Skip to content

Scan env

Before any install advisor runs, sweep the cluster and AWS account to capture what's already deployed and what infra exists. Returns a markdown report plus a snapshot_id cached for 30 minutes; Reporter advisor, Receiver advisor, Retriever advisor, and Advise read it. Probes are read-only: only kubectl get and aws describe / list calls. Every shell command run is recorded in the snapshot's probeLog.

Example

You

scan env for install candidates

Log10x

Probes via kubectl get:

  • Existing workloads: DaemonSets, Deployments, Helm releases
  • Log forwarder detection: fluent-bit / fluentd / filebeat / logstash / otel-collector / vector
  • Log10x apps already installed (and in which namespace)
  • Storage classes, ingress classes
  • ServiceAccounts with IRSA annotations (IAM roles for pods)

Detected on this run: fluent-bit DaemonSet (3 replicas) in logging ns · EKS 1.28 · no Log10x apps · 4 storage classes · gp3 default.

Probes via aws describe / list:

  • EKS clusters in the region
  • S3 buckets matching log10x / tenx / retriever / bucket_hint
  • SQS queues following the Retriever convention (*-index-queue, *-query-queue, *-subquery-queue, *-stream-queue)
  • CloudWatch log groups

Detected on this run: AWS account 123456 · 1 EKS cluster acme-prod · S3 bucket logs-archive matched · 0 SQS queues · 12 CloudWatch log groups.

More to ask

  • "scan us-east-1, cluster acme-prod, namespaces logging+observability"
  • "AWS-only — no kubectl available"
  • "K8s-only scan, skip AWS"

Prerequisites

kubectl and/or aws CLI on PATH with working credentials. Either is optional — missing probes are reported as available: false. No Log10x components needed.

Schema and samples

Input example

Real call against the demo env (captured by scripts/capture-tool-envelopes.mjs).

{
  "skip_aws": true,
  "skip_kubectl": true,
  "view": "summary"
}
Input schema

Agent-facing JSON Schema (the canonical shape the MCP server publishes via tools/list):

{
  "type": "object",
  "properties": {
    "namespaces": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Explicit list of Kubernetes namespaces to probe. If omitted, the tool auto-picks up to 5 likely candidates (demo, logging, observability, otel-demo, default) plus kube-system."
    },
    "region": {
      "type": "string",
      "description": "AWS region to probe. If omitted, uses the region from your AWS CLI profile."
    },
    "eks_cluster_name": {
      "type": "string",
      "description": "EKS cluster to describe. If omitted and exactly one cluster exists in the account/region, that one is auto-selected."
    },
    "bucket_hint": {
      "type": "string",
      "description": "Substring to match against S3 bucket names. Defaults to \"retriever\"; also matches \"log10x\" and \"tenx\" out of the box."
    },
    "forwarder_hint": {
      "type": "string",
      "enum": [
        "fluentbit",
        "fluentd",
        "filebeat",
        "logstash",
        "otel-collector",
        "vector"
      ],
      "description": "Override forwarder detection. Use this if multiple forwarders are running and you want the advisor to target a specific one."
    },
    "namespace_hint": {
      "type": "string",
      "description": "Preferred namespace for new installs. Defaults to \"logging\" unless an existing forwarder namespace is found."
    },
    "skip_kubectl": {
      "type": "boolean",
      "description": "Skip all kubectl probes (for AWS-only discovery or when cluster access is restricted)."
    },
    "skip_aws": {
      "type": "boolean",
      "description": "Skip all AWS probes (for cluster-only discovery)."
    }
  },
  "additionalProperties": false
}

Source: src/tools/discover-env.ts.

Output example

Real envelope from the demo env. view: "summary" returns the full StructuredOutput with typed data. Long arrays + base64 PNG bodies trimmed for readability; the real call returns them in full.

Headline (the 1-line agent-facing answer):

Snapshot disc-572502b7-d5b0-42bf-9055-e4856bdf1f54: forwarder=none, installed=none, kubectl=unavailable, aws=unavailable.

{
  "schema_version": "1.0",
  "schema_epoch": "2026-05-25",
  "tool": "log10x_discover_env",
  "generated_at": "2026-05-26T15:38:35.785Z",
  "view": "summary",
  "summary": {
    "headline": "Snapshot `disc-572502b7-d5b0-42bf-9055-e4856bdf1f54`: forwarder=none, installed=none, kubectl=unavailable, aws=unavailable."
  },
  "data": {
    "snapshot_id": "disc-572502b7-d5b0-42bf-9055-e4856bdf1f54",
    "started_at": "2026-05-26T15:38:35.782Z",
    "finished_at": "2026-05-26T15:38:35.782Z",
    "kubectl_available": false,
    "aws_available": false,
    "installed_components": {
      "reporter": false,
      "receiver": false,
      "retriever": false
    },
    "namespaces_probed": [],
    "s3_buckets": [],
    "sqs_queues": [],
    "log_groups_count": 0,
    "probe_log_entry_count": 0
  },
  "actions": [
    {
      "tool": "log10x_advise_install",
      "args": {
        "snapshot_id": "disc-572502b7-d5b0-42bf-9055-e4856bdf1f54"
      },
      "reason": "no Reporter installed — pick the right install path"
    }
  ],
  "truncated": false,
  "warnings": []
}
Output schema

The data block inside the StructuredOutput envelope:

interface ToolData {
  snapshot_id: string;
  started_at: string;
  finished_at: string;
  kubectl_available: boolean;
  aws_available: boolean;
  installed_components: { reporter: boolean; receiver: boolean; retriever: boolean };
  namespaces_probed: unknown[];
  s3_buckets: unknown[];
  sqs_queues: unknown[];
  log_groups_count: number;
  probe_log_entry_count: number;
}

Envelope-level fields the agent should also read: summary.headline (1-line answer), actions[] (next-call chain hints as {tool, args, reason}), truncated: boolean, images[] (PNG attachments where applicable), schema_epoch (engine-ID stability boundary).

Next: Recommend