Start

The first tool the agent calls whenever a user expresses a cost-cutting goal or open-ended platform question in a fresh session. Probes the environment (Reporter, Receiver, Retriever, SIEM) and returns a full orientation envelope:

• tier detected (dev / reporter / receiver / retriever)
• capability_summary (what is and isn't available without further setup)
• action_menu with 6 items, each gated by the detected tier
• must_render_verbatim — pre-rendered markdown the agent surfaces as-is
• must_ask_user — the numbered question the user must answer before any follow-up tool runs
• forbidden_next_actions — tools the agent must not call until the user picks

Example

You

where do I start?

Log10x

Log10x orientation

Tier: Reporter — cost attribution metrics flowing; in-path actions not yet wired.

Journey: [x] 1. Visibility [ ] 2. Attribution [ ] 3. Mitigation [ ] 4. Overflow [ ] 5. Commitment

What would you like to do? Pick a number: 1. Show me what cutting costs would look like (estimate before action) 2. Investigate a specific cost spike or top-N pattern right now 3. Fetch back events from your overflow bucket (incident / audit / debugging) 4. Deploy the Receiver so 10x can compact / sample / drop in-flight 5. Set up the overflow bucket (your own S3); diverts noisy patterns out of the SIEM for cost savings, events stay recoverable 6. Just orient me, explain what 10x does and what I should ask next

(Pick a number before I run any other tool.)

More to ask

• "orient me — first session"
• "I want to cut my Splunk bill"
• "what can 10x do?"

Prerequisites

None. The tool degrades gracefully when no environment is configured.

Schema and samples

Input schema

Agent-facing JSON Schema (the canonical shape the MCP server publishes via tools/list):

{
  "type": "object",
  "properties": {
    "intent_hint": {
      "type": "string",
      "enum": [
        "cost",
        "forensic",
        "install",
        "orient"
      ],
      "description": "Optional hint at what brought the user here. `cost` = wants to cut/save bill; `forensic` = wants to read back the offloaded/overflow cohort from the customer-owned S3 bucket; `install` = wants to deploy; `orient` = first-time session, open-ended. When omitted, the tool treats it as `orient`."
    },
    "session_state": {
      "type": "string",
      "enum": [
        "fresh",
        "midway",
        "returning"
      ],
      "description": "Optional caller hint at where the user is in the session. `fresh` (default when omitted) = first message of a new chat, emit the full orientation envelope. `midway` = the agent has already surfaced the orientation envelope this session and the user is mid-flow, emit a short \"already oriented, proceeding\" envelope. `returning` = treated as `fresh` because the menu / journey phase may have shifted since the last session."
    }
  },
  "additionalProperties": false
}

Source: src/tools/log10x-start.ts.

Output schema

The data block inside the StructuredOutput envelope:

interface ToolData {
  tier: 'dev' | 'reporter' | 'receiver' | 'retriever';
  siem_detected: string | null;
  capability_summary: {
    cost_attribution_available: boolean;
    compact_installable: boolean;
    tier_down_available: boolean;
    forensic_query_available: boolean;
    offload_ready: boolean;
    siem_query_available: boolean;
    receiver_discrimination_uncertain: boolean;
  };
  action_menu: Array<{
    action: string;
    label: string;
    applicable: boolean;
    gated_reason?: string;
    routes_to: string;
  }>;
  journey_phases: Array<{
    phase: number;
    name: string;
    description: string;
    current_status: 'complete' | 'in_progress' | 'not_started' | 'blocked_by_prior_phase';
  }>;
  must_render_verbatim: string;
  must_ask_user: { question: string; options: string[] };
  forbidden_next_actions: string[];
  intent_hint: 'cost' | 'forensic' | 'install' | 'orient';
}

Envelope-level fields the agent should also read: summary.headline (1-line answer), actions[] (next-call chain hints as {tool, args, reason}), schema_epoch (engine-ID stability boundary).

Next: Cost options