insights/products/logs/mcp/tools.yaml

# MCP tool definition — tool entries are scaffolded from the OpenAPI schema.
# The tool list and operation IDs are kept in sync automatically:
#   pnpm --filter=@hanzo/mcp run scaffold-yaml -- --sync-all
#
# To enable a tool, set enabled: true and add required scopes + annotations.
# All other fields (title, description, enrich_url, etc.) are yours to configure.
category: Logs
feature: logs
url_prefix: /logs
ui_apps: {}
tools:
    logs-alerts-create:
        operation: logs_alerts_create
        enabled: true
        scopes:
            - logs:write
        annotations:
            readOnly: false
            destructive: false
            idempotent: false
        title: Create log alert
        description: >
            Create a threshold-based alert on log streams. The alert periodically counts log entries matching the given
            filters and fires when the count crosses the threshold. Maximum 20 alerts per project.
        exclude_params:
            - id
            - state
            - check_interval_minutes
            - next_check_at
            - last_notified_at
            - last_checked_at
            - consecutive_failures
            - created_at
            - created_by
            - updated_at
        feature_flag: logs-alerting
        response:
            include:
                - id
                - name
                - enabled
                - state
                - filters
                - threshold_count
                - threshold_operator
                - window_minutes
                - check_interval_minutes
                - evaluation_periods
                - datapoints_to_alarm
                - cooldown_minutes
                - snooze_until
                - next_check_at
                - last_notified_at
                - last_checked_at
                - consecutive_failures
                - last_error_message
                - created_at
                - updated_at
    logs-alerts-destinations-create:
        operation: logs_alerts_destinations_create
        enabled: true
        scopes:
            - logs:write
        annotations:
            readOnly: false
            destructive: false
            idempotent: false
        title: Attach alert destination
        description: >
            Attach a Slack, webhook, or Microsoft Teams notification destination to a log alert. Without a destination
            an alert evaluates silently and never notifies. One InsightsFunction is created per event kind (firing, resolved,
            broken, errored) atomically. The returned insights_function_ids identify the destination group.
        param_overrides:
            type:
                description: >
                    Destination type. Use slack, webhook, or teams. Slack requires slack_workspace_id and
                    slack_channel_id. Webhook and teams require webhook_url.
            slack_workspace_id:
                description: Slack workspace integration ID. Required when type is slack.
            slack_channel_id:
                description: Slack channel ID. Required when type is slack.
            slack_channel_name:
                description: Optional Slack channel name used for display.
            webhook_url:
                description: Required when type is webhook or teams.
        feature_flag: logs-alerting
        response:
            include:
                - insights_function_ids
    logs-alerts-destinations-delete-create:
        operation: logs_alerts_destinations_delete_create
        enabled: true
        scopes:
            - logs:write
        annotations:
            readOnly: false
            destructive: true
            idempotent: true
        title: Detach alert destination
        description: >
            Remove a notification destination from a log alert by passing the insights_function_ids returned from
            logs-alerts-destinations-create. Destinations are deleted as one atomic group — partial deletion fails the
            call.
        feature_flag: logs-alerting
    logs-alerts-destroy:
        operation: logs_alerts_destroy
        enabled: true
        scopes:
            - logs:write
        annotations:
            readOnly: false
            destructive: true
            idempotent: true
        title: Delete log alert
        description: |
            Permanently delete a log alert configuration by ID.
        feature_flag: logs-alerting
    logs-alerts-events-list:
        operation: logs_alerts_events_list
        enabled: true
        scopes:
            - logs:read
        annotations:
            readOnly: true
            destructive: false
            idempotent: true
        list: true
        title: List alert events
        description: >
            List historical events for a log alert — fires, resolves, errors, enable/disable toggles, threshold changes.
            Use to evaluate how an existing alert has behaved (firing cadence, error rate, flap pattern) before tuning
            thresholds. Quiet no-op check rows are filtered out server-side. Optional `kind` query param narrows to a
            single event kind.
        feature_flag: logs-alerting
        response:
            include:
                - id
                - created_at
                - kind
                - state_before
                - state_after
                - threshold_breached
                - result_count
                - error_message
                - query_duration_ms
    logs-alerts-list:
        operation: logs_alerts_list
        enabled: true
        scopes:
            - logs:read
        annotations:
            readOnly: true
            destructive: false
            idempotent: true
        list: true
        title: List log alerts
        description: >
            List log alert configurations in the current project, newest first. Returns alert name, state, threshold,
            filters, and scheduling details. Use this to review existing alerts before creating or modifying them.
        feature_flag: logs-alerting
        response:
            include:
                - id
                - name
                - enabled
                - state
                - threshold_count
                - threshold_operator
                - window_minutes
                - created_at
                - updated_at
    logs-alerts-partial-update:
        operation: logs_alerts_partial_update
        enabled: true
        scopes:
            - logs:write
        annotations:
            readOnly: false
            destructive: false
            idempotent: true
        title: Update log alert
        description: >
            Update a log alert configuration by ID. Only the fields you provide are changed. Use this to adjust
            thresholds, filters, enable/disable alerts, or snooze them.
        exclude_params:
            - id
            - state
            - check_interval_minutes
            - next_check_at
            - last_notified_at
            - last_checked_at
            - consecutive_failures
            - created_at
            - created_by
            - updated_at
        feature_flag: logs-alerting
        response:
            include:
                - id
                - name
                - enabled
                - state
                - filters
                - threshold_count
                - threshold_operator
                - window_minutes
                - check_interval_minutes
                - evaluation_periods
                - datapoints_to_alarm
                - cooldown_minutes
                - snooze_until
                - next_check_at
                - last_notified_at
                - last_checked_at
                - consecutive_failures
                - last_error_message
                - created_at
                - updated_at
    logs-alerts-reset-create:
        operation: logs_alerts_reset_create
        enabled: false
    logs-alerts-retrieve:
        operation: logs_alerts_retrieve
        enabled: true
        scopes:
            - logs:read
        annotations:
            readOnly: true
            destructive: false
            idempotent: true
        title: Get log alert
        description: >
            Get a log alert configuration by ID. Returns full details including current state, threshold settings,
            filters, and scheduling information.
        feature_flag: logs-alerting
        response:
            include:
                - id
                - name
                - enabled
                - state
                - filters
                - threshold_count
                - threshold_operator
                - window_minutes
                - check_interval_minutes
                - evaluation_periods
                - datapoints_to_alarm
                - cooldown_minutes
                - snooze_until
                - next_check_at
                - last_notified_at
                - last_checked_at
                - consecutive_failures
                - last_error_message
                - created_at
                - updated_at
    logs-alerts-simulate-create:
        operation: logs_alerts_simulate_create
        enabled: true
        scopes:
            - logs:read
        annotations:
            readOnly: true
            destructive: false
            idempotent: true
        title: Simulate log alert
        description: >
            Run a draft alert configuration against historical logs and return per-bucket results from the full state
            machine — count, threshold_breached, state, notification (none/fire/resolve), reason. Use to validate
            threshold + N-of-M settings before creating an alert. Read-only; no alert records are written. Aim for
            fire_count between 0 and 3 over a `-7d` lookback for a healthy threshold.
        feature_flag: logs-alerting
        response:
            include:
                - buckets
                - fire_count
                - resolve_count
                - total_buckets
                - threshold_count
                - threshold_operator
    logs-alerts-update:
        operation: logs_alerts_update
        enabled: false
    logs-attribute-values-list:
        operation: logs_values_retrieve
        enabled: true
        scopes:
            - logs:read
        annotations:
            readOnly: true
            destructive: false
            idempotent: true
        title: List log attribute values
        description: >
            List values for a specific log attribute key. Use to discover what values exist before building filters.
            Defaults to attribute_type "log" (log-level attributes). To get values for resource-level attributes (e.g.
            service.name, k8s.pod.name), you MUST explicitly pass attribute_type: "resource". Accepts optional
            serviceNames, dateRange, and filterGroup to narrow which logs are scanned.
        response:
            include:
                - results
    logs-attributes-list:
        operation: logs_attributes_retrieve
        enabled: true
        scopes:
            - logs:read
        annotations:
            readOnly: true
            destructive: false
            idempotent: true
        title: List log attributes
        description: >
            List available log attribute names for filtering. Defaults to attribute_type "log" (log-level attributes).
            To search resource-level attributes (e.g. k8s.pod.name, k8s.namespace.name), you MUST explicitly pass
            attribute_type: "resource" — it will NOT return resource attributes unless you do. Accepts optional
            serviceNames, dateRange, and filterGroup to narrow which logs are scanned.
        response:
            include:
                - results
                - count
    logs-count:
        operation: logs_count_create
        enabled: true
        scopes:
            - logs:read
        annotations:
            readOnly: true
            destructive: false
            idempotent: true
        title: Count logs
        description_file: ./prompts/logs-count.md
        response:
            include:
                - count
    logs-count-ranges:
        operation: logs_count_ranges_create
        enabled: true
        scopes:
            - logs:read
        annotations:
            readOnly: true
            destructive: false
            idempotent: true
        title: Count logs by time bucket
        description_file: ./prompts/logs-count-ranges.md
        response:
            include:
                - ranges
                - interval
    logs-explain-log-with-ai-create:
        operation: logs_explainLogWithAI_create
        enabled: false
    logs-export-create:
        operation: logs_export_create
        enabled: false
    logs-facet-values-create:
        operation: logs_facet_values_create
        enabled: true
        scopes:
            - logs:read
        annotations:
            readOnly: true
            destructive: false
            idempotent: true
        title: Facet log counts
        description_file: ./prompts/logs-facet-values.md
        response:
            include:
                - results
    logs-group-by-create:
        operation: logs_group_by_create
        enabled: false
    logs-has-logs-retrieve:
        operation: logs_has_logs_retrieve
        enabled: false
    logs-metric-rules-create:
        operation: logs_metric_rules_create
        enabled: false
    logs-metric-rules-destroy:
        operation: logs_metric_rules_destroy
        enabled: false
    logs-metric-rules-list:
        operation: logs_metric_rules_list
        enabled: false
    logs-metric-rules-partial-update:
        operation: logs_metric_rules_partial_update
        enabled: false
    logs-metric-rules-retrieve:
        operation: logs_metric_rules_retrieve
        enabled: false
    logs-metric-rules-update:
        operation: logs_metric_rules_update
        enabled: false
    logs-patterns:
        operation: logs_patterns_create
        enabled: true
        scopes:
            - logs:read
        annotations:
            readOnly: true
            destructive: false
            idempotent: true
        title: Mine log patterns
        description_file: ./prompts/logs-patterns.md
        feature_flag: logs-patterns-view
        response:
            exclude:
                - patterns.*.examples
                - patterns.*.sparkline
                - patterns.*.count
                - patterns.*.error_count
                - sparkline_buckets
    logs-patterns-diff:
        operation: logs_patterns_diff_create
        enabled: true
        scopes:
            - logs:read
        annotations:
            readOnly: true
            destructive: false
            idempotent: true
        title: Diff log patterns between two windows
        description_file: ./prompts/logs-patterns-diff.md
        feature_flag: logs-patterns-view
        response:
            exclude:
                - entries.*.pattern.examples
                - entries.*.pattern.sparkline
                - entries.*.pattern.count
                - entries.*.pattern.error_count
    logs-retention-rules-create:
        operation: logs_retention_rules_create
        enabled: false
    logs-retention-rules-destroy:
        operation: logs_retention_rules_destroy
        enabled: false
    logs-retention-rules-list:
        operation: logs_retention_rules_list
        enabled: false
    logs-retention-rules-partial-update:
        operation: logs_retention_rules_partial_update
        enabled: false
    logs-retention-rules-reorder-create:
        operation: logs_retention_rules_reorder_create
        enabled: false
    logs-retention-rules-retrieve:
        operation: logs_retention_rules_retrieve
        enabled: false
    logs-retention-rules-suggest-name-create:
        operation: logs_retention_rules_suggest_name_create
        enabled: false
    logs-retention-rules-update:
        operation: logs_retention_rules_update
        enabled: false
    logs-sampling-rules-create:
        operation: logs_sampling_rules_create
        enabled: false
    logs-sampling-rules-destroy:
        operation: logs_sampling_rules_destroy
        enabled: false
    logs-sampling-rules-list:
        operation: logs_sampling_rules_list
        enabled: false
    logs-sampling-rules-partial-update:
        operation: logs_sampling_rules_partial_update
        enabled: false
    logs-sampling-rules-reorder-create:
        operation: logs_sampling_rules_reorder_create
        enabled: false
    logs-sampling-rules-retrieve:
        operation: logs_sampling_rules_retrieve
        enabled: false
    logs-sampling-rules-simulate-create:
        operation: logs_sampling_rules_simulate_create
        enabled: false
    logs-sampling-rules-update:
        operation: logs_sampling_rules_update
        enabled: false
    logs-services-create:
        operation: logs_services_create
        enabled: true
        scopes:
            - logs:read
        annotations:
            readOnly: true
            destructive: false
            idempotent: true
        title: List services with stats
        description: >
            Return the top-25 services by log volume in the window, each with log_count, error_count, and error_rate,
            plus a per-service sparkline. Use this as the entry point when triaging which services are worth alerting on
            — high volume × non-zero error_rate is the natural alert candidate. Far cheaper than walking
            attribute-values + per-service counts.
        response:
            include:
                - services
                - sparkline
    logs-sparkline-query:
        operation: logs_sparkline_create
        enabled: true
        scopes:
            - logs:read
        annotations:
            readOnly: true
            destructive: false
            idempotent: true
        title: Query logs sparkline
        description_file: ./prompts/logs-sparkline.md
        response:
            include:
                - results
    logs-views-create:
        operation: logs_views_create
        enabled: false
    logs-views-destroy:
        operation: logs_views_destroy
        enabled: false
    logs-views-list:
        operation: logs_views_list
        enabled: false
    logs-views-partial-update:
        operation: logs_views_partial_update
        enabled: false
    logs-views-retrieve:
        operation: logs_views_retrieve
        enabled: false
    logs-views-update:
        operation: logs_views_update
        enabled: false
    query-logs:
        operation: logs_query_create
        enabled: true
        scopes:
            - logs:read
        annotations:
            readOnly: true
            destructive: false
            idempotent: true
        title: Query logs
        description_file: ./prompts/query-logs.md
        system_prompt_hint: Log filtering by severity/service/attribute
        response:
            include:
                - results
    tasks-runs-logs-retrieve:
        operation: tasks_runs_logs_retrieve
        enabled: false