Cost options
Called after the user picks option 1 from log10x_start. Returns a structured menu of the 6 enforcement modes, each with a plain-English description of what happens to the data and which infrastructure layer enforces it. At Receiver tier all 6 modes are available; at Reporter-only or Dev tier the menu collapses to 2 items (observe_only + install_receiver placeholder).
Three compliance levers (same shape as log10x_start):
- must_render_verbatim — pre-rendered markdown surfaced as-is
- must_ask_user — numbered question the agent must ask before routing
- forbidden_next_actions — tools blocked until the user picks
Example
You
what are my options?
Log10x
How do you want to handle the cost?
SIEM detected: splunk.
Pick a mode: 1. drop — stop events at the forwarder. Nothing reaches the SIEM. 2. sample — keep 1 in N events. Trends stay valid. 3. compact — compress events ~50-80% losslessly. All events still land in the SIEM. 4. tier_down — SIEM stores events at a cheaper storage tier. (not available: tier_down maps to billing reductions only on Datadog/CloudWatch. Detected SIEM: splunk.) 5. offload — events route to your S3 bucket instead of the SIEM. 6. observe_only — 10x marks patterns in metrics; nothing is dropped.
(Pick a number. After you pick, I'll run the savings estimate.)
Prerequisites
Requires Receiver tier for modes 1–5. Mode 6 (observe_only) works at all tiers. See log10x_start for tier detection.
Schema and samples
Input schema
Agent-facing JSON Schema (the canonical shape the MCP server publishes via tools/list):
{
"type": "object",
"properties": {
"target_percent": {
"type": "number",
"minimum": 1,
"maximum": 95,
"description": "% reduction goal carried from log10x_start pick, pre-filled when the user stated a target."
},
"service": {
"type": "string",
"description": "Scope to a service. Passed forward to estimate_savings when the user picks a mode."
},
"pattern_hash": {
"type": "string",
"description": "Optional pattern hash to scope the cost option menu to a single pattern. When present, routes_to.args will include a proposed_config row for this hash."
}
},
"additionalProperties": false
}
Source: src/tools/cost-options.ts.
Output schema
The data block inside the StructuredOutput envelope:
interface ToolData {
modes: Array<{
id: 'drop' | 'sample' | 'compact' | 'tier_down' | 'offload' | 'observe_only' | 'install_receiver';
label: string;
description: string;
who_enforces: 'engine' | 'SIEM' | 'forwarder' | 'customer';
applicable: boolean;
gated_reason?: string;
what_survives: string;
routes_to: { tool: string; args: Record<string, unknown> };
}>;
siem_detected: string | null;
capability_summary: { [key: string]: boolean };
must_render_verbatim: string;
must_ask_user: { question: string; options: string[] };
forbidden_next_actions: string[];
}
Envelope-level fields the agent should also read: summary.headline, actions[], schema_epoch.