[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-apm-health-summary":3,"mdc-rgq5ez-key":33,"related-org-elastic-apm-health-summary":1582,"related-repo-elastic-apm-health-summary":1756},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":29,"sourceUrl":31,"mdContent":32},"apm-health-summary","summarize Elastic APM service health","Get a cluster-level rollup of service health from APM telemetry — the \"how's my environment right now?\" entry point for observability investigations. Use whenever the user asks about HEALTH, STATUS, or general wellbeing of an environment \u002F cluster \u002F namespace (\"how's my cluster\", \"status of the X env\", \"what's broken\", \"any issues\", \"show me the health of …\", \"give me a status report\", \"what should I look at\", \"things feel slow\"). This applies regardless of any time qualifier — \"show me the health of X over the past hour\" still routes here (with lookback=\"1h\"), NOT to observe. observe is for raw-metric queries; this tool is for the rollup. Gracefully degrades: layers in Kubernetes pod data and ML anomaly context when those backends are present, but still returns useful APM-only output if they aren't. Do not use for log-only or metrics-only customers — this tool requires Elastic APM.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"Observability","observability","tag",{"name":17,"slug":18,"type":15},"Monitoring","monitoring",{"name":20,"slug":21,"type":15},"APM","apm",{"name":9,"slug":8,"type":15},10,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fexample-mcp-app-observability","2026-07-12T07:49:24.405551",null,7,[],{"repoUrl":24,"stars":23,"forks":27,"topics":30,"description":26},[],"https:\u002F\u002Fgithub.com\u002Felastic\u002Fexample-mcp-app-observability\u002Ftree\u002FHEAD\u002Fskills\u002Fapm-health-summary","---\nname: apm-health-summary\ndescription: >\n  Get a cluster-level rollup of service health from APM telemetry — the \"how's my environment right now?\"\n  entry point for observability investigations. Use whenever the user asks about HEALTH, STATUS, or\n  general wellbeing of an environment \u002F cluster \u002F namespace (\"how's my cluster\", \"status of the X env\",\n  \"what's broken\", \"any issues\", \"show me the health of …\", \"give me a status report\", \"what should I\n  look at\", \"things feel slow\"). This applies regardless of any time qualifier — \"show me the health\n  of X over the past hour\" still routes here (with lookback=\"1h\"), NOT to observe. observe is for\n  raw-metric queries; this tool is for the rollup. Gracefully degrades: layers in Kubernetes pod data\n  and ML anomaly context when those backends are present, but still returns useful APM-only output if\n  they aren't. Do not use for log-only or metrics-only customers — this tool requires Elastic APM.\n---\n\n# APM Health Summary\n\nThis is the **first tool to reach for** in vague-symptom investigations — \"something feels off, where should\nI look?\" It gives you a one-shot rollup: degraded services, top resource consumers, active anomalies, and a\n`data_coverage` report showing what backends contributed. From there, you pick the right follow-up tool.\n\n## Prerequisites\n\n| Signal | Required? | What happens without it |\n|--------|-----------|--------------------------|\n| Elastic APM | **Required** | Tool returns a warning and suggests `ml-anomalies`\u002F`observe`\u002F`manage-alerts` instead. |\n| Kubernetes (kubeletstats) | Optional | `pods` section is replaced by a note; service health still reported. |\n| ML anomaly jobs | Optional | `anomalies` section is replaced by a note; service health still reported. |\n\nIf the user is log-only or metrics-only (no APM), do not call this tool. Suggest `ml-anomalies` (for ML-backed\nanomaly detection) or `observe` \u002F `manage-alerts` (both universal).\n\n## Tools\n\n| Tool | Purpose |\n|------|---------|\n| `apm-health-summary` | The rollup. First call in most investigations. |\n| `ml-anomalies` | Drill into anomalies flagged in the summary. |\n| `apm-service-dependencies` | Map topology around any degraded service. |\n| `k8s-blast-radius` | If the summary implicates a node (pod resource pressure), assess node impact. |\n| `observe` | Post-investigation: observe for stabilization or follow-on anomalies. |\n\n## How to call apm-health-summary\n\n```json\n{\n  \"cluster\": \"prod-us-east\",\n  \"namespace\": \"otel-demo\",\n  \"lookback\": \"1h\"\n}\n```\n\n- **`cluster`**: pass whenever the user names a cluster (even partially) — \"the oteldemo cluster\", \"how's prod-us-east doing\", \"check the staging env\". Use the user's literal phrasing; the tool fuzzy-matches it. Omit only when the user clearly wants a cross-cluster view or there's a single cluster in the env.\n- **`namespace`**: pass when the user scopes to a K8s namespace. Same fuzzy-match logic as cluster.\n\n### Handling disambiguation responses\n\nWhen the user-supplied `cluster` or `namespace` matches multiple candidates (or none), the tool **does not** run the analysis. It returns a short response with `disambiguation_needed` set to `\"cluster\"`, `\"namespace\"`, or `\"cluster_and_namespace\"`, plus the candidate list:\n\n```json\n{\n  \"disambiguation_needed\": \"cluster\",\n  \"cluster_requested\": \"oteldemo\",\n  \"cluster_candidates\": [\"oteldemo-prod\", \"oteldemo-staging\"],\n  \"cluster_match\": \"multiple\"\n}\n```\n\nWhen you see this, **don't re-call the tool with a guessed cluster name.** Surface the candidates to the user verbatim, ask which one they meant, then re-call the tool with the exact name they pick. Same flow for `namespace_match: \"none\"` (the requested name doesn't exist in recent telemetry) — show candidates and ask.\n- **`lookback`**: **default `1h`** for any unqualified prompt — \"what's the status of X\", \"how is X doing\", \"check on X\", \"give me a status report\". Don't drop to 15m unless the user explicitly says something time-localized like \"right now \u002F this second \u002F this minute\". Use the user's time window literally when they give one (\"over the past 30 minutes\" → `30m`; \"in the last 6 hours\" → `6h`; \"today\" → `24h`). The 1h default is intentional — most cluster-state questions need a window wide enough to surface degradation patterns, and 15m hides slow-burning issues.\n- **`job_filter`**: optional ML-job prefix, e.g. `k8s-`. Rarely needed.\n- **`exclude_entities`**: optional wildcard to hide known noise, e.g. `chaos-*`.\n\n## After the tool returns\n\nThe tool renders an inline MCP App view — status badge, scope card (cluster › namespace › service\u002Fpod\ncounts plus an applications strip), KPI tile rows, anomaly-severity donut + heatmap, top memory pods,\nservice throughput list, and a next-step button row driven by `investigation_actions`. Use the view\nfor the visual rollup; narrate findings below it.\n\nInspect `data_coverage` first — this tells you which signals contributed.\n\nThe `scope` field anchors what the user is looking at — start narration with it when present:\n\"Looking at cluster `prod-us-east`, namespace `payments`, 12 services across 42 pods…\". When `scope.service_groups`\nis populated the view shows clickable application chips users can toggle to filter the page client-side\n(throughput rows, top pods, anomaly heatmap, donut counts all recompute). **Don't suggest re-running the\ntool when the user wants to narrow to one application — point them at the chips instead.** Only re-call\nwith a different `cluster` \u002F `namespace` when they're crossing the scope boundary.\n\nIgnore `_setup_notice` if present in the response — it's view-side chrome (welcome banner \u002F skill-gap hint)\nthat the UI handles. Don't echo or summarize it in chat.\n\nThen walk the output top-down:\n\n1. **Overall health** (`healthy` \u002F `degraded` \u002F `critical`): lead with this.\n2. **Degraded services**: name them with reasons (error rate, latency). These are the investigation targets.\n3. **Pods** (if present): top memory consumers — cross-reference with degraded services.\n4. **Anomalies** (if present): by-severity counts + top entities. Drives the ML follow-up.\n5. **Alerts** (`alerts` field, always emitted): `active_count` \u002F `recovered_count` plus `top_rules` and `active_samples`. **Read these before reaching for `manage-alerts`** — the rollup already shows what fired and why. Only call `manage-alerts` when the user wants to create\u002Fmodify rules (not just see what fired). Cross-reference active alerts with degraded services: a pod-memory alert on the same pod that's degrading is a strong signal.\n6. **SLOs** (`slos` field, always emitted): authoritative source for \"is this cluster meeting its objectives?\". `configured: false` means no SLOs exist — surface the `note` once and move on. `configured: true` gives you `violated_count`, `healthy_count`, and `top_violations[]` with each violated SLO's current `sli_value`, `target`, and `one_hour_burn_rate`. **Read burn rate hard:** `> 14.4×` means the rolling-window error budget burns out in \u003C2h at the current rate (page-worthy); `6–14×` is degrading; `\u003C 1×` is safe pace. Cross-reference `top_violations[].name` with `degraded_services[]` — services that appear in both are the priority drilldowns. Don't suggest creating SLOs if `configured: true`; do suggest it if `configured: false`.\n7. **Next-step buttons**: the view surfaces `investigation_actions` as clickable prompts (drill into the\n   top pod, investigate the degraded service, check blast radius). Mention them in chat so the user knows.\n\nBased on what you see, pick the next tool:\n- **Degraded service named → `apm-service-dependencies` first.** This is the highest-yield drilldown for a known-degraded service in almost every cluster. The topology map points directly at upstream\u002Fdownstream root causes (slow gRPC dependency, hung leaf node, fan-out timing). Don't reach for `ml-anomalies` first — most clusters don't have anomaly jobs configured for arbitrary services, and you'll waste a turn on an empty result.\n- **`ml-anomalies` is a complementary, not primary, drilldown.** Use it when (a) the user wants anomaly *detail* on a known-degraded service AND `data_coverage.ml_anomalies` is true, OR (b) the user is investigating a vague symptom and wants detection. If `data_coverage.ml_anomalies` is false, skip `ml-anomalies` entirely — there are no jobs to query.\n- **If you do call `ml-anomalies` and it returns empty \u002F no-jobs for the entity**, fall back to `apm-service-dependencies` for that same service immediately. Don't leave the user at a dead end.\n- High anomaly count in the rollup → `ml-anomalies` with matching `lookback` (this is the \"lots of anomalies, what's worst?\" path — different from the named-degraded-service path above).\n- Pod resource pressure on a specific node → `k8s-blast-radius` with that node name.\n\n## Key principles\n\n- **Start here, then narrow.** Don't guess which service is the problem — let the rollup tell you.\n- **Respect `data_coverage`.** If K8s is absent, don't suggest `k8s-blast-radius`. If APM is absent, don't\n  call this tool at all.\n- **The overall health is coarse.** \"Healthy\" doesn't mean nothing is wrong — it means nothing meets the\n  degraded thresholds. Always scan the details.\n- **Graceful degradation is by design.** APM-only output is still useful — don't apologize for missing K8s\n  or ML signals; just report what you have.\n\n## Investigation discipline\n\nMulti-tool investigations should be **sequential and narrated**, not parallel and silent. Each tool call renders its own widget in the chat — firing 4-5 in a row after a single \"yes\" creates a wall of \"Waiting…\" placeholders that look like the system is broken.\n\n- **One tool call per turn.** After a tool returns, narrate what you saw — the headline number, what it implies, what it rules in or out — *before* making the next call. The narration is the user's only signal that you read the result.\n- **Sequential offers, not OR offers.** Don't ask \"Want me to check X *or* Y?\" — that's ambiguous and the user's \"yes\" turns into both calls in parallel. Phrase offers as a chain: \"Want me to start with X? If it's inconclusive I can follow up with Y.\" The user gets the same options without the parallel-execution trap.\n- **Commit to a plan before \"yes.\"** If a triage will need 3-4 tool calls, lay out the plan first (\"I'll check anomalies for flagd, then its pod resources, then trace errors from product-reviews — pause me if you've seen enough at any point\") and execute one step at a time. Don't pre-fire all 3 calls because the user agreed to \"the plan.\"\n- **Read the rollup before drilling.** apm-health-summary already includes services, pods, anomalies, fired alerts, and SLOs in one response. If the user asks \"what fired recently?\" — answer from `alerts.top_rules`, don't call manage-alerts. If they ask \"what's anomalous?\" — answer from `anomalies.top_entities`, don't call ml-anomalies for the same data.\n",{"data":34,"body":35},{"name":4,"description":6},{"type":36,"children":37},"root",[38,46,69,76,199,225,231,335,341,491,522,529,587,775,795,891,897,910,922,978,991,996,1291,1296,1423,1429,1485,1491,1503,1576],{"type":39,"tag":40,"props":41,"children":42},"element","h1",{"id":4},[43],{"type":44,"value":45},"text","APM Health Summary",{"type":39,"tag":47,"props":48,"children":49},"p",{},[50,52,58,60,67],{"type":44,"value":51},"This is the ",{"type":39,"tag":53,"props":54,"children":55},"strong",{},[56],{"type":44,"value":57},"first tool to reach for",{"type":44,"value":59}," in vague-symptom investigations — \"something feels off, where should\nI look?\" It gives you a one-shot rollup: degraded services, top resource consumers, active anomalies, and a\n",{"type":39,"tag":61,"props":62,"children":64},"code",{"className":63},[],[65],{"type":44,"value":66},"data_coverage",{"type":44,"value":68}," report showing what backends contributed. From there, you pick the right follow-up tool.",{"type":39,"tag":70,"props":71,"children":73},"h2",{"id":72},"prerequisites",[74],{"type":44,"value":75},"Prerequisites",{"type":39,"tag":77,"props":78,"children":79},"table",{},[80,104],{"type":39,"tag":81,"props":82,"children":83},"thead",{},[84],{"type":39,"tag":85,"props":86,"children":87},"tr",{},[88,94,99],{"type":39,"tag":89,"props":90,"children":91},"th",{},[92],{"type":44,"value":93},"Signal",{"type":39,"tag":89,"props":95,"children":96},{},[97],{"type":44,"value":98},"Required?",{"type":39,"tag":89,"props":100,"children":101},{},[102],{"type":44,"value":103},"What happens without it",{"type":39,"tag":105,"props":106,"children":107},"tbody",{},[108,153,177],{"type":39,"tag":85,"props":109,"children":110},{},[111,117,125],{"type":39,"tag":112,"props":113,"children":114},"td",{},[115],{"type":44,"value":116},"Elastic APM",{"type":39,"tag":112,"props":118,"children":119},{},[120],{"type":39,"tag":53,"props":121,"children":122},{},[123],{"type":44,"value":124},"Required",{"type":39,"tag":112,"props":126,"children":127},{},[128,130,136,138,144,145,151],{"type":44,"value":129},"Tool returns a warning and suggests ",{"type":39,"tag":61,"props":131,"children":133},{"className":132},[],[134],{"type":44,"value":135},"ml-anomalies",{"type":44,"value":137},"\u002F",{"type":39,"tag":61,"props":139,"children":141},{"className":140},[],[142],{"type":44,"value":143},"observe",{"type":44,"value":137},{"type":39,"tag":61,"props":146,"children":148},{"className":147},[],[149],{"type":44,"value":150},"manage-alerts",{"type":44,"value":152}," instead.",{"type":39,"tag":85,"props":154,"children":155},{},[156,161,166],{"type":39,"tag":112,"props":157,"children":158},{},[159],{"type":44,"value":160},"Kubernetes (kubeletstats)",{"type":39,"tag":112,"props":162,"children":163},{},[164],{"type":44,"value":165},"Optional",{"type":39,"tag":112,"props":167,"children":168},{},[169,175],{"type":39,"tag":61,"props":170,"children":172},{"className":171},[],[173],{"type":44,"value":174},"pods",{"type":44,"value":176}," section is replaced by a note; service health still reported.",{"type":39,"tag":85,"props":178,"children":179},{},[180,185,189],{"type":39,"tag":112,"props":181,"children":182},{},[183],{"type":44,"value":184},"ML anomaly jobs",{"type":39,"tag":112,"props":186,"children":187},{},[188],{"type":44,"value":165},{"type":39,"tag":112,"props":190,"children":191},{},[192,198],{"type":39,"tag":61,"props":193,"children":195},{"className":194},[],[196],{"type":44,"value":197},"anomalies",{"type":44,"value":176},{"type":39,"tag":47,"props":200,"children":201},{},[202,204,209,211,216,218,223],{"type":44,"value":203},"If the user is log-only or metrics-only (no APM), do not call this tool. Suggest ",{"type":39,"tag":61,"props":205,"children":207},{"className":206},[],[208],{"type":44,"value":135},{"type":44,"value":210}," (for ML-backed\nanomaly detection) or ",{"type":39,"tag":61,"props":212,"children":214},{"className":213},[],[215],{"type":44,"value":143},{"type":44,"value":217}," \u002F ",{"type":39,"tag":61,"props":219,"children":221},{"className":220},[],[222],{"type":44,"value":150},{"type":44,"value":224}," (both universal).",{"type":39,"tag":70,"props":226,"children":228},{"id":227},"tools",[229],{"type":44,"value":230},"Tools",{"type":39,"tag":77,"props":232,"children":233},{},[234,250],{"type":39,"tag":81,"props":235,"children":236},{},[237],{"type":39,"tag":85,"props":238,"children":239},{},[240,245],{"type":39,"tag":89,"props":241,"children":242},{},[243],{"type":44,"value":244},"Tool",{"type":39,"tag":89,"props":246,"children":247},{},[248],{"type":44,"value":249},"Purpose",{"type":39,"tag":105,"props":251,"children":252},{},[253,269,285,302,319],{"type":39,"tag":85,"props":254,"children":255},{},[256,264],{"type":39,"tag":112,"props":257,"children":258},{},[259],{"type":39,"tag":61,"props":260,"children":262},{"className":261},[],[263],{"type":44,"value":4},{"type":39,"tag":112,"props":265,"children":266},{},[267],{"type":44,"value":268},"The rollup. First call in most investigations.",{"type":39,"tag":85,"props":270,"children":271},{},[272,280],{"type":39,"tag":112,"props":273,"children":274},{},[275],{"type":39,"tag":61,"props":276,"children":278},{"className":277},[],[279],{"type":44,"value":135},{"type":39,"tag":112,"props":281,"children":282},{},[283],{"type":44,"value":284},"Drill into anomalies flagged in the summary.",{"type":39,"tag":85,"props":286,"children":287},{},[288,297],{"type":39,"tag":112,"props":289,"children":290},{},[291],{"type":39,"tag":61,"props":292,"children":294},{"className":293},[],[295],{"type":44,"value":296},"apm-service-dependencies",{"type":39,"tag":112,"props":298,"children":299},{},[300],{"type":44,"value":301},"Map topology around any degraded service.",{"type":39,"tag":85,"props":303,"children":304},{},[305,314],{"type":39,"tag":112,"props":306,"children":307},{},[308],{"type":39,"tag":61,"props":309,"children":311},{"className":310},[],[312],{"type":44,"value":313},"k8s-blast-radius",{"type":39,"tag":112,"props":315,"children":316},{},[317],{"type":44,"value":318},"If the summary implicates a node (pod resource pressure), assess node impact.",{"type":39,"tag":85,"props":320,"children":321},{},[322,330],{"type":39,"tag":112,"props":323,"children":324},{},[325],{"type":39,"tag":61,"props":326,"children":328},{"className":327},[],[329],{"type":44,"value":143},{"type":39,"tag":112,"props":331,"children":332},{},[333],{"type":44,"value":334},"Post-investigation: observe for stabilization or follow-on anomalies.",{"type":39,"tag":70,"props":336,"children":338},{"id":337},"how-to-call-apm-health-summary",[339],{"type":44,"value":340},"How to call apm-health-summary",{"type":39,"tag":342,"props":343,"children":348},"pre",{"className":344,"code":345,"language":346,"meta":347,"style":347},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"cluster\": \"prod-us-east\",\n  \"namespace\": \"otel-demo\",\n  \"lookback\": \"1h\"\n}\n","json","",[349],{"type":39,"tag":61,"props":350,"children":351},{"__ignoreMap":347},[352,364,409,447,482],{"type":39,"tag":353,"props":354,"children":357},"span",{"class":355,"line":356},"line",1,[358],{"type":39,"tag":353,"props":359,"children":361},{"style":360},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[362],{"type":44,"value":363},"{\n",{"type":39,"tag":353,"props":365,"children":367},{"class":355,"line":366},2,[368,373,379,384,389,394,400,404],{"type":39,"tag":353,"props":369,"children":370},{"style":360},[371],{"type":44,"value":372},"  \"",{"type":39,"tag":353,"props":374,"children":376},{"style":375},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[377],{"type":44,"value":378},"cluster",{"type":39,"tag":353,"props":380,"children":381},{"style":360},[382],{"type":44,"value":383},"\"",{"type":39,"tag":353,"props":385,"children":386},{"style":360},[387],{"type":44,"value":388},":",{"type":39,"tag":353,"props":390,"children":391},{"style":360},[392],{"type":44,"value":393}," \"",{"type":39,"tag":353,"props":395,"children":397},{"style":396},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[398],{"type":44,"value":399},"prod-us-east",{"type":39,"tag":353,"props":401,"children":402},{"style":360},[403],{"type":44,"value":383},{"type":39,"tag":353,"props":405,"children":406},{"style":360},[407],{"type":44,"value":408},",\n",{"type":39,"tag":353,"props":410,"children":412},{"class":355,"line":411},3,[413,417,422,426,430,434,439,443],{"type":39,"tag":353,"props":414,"children":415},{"style":360},[416],{"type":44,"value":372},{"type":39,"tag":353,"props":418,"children":419},{"style":375},[420],{"type":44,"value":421},"namespace",{"type":39,"tag":353,"props":423,"children":424},{"style":360},[425],{"type":44,"value":383},{"type":39,"tag":353,"props":427,"children":428},{"style":360},[429],{"type":44,"value":388},{"type":39,"tag":353,"props":431,"children":432},{"style":360},[433],{"type":44,"value":393},{"type":39,"tag":353,"props":435,"children":436},{"style":396},[437],{"type":44,"value":438},"otel-demo",{"type":39,"tag":353,"props":440,"children":441},{"style":360},[442],{"type":44,"value":383},{"type":39,"tag":353,"props":444,"children":445},{"style":360},[446],{"type":44,"value":408},{"type":39,"tag":353,"props":448,"children":450},{"class":355,"line":449},4,[451,455,460,464,468,472,477],{"type":39,"tag":353,"props":452,"children":453},{"style":360},[454],{"type":44,"value":372},{"type":39,"tag":353,"props":456,"children":457},{"style":375},[458],{"type":44,"value":459},"lookback",{"type":39,"tag":353,"props":461,"children":462},{"style":360},[463],{"type":44,"value":383},{"type":39,"tag":353,"props":465,"children":466},{"style":360},[467],{"type":44,"value":388},{"type":39,"tag":353,"props":469,"children":470},{"style":360},[471],{"type":44,"value":393},{"type":39,"tag":353,"props":473,"children":474},{"style":396},[475],{"type":44,"value":476},"1h",{"type":39,"tag":353,"props":478,"children":479},{"style":360},[480],{"type":44,"value":481},"\"\n",{"type":39,"tag":353,"props":483,"children":485},{"class":355,"line":484},5,[486],{"type":39,"tag":353,"props":487,"children":488},{"style":360},[489],{"type":44,"value":490},"}\n",{"type":39,"tag":492,"props":493,"children":494},"ul",{},[495,509],{"type":39,"tag":496,"props":497,"children":498},"li",{},[499,507],{"type":39,"tag":53,"props":500,"children":501},{},[502],{"type":39,"tag":61,"props":503,"children":505},{"className":504},[],[506],{"type":44,"value":378},{"type":44,"value":508},": pass whenever the user names a cluster (even partially) — \"the oteldemo cluster\", \"how's prod-us-east doing\", \"check the staging env\". Use the user's literal phrasing; the tool fuzzy-matches it. Omit only when the user clearly wants a cross-cluster view or there's a single cluster in the env.",{"type":39,"tag":496,"props":510,"children":511},{},[512,520],{"type":39,"tag":53,"props":513,"children":514},{},[515],{"type":39,"tag":61,"props":516,"children":518},{"className":517},[],[519],{"type":44,"value":421},{"type":44,"value":521},": pass when the user scopes to a K8s namespace. Same fuzzy-match logic as cluster.",{"type":39,"tag":523,"props":524,"children":526},"h3",{"id":525},"handling-disambiguation-responses",[527],{"type":44,"value":528},"Handling disambiguation responses",{"type":39,"tag":47,"props":530,"children":531},{},[532,534,539,541,546,548,553,555,561,563,569,571,577,579,585],{"type":44,"value":533},"When the user-supplied ",{"type":39,"tag":61,"props":535,"children":537},{"className":536},[],[538],{"type":44,"value":378},{"type":44,"value":540}," or ",{"type":39,"tag":61,"props":542,"children":544},{"className":543},[],[545],{"type":44,"value":421},{"type":44,"value":547}," matches multiple candidates (or none), the tool ",{"type":39,"tag":53,"props":549,"children":550},{},[551],{"type":44,"value":552},"does not",{"type":44,"value":554}," run the analysis. It returns a short response with ",{"type":39,"tag":61,"props":556,"children":558},{"className":557},[],[559],{"type":44,"value":560},"disambiguation_needed",{"type":44,"value":562}," set to ",{"type":39,"tag":61,"props":564,"children":566},{"className":565},[],[567],{"type":44,"value":568},"\"cluster\"",{"type":44,"value":570},", ",{"type":39,"tag":61,"props":572,"children":574},{"className":573},[],[575],{"type":44,"value":576},"\"namespace\"",{"type":44,"value":578},", or ",{"type":39,"tag":61,"props":580,"children":582},{"className":581},[],[583],{"type":44,"value":584},"\"cluster_and_namespace\"",{"type":44,"value":586},", plus the candidate list:",{"type":39,"tag":342,"props":588,"children":590},{"className":344,"code":589,"language":346,"meta":347,"style":347},"{\n  \"disambiguation_needed\": \"cluster\",\n  \"cluster_requested\": \"oteldemo\",\n  \"cluster_candidates\": [\"oteldemo-prod\", \"oteldemo-staging\"],\n  \"cluster_match\": \"multiple\"\n}\n",[591],{"type":39,"tag":61,"props":592,"children":593},{"__ignoreMap":347},[594,601,636,673,734,767],{"type":39,"tag":353,"props":595,"children":596},{"class":355,"line":356},[597],{"type":39,"tag":353,"props":598,"children":599},{"style":360},[600],{"type":44,"value":363},{"type":39,"tag":353,"props":602,"children":603},{"class":355,"line":366},[604,608,612,616,620,624,628,632],{"type":39,"tag":353,"props":605,"children":606},{"style":360},[607],{"type":44,"value":372},{"type":39,"tag":353,"props":609,"children":610},{"style":375},[611],{"type":44,"value":560},{"type":39,"tag":353,"props":613,"children":614},{"style":360},[615],{"type":44,"value":383},{"type":39,"tag":353,"props":617,"children":618},{"style":360},[619],{"type":44,"value":388},{"type":39,"tag":353,"props":621,"children":622},{"style":360},[623],{"type":44,"value":393},{"type":39,"tag":353,"props":625,"children":626},{"style":396},[627],{"type":44,"value":378},{"type":39,"tag":353,"props":629,"children":630},{"style":360},[631],{"type":44,"value":383},{"type":39,"tag":353,"props":633,"children":634},{"style":360},[635],{"type":44,"value":408},{"type":39,"tag":353,"props":637,"children":638},{"class":355,"line":411},[639,643,648,652,656,660,665,669],{"type":39,"tag":353,"props":640,"children":641},{"style":360},[642],{"type":44,"value":372},{"type":39,"tag":353,"props":644,"children":645},{"style":375},[646],{"type":44,"value":647},"cluster_requested",{"type":39,"tag":353,"props":649,"children":650},{"style":360},[651],{"type":44,"value":383},{"type":39,"tag":353,"props":653,"children":654},{"style":360},[655],{"type":44,"value":388},{"type":39,"tag":353,"props":657,"children":658},{"style":360},[659],{"type":44,"value":393},{"type":39,"tag":353,"props":661,"children":662},{"style":396},[663],{"type":44,"value":664},"oteldemo",{"type":39,"tag":353,"props":666,"children":667},{"style":360},[668],{"type":44,"value":383},{"type":39,"tag":353,"props":670,"children":671},{"style":360},[672],{"type":44,"value":408},{"type":39,"tag":353,"props":674,"children":675},{"class":355,"line":449},[676,680,685,689,693,698,702,707,711,716,720,725,729],{"type":39,"tag":353,"props":677,"children":678},{"style":360},[679],{"type":44,"value":372},{"type":39,"tag":353,"props":681,"children":682},{"style":375},[683],{"type":44,"value":684},"cluster_candidates",{"type":39,"tag":353,"props":686,"children":687},{"style":360},[688],{"type":44,"value":383},{"type":39,"tag":353,"props":690,"children":691},{"style":360},[692],{"type":44,"value":388},{"type":39,"tag":353,"props":694,"children":695},{"style":360},[696],{"type":44,"value":697}," [",{"type":39,"tag":353,"props":699,"children":700},{"style":360},[701],{"type":44,"value":383},{"type":39,"tag":353,"props":703,"children":704},{"style":396},[705],{"type":44,"value":706},"oteldemo-prod",{"type":39,"tag":353,"props":708,"children":709},{"style":360},[710],{"type":44,"value":383},{"type":39,"tag":353,"props":712,"children":713},{"style":360},[714],{"type":44,"value":715},",",{"type":39,"tag":353,"props":717,"children":718},{"style":360},[719],{"type":44,"value":393},{"type":39,"tag":353,"props":721,"children":722},{"style":396},[723],{"type":44,"value":724},"oteldemo-staging",{"type":39,"tag":353,"props":726,"children":727},{"style":360},[728],{"type":44,"value":383},{"type":39,"tag":353,"props":730,"children":731},{"style":360},[732],{"type":44,"value":733},"],\n",{"type":39,"tag":353,"props":735,"children":736},{"class":355,"line":484},[737,741,746,750,754,758,763],{"type":39,"tag":353,"props":738,"children":739},{"style":360},[740],{"type":44,"value":372},{"type":39,"tag":353,"props":742,"children":743},{"style":375},[744],{"type":44,"value":745},"cluster_match",{"type":39,"tag":353,"props":747,"children":748},{"style":360},[749],{"type":44,"value":383},{"type":39,"tag":353,"props":751,"children":752},{"style":360},[753],{"type":44,"value":388},{"type":39,"tag":353,"props":755,"children":756},{"style":360},[757],{"type":44,"value":393},{"type":39,"tag":353,"props":759,"children":760},{"style":396},[761],{"type":44,"value":762},"multiple",{"type":39,"tag":353,"props":764,"children":765},{"style":360},[766],{"type":44,"value":481},{"type":39,"tag":353,"props":768,"children":770},{"class":355,"line":769},6,[771],{"type":39,"tag":353,"props":772,"children":773},{"style":360},[774],{"type":44,"value":490},{"type":39,"tag":47,"props":776,"children":777},{},[778,780,785,787,793],{"type":44,"value":779},"When you see this, ",{"type":39,"tag":53,"props":781,"children":782},{},[783],{"type":44,"value":784},"don't re-call the tool with a guessed cluster name.",{"type":44,"value":786}," Surface the candidates to the user verbatim, ask which one they meant, then re-call the tool with the exact name they pick. Same flow for ",{"type":39,"tag":61,"props":788,"children":790},{"className":789},[],[791],{"type":44,"value":792},"namespace_match: \"none\"",{"type":44,"value":794}," (the requested name doesn't exist in recent telemetry) — show candidates and ask.",{"type":39,"tag":492,"props":796,"children":797},{},[798,847,869],{"type":39,"tag":496,"props":799,"children":800},{},[801,809,811,821,823,829,831,837,839,845],{"type":39,"tag":53,"props":802,"children":803},{},[804],{"type":39,"tag":61,"props":805,"children":807},{"className":806},[],[808],{"type":44,"value":459},{"type":44,"value":810},": ",{"type":39,"tag":53,"props":812,"children":813},{},[814,816],{"type":44,"value":815},"default ",{"type":39,"tag":61,"props":817,"children":819},{"className":818},[],[820],{"type":44,"value":476},{"type":44,"value":822}," for any unqualified prompt — \"what's the status of X\", \"how is X doing\", \"check on X\", \"give me a status report\". Don't drop to 15m unless the user explicitly says something time-localized like \"right now \u002F this second \u002F this minute\". Use the user's time window literally when they give one (\"over the past 30 minutes\" → ",{"type":39,"tag":61,"props":824,"children":826},{"className":825},[],[827],{"type":44,"value":828},"30m",{"type":44,"value":830},"; \"in the last 6 hours\" → ",{"type":39,"tag":61,"props":832,"children":834},{"className":833},[],[835],{"type":44,"value":836},"6h",{"type":44,"value":838},"; \"today\" → ",{"type":39,"tag":61,"props":840,"children":842},{"className":841},[],[843],{"type":44,"value":844},"24h",{"type":44,"value":846},"). The 1h default is intentional — most cluster-state questions need a window wide enough to surface degradation patterns, and 15m hides slow-burning issues.",{"type":39,"tag":496,"props":848,"children":849},{},[850,859,861,867],{"type":39,"tag":53,"props":851,"children":852},{},[853],{"type":39,"tag":61,"props":854,"children":856},{"className":855},[],[857],{"type":44,"value":858},"job_filter",{"type":44,"value":860},": optional ML-job prefix, e.g. ",{"type":39,"tag":61,"props":862,"children":864},{"className":863},[],[865],{"type":44,"value":866},"k8s-",{"type":44,"value":868},". Rarely needed.",{"type":39,"tag":496,"props":870,"children":871},{},[872,881,883,889],{"type":39,"tag":53,"props":873,"children":874},{},[875],{"type":39,"tag":61,"props":876,"children":878},{"className":877},[],[879],{"type":44,"value":880},"exclude_entities",{"type":44,"value":882},": optional wildcard to hide known noise, e.g. ",{"type":39,"tag":61,"props":884,"children":886},{"className":885},[],[887],{"type":44,"value":888},"chaos-*",{"type":44,"value":890},".",{"type":39,"tag":70,"props":892,"children":894},{"id":893},"after-the-tool-returns",[895],{"type":44,"value":896},"After the tool returns",{"type":39,"tag":47,"props":898,"children":899},{},[900,902,908],{"type":44,"value":901},"The tool renders an inline MCP App view — status badge, scope card (cluster › namespace › service\u002Fpod\ncounts plus an applications strip), KPI tile rows, anomaly-severity donut + heatmap, top memory pods,\nservice throughput list, and a next-step button row driven by ",{"type":39,"tag":61,"props":903,"children":905},{"className":904},[],[906],{"type":44,"value":907},"investigation_actions",{"type":44,"value":909},". Use the view\nfor the visual rollup; narrate findings below it.",{"type":39,"tag":47,"props":911,"children":912},{},[913,915,920],{"type":44,"value":914},"Inspect ",{"type":39,"tag":61,"props":916,"children":918},{"className":917},[],[919],{"type":44,"value":66},{"type":44,"value":921}," first — this tells you which signals contributed.",{"type":39,"tag":47,"props":923,"children":924},{},[925,927,933,935,940,942,948,950,956,958,963,965,970,971,976],{"type":44,"value":926},"The ",{"type":39,"tag":61,"props":928,"children":930},{"className":929},[],[931],{"type":44,"value":932},"scope",{"type":44,"value":934}," field anchors what the user is looking at — start narration with it when present:\n\"Looking at cluster ",{"type":39,"tag":61,"props":936,"children":938},{"className":937},[],[939],{"type":44,"value":399},{"type":44,"value":941},", namespace ",{"type":39,"tag":61,"props":943,"children":945},{"className":944},[],[946],{"type":44,"value":947},"payments",{"type":44,"value":949},", 12 services across 42 pods…\". When ",{"type":39,"tag":61,"props":951,"children":953},{"className":952},[],[954],{"type":44,"value":955},"scope.service_groups",{"type":44,"value":957},"\nis populated the view shows clickable application chips users can toggle to filter the page client-side\n(throughput rows, top pods, anomaly heatmap, donut counts all recompute). ",{"type":39,"tag":53,"props":959,"children":960},{},[961],{"type":44,"value":962},"Don't suggest re-running the\ntool when the user wants to narrow to one application — point them at the chips instead.",{"type":44,"value":964}," Only re-call\nwith a different ",{"type":39,"tag":61,"props":966,"children":968},{"className":967},[],[969],{"type":44,"value":378},{"type":44,"value":217},{"type":39,"tag":61,"props":972,"children":974},{"className":973},[],[975],{"type":44,"value":421},{"type":44,"value":977}," when they're crossing the scope boundary.",{"type":39,"tag":47,"props":979,"children":980},{},[981,983,989],{"type":44,"value":982},"Ignore ",{"type":39,"tag":61,"props":984,"children":986},{"className":985},[],[987],{"type":44,"value":988},"_setup_notice",{"type":44,"value":990}," if present in the response — it's view-side chrome (welcome banner \u002F skill-gap hint)\nthat the UI handles. Don't echo or summarize it in chat.",{"type":39,"tag":47,"props":992,"children":993},{},[994],{"type":44,"value":995},"Then walk the output top-down:",{"type":39,"tag":997,"props":998,"children":999},"ol",{},[1000,1032,1042,1052,1062,1129,1274],{"type":39,"tag":496,"props":1001,"children":1002},{},[1003,1008,1010,1016,1017,1023,1024,1030],{"type":39,"tag":53,"props":1004,"children":1005},{},[1006],{"type":44,"value":1007},"Overall health",{"type":44,"value":1009}," (",{"type":39,"tag":61,"props":1011,"children":1013},{"className":1012},[],[1014],{"type":44,"value":1015},"healthy",{"type":44,"value":217},{"type":39,"tag":61,"props":1018,"children":1020},{"className":1019},[],[1021],{"type":44,"value":1022},"degraded",{"type":44,"value":217},{"type":39,"tag":61,"props":1025,"children":1027},{"className":1026},[],[1028],{"type":44,"value":1029},"critical",{"type":44,"value":1031},"): lead with this.",{"type":39,"tag":496,"props":1033,"children":1034},{},[1035,1040],{"type":39,"tag":53,"props":1036,"children":1037},{},[1038],{"type":44,"value":1039},"Degraded services",{"type":44,"value":1041},": name them with reasons (error rate, latency). These are the investigation targets.",{"type":39,"tag":496,"props":1043,"children":1044},{},[1045,1050],{"type":39,"tag":53,"props":1046,"children":1047},{},[1048],{"type":44,"value":1049},"Pods",{"type":44,"value":1051}," (if present): top memory consumers — cross-reference with degraded services.",{"type":39,"tag":496,"props":1053,"children":1054},{},[1055,1060],{"type":39,"tag":53,"props":1056,"children":1057},{},[1058],{"type":44,"value":1059},"Anomalies",{"type":44,"value":1061}," (if present): by-severity counts + top entities. Drives the ML follow-up.",{"type":39,"tag":496,"props":1063,"children":1064},{},[1065,1070,1071,1077,1079,1085,1086,1092,1094,1100,1102,1108,1110,1120,1122,1127],{"type":39,"tag":53,"props":1066,"children":1067},{},[1068],{"type":44,"value":1069},"Alerts",{"type":44,"value":1009},{"type":39,"tag":61,"props":1072,"children":1074},{"className":1073},[],[1075],{"type":44,"value":1076},"alerts",{"type":44,"value":1078}," field, always emitted): ",{"type":39,"tag":61,"props":1080,"children":1082},{"className":1081},[],[1083],{"type":44,"value":1084},"active_count",{"type":44,"value":217},{"type":39,"tag":61,"props":1087,"children":1089},{"className":1088},[],[1090],{"type":44,"value":1091},"recovered_count",{"type":44,"value":1093}," plus ",{"type":39,"tag":61,"props":1095,"children":1097},{"className":1096},[],[1098],{"type":44,"value":1099},"top_rules",{"type":44,"value":1101}," and ",{"type":39,"tag":61,"props":1103,"children":1105},{"className":1104},[],[1106],{"type":44,"value":1107},"active_samples",{"type":44,"value":1109},". ",{"type":39,"tag":53,"props":1111,"children":1112},{},[1113,1115],{"type":44,"value":1114},"Read these before reaching for ",{"type":39,"tag":61,"props":1116,"children":1118},{"className":1117},[],[1119],{"type":44,"value":150},{"type":44,"value":1121}," — the rollup already shows what fired and why. Only call ",{"type":39,"tag":61,"props":1123,"children":1125},{"className":1124},[],[1126],{"type":44,"value":150},{"type":44,"value":1128}," when the user wants to create\u002Fmodify rules (not just see what fired). Cross-reference active alerts with degraded services: a pod-memory alert on the same pod that's degrading is a strong signal.",{"type":39,"tag":496,"props":1130,"children":1131},{},[1132,1137,1138,1144,1146,1152,1154,1160,1162,1168,1170,1176,1177,1183,1185,1191,1193,1199,1200,1206,1207,1213,1214,1219,1221,1227,1229,1235,1237,1243,1245,1251,1253,1259,1261,1266,1268,1273],{"type":39,"tag":53,"props":1133,"children":1134},{},[1135],{"type":44,"value":1136},"SLOs",{"type":44,"value":1009},{"type":39,"tag":61,"props":1139,"children":1141},{"className":1140},[],[1142],{"type":44,"value":1143},"slos",{"type":44,"value":1145}," field, always emitted): authoritative source for \"is this cluster meeting its objectives?\". ",{"type":39,"tag":61,"props":1147,"children":1149},{"className":1148},[],[1150],{"type":44,"value":1151},"configured: false",{"type":44,"value":1153}," means no SLOs exist — surface the ",{"type":39,"tag":61,"props":1155,"children":1157},{"className":1156},[],[1158],{"type":44,"value":1159},"note",{"type":44,"value":1161}," once and move on. ",{"type":39,"tag":61,"props":1163,"children":1165},{"className":1164},[],[1166],{"type":44,"value":1167},"configured: true",{"type":44,"value":1169}," gives you ",{"type":39,"tag":61,"props":1171,"children":1173},{"className":1172},[],[1174],{"type":44,"value":1175},"violated_count",{"type":44,"value":570},{"type":39,"tag":61,"props":1178,"children":1180},{"className":1179},[],[1181],{"type":44,"value":1182},"healthy_count",{"type":44,"value":1184},", and ",{"type":39,"tag":61,"props":1186,"children":1188},{"className":1187},[],[1189],{"type":44,"value":1190},"top_violations[]",{"type":44,"value":1192}," with each violated SLO's current ",{"type":39,"tag":61,"props":1194,"children":1196},{"className":1195},[],[1197],{"type":44,"value":1198},"sli_value",{"type":44,"value":570},{"type":39,"tag":61,"props":1201,"children":1203},{"className":1202},[],[1204],{"type":44,"value":1205},"target",{"type":44,"value":1184},{"type":39,"tag":61,"props":1208,"children":1210},{"className":1209},[],[1211],{"type":44,"value":1212},"one_hour_burn_rate",{"type":44,"value":1109},{"type":39,"tag":53,"props":1215,"children":1216},{},[1217],{"type":44,"value":1218},"Read burn rate hard:",{"type":44,"value":1220}," ",{"type":39,"tag":61,"props":1222,"children":1224},{"className":1223},[],[1225],{"type":44,"value":1226},"> 14.4×",{"type":44,"value":1228}," means the rolling-window error budget burns out in \u003C2h at the current rate (page-worthy); ",{"type":39,"tag":61,"props":1230,"children":1232},{"className":1231},[],[1233],{"type":44,"value":1234},"6–14×",{"type":44,"value":1236}," is degrading; ",{"type":39,"tag":61,"props":1238,"children":1240},{"className":1239},[],[1241],{"type":44,"value":1242},"\u003C 1×",{"type":44,"value":1244}," is safe pace. Cross-reference ",{"type":39,"tag":61,"props":1246,"children":1248},{"className":1247},[],[1249],{"type":44,"value":1250},"top_violations[].name",{"type":44,"value":1252}," with ",{"type":39,"tag":61,"props":1254,"children":1256},{"className":1255},[],[1257],{"type":44,"value":1258},"degraded_services[]",{"type":44,"value":1260}," — services that appear in both are the priority drilldowns. Don't suggest creating SLOs if ",{"type":39,"tag":61,"props":1262,"children":1264},{"className":1263},[],[1265],{"type":44,"value":1167},{"type":44,"value":1267},"; do suggest it if ",{"type":39,"tag":61,"props":1269,"children":1271},{"className":1270},[],[1272],{"type":44,"value":1151},{"type":44,"value":890},{"type":39,"tag":496,"props":1275,"children":1276},{},[1277,1282,1284,1289],{"type":39,"tag":53,"props":1278,"children":1279},{},[1280],{"type":44,"value":1281},"Next-step buttons",{"type":44,"value":1283},": the view surfaces ",{"type":39,"tag":61,"props":1285,"children":1287},{"className":1286},[],[1288],{"type":44,"value":907},{"type":44,"value":1290}," as clickable prompts (drill into the\ntop pod, investigate the degraded service, check blast radius). Mention them in chat so the user knows.",{"type":39,"tag":47,"props":1292,"children":1293},{},[1294],{"type":44,"value":1295},"Based on what you see, pick the next tool:",{"type":39,"tag":492,"props":1297,"children":1298},{},[1299,1323,1368,1392,1411],{"type":39,"tag":496,"props":1300,"children":1301},{},[1302,1314,1316,1321],{"type":39,"tag":53,"props":1303,"children":1304},{},[1305,1307,1312],{"type":44,"value":1306},"Degraded service named → ",{"type":39,"tag":61,"props":1308,"children":1310},{"className":1309},[],[1311],{"type":44,"value":296},{"type":44,"value":1313}," first.",{"type":44,"value":1315}," This is the highest-yield drilldown for a known-degraded service in almost every cluster. The topology map points directly at upstream\u002Fdownstream root causes (slow gRPC dependency, hung leaf node, fan-out timing). Don't reach for ",{"type":39,"tag":61,"props":1317,"children":1319},{"className":1318},[],[1320],{"type":44,"value":135},{"type":44,"value":1322}," first — most clusters don't have anomaly jobs configured for arbitrary services, and you'll waste a turn on an empty result.",{"type":39,"tag":496,"props":1324,"children":1325},{},[1326,1336,1338,1344,1346,1352,1354,1359,1361,1366],{"type":39,"tag":53,"props":1327,"children":1328},{},[1329,1334],{"type":39,"tag":61,"props":1330,"children":1332},{"className":1331},[],[1333],{"type":44,"value":135},{"type":44,"value":1335}," is a complementary, not primary, drilldown.",{"type":44,"value":1337}," Use it when (a) the user wants anomaly ",{"type":39,"tag":1339,"props":1340,"children":1341},"em",{},[1342],{"type":44,"value":1343},"detail",{"type":44,"value":1345}," on a known-degraded service AND ",{"type":39,"tag":61,"props":1347,"children":1349},{"className":1348},[],[1350],{"type":44,"value":1351},"data_coverage.ml_anomalies",{"type":44,"value":1353}," is true, OR (b) the user is investigating a vague symptom and wants detection. If ",{"type":39,"tag":61,"props":1355,"children":1357},{"className":1356},[],[1358],{"type":44,"value":1351},{"type":44,"value":1360}," is false, skip ",{"type":39,"tag":61,"props":1362,"children":1364},{"className":1363},[],[1365],{"type":44,"value":135},{"type":44,"value":1367}," entirely — there are no jobs to query.",{"type":39,"tag":496,"props":1369,"children":1370},{},[1371,1383,1385,1390],{"type":39,"tag":53,"props":1372,"children":1373},{},[1374,1376,1381],{"type":44,"value":1375},"If you do call ",{"type":39,"tag":61,"props":1377,"children":1379},{"className":1378},[],[1380],{"type":44,"value":135},{"type":44,"value":1382}," and it returns empty \u002F no-jobs for the entity",{"type":44,"value":1384},", fall back to ",{"type":39,"tag":61,"props":1386,"children":1388},{"className":1387},[],[1389],{"type":44,"value":296},{"type":44,"value":1391}," for that same service immediately. Don't leave the user at a dead end.",{"type":39,"tag":496,"props":1393,"children":1394},{},[1395,1397,1402,1404,1409],{"type":44,"value":1396},"High anomaly count in the rollup → ",{"type":39,"tag":61,"props":1398,"children":1400},{"className":1399},[],[1401],{"type":44,"value":135},{"type":44,"value":1403}," with matching ",{"type":39,"tag":61,"props":1405,"children":1407},{"className":1406},[],[1408],{"type":44,"value":459},{"type":44,"value":1410}," (this is the \"lots of anomalies, what's worst?\" path — different from the named-degraded-service path above).",{"type":39,"tag":496,"props":1412,"children":1413},{},[1414,1416,1421],{"type":44,"value":1415},"Pod resource pressure on a specific node → ",{"type":39,"tag":61,"props":1417,"children":1419},{"className":1418},[],[1420],{"type":44,"value":313},{"type":44,"value":1422}," with that node name.",{"type":39,"tag":70,"props":1424,"children":1426},{"id":1425},"key-principles",[1427],{"type":44,"value":1428},"Key principles",{"type":39,"tag":492,"props":1430,"children":1431},{},[1432,1442,1465,1475],{"type":39,"tag":496,"props":1433,"children":1434},{},[1435,1440],{"type":39,"tag":53,"props":1436,"children":1437},{},[1438],{"type":44,"value":1439},"Start here, then narrow.",{"type":44,"value":1441}," Don't guess which service is the problem — let the rollup tell you.",{"type":39,"tag":496,"props":1443,"children":1444},{},[1445,1456,1458,1463],{"type":39,"tag":53,"props":1446,"children":1447},{},[1448,1450,1455],{"type":44,"value":1449},"Respect ",{"type":39,"tag":61,"props":1451,"children":1453},{"className":1452},[],[1454],{"type":44,"value":66},{"type":44,"value":890},{"type":44,"value":1457}," If K8s is absent, don't suggest ",{"type":39,"tag":61,"props":1459,"children":1461},{"className":1460},[],[1462],{"type":44,"value":313},{"type":44,"value":1464},". If APM is absent, don't\ncall this tool at all.",{"type":39,"tag":496,"props":1466,"children":1467},{},[1468,1473],{"type":39,"tag":53,"props":1469,"children":1470},{},[1471],{"type":44,"value":1472},"The overall health is coarse.",{"type":44,"value":1474}," \"Healthy\" doesn't mean nothing is wrong — it means nothing meets the\ndegraded thresholds. Always scan the details.",{"type":39,"tag":496,"props":1476,"children":1477},{},[1478,1483],{"type":39,"tag":53,"props":1479,"children":1480},{},[1481],{"type":44,"value":1482},"Graceful degradation is by design.",{"type":44,"value":1484}," APM-only output is still useful — don't apologize for missing K8s\nor ML signals; just report what you have.",{"type":39,"tag":70,"props":1486,"children":1488},{"id":1487},"investigation-discipline",[1489],{"type":44,"value":1490},"Investigation discipline",{"type":39,"tag":47,"props":1492,"children":1493},{},[1494,1496,1501],{"type":44,"value":1495},"Multi-tool investigations should be ",{"type":39,"tag":53,"props":1497,"children":1498},{},[1499],{"type":44,"value":1500},"sequential and narrated",{"type":44,"value":1502},", not parallel and silent. Each tool call renders its own widget in the chat — firing 4-5 in a row after a single \"yes\" creates a wall of \"Waiting…\" placeholders that look like the system is broken.",{"type":39,"tag":492,"props":1504,"children":1505},{},[1506,1523,1540,1550],{"type":39,"tag":496,"props":1507,"children":1508},{},[1509,1514,1516,1521],{"type":39,"tag":53,"props":1510,"children":1511},{},[1512],{"type":44,"value":1513},"One tool call per turn.",{"type":44,"value":1515}," After a tool returns, narrate what you saw — the headline number, what it implies, what it rules in or out — ",{"type":39,"tag":1339,"props":1517,"children":1518},{},[1519],{"type":44,"value":1520},"before",{"type":44,"value":1522}," making the next call. The narration is the user's only signal that you read the result.",{"type":39,"tag":496,"props":1524,"children":1525},{},[1526,1531,1533,1538],{"type":39,"tag":53,"props":1527,"children":1528},{},[1529],{"type":44,"value":1530},"Sequential offers, not OR offers.",{"type":44,"value":1532}," Don't ask \"Want me to check X ",{"type":39,"tag":1339,"props":1534,"children":1535},{},[1536],{"type":44,"value":1537},"or",{"type":44,"value":1539}," Y?\" — that's ambiguous and the user's \"yes\" turns into both calls in parallel. Phrase offers as a chain: \"Want me to start with X? If it's inconclusive I can follow up with Y.\" The user gets the same options without the parallel-execution trap.",{"type":39,"tag":496,"props":1541,"children":1542},{},[1543,1548],{"type":39,"tag":53,"props":1544,"children":1545},{},[1546],{"type":44,"value":1547},"Commit to a plan before \"yes.\"",{"type":44,"value":1549}," If a triage will need 3-4 tool calls, lay out the plan first (\"I'll check anomalies for flagd, then its pod resources, then trace errors from product-reviews — pause me if you've seen enough at any point\") and execute one step at a time. Don't pre-fire all 3 calls because the user agreed to \"the plan.\"",{"type":39,"tag":496,"props":1551,"children":1552},{},[1553,1558,1560,1566,1568,1574],{"type":39,"tag":53,"props":1554,"children":1555},{},[1556],{"type":44,"value":1557},"Read the rollup before drilling.",{"type":44,"value":1559}," apm-health-summary already includes services, pods, anomalies, fired alerts, and SLOs in one response. If the user asks \"what fired recently?\" — answer from ",{"type":39,"tag":61,"props":1561,"children":1563},{"className":1562},[],[1564],{"type":44,"value":1565},"alerts.top_rules",{"type":44,"value":1567},", don't call manage-alerts. If they ask \"what's anomalous?\" — answer from ",{"type":39,"tag":61,"props":1569,"children":1571},{"className":1570},[],[1572],{"type":44,"value":1573},"anomalies.top_entities",{"type":44,"value":1575},", don't call ml-anomalies for the same data.",{"type":39,"tag":1577,"props":1578,"children":1579},"style",{},[1580],{"type":44,"value":1581},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":1583,"total":1755},[1584,1603,1620,1635,1654,1666,1676,1691,1703,1718,1729,1742],{"slug":1585,"name":1585,"fn":1586,"description":1587,"org":1588,"tags":1589,"stars":1600,"repoUrl":1601,"updatedAt":1602},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1590,1593,1596,1597],{"name":1591,"slug":1592,"type":15},"Analytics","analytics",{"name":1594,"slug":1595,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":1598,"slug":1599,"type":15},"Performance","performance",2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":1604,"name":1604,"fn":1605,"description":1606,"org":1607,"tags":1608,"stars":1600,"repoUrl":1601,"updatedAt":1619},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1609,1612,1613,1616],{"name":1610,"slug":1611,"type":15},"Debugging","debugging",{"name":9,"slug":8,"type":15},{"name":1614,"slug":1615,"type":15},"Engineering","engineering",{"name":1617,"slug":1618,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":1621,"name":1621,"fn":1622,"description":1623,"org":1624,"tags":1625,"stars":1600,"repoUrl":1601,"updatedAt":1634},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1626,1627,1630,1631],{"name":9,"slug":8,"type":15},{"name":1628,"slug":1629,"type":15},"Elasticsearch","elasticsearch",{"name":1598,"slug":1599,"type":15},{"name":1632,"slug":1633,"type":15},"Testing","testing","2026-07-12T07:46:37.277964",{"slug":1636,"name":1636,"fn":1637,"description":1638,"org":1639,"tags":1640,"stars":1651,"repoUrl":1652,"updatedAt":1653},"cloud-access-management","manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1641,1644,1645,1648],{"name":1642,"slug":1643,"type":15},"Cloud","cloud",{"name":9,"slug":8,"type":15},{"name":1646,"slug":1647,"type":15},"Operations","operations",{"name":1649,"slug":1650,"type":15},"Permissions","permissions",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:46:44.946285",{"slug":1655,"name":1655,"fn":1656,"description":1657,"org":1658,"tags":1659,"stars":1651,"repoUrl":1652,"updatedAt":1665},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1660,1661,1664],{"name":1642,"slug":1643,"type":15},{"name":1662,"slug":1663,"type":15},"Deployment","deployment",{"name":1628,"slug":1629,"type":15},"2026-07-12T07:46:42.353362",{"slug":1667,"name":1667,"fn":1668,"description":1669,"org":1670,"tags":1671,"stars":1651,"repoUrl":1652,"updatedAt":1675},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1672,1673,1674],{"name":1642,"slug":1643,"type":15},{"name":1628,"slug":1629,"type":15},{"name":1646,"slug":1647,"type":15},"2026-07-12T07:46:41.097412",{"slug":1677,"name":1677,"fn":1678,"description":1679,"org":1680,"tags":1681,"stars":1651,"repoUrl":1652,"updatedAt":1690},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1682,1683,1684,1687],{"name":1642,"slug":1643,"type":15},{"name":1628,"slug":1629,"type":15},{"name":1685,"slug":1686,"type":15},"Networking","networking",{"name":1688,"slug":1689,"type":15},"Security","security","2026-07-12T07:46:43.675992",{"slug":1692,"name":1692,"fn":1693,"description":1694,"org":1695,"tags":1696,"stars":1651,"repoUrl":1652,"updatedAt":1702},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1697,1700,1701],{"name":1698,"slug":1699,"type":15},"Authentication","authentication",{"name":1642,"slug":1643,"type":15},{"name":1628,"slug":1629,"type":15},"2026-07-12T07:46:39.783105",{"slug":1704,"name":1704,"fn":1705,"description":1706,"org":1707,"tags":1708,"stars":1651,"repoUrl":1652,"updatedAt":1717},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1709,1712,1713,1716],{"name":1710,"slug":1711,"type":15},"Audit","audit",{"name":1628,"slug":1629,"type":15},{"name":1714,"slug":1715,"type":15},"Logs","logs",{"name":1688,"slug":1689,"type":15},"2026-07-12T07:47:35.092599",{"slug":1719,"name":1719,"fn":1720,"description":1721,"org":1722,"tags":1723,"stars":1651,"repoUrl":1652,"updatedAt":1728},"elasticsearch-authn","configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1724,1725,1726,1727],{"name":1698,"slug":1699,"type":15},{"name":9,"slug":8,"type":15},{"name":1628,"slug":1629,"type":15},{"name":1688,"slug":1689,"type":15},"2026-07-12T07:47:41.474547",{"slug":1730,"name":1730,"fn":1731,"description":1732,"org":1733,"tags":1734,"stars":1651,"repoUrl":1652,"updatedAt":1741},"elasticsearch-authz","manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1735,1736,1737,1740],{"name":9,"slug":8,"type":15},{"name":1628,"slug":1629,"type":15},{"name":1738,"slug":1739,"type":15},"RBAC","rbac",{"name":1688,"slug":1689,"type":15},"2026-07-12T07:47:36.394177",{"slug":1743,"name":1743,"fn":1744,"description":1745,"org":1746,"tags":1747,"stars":1651,"repoUrl":1652,"updatedAt":1754},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1748,1749,1750,1751],{"name":1591,"slug":1592,"type":15},{"name":1594,"slug":1595,"type":15},{"name":1628,"slug":1629,"type":15},{"name":1752,"slug":1753,"type":15},"SQL","sql","2026-07-12T07:47:40.249533",86,{"items":1757,"total":769},[1758,1765,1775,1789,1803,1817],{"slug":4,"name":4,"fn":5,"description":6,"org":1759,"tags":1760,"stars":23,"repoUrl":24,"updatedAt":25},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1761,1762,1763,1764],{"name":20,"slug":21,"type":15},{"name":9,"slug":8,"type":15},{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},{"slug":296,"name":296,"fn":1766,"description":1767,"org":1768,"tags":1769,"stars":23,"repoUrl":24,"updatedAt":1774},"map application topology from APM telemetry","Map the application topology from APM telemetry — which services call which, over what protocols, with what call volume and latency. Use when the user asks \"what calls X\", \"what depends on X\", \"show me the topology\", \"what are the upstream\u002Fdownstream services\", \"where does this service fit\", or is doing root-cause investigation and needs to trace how a problem propagates through the call graph. Also trigger for \"service map\", \"dependency graph\", \"blast radius of service X\", or \"who's the dependency of Y\". Requires Elastic APM — do not trigger for log-only or metrics-only customers.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1770,1771,1772,1773],{"name":20,"slug":21,"type":15},{"name":9,"slug":8,"type":15},{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T07:49:23.167442",{"slug":313,"name":313,"fn":1776,"description":1777,"org":1778,"tags":1779,"stars":23,"repoUrl":24,"updatedAt":1788},"assess Kubernetes node failure impact","Assess the impact of a Kubernetes node going offline — which deployments lose all replicas (full outage), which lose partial capacity (degraded), which are unaffected, and whether the cluster has enough spare capacity to reschedule the lost pods. Use when the user asks \"what happens if node X goes down\", \"what's the blast radius of draining this node\", \"can I safely maintain node Y\", \"what's running on this node\", \"if I evict this node what breaks\", or is planning node maintenance, a cluster upgrade, or investigating an actual node failure. Requires Kubernetes (kubeletstats metrics) and Elastic APM for downstream service impact — do not trigger for non-K8s deployments.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1780,1781,1784,1785],{"name":9,"slug":8,"type":15},{"name":1782,"slug":1783,"type":15},"Kubernetes","kubernetes",{"name":13,"slug":14,"type":15},{"name":1786,"slug":1787,"type":15},"Risk Assessment","risk-assessment","2026-07-12T07:49:25.645103",{"slug":150,"name":150,"fn":1790,"description":1791,"org":1792,"tags":1793,"stars":23,"repoUrl":24,"updatedAt":1802},"manage Kibana alerting rules","CRUD for Kibana alerting rules — create, list, get, or delete custom-threshold rules. Use when the user says \"alert me when\", \"create a rule for\", \"page me if\", \"set up an alert\", \"show me my rules\", \"what alerts do I have\", \"delete that alert\", \"remove the rule\". Backend-agnostic — works on any metric field in any index pattern (metrics-*, logs-*, traces-apm*, custom). For transient session-scoped monitoring use `observe` instead. Requires Kibana with the Alerting feature enabled — the tool is auto-disabled when no Kibana URL is configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1794,1797,1798,1801],{"name":1795,"slug":1796,"type":15},"Alerting","alerting",{"name":9,"slug":8,"type":15},{"name":1799,"slug":1800,"type":15},"Kibana","kibana",{"name":17,"slug":18,"type":15},"2026-07-12T07:49:21.846108",{"slug":135,"name":135,"fn":1804,"description":1805,"org":1806,"tags":1807,"stars":23,"repoUrl":24,"updatedAt":1816},"query Elastic ML anomaly detection results","Query Elastic ML anomaly detection results to understand what's behaving unusually, why, and how badly. Use when the user asks \"what's anomalous\", \"is anything unusual happening\", \"why is X slow\u002Fspiking\", \"show me the weirdness\", or mentions memory growth, CPU spikes, restart patterns, unusual latency, unexpected error rates, or drift from typical behavior. Also trigger for \"ML anomalies\", \"anomaly detection\", \"Elastic ML\", \"what does ML think\", or when the user wants to understand behavior that deviates from baseline. The tool opens an inline explainer view with a severity gauge, plain-English narrative, and per-entity deviation breakdown — so the agent should USE the visualization, not just dump JSON.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1808,1811,1812,1815],{"name":1809,"slug":1810,"type":15},"Anomaly Detection","anomaly-detection",{"name":9,"slug":8,"type":15},{"name":1813,"slug":1814,"type":15},"Machine Learning","machine-learning",{"name":13,"slug":14,"type":15},"2026-07-12T07:49:26.869446",{"slug":143,"name":143,"fn":1818,"description":1819,"org":1820,"tags":1821,"stars":23,"repoUrl":24,"updatedAt":1828},"monitor Elastic observability telemetry","The agent's Elastic-access primitive. Four modes: wait for an ML anomaly to fire, poll an ES|QL metric (live-sample or wait for a threshold), read a single-instance scalar value, or return a full ES|QL table. Use when the user says \"tell me when...\", \"let me know if...\", \"wait until X drops below Y\", \"watch for anything unusual\", \"monitor for the next N minutes\", \"poll until stable\", \"what is X right now\", \"list …\", \"which … are …\", or wants transient (session-scoped) monitoring or ad-hoc querying without creating a persistent Kibana rule. Also trigger for \"keep an eye on\" and post-remediation validation.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1822,1823,1826,1827],{"name":9,"slug":8,"type":15},{"name":1824,"slug":1825,"type":15},"Metrics","metrics",{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T07:49:28.114697"]