Local POC
Run a cost POC straight from kubectl logs when you don't want to plug log analyzer credentials into the MCP yet. Returns a sample-composition table by pod, an industry-pricing projection at Datadog / Splunk / CloudWatch / Sumo / Elastic / OpenSearch list rates, and the top patterns in the sample. The pricing is a list-rate matrix, not a prediction of a specific bill; for that, use POC submit once credentials are in the env.
Example
You
cost POC from kubectl, namespace production, 1h
Log10x
Pulled 38,420 lines (62 MB) across 17 pods over the last 1h.
Sample composition. Confirm this matches production before trusting the projection:
| Pod | Bytes | % of sample |
|---|---|---|
production/checkout-svc-7f9d-xk2z |
24 MB | 39% |
production/payments-svc-5b3c-h7n1 |
12 MB | 19% |
production/cart-svc-2a8e-q4r6 |
8 MB | 13% |
Projected savings at industry list pricing (extrapolated to 1.5 TB/day):
| Vendor | Rate | Annual cost | Annual savings |
|---|---|---|---|
| Datadog | $2.50/GB | $1.37M | $382K |
| Splunk | $5.00/GB | $2.74M | $763K |
| CloudWatch | $0.50/GB | $274K | $76K |
Top patterns: Payment_Gateway_Timeout 18% of bytes · DB_Connection_Refused 11% · Cart_Eviction_Replay 9%.
More to ask
- "cost POC from
kubectl, all namespaces, 24h" - "local POC against
default, top-10 pods only" - "local POC, 6h window, max 50 pods"
Prerequisites
kubectl on PATH with a working kubeconfig. Privacy mode (default) also needs a local Log10x engine: either the tenx CLI (install for macOS/Linux/Windows) or a local Docker container (LOG10X_TENX_MODE=docker, auto-detected and preferred when the mode is unset).
There is no automatic fallthrough from POC submit when log analyzer credentials are missing. The two paths frame cost differently. Submit predicts the prospect's actual bill; this tool emits an industry matrix. Switching framing silently would be a bait-and-switch, so the call is always explicit.
Schema and samples
Input example
Real call against the demo env (captured by scripts/capture-tool-envelopes.mjs).
Input schema
Agent-facing JSON Schema (the canonical shape the MCP server publishes via tools/list):
{
"type": "object",
"properties": {
"source": {
"type": "string",
"enum": [
"kubectl"
],
"default": "kubectl",
"description": "Where to pull log lines from. Currently `kubectl` only; `docker` and `journald` are follow-up work."
},
"namespace": {
"type": "string",
"default": "default",
"description": "Kubernetes namespace to sample from. Pass `*` to sample across all namespaces. Default `default`."
},
"window": {
"type": "string",
"default": "1h",
"description": "How far back to read per pod. Accepts `1h`, `24h`, etc. Default `1h`."
},
"per_pod_limit": {
"type": "number",
"minimum": 100,
"maximum": 50000,
"default": 5000,
"description": "Cap on log lines pulled per pod. Default 5000."
},
"max_pods": {
"type": "number",
"minimum": 1,
"maximum": 200,
"default": 20,
"description": "Cap on number of pods sampled. Default 20."
},
"privacy_mode": {
"type": "boolean",
"default": true,
"description": "Templatize via locally-installed `tenx` (true) or the public Log10x paste endpoint (false). Default true."
},
"target_percent_reduction": {
"type": "number",
"minimum": 0,
"maximum": 100,
"description": "Customer-specified target reduction percent. If absent, POC produces a recommendation-only output. If present, POC produces a feasibility verdict + a pre-deploy commitment artifact stub the agent can surface alongside the per-pod savings matrix. Cap CSV ships in Item 4."
},
"exception_services": {
"type": "array",
"items": {
"type": "string"
},
"description": "Services / pods flagged by the customer to stay in the log analyzer with full retention (action=pass). Their bytes are subtracted from the achievable reduction pool used for the feasibility verdict. Matched case-insensitively against the pod / source name."
},
"pin_services": {
"type": "object",
"additionalProperties": {
"type": "string",
"enum": [
"pass",
"sample",
"compact",
"tier_down",
"offload",
"drop"
]
},
"description": "Primary per-pod/source override surface. Map of pod / source name to action. Pins are applied AFTER the destination default and AFTER exception_services. Feasibility reruns with the pins; max_achievable shifts and reason cites the pins."
},
"pin_patterns": {
"type": "object",
"additionalProperties": {
"type": "string",
"enum": [
"pass",
"sample",
"compact",
"tier_down",
"offload",
"drop"
]
},
"description": "Advanced — most customers will not need this. Map of pattern_hash to action for rare per-pattern overrides within a pod / source. Applied AFTER pin_services."
}
},
"additionalProperties": false
}
Source: src/tools/poc-from-local.ts.
Output example
Real envelope from the demo env. view: "summary" returns the full StructuredOutput with typed data. Long arrays + base64 PNG bodies trimmed for readability; the real call returns them in full.
Headline (the 1-line agent-facing answer):
POC from kubectl: 84,210 lines from 18 pods → 142 distinct patterns, projected $86-$1,025/day across vendors.
{
"schema_version": "1.0",
"schema_epoch": "2026-05-25",
"tool": "log10x_poc_from_local",
"view": "summary",
"summary": {
"headline": "POC from kubectl: 84,210 lines from 18 pods → 142 distinct patterns, projected $86-$1,025/day across vendors."
},
"data": {
"ok": true,
"source": "kubectl",
"namespace": "*",
"window": "1h",
"pods_sampled": 18,
"pods_failed": 2,
"events_pulled": 84210,
"total_bytes": 32814220,
"distinct_patterns": 142,
"daily_gb_projection": 0.732,
"daily_dollar_projection_low": 86,
"daily_dollar_projection_high": 1025,
"notes": [
"18 pods read; 2 pods failed (access denied)"
]
},
"actions": [
{
"tool": "log10x_resolve_batch",
"args": {
"source": "text",
"text": "..."
},
"reason": "run the same sample through resolve_batch for per-pattern variable concentration + next actions"
}
],
"generated_at": "2026-05-26T00:00:00.000Z"
}
Output schema
The data block inside the StructuredOutput envelope:
interface ToolData {
ok: boolean;
source: string;
namespace: string;
window: string;
pods_sampled: number;
pods_failed: number;
events_pulled: number;
total_bytes: number;
distinct_patterns: number;
daily_gb_projection: number;
daily_dollar_projection_low: number;
daily_dollar_projection_high: number;
notes: string[];
}
Envelope-level fields the agent should also read: summary.headline (1-line answer), actions[] (next-call chain hints as {tool, args, reason}), truncated: boolean, images[] (PNG attachments where applicable), schema_epoch (engine-ID stability boundary).