MCP

MCP tools your AI assistant calls when prompted with cost, pattern, or incident questions. Pick a row for the workflow at hand.

Tool	Ask
Orient	"where do I start?"
POC	"cost POC on our Splunk"
Account	"sign me up for log10x"
Install	"scan env, recommend install path"
Costs	"rank services by cost, 7d"
Identify	"is Retry_Backoff_Exhausted new, and is it spiking?"
Investigate	"why did Payment_Gateway_Timeout jump 40× since yesterday?"
Detect	"why is Payment_Gateway_Timeout so big?"
Drop	"safe to mute DEBUG /healthz?"
Retrieve	"fetch back the events I offloaded out of the log analyzer"

Boot mode

The MCP picks one of three modes at boot, based on what the env exposes. The mode decides which tools register. There is no runtime flag.

Mode	Trigger	Catalog registered
analysis	TSDB resolves AND tenx_pattern_bytes_total series exist	Full analysis catalog (Costs, Identify, Investigate, Drop, Retrieve)
analysis_pending	TSDB resolves, zero tenx_* series yet (fresh deploy)	Analysis catalog AND install advisors
poc	No TSDB resolvable from env (prospect)	POC + install advisors only

Detection runs once via the customer-metrics auto-detect cascade, bounded by a 5s probe. On timeout the MCP optimistically registers analysis tools and lets individual calls surface backend issues. Restart the MCP to re-detect after a backend change. The Doctor tool prints the resolved mode and trace.

Out-of-mode tool calls return a structured "not available in <mode>" reply instead of a backend 5xx.

Operator gates

Three boot-time env vars hide tools from tools/list without code changes. Useful for read-only customer demos, prospect evals, CI sandboxes.

Env var	Effect
LOG10X_MCP_ENABLED_CATEGORIES=cost,identify	Allowlist. Only listed categories register. Empty or unset = all categories.
LOG10X_MCP_DISABLED_CATEGORIES=poc,account	Blocklist. Applied after the allowlist.
LOG10X_MCP_DISABLE_WRITE=true	Hide every tool whose annotation readOnlyHint is explicitly false.

Categories match the nav: cost, identify, investigate, detect, drop, retrieve, install, account, poc.

JSON-by-default output

Every default-loaded analysis tool returns a StructuredOutput envelope:

{
  "schema_version": "1.0",
  "schema_epoch": "2026-05-25",
  "tool": "log10x_top_patterns",
  "generated_at": "2026-05-25T03:14:00Z",
  "view": "summary",
  "summary": { "headline": "...", "bullets": [...], "callout": "..." },
  "data": { ... },
  "actions": [ { "tool": "log10x_pattern_mitigate", "args": {...}, "reason": "..." } ],
  "render_hint": { "chart": "timeseries", "units": "$/h" },
  "truncated": false,
  "warnings": []
}

The agent reads actions[] to chain to the next tool without guessing the catalog graph. schema_epoch carries the deploy boundary: engine-derived IDs (template_hash, tenx_hash) are stable only within an epoch.

Pass view: "markdown" on any default-loaded tool to get the prior markdown-rendered output wrapped in data.markdown. view: "summary" (default) returns the typed data block plus a one-line summary.headline the agent quotes when it can't fit more.

Next: Orient