@skyhook-io/radar-app 0.2.2 → 0.3.1

package/src/components/home/MCPSetupDialog.tsx

@@ -1,6 +1,8 @@
 import { useRef, useEffect, useState, useCallback } from 'react'
 import { X, Copy, Check, Radio, Terminal, MessageSquare, Code2, ChevronRight, Pin } from 'lucide-react'
 import { apiUrl, getAuthHeaders, getCredentialsMode } from '../../api/config'
+import { MCP_TOOL_CATALOG } from './mcpToolCatalog'
+import { Tooltip } from '../ui/Tooltip'
 
 interface MCPSetupDialogProps {
   open: boolean
@@ -18,13 +20,14 @@ function CopyButton({ text }: { text: string }) {
   }
 
   return (
+    <Tooltip content="Copy to clipboard" position="left" wrapperClassName="absolute top-2 right-2">
     <button
       onClick={handleCopy}
-      className="absolute top-2 right-2 p-1.5 rounded-md bg-theme-elevated/50 hover:bg-theme-elevated text-theme-text-tertiary hover:text-theme-text-secondary transition-colors"
-      title="Copy to clipboard"
+      className="p-1.5 rounded-md bg-theme-elevated/50 hover:bg-theme-elevated text-theme-text-tertiary hover:text-theme-text-secondary transition-colors"
     >
       {copied ? <Check className="w-3.5 h-3.5 text-green-500" /> : <Copy className="w-3.5 h-3.5" />}
     </button>
+    </Tooltip>
   )
 }
 
@@ -201,15 +204,16 @@ export function MCPSetupDialog({ open, onClose, mcpUrl }: MCPSetupDialogProps) {
               <a href="https://modelcontextprotocol.io" target="_blank" rel="noopener noreferrer" className="text-purple-400 hover:text-purple-300 underline underline-offset-2">
                 Model Context Protocol
               </a>{' '}
-              (MCP) server that lets AI assistants query your cluster through Radar.
+              (MCP) server that lets AI agents query your cluster through Radar.
               Unlike raw kubectl access, Radar gives your AI pre-processed, enriched data —
               topology graphs, health assessments, deduplicated events, filtered logs — so it
               can understand your cluster state quickly without burning through context on
               verbose YAML output.
             </p>
             <p className="text-sm text-theme-text-secondary leading-relaxed">
-              Read tools are strictly read-only. Write tools (restart, scale, sync) are
-              non-destructive and annotated so your AI client can distinguish them.
+              Read tools are strictly read-only. Write tools (restart, scale, sync, apply,
+              node drain) are annotated as destructive so your AI client can flag them and
+              prompt before running.
             </p>
           </div>
 
@@ -219,7 +223,7 @@ export function MCPSetupDialog({ open, onClose, mcpUrl }: MCPSetupDialogProps) {
             <div className="relative">
               <div className="flex items-center gap-3 bg-theme-base rounded-md px-3 py-2.5">
                 <span className="badge text-purple-400 bg-purple-500/10">HTTP</span>
-                <code className="text-sm font-mono text-theme-text-primary">{mcpUrl}</code>
+                <code className="inline-code text-sm">{mcpUrl}</code>
               </div>
               <CopyButton text={mcpUrl} />
             </div>
@@ -296,95 +300,33 @@ export function MCPSetupDialog({ open, onClose, mcpUrl }: MCPSetupDialogProps) {
 
           {/* Available tools */}
           <div className="space-y-2">
-            <h4 className="text-sm font-semibold text-theme-text-primary">Tools</h4>
+            <div className="flex items-baseline justify-between">
+              <h4 className="text-sm font-semibold text-theme-text-primary">Tools</h4>
+              <span className="text-[11px] text-theme-text-tertiary">{MCP_TOOL_CATALOG.length} tools</span>
+            </div>
             <div className="grid grid-cols-1 gap-1.5">
-              {[
-                { name: 'get_dashboard', desc: 'Get cluster health overview including resource counts, problems (failing pods, unhealthy deployments), recent warning events, and Helm release status. Start here to understand cluster state before drilling into specific resources.', params: [
-                  { name: 'namespace', required: false, desc: 'filter to a specific namespace' },
-                ]},
-                { name: 'list_resources', desc: 'List Kubernetes resources of a given kind with minified summaries. Supports all built-in kinds (pods, deployments, services, etc.) and CRDs. Use to discover what\'s running before inspecting individual resources.', params: [
-                  { name: 'kind', required: true, desc: 'resource kind, e.g. pods, deployments, services' },
-                  { name: 'namespace', required: false, desc: 'filter to a specific namespace' },
-                ]},
-                { name: 'get_resource', desc: 'Get detailed information about a single Kubernetes resource. Returns minified spec, status, and metadata. Optionally include related context (events, relationships, metrics, logs) to avoid extra tool calls.', params: [
-                  { name: 'kind', required: true, desc: 'resource kind, e.g. pod, deployment, service' },
-                  { name: 'namespace', required: true, desc: 'resource namespace' },
-                  { name: 'name', required: true, desc: 'resource name' },
-                  { name: 'include', required: false, desc: 'events, relationships, metrics, logs' },
-                ]},
-                { name: 'get_topology', desc: 'Get the topology graph showing relationships between Kubernetes resources. Returns nodes and edges representing Deployments, Services, Ingresses, Pods, etc. Use \'traffic\' view for network flow or \'resources\' view for ownership hierarchy. Use \'summary\' format for LLM-friendly text descriptions.', params: [
-                  { name: 'namespace', required: false, desc: 'filter to a specific namespace' },
-                  { name: 'view', required: false, desc: 'traffic or resources' },
-                  { name: 'format', required: false, desc: 'graph (default) or summary (text)' },
-                ]},
-                { name: 'get_events', desc: 'Get recent Kubernetes warning events, deduplicated and sorted by recency. Useful for diagnosing issues — shows event reason, message, and occurrence count. Filter by resource kind/name to scope to a specific resource.', params: [
-                  { name: 'namespace', required: false, desc: 'filter to a specific namespace' },
-                  { name: 'limit', required: false, desc: 'max events to return (default 20)' },
-                  { name: 'kind', required: false, desc: 'filter to events for this resource kind' },
-                  { name: 'name', required: false, desc: 'filter to events for this resource name' },
-                ]},
-                { name: 'get_pod_logs', desc: 'Get filtered log lines from a pod, prioritizing errors and warnings. Returns diagnostically relevant lines (errors, panics, stack traces) or falls back to the last 20 lines if no error patterns match.', params: [
-                  { name: 'namespace', required: true, desc: 'pod namespace' },
-                  { name: 'name', required: true, desc: 'pod name' },
-                  { name: 'container', required: false, desc: 'container name (defaults to first)' },
-                  { name: 'tail_lines', required: false, desc: 'lines from end (default 200)' },
-                ]},
-                { name: 'list_namespaces', desc: 'List all Kubernetes namespaces with their status. Use to discover available namespaces before filtering other queries.', params: [] },
-                { name: 'get_changes', desc: 'Get recent resource changes (creates, updates, deletes) from the cluster timeline. Use to investigate what changed before an incident. Filter by namespace, resource kind, or specific resource name.', params: [
-                  { name: 'namespace', required: false, desc: 'filter to a specific namespace' },
-                  { name: 'kind', required: false, desc: 'filter to a resource kind (e.g. Deployment)' },
-                  { name: 'name', required: false, desc: 'filter to a specific resource name' },
-                  { name: 'since', required: false, desc: 'lookback duration, e.g. 1h, 30m (default 1h)' },
-                  { name: 'limit', required: false, desc: 'max changes to return (default 20, max 50)' },
-                ]},
-                { name: 'list_helm_releases', desc: 'List all Helm releases in the cluster with their status and health. Returns release name, namespace, chart, version, status, and resource health.', params: [
-                  { name: 'namespace', required: false, desc: 'filter to a specific namespace' },
-                ]},
-                { name: 'get_helm_release', desc: 'Get detailed information about a specific Helm release including owned resources and their status. Optionally include values, revision history, or manifest diff between revisions.', params: [
-                  { name: 'namespace', required: true, desc: 'release namespace' },
-                  { name: 'name', required: true, desc: 'release name' },
-                  { name: 'include', required: false, desc: 'values, history, diff' },
-                  { name: 'diff_revision_1', required: false, desc: 'first revision for diff' },
-                  { name: 'diff_revision_2', required: false, desc: 'second revision for diff (defaults to current)' },
-                ]},
-                { name: 'get_workload_logs', desc: 'Get aggregated, AI-filtered logs from all pods of a workload (Deployment, StatefulSet, or DaemonSet). Logs are collected from all matching pods, filtered for errors/warnings, and deduplicated.', params: [
-                  { name: 'kind', required: true, desc: 'deployment, statefulset, or daemonset' },
-                  { name: 'namespace', required: true, desc: 'workload namespace' },
-                  { name: 'name', required: true, desc: 'workload name' },
-                  { name: 'container', required: false, desc: 'specific container name' },
-                  { name: 'tail_lines', required: false, desc: 'lines per pod (default 100)' },
-                ]},
-                { name: 'manage_workload', desc: 'Perform operations on a workload. \'restart\' triggers a rolling restart, \'scale\' changes the replica count, \'rollback\' reverts to a previous revision.', params: [
-                  { name: 'action', required: true, desc: 'restart, scale, or rollback' },
-                  { name: 'kind', required: true, desc: 'deployment, statefulset, or daemonset' },
-                  { name: 'namespace', required: true, desc: 'workload namespace' },
-                  { name: 'name', required: true, desc: 'workload name' },
-                  { name: 'replicas', required: false, desc: 'target replica count (for scale)' },
-                  { name: 'revision', required: false, desc: 'target revision (for rollback)' },
-                ]},
-                { name: 'manage_cronjob', desc: 'Perform operations on a CronJob. \'trigger\' creates a manual Job run, \'suspend\' pauses the schedule, \'resume\' re-enables it.', params: [
-                  { name: 'action', required: true, desc: 'trigger, suspend, or resume' },
-                  { name: 'namespace', required: true, desc: 'cronjob namespace' },
-                  { name: 'name', required: true, desc: 'cronjob name' },
-                ]},
-                { name: 'manage_gitops', desc: 'Perform operations on GitOps resources. ArgoCD: sync, suspend, resume. FluxCD: reconcile, suspend, resume.', params: [
-                  { name: 'action', required: true, desc: 'sync/reconcile, suspend, or resume' },
-                  { name: 'tool', required: true, desc: 'argocd or fluxcd' },
-                  { name: 'namespace', required: true, desc: 'resource namespace' },
-                  { name: 'name', required: true, desc: 'resource name' },
-                  { name: 'kind', required: false, desc: 'FluxCD resource kind (e.g. kustomization, helmrelease)' },
-                ]},
-              ].map((tool) => (
+              {MCP_TOOL_CATALOG.map((tool) => (
                 <div key={tool.name} className="card-inner space-y-1.5">
-                  <code className="text-[11px] font-mono text-purple-400">{tool.name}</code>
+                  <div className="flex items-center gap-2">
+                    <code className="inline-code text-[11px]">{tool.name}</code>
+                    {tool.write && (
+                      <Tooltip content="Write tool — annotated as destructive">
+                      <span className="badge-sm bg-amber-500/10 text-amber-600 dark:text-amber-400">
+                        write
+                      </span>
+                      </Tooltip>
+                    )}
+                  </div>
                   <p className="text-[11px] text-theme-text-tertiary leading-relaxed">{tool.desc}</p>
                   {tool.params.length > 0 && (
                     <div className="flex flex-wrap gap-1.5 pt-0.5">
                       {tool.params.map((p) => (
-                        <span key={p.name} className="badge-sm font-mono bg-theme-elevated text-theme-text-secondary" title={p.desc}>
-                          <span className="text-theme-text-secondary">{p.name}</span>
+                        <Tooltip key={p.arg} content={p.desc}>
+                        <span className="inline-code text-[11px]">
+                          <span>{p.arg}</span>
                           {p.required && <span className="text-red-400">*</span>}
                         </span>
+                        </Tooltip>
                       ))}
                     </div>
                   )}

package/src/components/home/TrafficSummary.tsx

@@ -100,7 +100,7 @@ export function TrafficSummary({ data, onNavigate }: TrafficSummaryProps) {
       <div className="flex items-center justify-between px-5 py-3 border-b border-theme-border/50">
         <div className="flex items-center gap-2">
           <Activity className="w-4 h-4 text-theme-text-tertiary" />
-          <span className="text-xs font-semibold uppercase tracking-wider text-theme-text-secondary">Traffic</span>
+          <span className="text-xs font-semibold uppercase tracking-wider text-theme-text-secondary">Live Traffic</span>
         </div>
         {hasFlows && (
           <span className="text-[11px] text-theme-text-tertiary">
@@ -145,7 +145,7 @@ export function TrafficSummary({ data, onNavigate }: TrafficSummaryProps) {
       </div>
 
       <div className="px-4 py-1.5 border-t border-theme-border/50 flex items-center justify-end gap-1.5 text-[10px] font-semibold uppercase tracking-wider text-theme-text-secondary group-hover:text-theme-text-primary transition-colors">
-        Open Traffic
+        Open Live Traffic
         <ArrowRight className="w-3.5 h-3.5 transition-transform group-hover:translate-x-0.5" />
       </div>
       </div>

package/src/components/home/mcpToolCatalog.ts

@@ -0,0 +1,333 @@
+// Human-facing catalog for the MCP setup dialog (MCPSetupDialog.tsx).
+//
+// Source of truth for the *set* of tools is the backend registration in
+// internal/mcp/tools.go. This list must stay in sync with it — the Go test
+// TestSetupDialogCoversAllTools (internal/mcp/tools_catalog_test.go) parses
+// this file and fails CI if the tool names here don't exactly match the
+// registered tools. When you add or remove an MCP tool there, update this
+// catalog too.
+//
+// Descriptions here are intentionally shorter and more human-facing than the
+// LLM-oriented routing descriptions in tools.go — different audience, so they
+// are not shared verbatim.
+
+export interface MCPToolParam {
+  arg: string
+  required?: boolean
+  desc: string
+}
+
+export interface MCPToolInfo {
+  name: string
+  write?: boolean
+  desc: string
+  params: MCPToolParam[]
+}
+
+export const MCP_TOOL_CATALOG: MCPToolInfo[] = [
+  {
+    name: 'get_dashboard',
+    desc: 'Cluster or namespace health overview: resource counts, failing pods, unhealthy workloads, recent warning events, and Helm status. Start here before drilling into specific resources.',
+    params: [{ arg: 'namespace', desc: 'filter to a specific namespace' }],
+  },
+  {
+    name: 'top_resources',
+    desc: 'Live CPU/memory ranking (like `kubectl top`) joined with Kubernetes context — pod status, restarts, owner workload, requests, and limits. Ranks pods, workloads, or nodes.',
+    params: [
+      { arg: 'kind', desc: 'pods (default), workloads, or nodes' },
+      { arg: 'namespace', desc: 'filter pods/workloads to a namespace' },
+      { arg: 'sort', desc: 'cpu (default) or memory' },
+      { arg: 'limit', desc: 'max rows (default 20, max 100)' },
+    ],
+  },
+  {
+    name: 'list_resources',
+    desc: 'List Kubernetes resources of a given kind with compact summaries plus per-row health, managedBy, and issue counts. Supports built-in kinds and CRDs.',
+    params: [
+      { arg: 'kind', required: true, desc: 'resource kind, e.g. pods, deployments, services' },
+      { arg: 'group', desc: 'API group when the kind is ambiguous (e.g. serving.knative.dev)' },
+      { arg: 'namespace', desc: 'filter to a specific namespace' },
+      { arg: 'context', desc: 'per-row context: default (summaryContext) or none' },
+    ],
+  },
+  {
+    name: 'get_resource',
+    desc: 'A single resource: minified spec/status/metadata plus resourceContext (relationships, refs, issue/audit/policy rollups). Optionally include heavier event/metrics data.',
+    params: [
+      { arg: 'kind', required: true, desc: 'resource kind, e.g. pod, deployment, service' },
+      { arg: 'name', required: true, desc: 'resource name' },
+      { arg: 'namespace', desc: 'omit for cluster-scoped kinds (Node, ClusterRole, IngressClass, etc.)' },
+      { arg: 'group', desc: 'API group when the kind is ambiguous (e.g. serving.knative.dev for Knative Service vs core Service)' },
+      { arg: 'include', desc: 'events, metrics' },
+      { arg: 'context', desc: 'resourceContext tier: basic (default) or none' },
+    ],
+  },
+  {
+    name: 'get_topology',
+    desc: 'Topology graph of relationships between resources — Services, workloads, Pods, Ingresses, owners. Use traffic view for network flow or resources view for ownership hierarchy.',
+    params: [
+      { arg: 'namespace', desc: 'filter to a specific namespace' },
+      { arg: 'view', desc: 'traffic or resources' },
+      { arg: 'format', desc: 'graph (default) or summary (text)' },
+    ],
+  },
+  {
+    name: 'get_neighborhood',
+    desc: 'BFS-expanded topology around one resource — its upstream/downstream Services, workloads, Pods, refs, and owners. Cheaper and more focused than full topology once you have a suspect.',
+    params: [
+      { arg: 'kind', required: true, desc: 'resource kind, e.g. pod, deployment, service, application' },
+      { arg: 'name', required: true, desc: 'resource name' },
+      { arg: 'namespace', desc: 'resource namespace; omit for cluster-scoped kinds' },
+      { arg: 'group', desc: 'API group to disambiguate colliding kinds' },
+      { arg: 'profile', desc: 'auto (default) or all (every edge type, heavier)' },
+      { arg: 'hops', desc: 'BFS depth (default 1, max 2)' },
+      { arg: 'max_nodes', desc: 'node budget (default 25)' },
+    ],
+  },
+  {
+    name: 'get_events',
+    desc: 'Recent Kubernetes warning events, deduplicated and sorted by recency. Shows reason, message, and occurrence count. Filter to a specific resource by kind/name.',
+    params: [
+      { arg: 'namespace', desc: 'filter to a specific namespace' },
+      { arg: 'limit', desc: 'max events (default 20, max 100)' },
+      { arg: 'kind', desc: 'filter to events for this resource kind' },
+      { arg: 'name', desc: 'filter to events for this resource name' },
+    ],
+  },
+  {
+    name: 'get_pod_logs',
+    desc: 'Pod logs with secret redaction. Without grep, prioritizes errors and warnings and falls back to recent tail lines; grep returns only regex matches instead.',
+    params: [
+      { arg: 'namespace', required: true, desc: 'pod namespace' },
+      { arg: 'name', required: true, desc: 'pod name' },
+      { arg: 'container', desc: 'container name (defaults to first)' },
+      { arg: 'tail_lines', desc: 'lines from end (default 200)' },
+      { arg: 'grep', desc: 'regex matches to return instead of diagnostic auto-filtering' },
+      { arg: 'since', desc: 'only logs newer than this duration (e.g. 30s, 10m, 1h)' },
+      { arg: 'previous', desc: 'logs from the previous terminated container (CrashLoopBackOff)' },
+    ],
+  },
+  {
+    name: 'diagnose',
+    desc: 'One-call root-cause bundle. Workloads get spec + resourceContext + current AND previous logs across pods + warning events + startup blockers; GitOps reconcilers, including Flux HelmRelease, get status summary + parsed related issues.',
+    params: [
+      { arg: 'kind', required: true, desc: 'pod, deployment, statefulset, daemonset, application, kustomization, or Flux HelmRelease' },
+      { arg: 'namespace', required: true, desc: 'resource namespace' },
+      { arg: 'name', required: true, desc: 'resource name' },
+      { arg: 'container', desc: 'specific container (defaults to all)' },
+      { arg: 'tail_lines', desc: 'lines per pod/stream (default 100)' },
+      { arg: 'since', desc: 'only logs newer than this duration' },
+    ],
+  },
+  {
+    name: 'list_namespaces',
+    desc: 'List all Kubernetes namespaces with their status. Use to discover available namespaces before filtering other queries.',
+    params: [],
+  },
+  {
+    name: 'get_changes',
+    desc: 'Recent meaningful changes from the Kubernetes timeline plus native Helm deployment history (source=helm). Includes failed upgrades, rollbacks, and current Helm revisions; sourcesErrored marks partial source failures.',
+    params: [
+      { arg: 'namespace', desc: 'filter to a specific namespace' },
+      { arg: 'kind', desc: 'filter to a resource kind (e.g. Deployment)' },
+      { arg: 'name', desc: 'filter to a specific resource name' },
+      { arg: 'since', desc: 'lookback duration, e.g. 1h, 30m (default 1h)' },
+      { arg: 'limit', desc: 'max changes (default 20, max 50)' },
+    ],
+  },
+  {
+    name: 'get_cluster_audit',
+    desc: 'Best-practice and security posture findings — Security, Reliability, Efficiency — each with remediation guidance. Static config posture, independent of live operational health.',
+    params: [
+      { arg: 'namespace', desc: 'filter to a specific namespace' },
+      { arg: 'category', desc: 'Security, Reliability, or Efficiency' },
+      { arg: 'severity', desc: 'danger or warning' },
+      { arg: 'limit', desc: 'max findings (default 30, max 100)' },
+    ],
+  },
+  {
+    name: 'list_helm_releases',
+    desc: 'All Helm releases with status, resource health, storage namespace, Flux ownership, current lastOperation, and capped operation trails for failed upgrades, rollbacks, or stuck pending operations.',
+    params: [{ arg: 'namespace', desc: 'filter to a specific namespace' }],
+  },
+  {
+    name: 'get_helm_release',
+    desc: 'Detailed Helm release info with owned resources, health, Flux ownership, current lastOperation, operationInsight, hooks, and failed/running hook diagnostics with live Job/Pod/Event/redacted-log evidence when available.',
+    params: [
+      { arg: 'namespace', required: true, desc: 'Helm storage namespace; use storageNamespace from list_helm_releases when present' },
+      { arg: 'name', required: true, desc: 'release name' },
+      { arg: 'include', desc: 'values, history, operations, diff, values_diff, notes_diff, resource_diff' },
+      { arg: 'diff_revision_1', desc: 'first revision for any diff include' },
+      { arg: 'diff_revision_2', desc: 'second revision for any diff include (defaults to current)' },
+    ],
+  },
+  {
+    name: 'list_packages',
+    desc: 'Unified "what\'s installed" view across Helm releases, workload labels, CRD registrations, and GitOps declarations (Argo + Flux), with sources, versions, health, and a sourceLegend for the stable source codes.',
+    params: [
+      { arg: 'namespace', desc: 'filter to a specific namespace' },
+      { arg: 'source', desc: 'H/helm, L/labels, C/crds, A/argocd, F/fluxcd' },
+      { arg: 'chart', desc: 'case-insensitive chart-name substring' },
+    ],
+  },
+  {
+    name: 'issues',
+    desc: 'Ranked list of what is broken right now — failing workloads, active native Helm release failures or stuck pending operations, dangling references, scheduling blockers, and false CRD conditions. Native Helm rows use group=helm.sh.',
+    params: [
+      { arg: 'namespace', desc: 'filter to one namespace' },
+      { arg: 'severity', desc: 'comma-separated: critical, warning' },
+      { arg: 'kind', desc: 'comma-separated kind filter' },
+      { arg: 'limit', desc: 'max issues (default 200, max 1000)' },
+      { arg: 'filter', desc: 'optional CEL boolean expression' },
+    ],
+  },
+  {
+    name: 'search',
+    desc: 'Find resources by content/term match — config keys, env refs, images, label values, ConfigMap data, CRD fields, status messages. Secret values are never indexed.',
+    params: [
+      { arg: 'query', required: true, desc: 'tokens AND\'d; modifiers kind:, ns:, label:, image:' },
+      { arg: 'limit', desc: 'max hits (default 50, max 500)' },
+      { arg: 'include', desc: 'summary (default), raw, or none' },
+      { arg: 'filter', desc: 'optional CEL boolean expression' },
+      { arg: 'context', desc: 'per-hit context: default (summaryContext) or none' },
+    ],
+  },
+  {
+    name: 'get_subject_permissions',
+    desc: 'Effective RBAC for a ServiceAccount, User, or Group. Returns the full bindings/rules dump by default, or an authoritative SubjectAccessReview answer when verb and resource are supplied for a ServiceAccount.',
+    params: [
+      { arg: 'kind', required: true, desc: 'ServiceAccount, User, or Group' },
+      { arg: 'name', required: true, desc: 'subject name' },
+      { arg: 'namespace', desc: 'required for ServiceAccount; omit for User/Group' },
+      { arg: 'verb', desc: 'access check: Kubernetes API verb; requires resource' },
+      { arg: 'resource', desc: 'access check: plural API resource; requires verb' },
+      { arg: 'group', desc: 'access check: API group; omit for core/v1' },
+      { arg: 'resource_namespace', desc: 'access check target; defaults to subject namespace' },
+      { arg: 'subresource', desc: 'access check subresource, e.g. log for pods/log' },
+      { arg: 'resource_name', desc: 'access check target resource name' },
+    ],
+  },
+  {
+    name: 'query_prometheus',
+    desc: "Run PromQL against the cluster's Prometheus (auto-discovered or configured; works with Thanos, VictoriaMetrics, Mimir). Instant queries return current values; range queries return time-series history with automatic step adjustment. Oversized results return a cardinality summary with a suggested topk rewrite instead of raw data.",
+    params: [
+      { arg: 'query', required: true, desc: 'PromQL query to execute' },
+      { arg: 'type', desc: 'instant (default) or range' },
+      { arg: 'since', desc: 'range lookback, e.g. 30m, 1h, 24h, 7d (default 1h)' },
+      { arg: 'start', desc: 'range RFC3339 start time; overrides since' },
+      { arg: 'end', desc: 'range RFC3339 end time (default now)' },
+      { arg: 'step', desc: 'range resolution, e.g. 30s, 5m (auto-calculated when omitted)' },
+      { arg: 'max_points', desc: 'max data points per series (default 300, max 600)' },
+      { arg: 'timeout', desc: 'query timeout in seconds (default 30, max 180)' },
+    ],
+  },
+  {
+    name: 'discover_metrics',
+    desc: 'Discover exact Prometheus metric names (with type and help text) or values of one label before writing PromQL. Lists active series from the last hour; flags truncation so the selector can be narrowed.',
+    params: [
+      { arg: 'match', desc: 'PromQL series selector filter, e.g. {__name__=~"node_cpu.*"}; required when label is empty' },
+      { arg: 'label', desc: 'discover values of this label instead of metric names, e.g. namespace, pod' },
+      { arg: 'limit', desc: 'max values returned (default 100, max 500)' },
+    ],
+  },
+  {
+    name: 'get_prometheus_rules',
+    desc: 'List Prometheus alerting and recording rules with their PromQL definitions, state (firing/pending/inactive), and active alert instances. The starting point for alert investigation: fetch the rule, then query its expression.',
+    params: [
+      { arg: 'type', desc: 'alert or record (omit for both)' },
+      { arg: 'name', desc: 'substring filter on rule name' },
+      { arg: 'group', desc: 'substring filter on rule group name' },
+      { arg: 'state', desc: 'alerting rules only: firing, pending, or inactive' },
+      { arg: 'limit', desc: 'max rules returned (default 50, max 200)' },
+    ],
+  },
+  {
+    name: 'get_workload_logs',
+    desc: 'Aggregated logs across all pods of a workload. Without grep, filters for diagnostic relevance; grep returns only matching timestamp-prefixed lines instead.',
+    params: [
+      { arg: 'kind', desc: 'deployment (default), statefulset, daemonset, job, or workflow' },
+      { arg: 'namespace', required: true, desc: 'workload namespace' },
+      { arg: 'name', required: true, desc: 'workload name' },
+      { arg: 'container', desc: 'specific container (defaults to all)' },
+      { arg: 'tail_lines', desc: 'lines per pod (default 100)' },
+      { arg: 'grep', desc: 'regex matches to return instead of diagnostic auto-filtering' },
+      { arg: 'since', desc: 'only logs newer than this duration' },
+      { arg: 'previous', desc: 'logs from the previous terminated container' },
+    ],
+  },
+  {
+    name: 'manage_workload',
+    write: true,
+    desc: 'Operate on a workload: restart triggers a rolling restart, scale changes the replica count, rollback reverts to a previous revision.',
+    params: [
+      { arg: 'action', required: true, desc: 'restart, scale, or rollback' },
+      { arg: 'kind', required: true, desc: 'deployment, statefulset, or daemonset' },
+      { arg: 'namespace', required: true, desc: 'workload namespace' },
+      { arg: 'name', required: true, desc: 'workload name' },
+      { arg: 'replicas', desc: 'target replica count (for scale)' },
+      { arg: 'revision', desc: 'target revision (for rollback)' },
+    ],
+  },
+  {
+    name: 'manage_cronjob',
+    write: true,
+    desc: 'Operate on a CronJob: trigger creates a manual Job run, suspend pauses the schedule, resume re-enables it.',
+    params: [
+      { arg: 'action', required: true, desc: 'trigger, suspend, or resume' },
+      { arg: 'namespace', required: true, desc: 'cronjob namespace' },
+      { arg: 'name', required: true, desc: 'cronjob name' },
+    ],
+  },
+  {
+    name: 'manage_gitops',
+    write: true,
+    desc: 'Operate on GitOps resources. ArgoCD: sync, refresh, terminate, rollback, suspend, resume. FluxCD: reconcile, sync-with-source, suspend, resume.',
+    params: [
+      { arg: 'action', required: true, desc: 'sync/reconcile, refresh, terminate, rollback, suspend, or resume' },
+      { arg: 'tool', required: true, desc: 'argocd or fluxcd' },
+      { arg: 'namespace', required: true, desc: 'resource namespace' },
+      { arg: 'name', required: true, desc: 'resource name' },
+      { arg: 'kind', desc: 'FluxCD resource kind (e.g. kustomization, helmrelease)' },
+    ],
+  },
+  {
+    name: 'apply_resource',
+    write: true,
+    desc: 'Create or update a resource from YAML. apply mode is server-side apply and reports field ownership conflicts by default; create mode fails if it exists. Multi-document YAML returns per-document status on partial failure.',
+    params: [
+      { arg: 'yaml', required: true, desc: 'YAML manifest (multi-document with --- supported)' },
+      { arg: 'mode', desc: 'apply (default) or create' },
+      { arg: 'dry_run', desc: 'validate and preview without persisting' },
+      { arg: 'namespace', desc: 'override namespace for the resource' },
+      { arg: 'verify', desc: 'return post-mutation state; on dry_run return preview diff (default true)' },
+      { arg: 'force', desc: 'force SSA field ownership conflicts and take ownership from other managers (default false)' },
+    ],
+  },
+  {
+    name: 'patch_resource',
+    write: true,
+    desc: 'Patch one existing resource with JSON Patch, JSON Merge Patch, or built-in-kind strategic merge patch for precise edits without rewriting the full manifest.',
+    params: [
+      { arg: 'kind', required: true, desc: 'resource kind, e.g. Deployment, Service, ConfigMap' },
+      { arg: 'name', required: true, desc: 'resource name' },
+      { arg: 'namespace', desc: 'resource namespace; omit for cluster-scoped resources' },
+      { arg: 'group', desc: 'API group when the kind is ambiguous' },
+      { arg: 'patch_type', desc: 'json (default), merge, or strategic' },
+      { arg: 'patch', required: true, desc: 'JSON patch body' },
+      { arg: 'dry_run', desc: 'validate and preview without persisting' },
+      { arg: 'verify', desc: 'return post-patch state; on dry_run return preview diff (default true)' },
+    ],
+  },
+  {
+    name: 'manage_node',
+    write: true,
+    desc: 'Operate on a node: cordon marks it unschedulable, uncordon reverses that, drain cordons then evicts all non-DaemonSet pods.',
+    params: [
+      { arg: 'action', required: true, desc: 'cordon, uncordon, or drain' },
+      { arg: 'name', required: true, desc: 'node name' },
+      { arg: 'delete_empty_dir_data', desc: 'evict pods with emptyDir volumes (default true)' },
+      { arg: 'force', desc: 'evict pods not managed by a controller (default false)' },
+      { arg: 'timeout', desc: 'drain timeout in seconds (default 60)' },
+    ],
+  },
+]