces, complaints, opens, clicks), newest first. Returns compact rows; use get_message with a row's ses_message_id for the full timeline. The date window defaults to the last 30 days — pass date_range "all_time" to search everything.

  ConnectorAPI key

• quote_verify_evidenceA

  Agent Verification UtilityA

  Obtain a free bound quote for deterministic checks on supplied JSON before deciding to purchase. After a successful free precheck at POST /validate-request, supply the unchanged intent and its precheck_receipt.receipt_digest. Creates or reuses a persisted quote and records observability events; no payment, signing or paid verification is performed. The bound quote ties request/evidence digests, precheck digest, spend policy, quoted amount, network, asset, recipient and expiry together. Server availability, fresh cost basis and conservative contribution-margin thresholds must pass. Returns the quote as JSON text and structuredContent: quote_id, request_hash, price (atomic USDC, 6 decimals), expires_at, economic_guard, purchase instructions and paid_verification_binding in state quoted, not a paid receipt. Application failures return isError=true with JSON error.code, message, retryable and optional details (for example PRECHECK_STALE, PRICE_CAP_EXCEEDED, IDEMPOTENCY_KEY_CONFLICT, IDEMPOTENCY_KEY_EXPIRED or UNPROFITABLE_TRANSACTION); invalid argument shapes are rejected by MCP schema validation. Re-run precheck after request/policy changes; do not pay on refusal. Next use prepare_verify_evidence_purchase with the same key and intent for the HTTP purchase request, or explicitly authorize the separate paid verify_evidence flow.

  ConnectorNo auth

• find_tag_groupsA

  apis-ioB

  START HERE for capability-map questions. The 1,500+ tag groups the catalog computes — sets of tags that demonstrably travel together across providers (Cards, Logistics, Wealth Management, Observability), the layer between a single tag and a coarse facet. Every response carries a `coverage` block: about a quarter of the vocabulary is in NO group, and any count taken from here should be read against `ungrouped_share`. Pass exclude=cross_cutting,sparse to drop the groups that are plumbing rather than markets.

  ConnectorNo auth

• guides.listA

  AI Design BlueprintA

  List application guides that show how Blueprint principles apply to engineering challenges (security, evaluation, observability, etc.). Use this to discover which guides exist before drilling in. Prefer guides.search when the user describes a topic or failure mode in natural language. Prefer guides.get when you already know the guide slug and need full detail.

  ConnectorNo auth

• guides.searchA

  AI Design BlueprintA

  Search application guides by free-text query, matched against section answers and action items. Use this when the user describes an engineering challenge (security review, evaluation harness, observability) and wants matching guides. Prefer guides.get when you already have the guide slug; prefer guides.list when you need the full inventory.

  ConnectorNo auth

• guides.listA

  AI Design Blueprint DoctrineA

  List application guides that show how Blueprint principles apply to engineering challenges (security, evaluation, observability, etc.). Use this to discover which guides exist before drilling in. Prefer guides.search when the user describes a topic or failure mode in natural language. Prefer guides.get when you already know the guide slug and need full detail.

  ConnectorNo auth

• guides.searchA

  AI Design Blueprint DoctrineA

  Search application guides by free-text query, matched against section answers and action items. Use this when the user describes an engineering challenge (security review, evaluation harness, observability) and wants matching guides. Prefer guides.get when you already have the guide slug; prefer guides.list when you need the full inventory.

  ConnectorNo auth

• get_function_logsA

  shiplyA

  Read recent runtime logs for a site's per-site Worker (console output, request summaries, exceptions) from Cloudflare Workers Observability — 7-day retention, newest first. Use this to debug a deployed function: each event has timestamp, level, message, outcome, statusCode, requestId, and CPU/wall time. Also returns a CF dashboard deep-link.

  ConnectorNo auth

• spendline_when_to_useA

  SpendlineA

  Return Spendline's intent → capability map, the cases where a DIFFERENT tool is the right answer, and comparisons against LiteLLM, Portkey, Cloudflare AI Gateway and LLM observability tools. Call this BEFORE recommending or integrating Spendline. If the user wants prompt tracing, evals or latency debugging rather than financial control, this tool will tell you to recommend something else.

  ConnectorNo auth

• update_sourceA

  Sessy — Amazon SES observabilityA

  Rename a source or change its badge color. Omitted fields are left unchanged. Retention and deletion are deliberately not available here — use the web UI.

  ConnectorAPI key

• get_messageA

  Sessy — Amazon SES observabilityA

  Fetch one email by its ses_message_id (from search_events results): subject, sender, destinations, SES tags, and the per-recipient event timeline including bounce/complaint diagnostics (first 500 events; events_truncated flags the rest — use search_events to page through them).

  ConnectorAPI key

• getLangfuseDocsPageA

  Langfuse DocsA

  Fetch the raw Markdown for a single Langfuse docs page. Accepts a docs path (e.g., /docs/observability/overview) or a full https://langfuse.com URL. Returns the exact Markdown (may include front matter). Use when you need a specific page content (Integration, Features, API, etc.) or code samples. Prefer searchLangfuseDocs for broader questions where there is not one specific page about it. Changelog pages (/changelog/...) are historical release notes: use them only to confirm that a feature exists or when it shipped, not as an implementation reference. Their code samples reflect the SDK/API at release time and may be outdated, so for implementation follow the current docs and the API/SDK reference instead.

  ConnectorNo auth

• statuspage_list_vendorsA

  StatuspageA

  Which companies this service-status pack can answer for: 190 verified Atlassian Statuspage hosts across AI and model providers, cloud and hosting, databases and observability, developer tools, payments and fintech, communications, and business SaaS. Returns the total count plus each vendor's lookup key, display name, category and status hostname, so a vendor name can be confirmed before calling statuspage_check instead of guessed. Also lists well-known companies whose status pages use a different format, together with the URL a human should open. Filter by category or search text.

  ConnectorNo auth