# Log10x MCP (npm · log10x-mcp) Rank log patterns by volume and cost, then compact, tier down or offload the excess over each cap - Trust score: 90/100 (high trust) - Change this week: +59 - Registry status: active - Liveness: live - Owner verified: no - Last scored: 2026-10-16 ## Components - npm · `log10x-mcp`: 90/100 (this document), [markdown](https://verifymcp.io/servers/log-10x-log10x-mcp/log10x-mcp.md), [page](https://verifymcp.io/servers/log-10x-log10x-mcp/log10x-mcp) ## Channel facts - Registry: `npm` - Package: `log10x-mcp` - Version: `1.30.68` - Transport: `stdio` ## Trust breakdown How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog) Scored 2026-10-16. - **Supply Chain Security**: 90/100 - No malware found by supply-chain analysis. - CVE check failed: a known high-severity CVE affects uuid 9.0.1, reached via @google-cloud/logging > google-gax > uuid. A fixed version is available. - No install/post-install scripts declared. - 110 of 400 dependencies flagged as unhealthy (5 deprecated). - **Provenance & Transparency**: 97/100 - Source repository is publicly reachable at the declared URL. - Cryptographically verified build provenance (signed, bound to log-10x/log10x-mcp). - Clear OSI-approved license (MIT). - Actively maintained (last published 0 days ago). - Disclosure check failed: no security disclosure policy was found in the source repository. - **Schema Quality & AI Usability**: 72/100 - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name). - AI-judged instruction clarity (excellent). - Context-footprint check failed: tool/resource definitions use about 43316 tokens (~746/item across 58 items; 57 tools + 1 resources), over budget; trim descriptions and params. - Usage-examples check failed: none of the tools include examples. - **Stability & Change Management**: 100/100 - No destabilizing schema changes in the last 30 days. - **Tool Coverage**: 99/100 - 100% of tools have a non-trivial description (not blank, and not just the tool's name). - 97% of tool parameters carry a description. - Structured output schemas are declared (100% of tools); any adoption earns full credit. - **Tool Safety**: 75/100 - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured. - 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "log10x_signout" implies "wipe" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. - An AI judge read all 59 captured unit(s) of tool text and found none that tries to manipulate the model reading it. - **Capabilities**: 100/100 - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28. ## Install ### How do I install the Log10x MCP server? Log10x MCP runs locally as an npm package, launched with npx -y log10x-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation. ### Claude ```bash claude mcp add log-10x-log10x-mcp -- npx -y log10x-mcp ``` ### Cursor ```json { "mcpServers": { "log-10x-log10x-mcp": { "command": "npx", "args": [ "-y", "log10x-mcp" ] } } } ``` ### VS Code ```json { "servers": { "log-10x-log10x-mcp": { "command": "npx", "args": [ "-y", "log10x-mcp" ] } } } ``` ### Codex ```bash codex mcp add log-10x-log10x-mcp -- npx -y log10x-mcp ``` ### opencode ```json { "$schema": "https://opencode.ai/config.json", "mcp": { "log-10x-log10x-mcp": { "type": "local", "command": [ "npx", "-y", "log10x-mcp" ], "enabled": true } } } ``` ### OpenClaw ```bash openclaw mcp add log-10x-log10x-mcp --command npx --arg -y --arg log10x-mcp ``` ### Hermes ```yaml mcp_servers: log-10x-log10x-mcp: command: "npx" args: ["-y", "log10x-mcp"] ``` ### Netclaw ```json { "McpServers": { "log-10x-log10x-mcp": { "Transport": "stdio", "Command": "npx", "Arguments": [ "-y", "log10x-mcp" ] } } } ``` ### Vellum ```bash assistant mcp add log-10x-log10x-mcp -t stdio -c npx -a -y log10x-mcp ``` ### Other ```json { "mcpServers": { "log-10x-log10x-mcp": { "command": "npx", "args": [ "-y", "log10x-mcp" ] } } } ``` ## Changelog Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims. ### 2026-10-16 (score 90, +44) - [security regression] Known CVEs: fail → unverified - [security improvement] Injection markers: unverified → pass - [security improvement] Stability: unverified → pass - [security] Tool safety: Tool safety not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet. - [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. - [functional regression] Dependency health: 0.88 → unverified - [functional improvement] Tool coverage: unverified → 100 - [functional improvement] MCP protocol: unverified → pass - [functional improvement] Schema quality: unverified → 100 - [functional] Capabilities: Protocol version not yet verified: we do not have a sandbox capture of the MCP handshake this version of the package performs yet. - [functional] Tool coverage: Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet. - [functional] Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. - [functional] Package version: 1.30.65 → 1.30.68 - [functional] Package version: 1.30.65 → 1.30.67 - [functional] Package version: 1.30.37 → 1.30.66 ### 2026-10-15 (score 46, +8) - [security regression] Known CVEs: unverified → fail - [security] Stability: Stability not yet verified: this server's registry entry declares environment variables (an API key or similar), and its server did not start in our sandbox, so we have no schema to compare. - [security] Tool safety: Tool safety not yet verified: this server's registry entry declares environment variables (an API key or similar), and its server did not start in our sandbox, so we have no tool text to scan. - [functional improvement] Dependency health: unverified → 0.88 - [functional] Schema quality: Schema quality not yet verified: this server's registry entry declares environment variables (an API key or similar), and its server did not start in our sandbox, so we have no schema to assess. - [functional] Capabilities: Protocol version not yet verified: this server's registry entry declares environment variables (an API key or similar), and its server did not start in our sandbox, so we never saw its MCP handshake. - [functional] Tool coverage: Tool coverage not yet verified: this server's registry entry declares environment variables (an API key or similar), and its server did not start in our sandbox, so we have no tool definitions to assess. - [functional] Package version: 1.30.37 → 1.30.65 - [functional] Package version: 1.30.37 → 1.30.63 - [functional] Package version: 1.30.37 → 1.30.62 - [functional] Package version: 1.30.54 → 1.30.62 - [functional] Package version: 1.30.54 → 1.30.60 - [functional] Package version: 1.30.37 → 1.30.59 - [functional] Package version: 1.30.54 → 1.30.58 - [functional] Package version: 1.30.54 → 1.30.56 - [functional] Package version: 1.30.37 → 1.30.55 ### 2026-10-14 (score 38, −8) - [security regression] Known CVEs: fail → unverified - [security] Stability: Stability not yet verified: this package could not be installed in a clean environment, so we have no schema to compare. - [security] Tool safety: Tool safety not yet verified: this package could not be installed in a clean environment, so we have no tool text to scan. - [functional regression] Dependency health: 0.88 → unverified - [functional] Schema quality: Schema quality not yet verified: this package could not be installed in a clean environment, so we have no schema to assess. - [functional] Capabilities: Protocol version not yet verified: this package could not be installed in a clean environment, so we never saw its MCP handshake. - [functional] Tool coverage: Tool coverage not yet verified: this package could not be installed in a clean environment, so we have no tool definitions to assess. - [functional] Package version: 1.30.49 → 1.30.54 - [functional] Package version: 1.30.49 → 1.30.52 - [functional] Package version: 1.30.49 → 1.30.50 ### 2026-10-13 (score 46, 0) - [functional regression] Security disclosure: unverified → fail ### 2026-10-12 (score 46, +15) - [security improvement] Malware scan: unverified → pass - [functional regression] Security disclosure: fail → unverified - [functional] Package version: 1.30.37 → 1.30.49 ### 2026-10-09 (score 31, −56) - [security regression] Malware scan: pass → unverified - [security regression] Stability: 0.77 → unverified - [security regression] Tool safety: pass → unverified - [functional regression] Capabilities: pass → unverified - [functional regression] Tool coverage: 100 → unverified - [functional regression] Schema quality: 100 → unverified - [functional] Package version: 1.30.37 → 1.30.45 ### 2026-10-04 (score 87, +16) - [security improvement] Malware scan: unverified → pass ### 2026-10-03 (score 71, 0) - [security improvement] Malware scan: unverified → pass - [functional] Package version: 1.30.36 → 1.30.37 ## MCP tools (57) ### `log10x_event_lookup` (~605 tokens) Event lookup Resolve a raw log line or pattern name to its pattern hash, which is the same for the same line under the same engine, symbol library and configuration, then return byte volume + share per service (with cost overlay when $/GB is set), before→after delta, first-seen timestamp within the observation window, and the current offload disposition (pass / sample / compact / drop) read from the Reporter `routeState` label; only when `LOG10X_AI_SUMMARY=true`, an AI category for the pattern (error/debug/info/metric/health) with a one-line explanation. **Call this first** whenever a user pastes a SINGLE log line and asks "what is this", "is this new", "is this safe to drop", or "is this being dropped / offloaded". The lookup is structural, not byte-exact: different timestamps/request IDs/user IDs on the same underlying pattern resolve to the same hash. If no match is returned, say so. Use log10x_resolve_batch instead when the user pastes MULTIPLE events, a SIEM dump, or a batch to triage. Input parameters: - `analyzerCost` (number): SIEM ingestion cost in $/GB (deprecated alias of `effective_ingest_per_gb`) - `effective_ingest_per_gb` (number): Customer-supplied SIEM ingest cost in $/GB. When set, dollar fields populate with rate_source=customer_supplied; when absent and no default rate is detected, dollar fields collapse to null and rate_s… - `environment` (string): Environment nickname - `pattern` (string): Pattern name or search term to look up (e.g., "Payment_Gateway_Timeout"). Omit when passing `pattern_hash` / `tenxHash` instead. - `pattern_hash` (string): Canonical 11-char hash seen on a SIEM / CloudWatch Logs event (e.g. "03ndjreM-sU"). Alias of `tenxHash`; both are accepted. Resolved against the 10x metrics to recover the pattern, then the normal co… - `service` (string): Service to scope the lookup - `siemScope` (string): SIEM scope for the live sample line on a tenxHash reverse lookup: a CloudWatch log group (`/aws/ecs/my-svc`), ES index, or Splunk index. When omitted, the detected SIEM connector uses its own default… - `tenxHash` (string): Legacy alias of `pattern_hash`. Both are accepted. Pass either the canonical `pattern_hash` form or this legacy form: they are treated identically. - `timeRange` (string): Time range. Sub-day values for incident-window lookups. '24h' and '1d' are equivalent. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_pattern_examples` (~872 tokens) Pattern examples Pull recent live events for a pattern from the customer's log analyzer (Splunk, Datadog, Elasticsearch, CloudWatch) and return them grouped by templateHash with template-extracted slot values per match. **Bounded to a 24-hour window** (live log analyzer retention); for older history use `log10x_retriever_query`. Input is either a Symbol Message (pattern name like `Payment_Gateway_Timeout`) or a pasted raw log line; pasted lines resolve via the same templater path as `log10x_resolve_batch`. The tool runs a SIEM phrase-search probe, runs returned events through the local templater, groups by templateHash (one bucket per template variant of the pattern; each bucket carries the pattern hash, `tenx_hash`), applies a content-token Jaccard similarity threshold (≥0.85) to discriminate the matching pattern's events from look-alikes, and returns the top buckets by event count. Output marks partial extractions: per-bucket templateHash labels, recall counts, and explicit `parseFailed` markers when slot extraction fails. Multi-line group templates report head-line-only with an explicit warning. **Designed as an orchestration primitive** called by `log10x_investigate` when the chain needs concrete event evidence after a metric-tier identification. Direct user-facing use is fine but rare; prefer `log10x_event_lookup` + `log10x_pattern_trend` for single-line inspection. Input parameters: - `bucket_id` (string): Bucket identifier to fully hydrate. Accepts either the `template_hash` or the `tenx_hash` returned in a prior `view=summary` call. When supplied, the response carries one bucket with full sample_even… - `environment` (string): Environment nickname. - `limit` (number): Maximum number of sample events per templateHash bucket. 1-50, default 10. - `pattern` (string): Pattern name (e.g. `Payment_Gateway_Timeout`) or a pasted raw log line. Pasted lines resolve to the matching pattern via the same pattern-extraction path as log10x_resolve_batch. Either pattern or pa… - `pattern_hash` (string): Canonical 11-char hash. Either pattern (Symbol Message name) or pattern_hash must be provided; pattern_hash is preferred when available. Resolved to the pattern name via the 10x metrics (same path pa… - `scope` (string): Vendor-specific scope (Splunk index, Datadog index, ES index pattern, CloudWatch log group). Defaults to a sensible per-vendor value when omitted. - `service` (string): Optional service-name scope. Translated to the vendor-specific service filter. - `severity` (string): Optional severity scope (e.g., `ERROR`, `WARN`). - `slot_filter` (object): Optional slot-value filter. When provided, only buckets whose slot_distribution carries the given slot value pass through. Useful for drilling into a single dominant value from a previous pattern_exa… - `timeRange` (string): Window for the live SIEM probe. Capped at 24h. To sample a pattern's offloaded cohort (events the Receiver routed to the overflow bucket, which the SIEM never received), use log10x_retriever_query. '… - `vendor` (string): Log analyzer to search. Auto-detected when exactly one of the supported vendors has credentials in the env; pass explicitly when multiple are configured. - `view` (string): Response shape. `summary` (default) returns slim top-3 buckets (rank, template_hash, tenx_hash, event_count, jaccard, severity, service, recommended_action, headline, ~200-char sample_event preview)… Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_product_qa` (~483 tokens) Product Q&A from shipped docs Answer Log10x product questions from the docs that ship inside the MCP build (chunked + indexed at install time). Use whenever the user asks a factual product question: "what is the Receiver", "how is pattern_hash computed", "what data leaves my network", "does the Reporter modify data", instead of answering from training data. Inputs: `topic` for an exact docs-slug lookup (e.g. `faq/security/data-protection`), or `query` for natural-language TF-IDF search across those docs. `category` narrows search to one of faq / apps / engine / api / config / manage. `max_results` caps the result count (default 3). Output is a standard chassis envelope with `found`, ranked `results` (each carrying matched chunks + canonical_url), and `similar_topics` as a did-you-mean fallback. Link the `canonical_url` of each result used in the answer. The docs are shipped from `config/mksite/docs` at build time; in development the loader also honors `LOG10X_PRODUCT_KB_PATH`. Input parameters: - `category` (string): Restrict results to one category. One of: faq, apps, engine, api, config, manage. Combines with `query`. - `depth` (string): Response detail. "short" (default) returns a tight grounded answer plus citation metadata (topic + canonical_url, no section bodies) and offers a chained learn_more action per citation. "full" return… - `max_results` (integer): Cap on the number of results returned. Default 3. - `query` (string): Natural-language query: prefer this for how-to / content questions. Examples: "what does the kustomize overlay patch", "how is pattern_hash computed". When `topic` is also set, ranks that page's sect… - `topic` (string): Exact docs slug to fetch a known page. Example: "faq/security/data-protection" or "apps/receiver/deploy". For a multi-section page, ALSO pass `query` to get the asked-about section instead of the pag… Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_savings` (~435 tokens) Pipeline savings Show pipeline savings: the bytes the Receiver keeps out of the SIEM (filtering and compact) and the bytes the Retriever indexed in the customer's bucket (priced at the SIEM rate, less storage, less what was streamed back), with a dollar overlay when an analyzer $/GB rate is set (account profile list price, or per-call `effective_ingest_per_gb` override). Without a rate, the headline is percent-and-bytes only: never a fabricated $1/GB number. Use for "how much are we saving", "pipeline ROI", or "what is the Log10x stack worth financially". Accepts siem_lens (what-if destination): keeps the measured volumes, prices + gates for that destination at list rates, and stamps siem_actual vs siem_lens in the envelope. Input parameters: - `analyzerCost` (number): DEPRECATED alias for effective_ingest_per_gb. stack ingestion cost in $/GB. - `effective_ingest_per_gb` (number): Customer-supplied stack ingestion cost in $/GB. When provided, rate_source=customer_supplied and dollars are populated. When omitted and no profile rate is available, rate_source=unset and the headli… - `environment` (string): Environment nickname - `siem_lens` (string): What-if destination lens: price the SAME real volumes at this destination's default rates instead of the connected pipeline's. Dollars switch to the lens destination default rate (env-configured rate… - `storageCost` (number): S3 storage cost in $/GB/month. Defaults to $0.023 (S3 Standard). - `timeRange` (string): Time range. '24h' and '1d' are equivalent. - `view` (string): Output format. Always "summary": the typed envelope (data.totals, data.edge, data.retriever, data.run_rate). Field retained for backward-compat. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_pattern_trend` (~804 tokens) Pattern trend Return the volume history for a single pattern over a chosen window (e.g. 1h, 24h, 7d, 30d), with a sparkline and spike detection: ranked by byte volume (with cost overlay when $/GB is set). **Call this after log10x_event_lookup** when the user asks "is this getting worse", "has it been louder before", "when did it start", or wants temporal context on a pattern surfaced in an earlier step. Always state the observation window explicitly in the reply: "flat at 2/h for the last 6 months of observation, spiked at 13:58 today", and never claim history older than the window. Pass `include` to select the cohort: `kept` (default), `dropped` (offloaded-only trend, useful for "is the receiver dropping more of this lately"), or `both` (total ingest). The envelope reports which cohort the series represents so the agent never conflates kept-only with total volume. Input parameters: - `analyzerCost` (number): SIEM ingestion cost in $/GB - `environment` (string): Environment nickname - `include` (string): Which engine-decision cohort to scope the trend to. `kept` (default) = events that actually reached the destination (routeState=~"pass|", absence-tolerant). `dropped` = everything the receiver acted… - `include_chart` (boolean): Set include_chart=true to embed the rendered chart inline (large; default false to avoid response truncation). - `monthly_volume_gb` (number): What-if volume lens (forecast mode): model the environment at THIS monthly volume (decimal GB/month) instead of its measured volume. The real per-pattern shares and pattern mix are held fixed; only a… - `pattern` (string): Pattern name (e.g., "Payment_Gateway_Timeout"). Provide either pattern or pattern_hash: pattern_hash is preferred when available (skips a metrics lookup). - `pattern_hash` (string): The tenx_hash of the pattern (the 11-character pattern hash from top_patterns / preview_filter). Preferred over pattern when available. - `step` (string): Data point interval. Default `auto` sizes the step to give about 12 to 30 buckets per window (1h→5m, 6h→15m, 1d/24h→1h, 7d→6h, 30d→1d). Override only when a specific resolution is required; an over-c… - `timeRange` (string): Time range. '24h' and '1d' are equivalent (one-day window). Sub-day values show fine-grained trajectory around an incident. - `view` (string): Output format. Always "summary": the structured envelope. Field retained for backward-compat. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_dependency_check` (~276 tokens) Dependency check command Given a pattern identity, generate commands to scan the user's SIEM/observability stack (Datadog monitors, Splunk saved searches, Grafana dashboards, Prometheus alert rules) for anything that depends on that pattern. **Call this before any mute, drop, or source-code deletion**: deleting a log line that feeds a live alert silently breaks the alert. Also call when a developer asks "am I allowed to delete this log.info() call" or "what references this pattern". Input parameters: - `pattern` (string, required): Pattern name (e.g., "Payment_Gateway_Timeout") - `service` (string): Service name to scope the scan - `severity` (string): Severity level - `vendor` (string): SIEM vendor to scan. Omit to auto-detect from ambient credentials (DD_API_KEY+DD_APP_KEY → datadog; SPLUNK_HOST+SPLUNK_TOKEN → splunk; ELASTIC_URL → elasticsearch; AWS chain → cloudwatch). When multi… Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_env_validate` (~304 tokens) Validate env config doc Run schema validation + cross-field sanity checks on a stored env-config document at `~/.log10x/envs/.json`. **Call this** after any edit to the env doc (via `log10x_dest_set` / hand-edit / restore) or pre-flight before downstream tools that need a coherent config (commitment_report, configure_engine, offload-recipe emitters). Args: `env_id` (required, env_id UUID or nickname). Returns the canonical zod schema parse result PLUS findings across: destination.region required for vendors that need it (cloudwatch / datadog / azure-monitor / gcp-logging); ingest_url shape sanity (http(s):// prefix, splunk /services/collector suffix); streamer.url / retriever.url shape; cluster cloud type vs offload destination type alignment (eks↔s3, gke↔gcs, aks↔azure_blob); at-least-one active offload destination; SIEM region vs offload destination region (cross-region egress warning). Each finding carries severity (error / warning / info) and a remediation recommendation. Errors block downstream actions; warnings/info surface for the user. Input parameters: - `env_id` (string, required): Env identifier: either the `env_id` UUID or the `nickname` from the env-config document. Resolved by walking the store chain (k8s → aws_ssm → gcp_sm → azure_ac → local). Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_env_diff_vs_envvars` (~297 tokens) Diff env doc vs LOG10X_* env vars Compare the stored env-config document against the `LOG10X_*` environment variables the env-var bridge would have produced, and report per-field disagreements with remediation recommendations. **Call this when** the user says "but I set the env var" or downstream tools report a value the user thinks they overrode: the on-prem store wins over env vars per resolver precedence, and silent-override is the most common boot-time surprise. Args: `env_id` (required, env_id UUID or nickname). For each disagreeing field (env_id, nickname, cluster.*, destination.*, streamer.*, retriever.*, offload_destinations[0].*), returns `{ field, stored, envvar, recommendation }`. The recommendation tells the user to either unset the LOG10X_* env var (preferred: on-prem store is the source of truth) or to update the stored doc via the matching setter (log10x_dest_set for destination, log10x_set_gitops_repo for gitops). Pure-on-prem-store configs (no LOG10X_* env vars set) return ok:true with an empty diff and a note that no ambiguity is possible. Input parameters: - `env_id` (string, required): Env identifier: either the `env_id` UUID or the `nickname` from the env-config document. Resolved by walking the store chain (k8s → aws_ssm → gcp_sm → azure_ac → local). Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_siem_connector` (~685 tokens) Emit SIEM connector for an offload bucket Generate the customer-applied SIEM-side connector config (Datadog Forwarder Lambda, or the Splunk Add-on for AWS SQS-based S3 input) that makes a SIEM pull log10x's offload output from the customer's own S3 bucket. Call this when the user has offloaded a pattern's data to S3 (the offload action / a log10x_offload_add destination) and asks how to get Datadog or Splunk to ingest it, e.g. 'ship my offload bucket to Splunk' or 'wire Datadog to read these logs'. The MCP does not push offloaded events into a SIEM: the offload lands NDJSON in the customer's bucket, and this tool emits the pull-side connector the SIEM reads it with. Args: siem (required: datadog / splunk / both), bucket (required: the offload bucket), account_id (required), region (default us-east-1), prefix (optional, default app/), plus per-SIEM options (datadog_forwarder_arn, sqs_queue_name, sourcetype, index). Returns, per target: the discovery model, ordered setup steps, paste-ready terraform (an SNS fan-out plus IAM, and for Splunk the SQS queue and the S3-to-SNS-to-SQS notification), the SIEM-native config (the Splunk inputs.conf aws_sqs_based_s3 stanza), and verified caveats. Recipes are matched to log10x's offload output (uncompressed NDJSON, one event per line, Hive-partitioned keys) and encode the key gotcha: the offload bucket usually already notifies the 10x indexer's SQS, and S3 allows only one notification config per overlapping prefix, so both recipes fan out via SNS rather than a second raw bucket notification. Caveats: Datadog is logs-only (use log10x_backfill_metric for per-pattern metrics), and the Splunk SQS-based input collects only objects created after setup (backfill older data with a Generic S3 input). Read-only: it generates config and does not create AWS resources or mutate any env document. Input parameters: - `account_id` (string, required): AWS account ID that owns the bucket (same account the SIEM connector runs in). - `bucket` (string, required): The offload bucket the SIEM should read (where 10x writes the NDJSON). - `datadog_forwarder_arn` (string): ARN of an already-deployed Datadog Forwarder Lambda (datadog only). Omit to leave a placeholder. - `index` (string): Splunk index for the input. Default "main". - `prefix` (string): Offload key prefix the SIEM should watch. Default "app/". - `region` (string): AWS region of the bucket. - `siem` (string, required): Which SIEM should pull the offload: datadog (Forwarder Lambda), splunk (Add-on SQS-based S3 input), or both. - `sourcetype` (string): Splunk sourcetype for the input. Default "log10x:offload". - `sqs_queue_name` (string): Name for the SQS queue the Splunk input drains (splunk only). Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_top_patterns` (~1053 tokens) Top patterns Rank log patterns by byte volume and cost per pattern (bytes priced at the destination's $/GB rate when one is set), over a time range, for one service or all. Each row carries a trajectory badge (NEW, ACUTE, GROWING, STABLE or SHRINKING) read against 7, 14 and 21 day baselines. Use for "what is expensive right now", "what are the noisy patterns in this hour", "give me a snapshot of my loudest events". For "what changed this week" or "did the deploy add cost", use `log10x_whats_changing`, which ranks patterns by change against a `comparison_window` baseline. Can be scoped by service label. `timeRange` accepts free-form `` durations (e.g., `48h`, `3d`, `15m`): there's no enum snap. Pass `include` to choose which cohort to rank: `kept` (default, what the Receiver forwarded), `dropped` (the offloaded / overflow cohort alone), or `both` (total ingest pre-receiver). Use `dropped` for "what is the receiver throwing away" and `both` for an apples-to-apples pre/post comparison. Accepts siem_lens (what-if destination): keeps the measured volumes, prices + gates for that destination at list rates, and stamps siem_actual vs siem_lens in the envelope. REQUIRES Reporter-tier metrics. Before anything is deployed, the POC tools answer the same question from the user's own logs. Input parameters: - `analyzerCost` (number): DEPRECATED: use effective_ingest_per_gb. stack ingestion cost in $/GB. Auto-detected from profile if omitted. - `effective_ingest_per_gb` (number): Customer-supplied $/GB rate used for the dollar overlay. When set, headline tags `rate_source=customer_supplied`. When absent, falls back to the destination default rate (`rate_source=list_price`; a… - `environment` (string): Environment nickname (for multi-env setups). - `include` (string): Which engine-decision cohort to scope to. `kept` (default) = events the engine forwarded as-is (routeState!="drop"): the pre-PL-12 behavior. `dropped` = events stamped routeState="drop" by the engine… - `include_chart` (boolean): Set include_chart=true to embed the rendered chart inline (large; default false to avoid response truncation). - `limit` (number): Number of patterns to return. Default 10. - `monthly_volume_gb` (number): What-if volume lens (forecast mode): model the environment at THIS monthly volume (decimal GB/month) instead of its measured volume. The real per-pattern shares and pattern mix are held fixed; only a… - `offset` (number): Skip the first N patterns of the ranked result (for pagination). Default 0. - `service` (string): Service name to scope the result. Omit for all services. - `severity` (string): Severity level to scope the result (e.g., `ERROR`, `CRITICAL`, `DEBUG`). - `siemScope` (string): Ignored: the summary envelope carries no verbatim sample line. Accepted so existing callers still validate. - `siem_lens` (string): What-if destination lens: keep the measured volumes, price the $/mo columns at this destination's default rates (env-configured rates never cross destinations). Envelope stamps siem_actual vs siem_le… - `timeRange` (string): Time range to aggregate over. Default 1h. - `verbose` (boolean): When true, every card carries the full forwarder snippet inline, every CTA renders unconditionally, and the volume-trend chart shows on every top-3 card. Default: compact mode (snippet templated once… - `view` (string): Output format. Always "summary": the structured JSON envelope with patterns, incidents, totals, and chained-tool action hints. Field retained for backward-compat with callers that still pass `view: "… Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_pattern_diff` (~620 tokens) Pattern diff (set diff across a time boundary) Compare which log patterns are new, gone, persistent or back again between two adjacent time windows. Compares pattern presence in two windows (the most recent `timeRange` window as "after" vs the immediately preceding `timeRange` window as "before") and returns four sets: `new` (present after, absent before), `retired` (present before, absent after), `persistent` (present in both), and `re_emerged` (flagged as new but existed prior to the before-window, the "the bug we thought we fixed is back" case, derived by checking first_seen against the before-window boundary). Plus `co_emergence_clusters`: groups of 3+ patterns whose first_seen timestamps cluster within ±co_emergence_window_seconds (default 60s). That cluster is a deploy fingerprint: no CI/CD integration required; the agent can then query the customer's deploy system externally with the cluster timestamp. The two windows compare because a pattern's hash comes from the line, the symbol library and the engine configuration, not from what a query saw: under the same engine, library and configuration the same line carries the same hash in both windows. Use for "what changed since last deploy", "which patterns disappeared this week", "did the rollback bring back the old errors", or paired with log10x_pattern_examples on a flagged hash to see slot distribution. Scoping: `service` and `severity` narrow the universe; `limit` caps rows per category. Returns structured envelope under `data.diff` with the four sets plus an `incidents` block when co_emergence clusters are detected. An engine upgrade that changes the naming rules renames the patterns it affects once: across that boundary they show as `new` and their old names as `retired`, and the frequent ones form a co-emergence cluster at the upgrade time. Input parameters: - `analyzerCost` (number): stack ingestion cost in $/GB. Auto-detected from profile. - `co_emergence_window_seconds` (number): Time spread for clustering co-emergent patterns. Default 60s: tight enough to fingerprint a single deploy. - `environment` (string): Environment nickname (for multi-env setups). - `limit` (number): Max rows per category (new / retired / persistent / re_emerged). Default 20. - `min_co_emergence_cluster_size` (number): Minimum cluster size to emit. Default 3: 2 patterns sharing a timestamp is often coincidence. - `service` (string): Service name to scope. Omit for all services. - `severity` (string): Severity to scope (e.g. `ERROR`, `CRITICAL`). - `timeRange` (string): Window size on both sides of the boundary. The tool compares the most recent `timeRange` ("after") against the immediately preceding `timeRange` ("before"). Example: `timeRange: "1d"` compares today… - `view` (string): Output format. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_whats_changing` (~627 tokens) What's changing: patterns ranked by delta vs baseline Patterns ranked by delta vs a baseline window: the "what grew (or shrank) the most since X" question. Distinct from `log10x_top_patterns` which ranks by current cost; this tool ranks by delta and applies gates (`min_delta_usd`, `min_delta_contribution_pct`) that drop noise-level changes. `comparison_window: "auto"` (default) averages three offsets (1×, 2×, 3× the timeRange) for noise smoothing; specific offsets like `"7d"` compare to a single anchor, e.g. `{timeRange: "1d", comparison_window: "1d"}` is today vs yesterday (deploy-delta), `{timeRange: "7d", comparison_window: "7d"}` is this week vs last week. Brand-new patterns (no baseline samples) are EXCLUDED: they go to `log10x_whats_new` for clean separation of stories. Use for "what grew most this week", "which patterns regressed after the deploy", "what's driving cost up since yesterday". Returns patterns with per-row delta_usd, baseline_usd, current_usd, delta_pct, and a flag for whether each row crossed the contribution gate. Input parameters: - `analyzerCost` (number): SIEM ingestion cost in $/GB. Auto-detected from profile if omitted. - `comparison_window`: Baseline window to compare against. `"auto"` (default) averages three offsets (1×, 2×, 3× the timeRange) for noise smoothing. A specific offset like `"7d"` compares to that single anchor: e.g. `{time… - `environment` (string): Environment nickname (for multi-env setups). - `limit` (number): Max patterns to return. Default 10. - `min_delta_contribution_pct` (number): Contribution gate as a percentage. A row's delta must be at least this fraction of total positive delta to be surfaced. Default 5. Set to 0 to disable. - `min_delta_usd` (number): Dollar floor for delta. Rows with delta < min_delta_usd are dropped. Default $500/wk scaled to the selected timeRange window. Set to 0 to disable. - `service` (string): Service name to scope the result. Omit for all services. - `severity` (string): Severity level to scope (e.g. `ERROR`, `CRITICAL`). - `timeRange` (string): Current window to evaluate. Day-level only: delta math requires day-aligned baseline offsets. For sub-day spike investigation use `log10x_pattern_trend` or `log10x_investigate`. - `view` (string): Output format. `summary` returns the structured envelope; `markdown` returns a rendered table. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_whats_new` (~461 tokens) What's new: patterns by first_seen recency Patterns whose first_seen timestamp falls inside a recency window: the "what showed up recently" question. Distinct from `log10x_top_patterns` (current cost ranking) and `log10x_whats_changing` (delta vs baseline). New patterns have no baseline, so delta math is meaningless; this tool exists so they get a clean home and don't pollute the changing-vs-baseline surface. Implementation: queries bytes_per_pattern in the current `timeRange` window to find candidate hashes, then for each hash queries the 30-day history to find the earliest non-zero datapoint via `fetchFirstSeenBatch`. A pattern is "new" when its first_seen timestamp is younger than `first_seen_within` (default `1d`). Default sort: by first_seen recency descending (most recent first). Use `first_seen_within: "1h"` for incident triage, `"1d"` for daily-deploy review, `"7d"+` for weekly observability hygiene. Returns patterns with first_seen, age, cost_now_usd, bytes_now, events_now, and the service + severity attribution. An engine upgrade that changes the naming rules renames the patterns it affects once, so the first windows after it list those patterns here as new, first seen from the upgrade on. Input parameters: - `analyzerCost` (number): SIEM ingestion cost in $/GB. Auto-detected from profile if omitted. - `environment` (string): Environment nickname (for multi-env setups). - `first_seen_within` (string): Patterns whose first-seen timestamp is younger than this are "new." Default `1d`. Use `1h` for incident triage, `1d` for daily-deploy review, `7d`+ for weekly observability hygiene. - `limit` (number): Max patterns to return. Default 10. - `service` (string): Service name to scope the result. Omit for all services. - `severity` (string): Severity level to scope (e.g. `ERROR`, `CRITICAL`). - `timeRange` (string): Time range used to score current cost. Default 1h. - `view` (string): Output format. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_services` (~493 tokens) Services [FRESH-SESSION ROUTING: if this is the user first cost question of the session, call log10x_start first instead, it returns the orientation menu the user needs before any per-tool action.] List every service the Log10x pipeline is watching, ranked by byte volume (with cost overlay when $/GB is set) plus per-service share of total AND the four action-axis columns (bytes_passed / bytes_offloaded / bytes_compacted / bytes_dropped) derived by joining routeState="drop" events against the cap-CSV. Pass `exception_services` to mark customer-flagged services as current_mode=pass: their next_action points at log10x_pattern_mitigate instead of log10x_configure_engine. Input parameters: - `analyzerCost` (number): SIEM ingestion cost in $/GB - `environment` (string): Environment nickname - `exception_services` (array): Customer-flagged services that must stay in the SIEM with full retention (audit / regulatory / executive). Per row, marks current_mode="pass" and points next_action at pattern_mitigate instead of the… - `monthly_volume_gb` (number): What-if volume lens (forecast mode): model the environment at THIS monthly volume (decimal GB/month) instead of its measured volume. The real per-pattern shares and pattern mix are held fixed; only a… - `siem_lens` (string): What-if destination lens: price the per-service $/mo columns at this destination's default rates instead of the connected pipeline's (env-configured rates never cross destinations). Volumes/patterns… - `timeRange` (string): Time range. Sub-day values available for incident-window service ranking. '24h' and '1d' are equivalent. - `view` (string): Output format. Always "summary": the typed envelope (data.services[], data.totals). Field retained for backward-compat. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_overflow_contents` (~263 tokens) Overflow contents The contents view of the customer-owned offload S3 bucket: per-pattern bytes, event count, time-first-seen, time-last-seen, and growth rate. Filtered to action=offload via the cap-CSV the MCP wrote (`drop` patterns are NOT in S3; `compact` and `tier_down` route elsewhere). Call this as the maintenance-loop review: "what's accumulating in my overflow queue?" Routes the agent to log10x_retriever_query to fetch the offloaded events when an incident or audit needs them. Input parameters: - `environment` (string): Environment nickname - `limit` (integer): Cap on the number of per-pattern rows returned. Total bytes always reflect the full overflow, even when rows are truncated. - `service` (string): Filter to a single service. Omit for the full overflow queue across every service that routes to S3. - `timeRange` (string): Window over which to compute overflow contents. 30d matches the maintenance-loop cadence; sub-30d windows for incident-window probes. '24h' and '1d' are equivalent. - `view` (string): Output format. Always "summary": the typed envelope (data.patterns[], data.totals). Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_discover_labels` (~146 tokens) Discover labels List the labels Log10x metrics can be filtered or grouped by. Call at the start of a session, or before calling any tool that takes a label/filter argument: stops the model from guessing label names like "namespace" when the label is "k8s_namespace". Pass a label name to get its distinct values. Input parameters: - `environment` (string): Environment nickname (for multi-env setups). - `label` (string): If set, return distinct values for this label (e.g., "tenx_user_service" returns every service). If omitted, return the full label name list. - `limit` (number): Max values to return when a label is specified. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_investigate` (~573 tokens) Investigate Single-call root-cause investigation for any log line, pattern, service, or environment. Returns a complete causal chain (for acute spikes) or co-drifter cohort (for gradual drift) with confidence scores derived mechanically from data signal quality, plus ready-to-run verification commands. Per-pattern blocks include `offload_status` (pass / sample / compact / drop) so the narrative reflects whether the receiver is admitting or dropping the implicated patterns, matching `top_patterns` and `pattern_trend`. Call whenever the user asks 'what is going on with X', 'why is X spiking', 'investigate X', or pastes a log line / alert and asks for diagnosis. Input is the user's natural-language target: pass their words verbatim. The tool detects whether the input is a raw log line, pattern identity, service name, or 'environment' and runs the appropriate flow. It also detects whether the trajectory is acute or gradual drift and renders a different report shape for each. Confidence percentages decompose into named sub-scores (stat × lag × chain for acute; slope_sig × cohort for drift): walk the user through the decomposition when asked. Show the entire markdown report to the user without modification. Input parameters: - `baseline_offset` (string): Offset for the baseline comparison. Defaults to `24h` for short windows (acute-spike cases) and to the same value as `window` for long windows (≥7d, drift cases). Override only if you need a non-stan… - `depth` (string): `shallow`: anchor service only. `normal` (default): anchor service + immediate dependencies. `deep`: full environment-wide. - `environment` (string): Environment nickname: required in multi-env setups. - `starting_point` (string, required): The user's target, verbatim. Can be a raw log line, a pattern identity (symbolMessage or tenx_hash), a service name, or the literal string "environment"/"all"/"audit". The tool detects the mode autom… - `timeRange` (string): Alias for `window` for consistency with other Log10x tools. If both are set, `window` wins. - `use_bytes` (boolean): Use byte-based rate instead of event-count. Event-count is strongly preferred; use only if the Reporter does not emit the count metric. - `window` (string): Analysis window. Defaults to `1h` for acute-spike cases; `30d` recommended for drift cases. Accepts any PromQL-style duration string (`15m`, `1h`, `6h`, `24h`, `1d`, `7d`). Alias: `timeRange`. If nei… Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_find_skew` (~457 tokens) Find skew Identify patterns where one slot value dominates the field (>= 60% of events by default). Surfaces sampling opportunities: "slot `verb` is `get` 78% of events, sample the get case at 1/10 to cut its volume." Sampling is lossy: the other 9 in 10 of those events are discarded. Differentiated against analyzer field histograms because the engine groups by per-pattern field-set, so dominance is measured within the structural pattern, not globally. **Stage 1**: accepts events as a paste array (same shape as log10x_resolve_batch). **Calibration**: the 60% concentration floor and 1/10 sampling rate are hand-picked defaults tagged `unvalidated_default` in the output. The envelope surfaces the empirical `observed_dominant_pct_distribution` across all candidate slots so the agent can judge whether 0.6 is well above or below the noise floor for this dataset. See `docs/cross-pillar-primitives.md` for the agent behavior contract. Input parameters: - `events` (array, required): Events to analyze for slot skew. Same shape as log10x_resolve_batch: raw strings or JSON objects. Each event is templated locally; skew is computed across the resulting patterns. - `min_concentration` (number): Minimum dominant-value fraction for a slot to be flagged as skewed. Default 0.6 (a slot is "skewed" when one value is 60%+ of events). Hand-picked default tagged as `unvalidated_default` in the outpu… - `min_events` (number): Minimum events per pattern to bother checking. Default 10 (filters low-sample noise). - `sample_n` (number): Sampling rate N for the savings projection (1/N of the dominant case kept). Default 10. Same calibration caveat: sample_n=10 is a defensible starting point but not validated for any specific cost tar… - `top_n` (number): Number of findings to return. Default 20. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_resolve_batch` (~432 tokens) Triage Templatize a batch of log events and return per-pattern triage. **This is one of two tools that run a local Log10x pipeline on the user's machine** (the other is `log10x_extract_templates`): call this whenever the user asks 'can you run log10x locally', 'do a local pipeline run', 'templatize these events', or supplies any batch to analyze (Datadog/Splunk/Elastic query results, Slack incident attachments, kubectl logs, raw text). Does NOT need Kubernetes, a deployed Reporter, or a Log10x account: the pipeline runs in-process on the host. Output structures the batch by a paste-local templateHash with per-pattern frequency + severity + full template structure + per-slot variable distribution. Each top pattern carries `actions[]` chaining to `log10x_investigate` (historical correlation) and `log10x_retriever_query` (offload retrieval). Do NOT call for single-line resolution: use `log10x_event_lookup` for that. REQUIRES a local engine: the tenx binary on PATH, or Docker with LOG10X_TENX_MODE=docker. Input parameters: - `environment` (string): Environment nickname: used to build next_actions that call log10x_investigate. - `events`: Inline log lines: an array of lines, or a single newline-separated string (both accepted). `source` need not be set. - `include_next_actions` (boolean): Whether to generate next_action suggestions for each top pattern. - `path` (string): Local file path when source=file. Required for file mode. - `source` (string): Optional: auto-inferred from whichever of `events` / `text` / `path` you actually provide, so you normally do not set it. Provide explicitly only to disambiguate when more than one is present. - `text` (string): Raw text blob when source=text: newline-separated log events. - `top_n_patterns` (number): How many patterns to return in the ranked triage. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_compile` (~2839 tokens) Compile symbol library Compile a symbol library from any mix of sources, waiting inline for the result when it is quick and handing back a pollable `job_id` when it is not. It waits up to `max_wait_ms` (default 45s): a small compile, and EVERY re-run (which reuses prior units via the pinned output folder), finishes inside that window and returns the finished library plus the full scan/link diagnostics in ONE call; a long first compile of a large tree overruns the wait and returns a running `job_id` to poll with log10x_compile_status, or just call this tool again later, since the output is pinned and a finished run is returned by the next call. `max_wait_ms: 0` returns the job_id immediately (fire-and-forget). Sources combine freely: a local folder of source code / binaries (`source_path`), GitHub repositories via the GitHub REST API (`github_repos`, with optional `github_branch` / `github_folders`), docker/OCI images (`docker_images`), Helm charts (`helm_charts`), and Artifactory artifacts (`artifactory_instance` + `artifactory_repo`, with `artifactory_files` / `artifactory_folders`). The run scans the sources (Java, Go, Python, JS/TS, Scala, C/C++, C#, plus binaries) and writes per-file `.10x.json` symbol units plus a single linked `.10x.tar` library, the AOT artifact the 10x runtime later uses to assign hidden classes (TenXTemplates) to events. GitHub pull REQUIRES a token even for public repos: pass `github_token` or set GH_TOKEN; without one the tool returns not_configured. Docker-image pull is daemonless (podman bundled in compiler-10x, `--cap-add SYS_ADMIN` granted automatically) and public images need no credentials. Helm pull is a meta-source (renders the chart, by default also pulls the images it references); OCI/URL chart refs resolve standalone while a bare `repo/chart` needs a matching `helm_repos` entry. Artifactory pull needs a token (`artifactory_token` or ARTIFACTORY_TOKEN). REQUIRES the COMPILER flavor: runs `log10x/compiler-10x @apps/compiler` by default, or a local com… Input parameters: - `artifactory_files` (array): Specific files within artifactory_repo to pull, each a repo-relative path (e.g. ["dist/app-1.0.0.tar.gz"]). Combine with artifactory_folders; at least one of the two is required when pulling from Art… - `artifactory_folders` (array): Folder paths within artifactory_repo to pull (e.g. ["com/acme/app"]). Traversed recursively unless artifactory_recursive is false. At least one of artifactory_files / artifactory_folders is required… - `artifactory_instance` (string): Base URL of an Artifactory instance to pull artifacts (Java archives, .NET assemblies, etc.) from and scan, e.g. "https://demo.jfrog.io/artifactory". Requires artifactory_repo and a token (artifactor… - `artifactory_recursive` (boolean): Whether artifactory_folders are pulled recursively (sub-folders too). Default true. Ignored when only artifactory_files are given. - `artifactory_repo` (string): Artifactory repository key to pull from, e.g. "libs-release-local". Required when artifactory_instance is given. Scope the pull with artifactory_files and/or artifactory_folders. - `artifactory_token` (string): Artifactory API access token for artifactory_instance. Falls back to ARTIFACTORY_TOKEN from the MCP server environment. Required when pulling from Artifactory. Reaches the compiler as process environ… - `docker_images` (array): Docker/OCI images to pull and scan for symbols, as image refs, fully-qualified recommended (e.g. ["docker.io/grafana/grafana:11.1.0"]; a port-bearing host like "harbor.corp:8443/team/app:2.1" is fine… - `docker_token` (string): Registry token/password for docker_images (fed to `docker login --password-stdin` against the default registry, Docker Hub). Falls back to DOCKER_TOKEN from the MCP server environment. Omit for publi… - `docker_username` (string): Registry username for docker_images login, also used for private images a Helm chart references (helm_pull_images). Authenticates the default registry (Docker Hub). Falls back to DOCKER_USERNAME from… - `github_branch` (string): Branch to pull for ALL github_repos. Omit to pull each repo's default branch. - `github_folders` (array): Folders within each GitHub repo to pull (e.g. ["src/main/java"]). Omit to pull entire repos. Narrowing this speeds up both the pull and the scan. - `github_repos` (array): GitHub repositories to pull (via the GitHub REST API) and scan, each as owner/repo (e.g. ["apache/commons-cli"]). REQUIRES a GitHub token, even for public repos: pass github_token, or have GH_TOKEN /… - `github_token` (string): GitHub access token for github_repos (a fine-grained token with read-only Contents access to the target repos suffices). Falls back to GH_TOKEN / GITHUB_TOKEN from the MCP server environment. Reaches… - `helm_charts` (array): Helm charts to render and scan, as chart refs. A meta-source: the compiler runs `helm template` / `helm show chart` to extract the docker images and GitHub source repos the chart references, then (by… - `helm_pull_images` (boolean): Whether to pull + scan the docker images a chart references (the richest symbol source for a chart). Default true. When true the tool grants the compile container `--cap-add SYS_ADMIN` (daemonless po… - `helm_pull_repos` (boolean): Whether to pull + scan the GitHub source repos a chart references (via org.opencontainers.image.source annotations). Default false because it REQUIRES a GitHub token (engine refuses an empty token);… - `helm_repos` (array): Helm chart repositories to register before resolving helm_charts, each as "name=url" (e.g. ["ingress-nginx=https://kubernetes.github.io/ingress-nginx"]). Required for bare "repo/chart" names; unneces… - `library_name` (string): Base name for the linked .10x.tar library file and the compile runtimeName. Sanitized to [A-Za-z0-9_.-]. - `max_wait_ms` (integer): How long to wait inline (ms) for the compile to finish before handing back a job_id to poll. Default 45,000 (45s): small compiles, and re-runs over unchanged local sources (the engine skips files who… - `mode` (string): Execution backend. `auto` (default) prefers Docker (the compiler image, guaranteed compiler flavor) and falls back to a local compiler-flavor tenx; the backend is chosen once, before the output folde… - `output_path` (string): Absolute path where the symbol library is written (the .10x.json units and the linked .10x.tar). Defaults to a fresh temp directory, returned in the result as data.payload.output.folder. - `source_path` (string): Absolute path to a local folder of source code / binaries to scan, traversed recursively. Parsed with a grammar or AST: Java, Scala, Python, Go, C/C++, C#, JavaScript, TypeScript (.ts; .tsx goes thro… - `timeout_ms` (integer): Hard cap on compile wall time in milliseconds. Default 1,800,000 (30 min). The engine's own whole-scan cap (scanOperationTimeout, bundled default 10 min) is raised to 90% of this value on the command… Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_compile_status` (~332 tokens) Compile status Poll an asynchronous compile started by log10x_compile (or a link started by log10x_compile_link), by its `job_id`. Returns `job_status` (running / completed / failed / timed_out), the units produced so far + the linked `.10x.tar` (path + size), elapsed time, the engine exit code, and a credential-redacted tail of the engine log. Crucially, it promotes the engine's scan/link DIAGNOSTICS into the envelope so the compiler is not a black box at 100k to 500k file scale: per-language scan-failure counts with capped failure samples (which files failed to parse and why), and the link report (units merged / skipped, files excluded by folder/name filter, and the symbol-type histogram: class / enum / log / exec). Those appear once the compiler-10x image carries the engine diagnostics change; on an older image the tool degrades to unit counts + the log tail. The first terminal poll captures the exit code into the job record and frees the container; later polls stay readable and the compiled library is never removed. Input parameters: - `job_id` (string, required): The job id returned by log10x_compile (data.payload.job_id). - `log_lines` (integer): How many trailing engine-log lines to include in data.payload.log_tail (credential-redacted). 0 to omit. Raise it when diagnosing a failed or incomplete run. - `view` (string): summary returns the typed envelope (data.payload.job_status, .loss_markers, .diagnostics, .output, .log_tail). Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_compile_link` (~564 tokens) Link symbol units Link an existing folder of `.10x.json` symbol units (from a prior compile) into a single `.10x.tar` library, with NO source scan. This is the same compiler-flavor Compiler app invoked with link-only arguments: the units folder is the `outputSymbolFolder` and no source is mounted, so the engine reuses the units already on disk (scans 0 new files) and merges them into the library, which is written into that same folder. Like log10x_compile it waits inline up to `max_wait_ms` (default 45s; linking is usually fast, so it normally returns the linked library in ONE call) and otherwise hands back a `job_id` to poll with log10x_compile_status. Use it to re-link after editing or pruning units, to assemble a library from a units tree built piecemeal, or to rebuild a library from the output folder of a prior log10x_compile. REQUIRES the COMPILER flavor (runs `log10x/compiler-10x @apps/compiler` by default, or a local compiler-flavor `tenx` with mode="local"; an engine reporting the flavor as `cloud` is accepted, the native runtime build is refused). No Kubernetes or Log10x account needed. Input parameters: - `library_name` (string): Base name for the linked .10x.tar and the runtimeName. Sanitized to [A-Za-z0-9_.-]. - `max_wait_ms` (integer): How long to wait inline (ms) for the link to finish before handing back a job_id to poll. Default 45,000 (45s). Linking usually finishes inside this and returns the library in ONE call. A very large… - `mode` (string): Execution backend, same contract as log10x_compile's `mode`: `auto` prefers the compiler image, `docker` forces it, `local` uses a compiler-flavor tenx. Only the compiler flavor can link; see log10x_… - `timeout_ms` (integer): Hard cap on link wall time in ms. Default 600,000 (10 min). Linking is much faster than scanning, but a very large units tree can still take minutes. - `units_path` (string, required): Absolute path to a folder of .10x.json symbol units (produced by a prior compile) to link into a single .10x.tar library. Traversed recursively; the existing units are merged with NO source re-scan,… Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_extract_templates` (~433 tokens) Extract templates Extract the structural template library from a set of log lines by running a local Log10x pipeline on the user's machine. Returns per-template records (the engine-internal templateHash + the template body with variable slots) and event count. Companion to `log10x_resolve_batch`: both tools answer 'can you run log10x locally / templatize these events'. Does NOT need Kubernetes, a deployed Reporter, or a Log10x account; the pipeline runs in-process on the host via either a locally-installed `tenx` binary or a `docker run log10x/pipeline-10x` container. Use for: (a) bootstrapping a pattern catalog before wiring up a Reporter, (b) offline auditing of stored log files, (c) validating that a config change produces expected template identities. **Validation mode**: pass `expected.min_templates`, `expected.required_patterns`, and/or `expected.forbidden_merges` to turn extraction into assertion-checked validation, each assertion reports PASS/FAIL in the output. REQUIRES a local engine: the tenx binary on PATH, or Docker with LOG10X_TENX_MODE=docker. No preflight checks for it: log10x_doctor does not probe the engine. Input parameters: - `events` (array): Inline log lines when source=events. - `expected` (object): Optional assertions: turns extraction into validation. Each assertion reports pass/fail in the output. - `path` (string): Local file path or glob when source=file. - `source` (string, required): Input mode. `file`: read from a local path/glob. `events`: array of raw log lines. `text`: newline-separated log events as a single string. - `text` (string): Raw text blob when source=text. - `top_n` (number): Max templates to return. - `view` (string): summary returns the typed envelope (data.templates[], data.event_count, data.assertions, data.human_summary). The deprecated markdown view was removed; data.human_summary carries the prose distillati… Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_retriever_query` (~1348 tokens) Retriever query Fetch offloaded log events from the customer's own S3 bucket by pattern hash or by a variable value, reading only the byte ranges whose Bloom filters can hold a match, without a full scan. The use case: events the Receiver offloaded to the customer's S3 bucket instead of the SIEM, over any window the bucket holds. The Bloom filters cover each event's template hash and variable values. Matched events land as a list of `*.jsonl` objects in the customer's S3; the tool returns an in-context preview (capped by `limit`) PLUS `data.results_location` (the S3 bucket + prefix holding the full object set). A capable agent reads those objects directly to answer, or hands the S3 object list to the customer's own S3-to-SIEM path. No re-ingestion pipeline, no proprietary format. The envelope additionally carries per-pattern `offload_status` so retrieval results agree with the live metric-surface disposition (pass / sample / compact / drop) without a second tool call. Call for: offloaded events of a pattern; events filtered by a variable value that is not a faceted SIEM dimension (e.g. 'all payment_retry events for customer acme-corp 90 days ago'); compliance / audit / forensic exact retrieval; confirming what the Receiver offloaded for a given pattern. Optional JavaScript `filters` refine over payloads after the Bloom-scoped fetch. For a time-bucketed series instead of raw events, use `log10x_retriever_series`. The envelope carries by_severity / by_service / by_day rollups with a rollup_basis provenance stamp (qrs_summaries = whole-match from engine summaries; events_capped = derived from the capped download). Input parameters: - `bucket_size` (string): Bucket size when format=aggregated or ephemeral_series. Examples: `1m`, `5m`, `1h`, `1d`. - `debug` (boolean): Escalate the CloudWatch log level to DEBUG for THIS query only: per-blob Bloom decisions, per-fetch S3 reads, per-event results-writer samples. Use only when normal-run diagnostics cannot explain a 0… - `environment` (string): Environment nickname: required if multi-env. - `filters` (array): JavaScript filter expressions evaluated in-memory against each decoded event after the Bloom-scoped fetch. Full TenX JS API: `this.customer_id === "acme-corp"`, `this.http_code.startsWith("5")`. Filt… - `format` (string): `events` (default: raw events), `count` (total + severity/service rollups, no event bodies), `aggregated` (events bucketed into a time series, use with bucket_size), `ephemeral_series` (bucketed seri… - `from` (string, required): Start of the query window. Accepts ISO8601 (`2026-01-15T00:00:00Z`), epoch millis, or relative (`now-1h`, `now-24h`, `now-7d`). Normalized to the engine's `now("-1h")` form before dispatch. - `limit` (number): Hard cap on events returned after merging per-worker result files. Default 500. Typical conversational queries want 10-100; the LLM will render only the first 50. - `pattern` (string): Reporter-named pattern (Symbol Message). NOT SUPPORTED against the offload bucket: passing it returns an error naming the remedy, rather than a silent empty result. A Symbol Message is a label DERIVE… - `pattern_hash` (string): Canonical pattern_hash from top_patterns / event_lookup. When provided, search is auto-built as `includes(text, "")` and no name resolution runs. It matches the stamped hash as a TEXT TOKEN bec… - `result_target` (string): Tier-1 result-sink redirect: write this query OUTPUT (events, summaries, markers) under tenx// in the same bucket instead of the default target, e.g. to a prefix a SIEM connector watch… - `search` (string): Bloom-filter search expression using the TenX subset: `==`, `||`, `&&`, `includes(field, "substr")`. Example: `severity_level=="ERROR" && includes(text, "ECONNREFUSED")`. Selective values are dramati… - `target` (string): Target app/service prefix to scope the index scan. Defaults to __SAVE_LOG10X_RETRIEVER_TARGET__ (env var). Required if no default is configured. - `to` (string): End of the query window. Same grammar as `from`. Default `now`. - `view` (string): summary returns the typed envelope (data.events_matched, data.events[], data.query_id, data.diagnostics, data.human_summary). The deprecated markdown view was removed; data.human_summary carries the… Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_retriever_series` (~794 tokens) Retriever time series Materialize a fidelity-aware time series from the customer's S3 offload bucket over an arbitrary window, with optional group-by on enrichment fields. Auto-selects between exact full aggregation (Strategy A) and per-window-sampled fan-out (Strategy B) based on Reporter pattern volume: small/moderate-volume queries get exact counts; high-volume / long-window queries get a sampled series with time-distribution + group-ranking fidelity preserved and tail caveats reported. Pathological volume is refused with structured narrowing guidance, never silently truncated. Call when: (a) the user wants a 'rate of pattern X over the last 30 days, broken down by tenant' answer that exceeds SIEM retention/budget, (b) a baseline needs building from cost-driver patterns where Prometheus has continuous metrics but the *grouped breakdown* lives only in the offload bucket. Use `log10x_retriever_query` instead for the event payloads (not aggregates). Input parameters: - `bucket_size` (string): Time bucket granularity (`1m`, `5m`, `1h`, `1d`). Determines the resolution of the output series. - `environment` (string): Environment nickname: required if multi-env. - `fidelity` (string): `auto` (tool decides via Reporter volume + window length), `full` (force exact aggregation: may exceed Lambda budget), `per_window_sampled` (force sampling, default K=1000 per sub-window), or `per_wi… - `filters` (array): In-memory JS filters applied after the Bloom-scoped fetch (AND-combined). - `from` (string, required): Start of the query window. ISO8601, epoch millis, or relative (`now-1h`, `now-7d`, `now-30d`). - `group_by` (string): Optional enrichment field to group the series by: e.g., `tenx_user_service`, `severity_level`, `k8s_namespace`. Top-1000 group values are retained; tail collapsed to `_other_`. - `pattern` (string): Reporter-named pattern (Symbol Message). NOT SUPPORTED against the offload bucket: passing it returns an error naming the remedy, rather than a silent empty result. A Symbol Message is a label DERIVE… - `search` (string): Bloom-filter search expression using the TenX subset. Tightly bound queries (e.g., `includes(text, "")`, `severity_level == "ERROR"`) are dramatically cheaper. (legacy example removed:… - `target` (string): Target app prefix. Defaults to __SAVE_LOG10X_RETRIEVER_TARGET__. - `to` (string): End of the query window. Same grammar as `from`. Default `now`. - `view` (string): summary returns the typed envelope (data.mode, data.bucket_seconds, data.series_count, data.points_returned, data.top_groups, data.caveats, data.human_summary). The deprecated markdown view was remov… Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_retriever_query_status` (~498 tokens) Retriever query status Post-hoc diagnostic surface for a specific retriever query, addressed by `queryId` (returned from `log10x_retriever_query` or recovered from the S3 results prefix). Pulls the coordinator's `_DONE.json` stats (scanned / matched / streamRequests / streamBlobs / submittedTasks / expectedMarkers), counts per-worker byte-count markers under `q//`, lists result JSONL files under `qr//`, optionally filters CloudWatch events from the `queryLogGroup` for the queryId substring (when the chart's `queryLogGroup` is configured), and runs a diagnostics engine that classifies the run into states like `dispatcher_failure` (scanned=0 with submittedTasks>0), `results_not_uploaded`, or `observability_disabled`. When pod logs are reachable from the MCP host, fetches a tail and greps for the `cloud/streamer/subquery` include-resolution signature to confirm the dispatcher-failure category. Call this whenever `log10x_retriever_query` returns 0 events but the wall-clock implies scan work, or whenever an offline post-mortem needs the structured timeline for a specific queryId. Pass fetch_results: true to ALSO recover the completed results from S3 (10-event preview + counts + results_location) after a partial or timed-out query, without resubmitting. Input parameters: - `fetch_results` (boolean): When true and the query has completed, ALSO recover the results from S3: a 10-event preview, counts, and the results_location pointer, same core fields as a completed log10x_retriever_query. Use afte… - `include_pod_logs` (boolean): When true and a dispatcher_failure is suspected (scanned=0 + submittedTasks>0), attempt kubectl logs on the retriever pod to confirm the chart 1.0.20 include-resolution error. Requires kubectl access… - `query_id` (string, required): UUID of a previously-submitted retriever query. Returned as data.query_id from log10x_retriever_query. - `target` (string): Target app/service prefix used when the original query was submitted. Defaults to "app". Must match the target that was passed to the original query. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_retriever_probe` (~608 tokens) Retriever e2e probe End-to-end probe of the deployed Retriever chain. Fires a synthetic query at the picked top-volume tenx_hash (or an explicit target_hash) and asserts every stage in order: offload bucket has recent data, indexer pipeline is running (kubectl logs grep for 'starting pipeline - Tenx: @/apps/retriever/index'), SQS subquery + stream queues drained (depth ≤ 10), retriever pod containers all ready, then submits the query and asserts CloudWatch scan complete events have matched>0, CloudWatch stream worker complete events exist, S3 qr//*.jsonl files were written, and the MCP returned events_matched>0 AND events_returned>0. Returns a structured verdict (green / broken / unknown) with per-assert observed + remedy. Call this as the post-install verify step (chained from log10x_advise_retriever step_verify) OR as a deep doctor diagnostic when log10x_retriever_query returns 0 events and the cause is unclear. Catches the silent-failure shapes that take hours to debug manually: indexer not booted, stream pipeline launch failures, IRSA s3:PutObject misconfigured, MCP input_bucket misaligned with engine write location. Input parameters: - `input_bucket` (string): S3 bucket where the retriever WRITES qr//*.jsonl result objects. Default: read from the resolved env-config's `retriever.input_bucket` (walking K8s ConfigMap → AWS SSM → GCP Secret Manager → Azur… - `namespace` (string): Kubernetes namespace where the retriever pod runs. Default: "log10x". - `offload_bucket` (string): S3 bucket the receiver offloads data to (the bucket the retriever indexer reads from). Default: pick the `status="active"` entry from the resolved env-config's `offload_destinations[]` (walking K8s C… - `query_log_group` (string): CloudWatch log group the retriever writes per-query execution events to. - `target_hash` (string): Pre-picked tenx_hash to query for. When omitted, the probe queries the metric backend for the top-volume hash over the last 5 min. - `window_minutes` (number): Query window size in minutes. Default: 5. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_start` (~539 tokens) Log10x orientation CALL THIS FIRST whenever the user asks any open-ended cost question, says save X%, asks where do I start, what should I do, how can you help: before any other tool. Detects the customer's tier (Dev CLI / Reporter / Receiver / Retriever) via three live probes (gateway auth, Reporter metric counts, Retriever resolution), detects the SIEM, and returns a structured orientation envelope with three fields the agent follows: `must_render_verbatim` (markdown to show the user as is, without summarising), `must_ask_user` (a numbered question to ask before any follow-up tool call) and `forbidden_next_actions` (tools not to call until the user has picked an option). Also returns a 5-phase journey (Visibility → Attribution → Mitigation → Forensic → Commitment) showing where the customer is, an action menu gated by available capabilities (compact_installable, tier_down_available, offload_ready, forensic_query_available), and the resolved tier. The tool is read-only, takes an optional `intent_hint` (cost / forensic / install / orient), and is safe to call on any boot state: including when no env is configured yet (skips gateway/Reporter probes and treats the customer as Dev CLI tier). Accepts siem_lens (what-if destination): keeps the measured volumes, prices + gates for that destination at list rates, and stamps siem_actual vs siem_lens in the envelope. Input parameters: - `intent_hint` (string): Optional hint at what brought the user here. `cost` = wants to cut/save bill; `forensic` = wants to read back the offloaded cohort from the overflow bucket; `install` = wants to deploy; `orient` = fi… - `session_state` (string): Optional caller hint at where the user is in the session. `fresh` (default when omitted) = first message of a new chat, emit the full orientation envelope. `midway` = the agent has already surfaced t… - `siem_lens` (string): What-if destination lens: orient pricing/applicability for THIS destination while the pipeline keeps its actual one (the user's stack differs from the connected demo/env). Carry the same siem_lens on… Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_cost_options` (~577 tokens) Cost reduction options CALL THIS after the user picks 'show me what cutting costs would look like' from log10x_start. At Receiver/Retriever tier returns the 6-mode outcome-first menu (drop / sample / compact / tier_down / offload / observe_only), each gated by the customer's detected capabilities (receiver tier, SIEM type, offload bucket). At Reporter-only or Dev tier, collapses to 2 entries: observe_only + install_receiver (with prose explaining that the full 6-mode menu requires the Receiver in-path). All non-observe modes route to log10x_explain_mode. The envelope carries must_render_verbatim (show to user as-is), must_ask_user (numbered question), and forbidden_next_actions (do not call estimate_savings, configure_engine, or pattern_mitigate until the user picks). Accepts siem_lens (what-if destination): keeps the measured volumes, prices + gates for that destination at list rates, and stamps siem_actual vs siem_lens in the envelope. Input parameters: - `destination` (string): Destination stack. When set, routes_to.args carries THIS destination forward to estimate_savings: overrides the env-auto-detected SIEM. Pass when the upstream tool (baseline / configure_engine) alrea… - `monthly_volume_gb` (number): What-if volume lens (forecast mode), forwarded to the estimate_savings this menu routes to. cost_options scales nothing itself; it carries this value into routes_to.args so the projection survives th… - `pattern_hash` (string): Optional pattern hash to scope the cost option menu to a single pattern. When present, routes_to.args will include a proposed_config row for this hash. - `service` (string): Scope to a service. Passed forward to estimate_savings when the user picks a mode. - `siem_lens` (string): What-if destination lens (alias of `destination` with provenance stamping): gate the 6-mode menu and downstream pricing for THIS destination while the connected pipeline keeps its actual one. The env… - `splunk_pricing` (string): Splunk only: `ingest` (bytes per day) prices compact; `workload` (vCPU) meters compute, where compaction is not a saving, so the compact mode is gated with that reason. Set from what the user said; a… - `target_percent` (number): % reduction goal carried from log10x_start pick, pre-filled when the user stated a target. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_explain_mode` (~530 tokens) Explain enforcement mode CALL THIS AFTER log10x_cost_options when the user picks a mode. Explains the chosen enforcement mode (drop / sample / compact / tier_down / offload / observe_only) in service-level plain language, with dollar math when byte metrics are available. Returns must_render_verbatim (plain-text three-section card, no markdown), must_ask_user (Apply or Preview choice), and forbidden_next_actions (locks apply tools and log10x_preview_filter until the user picks). routes_to.apply routes all non-observe modes to log10x_configure_engine; observe_only has routes_to.apply === null (no enforcement step). routes_to.preview routes to log10x_preview_filter with { service, mode }. Input parameters: - `destination` (string): Auto-detected destination stack or forwarder. When omitted the tool infers from envs.json / env vars. Used to name the specific vendor in the explanation ("your Datadog workspace", "your Splunk index… - `effective_ingest_per_gb` (number): Customer-supplied $/GB rate used for the dollar overlay. When set, source_disclosure.rate_source='customer_supplied'. When absent, the shared rate resolver falls back to envs.json analyzerCost → LOG1… - `mode` (string, required): Which enforcement mode to explain. Keep-everything levers come first, then the lossy opt-ins. `compact` = keeps everything: engine minifies events; all events still reach the stack, and the destinati… - `service` (string, required): Service name to personalize the explanation with service-level volume and cost figures. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_preview_filter` (~230 tokens) Preview filter patterns CALL THIS AFTER log10x_explain_mode when the user picks Preview. Shows the list of patterns that would be affected by applying a given enforcement mode to a service, before any action is taken. Returns a fixed-width plain-text table (no markdown pipes) with columns: rank, descriptor, volume, %, service, severity, first seen, trend sparkline. Writes a CSV to /tmp/log10x-preview--.csv. must_ask_user offers: drill into pattern #N (calls log10x_pattern_detail), Apply, or go back to pick a different mode. forbidden_next_actions locks log10x_configure_engine, log10x_pattern_mitigate, and log10x_advise_retriever until the user commits. Input parameters: - `environment` (string): Environment nickname for multi-env setups. - `mode` (string, required): The enforcement mode being previewed. Controls which patterns are highlighted as affected. - `service` (string, required): Service to scope the preview to. - `top_n` (number): Number of patterns to surface. Default 20. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_pattern_detail` (~441 tokens) Pattern detail CALL THIS AFTER log10x_preview_filter when the user drills into a specific pattern by number. Returns a full single-pattern view: 24h line chart (up to 12 rows, 72 chars wide), ASCII horizontal bar chart for cross-service byte distribution (top 8 services), severity breakdown, and up to 5 sample events truncated to 120 chars each. Requires pattern_hash (tenx_hash from preview_filter.data.patterns[].tenx_hash). must_ask_user: Back to preview list, or Apply with this in the picture. actions[]: log10x_preview_filter (back) and log10x_configure_engine (apply). Input parameters: - `environment` (string): Environment nickname for multi-env setups. - `include_samples` (boolean): When true (default), attempts to fetch up to 3 full sample events from your stack. Set false to skip the stack round-trip. - `monthly_volume_gb` (number): What-if volume lens (forecast mode): model the environment at THIS monthly volume (decimal GB/month) instead of its measured volume. The real per-pattern shares and pattern mix are held fixed; only a… - `pattern` (string): Pattern name (Symbol Message, e.g. "Payment_Gateway_Timeout") as an alias for pattern_hash. Resolved to hash via metrics lookup. Provide either pattern or pattern_hash. - `pattern_hash` (string): The tenx_hash of the pattern to drill into. Obtained from log10x_preview_filter data.patterns[].tenx_hash. Preferred over pattern when available (skips a metrics lookup). - `timeRange` (string): Time window for the volume trend and sample events lookback. Default 7d. Pattern: ^\d+[mhd]$. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_measure_compaction` (~401 tokens) Measure compaction Measure per-pattern compact ratios (bytes before and after encoding) on a sample pulled from the customer's SIEM and run through a local engine; a ratio on that sample, not a SIEM meter reading. Pulls `sample_size` events for a service over `timeRange`, runs them through the local tenx engine, and returns per-pattern `compaction_ratio_x` (original bytes / encoded bytes) derived from that sample. Use this to replace the destination's default compact ratio in `log10x_estimate_savings` (one measured capture per destination, named in `compact_ratio_basis`) with ratios measured on this customer's sample. Requires: tenx CLI installed locally (LOG10X_TENX_PATH or `tenx` on PATH) AND SIEM credentials (same as `log10x_poc_from_siem_submit`). Confidence tiers: high (>=50 events), medium (10-49), low (<10). Results flow into `log10x_estimate_savings` to improve savings projections. REQUIRES a local engine: the tenx binary on PATH, or Docker with LOG10X_TENX_MODE=docker. Input parameters: - `environment` (string): Log10x environment id. Omit to use the default environment. - `sample_size` (integer): Number of events to pull from the stack for measurement. Default 500. Larger samples improve confidence (high confidence requires >=50 events per pattern) but take longer to pull and process. - `service` (string, required): Service name to scope the stack sample to. Used as the query filter (e.g., Datadog `service:`, Splunk `sourcetype=`, CloudWatch stream prefix). - `timeRange` (string): Lookback window for the stack pull. Format: where unit is m (minutes), h (hours), or d (days). Default "24h". Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_setup_recurring` (~1001 tokens) Set up recurring cost-reduction Conversational wizard that configures a scheduled cost-reduction tick (`tenx-recur`): each run clones the policy repo, recomputes the plan and pushes the changes. Walks the user through seven decisions: target services, savings target (%), tick schedule, scheduler runtime, gitops config repo, exception services, and final confirm, then emits two ready-to-commit artifacts: `policy.yaml` (the declarative policy the tick CLI consumes) and a scheduler manifest (Kubernetes CronJob YAML, GitHub Actions workflow, or crontab entry + wrapper script depending on the chosen scheduler). Each call merges the latest answer into the wizard session and either asks the next missing question or emits the artifacts once all answers are present. Re-invoke with the same `session_id` on every subsequent turn; sessions live 30 minutes. To skip interactive Q&A, supply all fields (`target_services`, `target_percent`, `schedule`, `scheduler`, `config_plane`, `confirm: true`) in a single call. Optional overrides: `exceptions` (services never touched), `min_delta_pp` (minimum savings delta before committing a new CSV, default 2pp), `env_id`, `namespace`, `secret_name`. Apply instructions for the chosen scheduler are in `data.apply_instructions`. After the first tick runs, call `log10x_commitment_report` to verify realized savings. REQUIRES nothing deployed to ASK: it renders manifests from the user's answers and writes to no account. The emitted tick needs a scheduler runtime (k8s CronJob, GitHub Actions, crontab, EventBridge, Container Apps job) and a policy repo or S3 prefix that the customer controls before it runs. Input parameters: - `budget_gb_monthly` (number): VOLUME BUDGET: keep monthly ingest for the targeted services at or under this many GB/mo. A standing line, not a one-shot cut: each tick scales the budget to its lookback window and cuts only the ove… - `config_plane` (string): Where the recurring CLI reads policy.yaml and writes updated cap CSVs: a gitops repo URL (e.g. https://github.com/acme/log10x-config), a local path, or (required when scheduler=eventbridge) an S3 pre… - `confirm` (boolean): Set to true to confirm the configuration and emit the artifacts. The wizard asks for confirmation interactively when omitted. - `env_id` (string): Log10x environment ID. Auto-detected from LOG10X_ENV_ID when absent. - `exceptions` (array): Service names the policy must never touch (audit / regulatory / executive). Optional: defaults to empty. Pass [] to explicitly clear all exceptions. - `min_delta_pp` (integer): Minimum change in savings percentage points required before the tick commits a new CSV. Default: 2. Set to 0 to commit on every tick. - `namespace` (string): Kubernetes namespace for the CronJob. Default: log10x. Only used when scheduler=k8s_cron. - `schedule`: Tick schedule. Presets: daily-03utc (default), every-6h, every-12h, every-24h-localtz. Or pass a raw 5-field cron expression (e.g. "0 5 * * 1"). - `scheduler` (string): Where the recurring tick runs. k8s_cron = Kubernetes CronJob (default when kubectl reachable), github_actions = GHA workflow, crontab = crontab + wrapper script, eventbridge = AWS-native (EventBridge… - `secret_name` (string): Name of the Kubernetes Secret holding LOG10X_API_KEY. Default: log10x-secret. Only used when scheduler=k8s_cron. - `session_id` (string): Wizard session handle. Omit on the first call: a new session is minted and returned. Pass it back unchanged on every subsequent call. - `target_percent` (integer): Desired savings target, as a percentage of current log volume (1-95). Default: 30. The CLI's per-pattern planner works backward from this target. - `target_services` (array): Services the policy targets. Empty array = all services. Use service names from `log10x_services`. The wizard asks if omitted. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_doctor` (~183 tokens) Doctor (health check) Run a startup health check on the Log10x MCP installation. Probes: environment configuration validity, prometheus.log10x.com reachability and auth, Reporter tier detection (Edge / Cloud / none), Retriever endpoint configuration (informational), Datadog destination credentials (informational), paste endpoint reachability, cross-pillar enrichment floor (v1.4, when LOG10X_CUSTOMER_METRICS_URL is set). Returns a markdown report with pass / warn / fail per check and remediation hints. Call this once at the start of a session to verify the install, or any time a tool returns an unexpected error to isolate whether the problem is configuration or transient. Input parameters: - `environment` (string): Optional environment nickname to probe. In multi-env setups, omit to run the checks against ALL configured environments; pass a specific nickname to check only that one. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_login_status` (~280 tokens) Login status List the user's Log10x ACCOUNT environments and report credential / login state. **Call this, and ONLY this, for any of these phrasings**: 'which Log10x environments do I have', 'which environments are available to me', 'list my envs', 'what tenants/accounts can I query', 'am I logged in', 'switch envs'. **For 'log me in' / 'sign me up' / 'create a Log10x account' / 'use my real account'**: call `log10x_signin_start` (browser Auth0 device flow; the model chains to `log10x_signin_complete` automatically), or call `log10x_signin_complete` directly with `{ api_key: "" }` if the user already has a key. **Do NOT call `log10x_discover_env` for these questions**: that tool scans the user's Kubernetes/AWS infrastructure, unrelated to Log10x account environments. In demo mode (no key set, or key failed validation), the response is a step-by-step config guide. In signed-in mode, lists the user's identity, every env they can reach with permissions (OWNER/WRITE/READ), the default env, and the most-recently used env this session. Read-only, takes no args. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_signin_start` (~258 tokens) Sign in (start browser flow) Step 1 of the Log10x browser sign-in chain. **Call this for any of these phrasings**: 'sign me up for Log10x', 'create a Log10x account', 'log me in to Log10x', 'set up my Log10x account', 'switch from demo to my own data'. Requests an Auth0 device code, opens the user's browser to auth.log10x.com with the user_code pre-embedded, and returns IMMEDIATELY (no polling). Response carries `user_code`, `verification_uri_complete`, and the opaque `device_code`. **What the model MUST do after this returns**: (1) show the user the `user_code` and `verification_uri_complete` so they can verify the code in their browser matches, then (2) AUTOMATICALLY call `log10x_signin_complete` with `{ device_code: "" }` as the next tool call. The user does NOT need to ask for that second step. **For pasted-key sign-in instead of browser**: skip this tool and call `log10x_signin_complete` directly with `{ api_key: "" }`. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_signin_complete` (~436 tokens) Sign in (complete) Step 2 of the Log10x sign-in chain. Two mutually-exclusive paths controlled by which argument is passed. (a) **`{ device_code: "<...>" }`**: finishes the browser flow that `log10x_signin_start` began. The model should call this AUTOMATICALLY right after `log10x_signin_start` returns, passing back the opaque `device_code` from that response unchanged. Polls Auth0's `/oauth/token` until the user confirms the device authorization in their browser, then exchanges the Auth0 access token for a long-lived Log10x API key. (b) **`{ api_key: "" }`**: pasted-key path, no browser. Validates the key against `/api/v1/user` and saves it. **Pass exactly one of `device_code` or `api_key`**; both or neither is rejected with a clear error. Either path writes the resolved API key to `~/.log10x/credentials` (mode 0600), hot-reloads the MCP's env list in-process, and (if `LOG10X_API_KEY` is set in the host config and would override the new file) clears that env var in-process and tells the user to remove it from their host config to make the change permanent. Input parameters: - `api_key` (string): Log10x API key to sign in with directly (no browser). Validated against /api/v1/user before saving. Use this when the user already has a key from console.log10x.com → Profile → API Settings, or when… - `device_code` (string): The opaque device_code returned by `log10x_signin_start`. Pass it back unchanged. The tool polls Auth0 for the access token, then exchanges it for a long-lived Log10x API key. Mutually exclusive with… - `wait_seconds` (integer): Max seconds to poll for browser confirmation (only used when device_code is passed). Default 600. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_signout` (~206 tokens) Sign out Wipe the persistent credentials file at `~/.log10x/credentials` and reload envs so subsequent calls fall back to demo mode (or whichever lower-priority configuration source picks up). **Call this for**: "sign me out of Log10x", "log out", "remove my Log10x credentials", "stop using my Log10x account", "go back to demo mode". Idempotent: running it without saved credentials is a no-op. Does NOT revoke the API key on the BE; the user must do that from console.log10x.com → Profile → API Settings if they want to invalidate the key everywhere (mirrors `gh auth logout` and `aws sso logout`). If the user has `LOG10X_API_KEY` set in their MCP host config, that env var will still be active after sign-out: the tool result will flag this so the LLM can tell the user to also unset it and restart. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_customer_metrics_query` (~269 tokens) Customer metrics query Low-level PromQL passthrough to the customer metric backend configured via LOG10X_CUSTOMER_METRICS_URL. Returns the raw Prometheus response shape plus metadata about which backend served the query. This is the escape hatch for cross-pillar investigations the higher-level primitives don't cover: use it to explore the customer backend's label universe, run a one-off PromQL expression, or verify that a specific metric exists before correlating against it. For typical cross-pillar workflows, compose the deterministic primitives: `log10x_metrics_that_moved` → `log10x_rank_by_shape_similarity` → `log10x_metric_overlay`. Input parameters: - `end` (string): End of the range window. Required when mode=range. - `mode` (string): `instant` runs a point-in-time query; `range` runs over a time window with a bucket step. - `promql` (string, required): PromQL expression to execute against the customer metric backend. Example: `apm_request_duration_p99{service="payments-svc"}`. - `start` (string): Start of the range window: ISO8601 or UNIX seconds. Required when mode=range. - `step` (string): Bucket step for range queries, in seconds. Required when mode=range. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_discover_join` (~633 tokens) Discover join label Auto-discover the structural join label between Log10x pattern metrics and the customer metric backend. Runs Jaccard similarity on label value sets across candidate label pairs, returns the best pair above the 0.7 threshold plus runner-ups above 0.5. The result is cached per-session keyed by (environment, customer-backend-endpoint) so the cross-pillar primitives (metrics_that_moved, rank_by_shape_similarity, metric_overlay) can auto-run this once at session start and reuse the cached join without re-probing. Agents should normally NOT need to call this tool directly: the primitives call it internally. The explicit tool exists for power users who want to inspect the join universe or force a re-discovery after backend changes. When no pair crosses the threshold, returns a structured `no_join_available` response with the full probed-label matrix and recommended next actions. Input parameters: - `candidate_labels` (array): Optional subset of customer-side labels to probe (max 100). An AI caller reasoning over results can't meaningfully digest more than a few dozen; the cap reflects that, not a backend constraint. When… - `customer_metrics_auth` (string): Per-call override for the customer metrics auth credential (bearer token, API key, or apiKey/envId for log10x type). - `customer_metrics_type` (string): Per-call override for the customer metrics backend type. Defaults to generic_prom if customer_metrics_url is supplied without a type. - `customer_metrics_url` (string): Per-call override for the customer metrics backend URL. Wins over LOG10X_CUSTOMER_METRICS_URL env var. Use this when the MCP server was launched with an empty/stale URL and you want to redirect to a… - `environment` (string): Environment nickname (for multi-env setups). - `force_refresh` (boolean): When true, bypass the session cache and re-run the Jaccard pass against the live backends. - `minimum_jaccard` (number): Minimum Jaccard similarity to accept as a primary join. Default 0.7. Lower to 0.5 for exploratory discovery, 0.3 for noisy environments with historical stale values. - `timeRange` (string): Alias for `window` for consistency with other Log10x tools. - `window` (string): Time window for label value enumeration (e.g., "10m", "1h", "30m"). When set, both the Log10x and customer backends are queried with [now - window, now] filtering, excluding stale label values from s… Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_metrics_that_moved` (~534 tokens) Metrics that moved First step of cross-pillar investigation: deterministic filter on which customer metrics moved while an anchor was active. Anchor is either a Log10x pattern (`anchor_type: "log10x_pattern"`) OR a customer metric expression (`anchor_type: "customer_metric"`); candidates are all sibling series from the OTHER pillar. Partitions the anchor's window into high-phase / low-phase buckets by median rate and keeps only candidates whose mean value differs ≥15% between the two phases. Returns `moved[]`, `not_moved[]`, `evaluation_failed[]`: no Pearson, no tier, no causal framing. This is the cheap deterministic cut that pares the candidate set before the more expensive shape-similarity pass. Compose with `log10x_rank_by_shape_similarity` and `log10x_metric_overlay`. Input parameters: - `anchor` (string, required): Anchor identity. For `anchor_type=log10x_pattern`: the pattern Symbol Message NAME or its 11-char `pattern_hash` (= `tenx_hash`), the tool detects shape and queries the correct PromQL label (`message… - `anchor_type` (string, required): Anchor side. `log10x_pattern` = anchor is a 10x pattern. `customer_metric` = anchor is a customer PromQL. - `candidates` (array, required): Customer-side PromQL expressions to evaluate (max 100). An AI caller reasoning over results can't meaningfully digest more than a few dozen; the cap reflects that, not a backend constraint. Pre-filte… - `customer_metrics_auth` (string) - `customer_metrics_type` (string) - `customer_metrics_url` (string): Per-call override for the customer metrics backend URL. Wins over LOG10X_CUSTOMER_METRICS_URL env var. Use when MCP was launched with an empty/stale URL. - `environment` (string) - `phase_gap_floor` (number): Relative gap floor between anchor-high and anchor-low phase means. Candidate is "moved" iff its gap ≥ this. Default 0.15 (=15%) is an uncalibrated default: output is tagged `unvalidated_default` unti… - `step` (string): Bucket step. - `timeRange` (string) - `window` (string): Time window. Alias: `timeRange`. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_rank_by_shape_similarity` (~540 tokens) Rank by shape similarity Second step of cross-pillar investigation: Pearson correlation + signed lag on a pre-filtered candidate set (typically the `moved[]` output of `log10x_metrics_that_moved`). Returns per-candidate: `pearson_magnitude`, `pearson_signed` (direction preserved), `lag_seconds` (signed: negative = candidate leads anchor, positive = candidate lags), `lag_at_bound` (flag: peak landed at search-window boundary), `lag_tightness` (how sharply the Pearson surface peaks), `anchor_phase_gap`, `anchor_phase_aligned` (flag: candidate value differs ≥15% between anchor's high-phase and low-phase buckets), `n_buckets`. No tier, no causal label: the agent reads the flags and decides. Compose with `log10x_metric_overlay` for the final per-candidate aligned-timeseries view. Input parameters: - `anchor` (string, required): Anchor identity. For `anchor_type=log10x_pattern`: the pattern Symbol Message NAME or its 11-char `pattern_hash` (= `tenx_hash`), the tool detects shape and queries the correct PromQL label (`message… - `anchor_phase_aligned_floor` (number): Relative phase-gap floor for the `anchor_phase_aligned` flag. Default 0.15: uncalibrated, same provenance caveat as lag_search_max_abs. - `anchor_type` (string, required) - `candidates` (array, required): Customer-side PromQL expressions to rank (max 100). An AI caller reasoning over results can't meaningfully digest more than a few dozen; the cap reflects that, not a backend constraint. - `customer_metrics_auth` (string) - `customer_metrics_type` (string) - `customer_metrics_url` (string): Per-call override for the customer metrics backend URL. Wins over LOG10X_CUSTOMER_METRICS_URL env var. Use when MCP was launched with an empty/stale URL. - `environment` (string) - `lag_search_max_abs` (number): Maximum absolute lag in seconds to scan. Default 1800s: uncalibrated. Output is tagged `unvalidated_default` when used as-is. Narrow it when the use case has a known tighter upper bound on cascade la… - `step` (string) - `timeRange` (string) - `window` (string) Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_metric_overlay` (~528 tokens) Metric overlay Third step of cross-pillar investigation: return aligned anchor + candidate timeseries plus deterministic facts (`peak_at`, `peak_offset_seconds`, `n_buckets_aligned`). No Pearson, no tier: pure raw data for the agent to interpret. Use this once `log10x_rank_by_shape_similarity` has narrowed to a single suspect, or to manually verify any anchor/candidate pair side-by-side. Bucket size auto-selected from window length; both series are right-aligned to the same trailing bucket grid so a sparse anchor and dense candidate compare on the same chaos window. Input parameters: - `anchor` (string, required): The anchor identity. For `log10x_pattern`: the pattern symbol_message (e.g. `error_processing_payment_$`). For `customer_metric`: a PromQL expression (e.g. `apm_request_duration_p99{service="payments… - `anchor_type` (string, required): Which side the anchor comes from. `log10x_pattern`: anchor is a 10x pattern symbol_message. `customer_metric`: anchor is a customer PromQL expression. - `candidate` (string): The candidate metric to overlay against the anchor. Must be a customer-side PromQL expression that returns a single series. Alias of `candidates[0]`: pass either form (sibling tools metrics_that_move… - `candidates` (array): Candidates array. Accepted for parity with metrics_that_moved + rank_by_shape_similarity. Only the first element is overlaid (metric_overlay is single-candidate by design: use rank_by_shape_similarit… - `customer_metrics_auth` (string) - `customer_metrics_type` (string) - `customer_metrics_url` (string): Per-call override for the customer metrics backend URL. Wins over LOG10X_CUSTOMER_METRICS_URL env var. Use when MCP was launched with an empty/stale URL. - `environment` (string): Environment nickname (for multi-env setups). - `max_buckets` (number): Max buckets to return in the aligned output. Pre-truncates from the most recent end if window/step exceeds this. - `step` (string): Bucket step. Smaller = more samples + more cost. Default 30s. - `timeRange` (string): Alias for `window`. - `window` (string): Time window. PromQL-style duration: `15m`, `1h`, `6h`, `24h`. Alias: `timeRange`. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_poc_from_siem_submit` (~2372 tokens) POC from SIEM (submit) Kick off a full log-cost-optimization POC against the user's SIEM. Pulls a representative event sample, groups the events into log patterns, each with its pattern hash, and renders a 9-section markdown report covering top cost drivers, Receiver recommendations, ready-to-paste native SIEM exclusion configs, Compact mode potential, risk/dependency checks, and deployment paths. Supported SIEMs: cloudwatch (AWS CloudWatch Logs via IAM credential chain), datadog (DD_API_KEY + DD_APP_KEY), sumo (Sumo Logic), gcp-logging (GCP Cloud Logging), elasticsearch (Elastic Cloud / self-hosted), azure-monitor (Azure Monitor / Log Analytics), splunk (SPLUNK_HOST + SPLUNK_TOKEN), clickhouse (OpenObserve / SigNoz / custom schemas). Auto-detects the SIEM from env vars when `siem` omitted: explicitly pass `siem` if multiple credential sets exist. `scope` and `query` are SIEM-specific: CloudWatch (log group + filter pattern), Datadog (index + query), Sumo (_sourceCategory + query), GCP (project id + filter), Elasticsearch (index pattern + KQL), Azure (workspace id + KQL), Splunk (index + SPL), ClickHouse (database + SQL WHERE). For ClickHouse, also pass `clickhouse_table` (required) and column-mapping args for custom schemas (OpenObserve/SigNoz auto-detected). Returns a `snapshot_id`: poll via log10x_poc_from_siem_status to retrieve progress and the final report. Report is also written to `${LOG10X_REPORT_DIR:-/tmp/log10x-reports}/poc_from_siem-.md`. Default window is 7d, default target event count is 250k, default max pull time is 5 min: the pull stops at whichever of the two ceilings hits first. **Tier prerequisites**: none. No log10x API key required. **Templating defaults to privacy_mode=true**: events are templated by a local Log10x engine, either a native `tenx` CLI (install for macOS/Linux/Windows: https://doc.log10x.com/install/) or a local Docker container (set `LOG10X_TENX_MODE=docker`, auto-detected and preferred when the mode is unset), and never leave the machine.… Input parameters: - `ai_prettify` (boolean): Default true: use MCP sampling to ask the host LLM (the same model the user is already chatting with: Claude Desktop, Claude Code, Cursor, etc.) to batch-generate 3-5-word human-readable names for th… - `analyzer_cost_per_gb` (number): Override the $/GB rate for cost calculations. Default is read from vendors.json per detected SIEM. - `auto_detect_volume` (boolean): Default true: when no total_*_gb arg is provided, probe the SIEM's usage/metrics API to auto-detect daily ingest volume. Per-SIEM best-effort: CloudWatch (describeLogGroups ÷ retention), Datadog (Usa… - `clickhouse_message_column` (string): [ClickHouse] Column holding the message body. Default auto-detected. - `clickhouse_service_column` (string): [ClickHouse] Optional column for service name. - `clickhouse_severity_column` (string): [ClickHouse] Optional column for severity. - `clickhouse_table` (string): [ClickHouse] Required: table name holding log events. - `clickhouse_timestamp_column` (string): [ClickHouse] Column holding the timestamp. Default auto-detected. - `enrich_max_tokens` (integer): Output token cap for the host-agent enrichment call. Default 8000. - `enrich_with_host_agent` (boolean): Default true: after the engine produces measured findings (per-pattern $/mo, growth, incident clusters), ask the MCP host LLM via sampling to contribute operational context the engine cannot see: kub… - `enterprise_security` (boolean): Splunk only: whether Enterprise Security or any CIM data model reads this estate. True or absent keeps the add-on sourcetypes (Windows, Palo Alto, Zeek, CrowdStrike, Okta and the like) raw: their add… - `environment` (string): Optional environment nickname: cosmetic only, for the report header. - `exception_services` (array): Services flagged by the customer to stay in the SIEM with full retention (action=pass). Typically 1-3 services for audit, compliance, or executive dashboards. Patterns whose service is in this list a… - `max_pull_minutes` (number): Hard cap on pull wall-time. Default 30. The pull stops at whichever of target_event_count, max_pull_minutes, or saturation-detected hits first. Long pulls run in the background; poll status while the… - `pin_patterns` (object): Advanced: most customers will not need this. Map of pattern_hash to action for rare per-pattern overrides within a service. Applied AFTER pin_services. Use only when a single pattern inside an otherw… - `pin_services` (object): Primary per-service override surface. Map of service name to action. "Pin payment-svc to pass" → {"payment-svc":"pass"}. Pins are applied AFTER the destination default and AFTER exception_services. F… - `query` (string): SIEM-native filter expression layered on top of `scope`. Syntax per SIEM (CloudWatch filter pattern; Datadog query; KQL for ES/Azure; SPL for Splunk; SQL WHERE for ClickHouse; Sumo query). - `record_overhead_bytes` (integer): Bytes of forwarder metadata per record. The Receiver counts each record as the forwarder sends it, metadata included, and events read back from a SIEM's API seldom carry that record, so the caps add… - `scope` (string): SIEM-specific resource scope. CloudWatch: log group name or wildcard (`/aws/ecs/*`). Datadog: index name. Sumo: `_sourceCategory`. GCP: project id. Elasticsearch: index pattern. Azure Monitor: worksp… - `siem` (string): Which SIEM to pull from. Omit to auto-detect from ambient credentials. Valid values: cloudwatch, datadog, sumo, gcp-logging, elasticsearch, azure-monitor, splunk, clickhouse. - `splunk_pricing` (string): Splunk only: `ingest` (bytes per day) prices compact; `workload` (vCPU) meters compute, where compaction is not a saving and compact leaves the lever set. Set from what the user said; absent means in… - `target_event_count` (number): Target event count for the pull. Default 1,000,000 (~500 MB at 500B avg, tokenizes in 5-10 min). The pull self-terminates earlier on saturation: when new patterns per 100k events drops below 2%, the… - `target_percent_reduction` (number): Customer-specified target reduction percent. If absent, POC produces a recommendation-only output. If present, POC produces a feasibility verdict (`output.feasibility`) plus a pre-deploy commitment a… - `total_annual_gb` (number): Customer's total annual log volume in GB/year. See total_daily_gb for semantics. - `total_daily_gb` (number): Customer's total daily log volume in GB/day. Pick any one of total_daily_gb / total_monthly_gb / total_annual_gb: whichever unit the user naturally thinks in. The tool normalizes to daily internally.… - `total_monthly_gb` (number): Customer's total monthly log volume in GB/month. See total_daily_gb for semantics. - `window` (string): Window to pull over. Accepts "1h", "24h", "7d", "14d", "30d". Default "14d": wide windows unlock the differentiated longitudinal signals (first-seen, growth, stable-vs-new) that the agent cannot comp… Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_poc_from_siem_status` (~741 tokens) POC from SIEM (status) Retrieve progress or a view of the report from a log10x_poc_from_siem_submit run. Pass `snapshot_id`; optionally `view` to select the level of detail. **In-progress** responses report status (pulling / templatizing / rendering), progress_pct, step_detail, and elapsed_seconds: poll every ~30s until done. **Complete** responses render one of six views: `summary` (default, ~30 lines, exec banner + top-5 wins + views CTA), `full` (complete 9-section report, ~300 lines), `yaml` (paste-ready Receiver mute-file for the top N patterns), `configs` (native SIEM exclusion configs, Datadog exclusion filter / Splunk props.conf / etc.), `top` (expanded N-row drivers table), `pattern` (deep-dive on one identity, requires `pattern` arg). **Failures** include partial_report_markdown when any events were successfully pulled before the error. The full report is also written to ${LOG10X_REPORT_DIR:-/tmp/log10x-reports}/poc_from_siem-.md regardless of which view the caller requested. Snapshots live in-memory per MCP process; a restart clears them, so persist the final report path to keep it. **Unified envelope**: response carries `status`, `query_count`, `total_latency_ms`, `backend_pressure_hint`, `human_summary`, plus the existing snapshot-lifecycle fields. Errors (unknown snapshot_id, render failure) come back as `status: 'error'` with a structured `PrimitiveError` envelope. See `docs/cross-pillar-primitives.md` for the agent behavior contract. **Two modes, and the agent should name whichever the user's phrasing invites.** This tool is the NETWORKED one: it reads the analyzer directly over the network with the caller's credentials, and the MCP mints one licence. The FENCED mode runs the same POC with no network at all: `log10x_emit_sample_plan` renders a read-only export script the user runs themselves, and the analysis happens in a container started with `--network none`, so 'cannot exfiltrate' is a kernel fact the user checks with one `docker inspect` rather than a clai… Input parameters: - `pattern` (string): Required when view="pattern". The snake_case pattern identity to expand. Pass the raw identity as printed in prior views. - `snapshot_id` (string, required): Snapshot id returned by log10x_poc_from_siem_submit. - `top_n` (integer): Number of rows for views that accept it (`top`, `yaml`, `configs`, `summary`). Defaults: summary=5, top=20, yaml/configs=5. - `view` (string): How to surface the report. Default `summary` returns the v2 structured envelope (`data.result` carries the full JSON: input section with scale + methodology + coverage, output section with aggregates… Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_poc_from_local` (~1924 tokens) POC from local logs (kubectl) Run a log-cost-optimization POC entirely from local log sources: pass `path` for one log file (wrapper-normalized) or `paths` for files, directories and globs; `kubectl` samples pod logs; `docker` and `journald` to follow. No log-analyzer credentials required. Use when the prospect has no SIEM connection or has not yet shared API keys. Returns a synchronous markdown report with: (a) **sample composition** table, top-N pods by byte volume; the prospect must confirm the sample looks like their production mix, (b) **industry-pricing matrix**, projected savings at Datadog / Splunk / CloudWatch / Sumo / Elastic / OpenSearch list prices, NOT a prediction of any specific bill, (c) **top patterns** in the kubectl-sourced sample. For native exclusion configs, paste-ready Receiver YAML, and the full 9-section report tied to a specific log analyzer's GB-billed volume, run `log10x_poc_from_siem_submit` once credentials are available. **No automatic fallthrough**: this tool is invoked explicitly. If `log10x_poc_from_siem_submit` failed on missing credentials, the calling LLM should ask the user before re-invoking with this tool: local-source framing differs from SIEM-attached framing and silent fallthrough would be a bait-and-switch. REQUIRES a local engine: the tenx binary on PATH, or Docker with LOG10X_TENX_MODE=docker. No log-analyzer credentials and no deployment are needed, but without an engine this returns an error rather than a report. Pass target_percent_reduction as a whole-number percent (e.g. 40 for 40%) to get a feasibility verdict against that target. **Two modes, and the agent should name whichever the user's phrasing invites.** Run normally, this tool reads local files but the server around it still has network. Run inside the FENCED profile (`TENX_AIRGAPPED=true`, `--network none`, the `log10x/poc` image) it is the same analysis with no network at all, and its output carries its own `docker inspect` proof. `log10x_emit_sample_plan` produces the sample for that… Input parameters: - `allow_lossy` (boolean): Permit sample/drop (lossy) to close a keep-everything shortfall. Default false: the plan stops at the keep-everything ceiling and reports the gap. Only set after the user explicitly chooses loss. - `budget_gb_monthly` (number): VOLUME BUDGET: keep projected monthly ingest at or under this many GB/mo. BYTE accounting: tier_down keeps every byte and is excluded from the ladder for this target. Sample scaled to a 30-day month… - `budget_usd_monthly` (number): DOLLAR BUDGET: keep the projected monthly bill on the assumed SIEM at or under this $/mo. The sample is scaled to a 30-day month (kubectl window, or the file span) before solving, so the budget and t… - `check_dependencies` (boolean): Datadog only, default true: before the plan moves statements off Standard, read the account's log monitors and log-based metrics (read-only GETs, needs DD_API_KEY + DD_APP_KEY in the session) and pri… - `enterprise_security` (boolean): Splunk only: whether Enterprise Security or any CIM data model reads this estate. True or absent keeps the add-on sourcetypes raw. Pass false only when the user states it. On a kubectl or file sample… - `exception_services` (array): Services / pods flagged by the customer to stay in the log analyzer with full retention (action=pass). Their bytes are subtracted from the achievable reduction pool used for the feasibility verdict.… - `fleet_default` (object): Set the fleet default from this capture: the limit for every service the plan gives no row, the largest statement the plan keeps per node times the headroom. The report states it in lines a day, and… - `forwarder` (string): Forwarder in the pipeline (fluentd, fluent-bit, filebeat, logstash, otel-collector, vector, hec). Used to pick verified apply/undo commands. Not guessed when absent: the report says commands are unav… - `max_pods` (number): Cap on number of pods sampled. Default 20. - `namespace` (string): Kubernetes namespace to sample from (`source: kubectl` only). Pass `*` to sample across all namespaces. Default `default`. - `path` (string): One local log file to analyse (source=`file`). Wrapped JSONL is normalized so the engine patterns payloads, not wrappers. For many files or globs use `paths` instead. - `paths` (array): Required for `source: file`: files, directories, or glob patterns (`*`, `**`, `?`) to sample, e.g. `["/var/log/app/*.log", "./bundle/**"]`. A directory is read one level deep; use `dir/**` for the tr… - `per_pod_limit` (number): Cap on log lines pulled per pod. Default 5000. - `pin_patterns` (object): Advanced: most customers will not need this. Map of pattern_hash to action for rare per-pattern overrides within a pod / source. Applied AFTER pin_services. - `pin_services` (object): Primary per-pod/source override surface. Map of pod / source name to action. Pins are applied AFTER the destination default and AFTER exception_services. Feasibility reruns with the pins; max_achieva… - `record_overhead_bytes` (integer): Bytes of forwarder metadata per record, for a capture that carries the log text only (a kubectl sample or plain lines). The Receiver counts each record as the forwarder sends it, metadata included, s… - `report_annotations` (object): Optional one-sentence annotations keyed by evidence statement identifier, rendered under the matching action. Hard cap 140 chars each; over-cap or unknown-hash input refuses the render (nothing is tr… - `retriever_installed` (boolean): Whether the prospect will install the S3 retriever. Gates the offload rung of the plan ladder: without it offloaded events would be unreachable, so the plan stops at the in-SIEM levers and the gap na… - `siem` (string): The destination SIEM, used for the report header chip and command selection. When absent the analysis assumes CloudWatch and the report labels the assumption. - `source` (string): Where to pull log lines from. `kubectl` samples pod logs; `file` samples local logs: pass `paths` (files, directories, globs) or `path` (one file; fluentd/k8s/docker-wrapped JSONL is detected and nor… - `splunk_pricing` (string): Splunk only: `ingest` (bytes per day) prices compact; `workload` (vCPU) meters compute, where compaction is not a saving and compact leaves the lever set. Set from what the user said; absent means in… - `target_percent_reduction` (number): Customer-specified target reduction percent. If absent, POC produces a recommendation-only output. If present, POC produces a feasibility verdict + a pre-deploy commitment artifact stub the agent can… - `window` (string): How far back to read per pod (`source: kubectl`, default `1h`). For `source: file`, the time span the files cover: read from the first and last record timestamps when the records carry them, and from… - `workload` (string): Forwarder workload name (daemonset/deployment) for the apply commands. Not guessed when absent. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_emit_sample_plan` (~947 tokens) Emit a sample-export script for the fenced POC Render a read-only shell script that exports a log sample out of the user's OWN log analyzer, with the user's OWN credentials, on a machine the user chooses: and then stop. This server does not run the script and, in the fenced profile, could not: it runs inside a container started with `--network none`. That split is the point. Code that sees log data has no network; code that has network is the user's own `aws` / `curl` driven by a script short enough to read once. Use this as step 2 of the fenced POC (step 1 is minting the licence with one visible curl, step 3 is running `log10x_poc_from_local` inside the fenced container over the exported files, step 4 is verifying the fence with `docker inspect` and by turning Wi-Fi off). Also use it whenever the credentials live somewhere this process does not: a jump host, a locked-down laptop, another team. Args: siem (required: cloudwatch / splunk / elasticsearch / opensearch / datadog), window (default 14d), target_event_count (default 1,000,000, the same default `log10x_poc_from_siem_submit` uses, so both paths sample the same size), scope, query, output_dir (default ./poc/logs), write_script (default true, writes export-sample.sh mode 0755 in the working directory). Returns the script text, the read-only API operations and credential variables it touches, a review checklist, and the exact `log10x_poc_from_local` arguments to call next. The sampling matches `log10x_poc_from_siem_submit` bucket for bucket (same stratified sub-windows, same per-bucket cap) so a fenced POC and a credentialed POC over the same window differ because the logs differ. Emitted scripts contain no log10x hostname; the server refuses to return one that does. Read-only: it renders text and writes one script file; it contacts nothing. Input parameters: - `output_dir` (string): Where the script writes the exported sample, relative to wherever the user runs it. Default `./poc/logs`, which is the directory the documented `docker run` line mounts read-only at /data. - `query` (string): Analyzer-native filter layered on top of `scope`: a CloudWatch filter pattern, an SPL fragment, a Lucene query_string for Elasticsearch, a Datadog query. Narrowing here narrows what the savings proje… - `scope` (string): Analyzer-native scope. CloudWatch: log group name or prefix (`/aws/ecs/*`, the asterisks are stripped, CloudWatch matches on prefix). Splunk: index name. Elasticsearch / OpenSearch: index pattern (de… - `siem` (string, required): Which log analyzer to export the sample from. One script per analyzer: `cloudwatch` (aws CLI: DescribeLogGroups + FilterLogEvents), `splunk` (search/jobs/export), `elasticsearch` and `opensearch` (_c… - `target_event_count` (number): Target event count for the export. Default 1,000,000 (~500 MB at 500 B average): the same default `log10x_poc_from_siem` uses, so a fenced POC and a credentialed one see samples of the same size. Low… - `window` (string): How far back to sample. Accepts `1h`, `24h`, `7d`, `14d`, `30d`. Default `14d`, matching `log10x_poc_from_siem`: a wide window is what makes first-seen, growth and stable-versus-new readable at all. - `write_script` (boolean): Default true: also write the script next to the working directory as `export-sample.sh` (mode 0755) so the user can read it in an editor rather than out of a chat transcript. Set false to get the tex… Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_discover_env` (~670 tokens) Discover env (k8s + AWS) Read-only discovery of the caller's Kubernetes cluster + AWS account: i.e. the customer's INFRASTRUCTURE environment, NOT their Log10x account. **When the user wants to install Log10x: call this tool FIRST and then `log10x_advise_install`, that's the whole pre-flight. Do NOT call `log10x_doctor` / `log10x_login_status` / `log10x_savings` / etc. before the install; the wizard handles all login + license logic internally, and surfacing those tools' optional-capability warnings (Retriever, Datadog backfill, cross-pillar metrics) makes the install feel more complicated than it is.** Probes kubectl (workloads, DaemonSets, Helm releases, service-account IRSA annotations, metrics-backend agents) and AWS (EKS, S3, SQS, CloudWatch log groups) to detect: which forwarder is running (Fluent Bit, Fluentd, Filebeat, Logstash, OTel Collector, Vector), which log10x apps are already installed (Reporter, Receiver, Retriever), and which metrics backends are already deployed (Datadog Agent, Prometheus, Elastic, CloudWatch Agent, etc.). Returns a terse markdown report + a `snapshot_id` (cached 30 min) the advisor tools consume. **Do NOT call this tool to answer "which Log10x environments do I have access to" / "list my envs" / "switch envs": those are about the user's Log10x ACCOUNT environments, use `log10x_login_status` for that.** Call THIS tool only when the question is about k8s workloads, AWS infra, or "what's deployed in my cluster". Every shell call is logged in the snapshot's `probeLog` for audit. No writes, no state mutation: only `kubectl get` and `aws ... describe/list` verbs. **Tier prerequisites**: none, this is a pre-install tool and runs against any customer environment. Input parameters: - `bucket_hint` (string): Substring to match against S3 bucket names. Defaults to "retriever"; also matches "log10x" and "tenx" out of the box. - `eks_cluster_name` (string): EKS cluster to describe. If omitted and exactly one cluster exists in the account/region, that one is auto-selected. - `forwarder_hint` (string): Override forwarder detection. Use this if multiple forwarders are running and you want the advisor to target a specific one. - `namespace_hint` (string): Preferred namespace for new installs. Defaults to "logging" unless an existing forwarder namespace is found. - `namespaces` (array): Explicit list of Kubernetes namespaces to probe. If omitted, the tool auto-picks up to 5 likely candidates (demo, logging, observability, otel-demo, default) plus kube-system. - `region` (string): AWS region to probe. If omitted, uses the region from your AWS CLI profile. - `skip_aws` (boolean): Skip all AWS probes (for cluster-only discovery). - `skip_kubectl` (boolean): Skip all kubectl probes (for AWS-only discovery or when cluster access is restricted). Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_advise_retriever` (~1366 tokens) Advise: Retriever install Given a DiscoverySnapshot (from `log10x_discover_env`), produce an install/verify/teardown plan for the Log10x Retriever. Unlike Reporter + Receiver, the Retriever has no forwarder choice: it is a standalone set of workloads (indexer + query-handler + stream-worker) that read source logs from object storage through a queue and serve an HTTP query endpoint. Two storage providers, picked by `storage_provider`: **aws** (S3 input bucket with an `indexing-results/` prefix, four SQS queues, an IRSA-annotated ServiceAccount), auto-detected from the discovery snapshot or supplied explicitly; **azure** (AKS, Azure Blob containers, four Azure Storage Queues, workload identity), where the chart's own `provision-retriever.sh` creates the resources and the plan quotes it. `blockers` carries the inputs a complete plan is still missing and the plan emits no steps while it is non-empty; the preflight table is the state report beside it, and a FAIL row there is reported, not a gate, so read `preflight_summary.fail` as well as `blockers`. Verify probes follow the provider: pods Ready, indexer processing, query endpoint responding, then S3 + SQS probes on aws and Blob + Storage Queue probes on azure. Teardown uninstalls the Helm release; on aws the S3 / SQS / IAM lifecycle stays with Terraform, on azure the last step runs the provisioning script with `--destroy` to delete the resource group it created. Input parameters: - `action` (string): Plan scope. Default: `all`. - `aks_cluster_name` (string): AKS cluster the release installs into (azure only). Used by the provisioning command (`--create-aks` for a new cluster) and by the `az aks get-credentials` step that points kubectl at it. - `azure_client_id` (string): Client id of the user-assigned managed identity federated to the release ServiceAccount (azure only). The provisioning script writes it into the values file it produces, under `storage.azure.auth.cli… - `azure_queues` (object): Azure Storage Queue names on the storage account (azure only). Default: tenx-index / tenx-query / tenx-subquery / tenx-stream, matching the provisioning script. - `azure_tenant_id` (string): Entra tenant id (azure only). The provisioning script writes it into the values file it produces, under `storage.azure.auth.tenantId`. - `destination` (string): Destination SIEM for the kept slice (e.g. `datadog`, `cloudwatch`, `splunk`). Gates SIEM down-tier sub-sections in the offload markdown. - `iam_role_arn` (string): IAM role ARN for the Retriever ServiceAccount (IRSA) (module output: iam_role_arn). Auto-detected from snapshot. - `index_bucket` (string): S3 path for indexed results (include prefix). Default: `/indexing-results/`. - `index_container` (string): Blob path for indexed results (azure only), as `account/container/path`. Default: `/tenx-index/tenx`. - `index_queue_url` (string): SQS URL for index operations (module output: index_queue_url). Auto-detected from snapshot. - `index_source_bucket` (string): S3 bucket for source logs (module output: index_source_bucket_name). Auto-filled from snapshot.recommendations.retrieverS3Bucket when present. - `infra_mode` (string): How the customer provisions AWS infra. **terraform** = emit .tf module block. **cli** = emit aws-cli commands. **existing** = infra already provisioned, wizard skips infra steps and jumps to helm val… - `input_container` (string): Azure Blob container holding source logs (azure only). Bare container name, e.g. `logs`. - `license_jwt_paste` (string): License JWT supplied by the user when `license_source: "paste"`. - `license_source` (string): How the engine is licensed. Defaults to `"builtin"`: nothing is minted and no key is written, and the engine runs its built-in evaluation licence (10 nodes, 30 days from each start, airgapped). Pass… - `location` (string): Azure region for the provisioning command, e.g. `eastus` (azure only). - `namespace` (string): Target namespace. Default: snapshot.recommendations.suggestedNamespace. - `query_queue_url` (string): SQS URL for query operations (module output: query_queue_url). Auto-detected from snapshot. - `release_name` (string): Helm release name. Default: `my-retriever`. - `resource_group` (string): Azure resource group for the provisioning command and the teardown (azure only). - `snapshot_id` (string, required): ID returned by `log10x_discover_env`. The snapshot is cached for 30 min. - `storage_account` (string): Azure storage account holding the input and index containers (azure only). Flat namespace only: a hierarchical-namespace account reorders listings and is refused by the engine at construction. - `storage_provider` (string): Which object store the Retriever reads. **aws** (default) = S3 buckets, four SQS queues, IRSA. **azure** = Azure Blob containers, four Azure Storage Queues, AKS workload identity, behind the chart's… - `stream_queue_url` (string): SQS URL for stream operations (module output: stream_queue_url). Auto-detected from snapshot. - `subquery_queue_url` (string): SQS URL for sub-query operations (module output: subquery_queue_url). Auto-detected from snapshot. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_advise_install` (~1605 tokens) Install wizard Progressive install wizard for the Log10x Reporter / Receiver on Kubernetes. **This is the SINGLE entry point for installs: call it first.** Do NOT call `log10x_doctor` or `log10x_login_status` as a pre-flight; the wizard handles login state, license acquisition, and demo-mode fallback internally, and surfacing the doctor's optional-capability warnings (Retriever, Datadog backfill, cross-pillar metrics) ahead of the install confuses users with concepts that are unrelated to deploying the Reporter/Receiver. Takes a `snapshot_id` from `log10x_discover_env` and walks the user through five decisions, asking one at a time and remembering each answer across turns (the snapshot's wizard session): (1) **app**, `reporter` (dedicated DaemonSet forwarder, zero-touch) or `receiver` (sidecar inside the user's existing forwarder); (2) **forwarder**, Receiver-only, auto-picked when one is detected, asked when multiple; (3) **backends**, array of metrics destinations, can be multiple (e.g., `["log10x", "datadog"]` to report to both SaaS + own backend simultaneously); (4) **airgapped**, opt-in, conflicts only with `"log10x"` in `backends` (engine sends NOTHING to log10x.com); (5) **license_jwt**, auto-fetched from `/api/v1/license/demo` if the user is not signed in, or from `/api/v1/license` with the persisted Auth0 token if they are. Each call merges new args into the session and either asks the next question (returning a markdown prompt) or emits the final install plan once all answers are in. Demo + airgapped surfaces a soft warning (engine downgrades to online mode on demo licenses). Plan is plan-only: emits helm commands + values.yaml; the user runs them. With `log_destination: "datadog"` a Receiver plan adds the step after the POC: the fleet default for every service with no rule (`fleet_default.action` tier_down to Flex, or offload to S3), with the Flex index and its `@routeState:tier_down` filter or the S3 branch, the always-pass sample, and what an error monitor sees. **Ti… Input parameters: - `action` (string): Plan scope when the wizard is ready to emit. Default: `all`. - `airgapped` (boolean): When true, the Log10x agents send nothing to log10x.com: engine metrics, license re-validation, and update checks all go silent. Use to reduce CISO friction. Conflicts with `"log10x"` in `backends` (… - `app` (string): Which Log10x app to install. **reporter** = a dedicated DaemonSet forwarder (zero-touch, runs alongside your existing forwarder); **receiver** = a sidecar plugged into your existing forwarder (filter… - `backend_credentials` (object): Per-backend credential configuration, keyed by backend kind (one of: datadog, elastic, cloudwatch, prometheus; `log10x` needs none, since it authenticates with the licence JWT). Each entry has a `sec… - `backends` (array): Where the engine emits TenXSummary metrics: the user's own TSDB(s), one or more of **prometheus**, **datadog**, **elastic**, **cloudwatch**. When omitted, the wizard asks, listing any backend whose a… - `fleet_default` (object): The fleet default for a Datadog Receiver plan (with `log_destination: "datadog"`). The Receiver values are written only on an engine release that reads `rateReceiverDefaultAction`. - `forwarder` (string): Receiver-only: which detected forwarder kind to sidecar into. Auto-uses the snapshot's detected forwarder when there's exactly one; the wizard asks when there are multiple. - `k8s_team_label` (string): A pod label key whose value names the owning team (e.g. `team`). Receiver plans write `k8sTeamLabel` with it, on an engine release that reads that option, so the metrics carry `tenx_team`. - `license_jwt_paste` (string): License JWT supplied by the user when `license_source: "paste"` (passing it alone implies `paste`). Minted from `POST /api/v1/license` (signed-in) or `POST /api/v1/license/demo` (anonymous). Maps to… - `license_source` (string): How the engine is licensed. **Defaults to `"builtin"`** when omitted: the plan carries no licence and the engine runs its built-in evaluation licence (10 nodes, 30 days from each start, airgapped). N… - `log_destination` (string): Where the forwarder ships the log events (not the metrics; `backends` is the metrics). `datadog` adds the step after the POC to a Receiver plan: the fleet default for every service the POC report giv… - `namespace` (string): Target namespace. Default: snapshot.recommendations.suggestedNamespace. - `release_name` (string): Helm release name. Default: `my-` (e.g., `my-reporter`). - `snapshot_id` (string): ID returned by `log10x_discover_env`, and the one arg the wizard cannot infer. The snapshot is cached for 30 min. Call `log10x_discover_env` first when there is no snapshot yet. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_estimate_savings` (~2339 tokens) Estimate savings [FRESH-SESSION ROUTING: if this is the user first cost question of the session, call log10x_start first instead, it returns the orientation menu the user needs before any per-tool action.] Two-mode savings estimator with percent-first reporting and a dollar overlay. `forecast` projects bytes_in -> bytes_out and percent reduction for a proposed plan; pass `effective_ingest_per_gb` (or rely on the account profile list-price rate) to overlay $/mo per pattern and in totals. `verify` counts realized savings from the engine `routeState` label over a window with cap-hit / drift / new-patterns / leakage attribution, leading with percent and adding the dollar overlay only when a rate is set. Without a rate, dollar fields are emitted as null (never as a fabricated $1/GB number); the envelope carries `rate_source: list_price | customer_supplied | unset` so callers can show how the overlay was derived. Accepts siem_lens (what-if destination): keeps the measured volumes, prices + gates for that destination at list rates, and stamps siem_actual vs siem_lens in the envelope. REQUIRES Reporter-tier cost attribution (per-pattern bytes in the metrics backend). Before anything is deployed, use log10x_poc_from_local or log10x_poc_from_siem_submit instead. Input parameters: - `allow_lossy` (boolean): Permit the ladder solver to close a keep-everything shortfall with sample/drop (lossy, opt-in). Default false: the plan stops at the keep-everything ceiling and reports the gap instead of silently di… - `baseline_window` (string): verify mode: PromQL range expression for the pre-merge window, e.g. "7d", "168h". - `budget_gb_monthly` (number): forecast mode: VOLUME BUDGET, keep monthly ingest toward the destination at or under this many GB/mo. BYTE accounting: tier_down keeps every byte in the destination, so it cannot serve this target an… - `budget_usd_monthly` (number): forecast mode: DOLLAR BUDGET, keep the (service-scoped or whole) destination bill at or under this $/mo. The ladder solver derives the reduction: max(0, bill - budget). Idempotent: already under budg… - `check_dependencies` (boolean): Ladder-plan path only: scan the destination (read-only) for dashboards, alerts, and saved searches that reference the top planned message types, and attach the result as plan_dependencies. Runs only… - `commitment_id` (string): verify mode: when present, the verify output is shaped as a commitment delta (used by log10x_commitment_report). - `contract_type` (string): verify mode: shapes the dollar projection (committed vs on-demand renewal math). - `current_compute_units` (number): forecast mode, compute-billed destinations only (ClickHouse): the service's current compute unit count. Turns the modeled compute saving in totals.compute_saving from a fraction into dollars. - `default_action` (string): forecast mode, OPTIONAL: force one action onto every solver-selected pattern (a mode choice, "cut 50% via drop"). Hard constraint when present, subject to destination compatibility (compact is replac… - `deployment` (string): How the customer RUNS the destination, which decides whether compaction is available at all: the expander is software they install (the l1es Elasticsearch/OpenSearch plugin, the 10x Splunk app), so a… - `destination` (string): Destination stack. Required for both modes (used to look up ingest $/GB + compact ratio band). - `effective_ingest_per_gb` (number): forecast and verify mode: override the destination default rate with the customer's contracted $/GB. When supplied, dollar projections use this rate and surface rate_source='customer_supplied'. - `enforcement_mode` (string): forecast mode: when manual_report, reframes the headline as a potential-savings estimate under external enforcement rather than engine enforcement. Headline reads 'If you enforce externally: X saving… - `enterprise_security` (boolean): Splunk only: whether Enterprise Security or any CIM data model reads this estate. True or absent keeps the add-on sourcetypes (Windows, Palo Alto, Zeek, CrowdStrike, Okta and the like) raw, since the… - `environment` (string): Environment nickname; routes to the right metrics backend. - `es_pruned` (boolean): Elasticsearch only: are compactable fields excluded from _source? Default false: the unpruned ratio band is used. - `exception_services` (array): Ladder-plan path only: services pinned at pass, their patterns stay in the bill but are never planned, exactly like protected severities. The SOC-owned or compliance-bound slice of the estate, stated… - `include_referenced` (boolean): Ladder-plan path only: message types LITERALLY referenced by a monitor, alert, saved search, or dashboard (found by the dependency scan) are EXCLUDED from the plan by default: they stay exactly as th… - `mode` (string): forecast: project savings of a proposed per-pattern policy (or a target_percent). verify: measure realized savings from a deployed policy by comparing baseline vs post-merge windows. - `monthly_compute_spend_usd` (number): forecast mode, compute-billed destinations only (ClickHouse): the service's current monthly compute spend in dollars. Converted to units at the destination's unit price; ignored when current_compute_… - `monthly_volume_gb` (number): What-if volume lens (forecast mode): model the environment at THIS monthly volume (decimal GB/month) instead of its measured volume. The real per-pattern shares and pattern mix are held fixed; only a… - `observation_window` (string): forecast mode: PromQL range expression for the observation window the solver/projection runs over. Default `30d`. Accepts `1h`, `24h`, `7d`, `30d`, etc. Alias: `timeRange`. - `pattern_limit` (integer): forecast mode: maximum number of per_pattern rows returned. Default 50 when service is omitted; ignored (unlimited) when service is set. Totals and coverage_pct are always computed over the full solv… - `post_window` (string): verify mode: PromQL range expression for the post-merge window, e.g. "7d". - `proposed_config` (array): forecast mode: explicit per-pattern (action, optional cap) rows. Either this OR target_percent is required. - `retention_months` (number): Retention window for storage cost. Default 1 month. - `retriever_installed` (boolean): Whether the S3 retriever is installed (or the user has agreed to install it). Gates the offload rung of the ladder solver: without it, offloaded events would be unreachable, so the plan stops at the… - `service` (string): Scope the target_percent greedy solver and coverage_pct to a single service. When present, only patterns from that service are candidates; coverage_of_env_pct and dollar totals reflect that service o… - `siem_lens` (string): What-if destination lens (alias of `destination` with provenance stamping): price the projection for THIS destination while the pipeline keeps its actual one. Envelope stamps siem_actual vs siem_lens. - `splunk_pricing` (string): Splunk only: how the licence meters. `ingest` (bytes per day, the common case) prices compact; `workload` (vCPU) meters compute, where compaction saves storage and not the bill and searches that expa… - `target_percent` (number): forecast mode: % volume reduction goal. Tool runs the same greedy solver as configure_engine on observed 30d bytes. - `tier_down_plan` (string): Which tier_down plan to price when the action is tier_down. Matches the plan name (case-insensitive substring): omit for the destination default (e.g. Azure Basic Logs), or pass e.g. "auxiliary" to p… - `timeRange` (string): forecast mode: alias for `observation_window` for consistency with other Log10x tools. If both are set, `observation_window` wins. - `unprotect_patterns` (array): Ladder-plan path only: pattern hashes the user EXPLICITLY unpinned from the severity floor (a warn-level retry storm they chose to act on). Bypasses severity protection for the listed hashes only; ha… Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_baseline` (~483 tokens) Baseline readiness Pre-flight readiness gate for cost-reduction tools. Verifies Reporter age (default 7d), pattern-coverage stability, and absence of acute anomalies before configure_engine / estimate_savings should run. Returns structured `not_ready` with the specific gate(s) that failed. Input parameters: - `destination` (string): Destination SIEM. Required to project dollar baselines and decide which top contributors are compactable. Auto-detected from `env.analyzer` when omitted; falls back to `not_ready/no_destination` if n… - `effectiveIngestPerGb` (number): Customer-negotiated $/GB for the destination. When supplied, baseline dollar projections use this rate and `rate_source` resolves to `customer_supplied`. Omit to fall back to vendors.json list pricin… - `environment` (string): Environment nickname for multi-env setups. - `horizon` (string): Lookback window for the baseline. 30d is the default and what `recommended_target_range` is calibrated against; 90d trades freshness for stability on lower-volume tenants. - `monthly_volume_gb` (number): What-if volume lens (forecast mode): model the environment at THIS monthly volume (decimal GB/month) instead of its measured volume. The real per-pattern shares and pattern mix are held fixed; only a… - `statedDailyGb` (number): Customer-stated daily SIEM ingest in GB. When supplied, the coverage gate compares observed bytes against this number; ≥80% passes, <80% returns `not_ready/coverage_low`. Omit to skip the coverage ga… - `view` (string): Output format. Always "summary": the typed envelope. Field retained for backward-compat with callers that still pass `view: "summary"`. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_commitment_report` (~348 tokens) Commitment report Weekly aggregate against a commitment record opened by `log10x_configure_engine`. Reports delivered bytes (and dollars at the contract rate where the contract allows), projects the next 90 days from a weak Beta(2,2) prior updated with weekly evidence, and renders a markdown summary suitable for sharing. REQUIRES a commitment record opened by a prior configure_engine apply; without one there is no baseline to report against. Input parameters: - `action_intent_path` (string): Override path to data/action-intent.json (relative to the gitops repo root or absolute). Used only when format=weekly_digest. - `commitment_id` (string): Commitment record id (created by log10x_configure_engine on PR-merge). If omitted, resolves the most recent commitment for the active service. - `environment` (string): Environment nickname; defaults to the active env. - `format` (string): cfo_md=executive markdown with weekly chart and forward confidence; summary=typed envelope only; json=full structured data; weekly_digest=7-day operational digest from the recurring tick audit trail. - `history_path` (string): Override path to the recurring-tick JSONL audit trail (default: $LOG10X_RECUR_HISTORY_PATH or /tmp/log10x-recur-history.jsonl). Used only when format=weekly_digest. - `period` (string): Reporting window. 30d=last 30 days, 90d=last 90 days, ytd=since Jan 1 of current year. - `service` (string): Service name to resolve a commitment by: used when commitment_id is omitted. When both are present, commitment_id wins. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_datadog_change_report` (~728 tokens) Datadog change report and spike monitors Weekly change report for a Datadog install, read from the per-pattern series the engine's Datadog metric output publishes (`emitted_events_summaryVolume`, tagged message_pattern, tenx_hash, k8s_container, tenx_user_service, routeState, and tenx_team once the team label ships). Lists the statements new in a service since `since` (a duration like `7d` or a date; stateless, so pass the previous report's `next_since` to continue), each with lines a day, estimated Standard indexing cost a month at Datadog list price, whether a rule held it, and the rule that did (the container's row and action in caps.csv / actions.csv, read from the gitops repo or the policy ConfigMap). Ends with proposed per-service rows in the plan's form: ": any statement above N lines a day goes to Flex. Today that is these K statements, about $X a month." `view: "monitors"` instead renders two Datadog monitor definitions as JSON for the account owner to apply: a metric monitor that fires when a statement's route turns tier_down or offload, and an anomaly monitor with weekly seasonality that fires when a statement's volume rises above its weekly baseline. Read-only: Datadog's query API with DD_API_KEY / DD_APP_KEY / DD_SITE (GET only), and the engine files. Writes nothing. Input parameters: - `action` (string): Where a proposed row sends a statement: `tier_down` (Flex, the default) or `offload` (S3) for an account without Flex. - `environment` (string): MCP environment nickname, used to find the gitops repo holding caps.csv and actions.csv. - `headroom` (number): Multiplier on the fleet's largest kept statement, for a service with no history of its own. Default 2. - `limit` (integer): Most new statements listed. Default 25. - `lookback` (string): How far before `since` to look for earlier lines of a statement. Default `28d`, at most `90d`. - `notify` (array): Notification handles for the monitors view (e.g. `@slack-log-cost`). - `since` (string): Start of the report: a duration back from now (`7d`, `36h`) or a date or ISO timestamp (`2026-10-06`). A statement is new when it had no line in its service in the `lookback` before this point. Pass… - `site` (string): Datadog site (e.g. `us5.datadoghq.com`). Defaults to DD_SITE, then `datadoghq.com`. - `team_tag` (string): Team tag key on the series (e.g. `tenx_team`). Omit to detect `tenx_team` on the series; the team is shown only when present. - `tenx_env` (string): `tenx_env` tag value to scope the series to. Omit for every environment. - `view` (string): `markdown` (default): the weekly change report. `summary`: the same data without the rendered page. `monitors`: two Datadog monitor definitions as JSON (a statement turning tier_down or offload; a st… Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_datadog_spike_audit` (~568 tokens) Datadog spike audit Prices an account's log spikes from Datadog's estimated usage metrics, with no 10x install. Reads `datadog.estimated_usage.logs.ingested_events` (datadog_is_excluded:false, by service and datadog_index) and `datadog.estimated_usage.logs.ingested_bytes` (by service) in hourly sums over `lookback` (default `90d`). An hour is a spike hour for a service when its indexed events exceed `spike_multiplier` (default 3) times the median of the same hour over the 7 days before; consecutive hours are one spike, and a service's first 7 days set its baseline. Each spike's excess events are priced at the Standard rate (list $1.70 per million, `standard_rate_per_million` overrides) and its excess bytes at ingestion (list $0.10 per GB, `ingestion_rate_per_gb` overrides). Estimates what a fleet default limit, `headroom` (default 2) times the service's largest hour outside its spikes, would have held, as an upper bound. Returns services by spike cost, each spike (start, hours, index, excess events, cost, held), the total a year at that rate, and the caveats. Read-only: Datadog's query API with DD_API_KEY / DD_APP_KEY / DD_SITE (GET only). Writes nothing. Input parameters: - `headroom` (number): The fleet default's multiplier on a service's largest hour outside its spikes. Default 2. - `ingestion_rate_per_gb` (number): The account's ingestion rate in dollars per GB. Default: list, $0.10. - `limit` (integer): Services listed, by spike cost. Default 10. - `lookback` (string): Days back from now to read, e.g. `90d` (default), from `8d` to `455d`; older days the API does not return are left out. The first 7 days of each service set its baseline. - `site` (string): Datadog site (e.g. `us5.datadoghq.com`). Defaults to DD_SITE, then `datadoghq.com`. - `spike_multiplier` (number): An hour is a spike when its events exceed this many times the median of the same hour over the 7 days before. Default 3. - `standard_rate_per_million` (number): The account's Standard indexing rate in dollars per million events. Default: list, $1.70 (15-day retention). - `view` (string): `markdown` (default): the audit page. `summary`: the same data without the page. Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ### `log10x_pattern_mitigate` (~567 tokens) Pattern mitigate [FRESH-SESSION ROUTING: if this is the user first cost question of the session, call log10x_start first instead, it returns the orientation menu the user needs before any per-tool action.] Given one pattern (symbolMessage identity or tenx_hash), return the env-gated CAPABILITY MENU of which mitigation paths are reachable: drop_at_analyzer, drop_at_forwarder, mute_at_10x, compact_at_10x. Each option carries `enabled` (true/false), `label`, and `disabled_reason` when not reachable. This is a REACHABILITY-FIRST router: it answers "which of the four tiers can I use right now given my env wiring", NOT "how much would each save". Per-option estimated savings (% reduction, $/mo) and paste-ready config snippets are surfaced by the next-tool chain (log10x_cost_options for the action menu, then the specific action tool for the snippet): NOT this envelope. The agent surfaces the menu to the user; the user picks; chain to log10x_cost_options for the action-level breakdown. **Action-shaped tool: calibration honesty**: the envelope's `recommendation_basis` tells the agent WHERE the capability detection came from (envs.json, snapshot, env vars, or unknown). `recommendation_audit.capability_sources` carries the per-field source, and `snapshot_age_seconds` carries snapshot staleness. The agent SHOULD NOT auto-route to the chosen sub-tool until the user picks an option, and SHOULD verify the basis before treating capability detection as authoritative (e.g., a stale snapshot may mis-flag mute as enabled when the receiver was uninstalled). See `docs/cross-pillar-primitives.md` for the agent behavior contract. **Call this** when a previous tool surfaced a high-cost pattern and the user asks 'what should I do' / 'how do I drop this' / 'how do I reduce this'. Input parameters: - `pattern` (string, required): The pattern identity to mitigate. Pass the canonical name from a prior log10x_top_patterns / log10x_event_lookup row. - `service` (string): Optional service scope. When set, options that target a single service (forwarder drop, exclusion filter) are scoped to it. - `snapshot_id` (string): Snapshot from log10x_discover_env. Used to detect which 10x components are deployed in the active env (receiver, retriever, GitOps wiring). When passed, the envelope's `recommendation_audit.capabilit… Output parameters: - `actions` (array) - `data` - `generated_at` (string) - `images` (array) - `next_cursor` (string) - `render_hint` (object) - `schema_epoch` (string) - `schema_version` (string) - `summary` (object) - `tool` (string) - `truncated` (boolean) - `view` (string) - `warnings` (array) ## Diagnostics Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/log-10x-log10x-mcp/log10x-mcp#diagnostics ## Score history - 2026-10-16: 90 - 2026-10-15: 46 - 2026-10-14: 38 - 2026-10-13: 46 - 2026-10-12: 46 - 2026-10-09: 31 - 2026-10-04: 87 - 2026-10-03: 71 - 2026-10-02: 71 - 2026-10-01: 70 - 2026-09-30: 85 - 2026-09-29: 69 - 2026-09-28: 61 - 2026-09-27: 83 - 2026-09-26: 83 - 2026-09-25: 82 - 2026-09-24: 82 - 2026-09-23: 81 - 2026-09-22: 81 - 2026-09-21: 80 - 2026-09-20: 80 - 2026-09-19: 80 - 2026-09-18: 79 - 2026-09-17: 79 - 2026-09-16: 78 - 2026-09-15: 63 - 2026-09-14: 77 - 2026-09-13: 54 - 2026-09-12: 76 - 2026-09-11: 61 ## Common questions ### What is the Log10x MCP server? Log10x MCP is listed in the public MCP registry as io.github.log-10x/log10x-mcp. Rank log patterns by volume and cost, then compact, tier down or offload the excess over each cap. This page covers its npm package (log10x-mcp). ### Is the Log10x MCP server safe to use? Log10x MCP scores 90 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 16 October 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm. ### What tools does the Log10x MCP server expose? Log10x MCP exposes 57 tools: log10x_event_lookup, log10x_pattern_examples, log10x_product_qa, log10x_savings, log10x_pattern_trend, and 52 more. Their descriptions and schemas cost roughly 39,546 tokens of context every time the server is loaded. ### Is the Log10x MCP server still maintained? Log10x MCP is still listed as active in the MCP registry. We last reached this channel on 16 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced. ### What licence is the Log10x MCP server under? Log10x MCP declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls. ## Links - npm package: https://www.npmjs.com/package/log10x-mcp - Socket report: https://socket.dev/npm/package/log10x-mcp - Repository: https://github.com/log-10x/log10x-mcp - Website: https://doc.log10x.com/apps/mcp/ - Changelog RSS feed: https://verifymcp.io/servers/log-10x-log10x-mcp/log10x-mcp.xml - Changelog JSON feed: https://verifymcp.io/servers/log-10x-log10x-mcp/log10x-mcp.json - HTML version of this page: https://verifymcp.io/servers/log-10x-log10x-mcp/log10x-mcp