awslabs.eks-mcp-server 0.1.1__py3-none-any.whl → 0.1.3__py3-none-any.whl

awslabs/eks_mcp_server/data/eks_cloudwatch_metrics_guidance.json

@@ -0,0 +1,287 @@
+{
+  "cluster": {
+    "metrics": [
+      {
+        "description": "The number of failed worker nodes in the cluster. A node is considered failed if it is suffering from any node conditions. For more information, see Conditions in the Kubernetes documentation.",
+        "dimensions": [
+          "ClusterName"
+        ],
+        "name": "cluster_failed_node_count"
+      },
+      {
+        "description": "The total number of worker nodes in the cluster.",
+        "dimensions": [
+          "ClusterName"
+        ],
+        "name": "cluster_node_count"
+      }
+    ]
+  },
+  "namespace": {
+    "metrics": [
+      {
+        "description": "The number of pods running per namespace in the resource that is specified by the dimensions that you're using.",
+        "dimensions": [
+          "Namespace,ClusterName",
+          "ClusterName"
+        ],
+        "name": "namespace_number_of_running_pods"
+      }
+    ]
+  },
+  "node": {
+    "metrics": [
+      {
+        "description": "The maximum number of CPU units that can be assigned to a single node in this cluster.",
+        "dimensions": [
+          "ClusterName"
+        ],
+        "name": "node_cpu_limit"
+      },
+      {
+        "description": "The percentage of CPU units that are reserved for node components, such as kubelet, kube-proxy, and Docker.",
+        "dimensions": [
+          "NodeName,ClusterName,InstanceId",
+          "ClusterName"
+        ],
+        "name": "node_cpu_reserved_capacity"
+      },
+      {
+        "description": "The number of CPU units being used on the nodes in the cluster.",
+        "dimensions": [
+          "ClusterName"
+        ],
+        "name": "node_cpu_usage_total"
+      },
+      {
+        "description": "The total percentage of CPU units being used on the nodes in the cluster.",
+        "dimensions": [
+          "NodeName,ClusterName,InstanceId",
+          "ClusterName"
+        ],
+        "name": "node_cpu_utilization"
+      },
+      {
+        "description": "The total number of GPU(s) available on the node.",
+        "dimensions": [
+          "ClusterName",
+          "ClusterName,InstanceId,NodeName"
+        ],
+        "name": "node_gpu_limit"
+      },
+      {
+        "description": "The number of GPU(s) being used by the running pods on the node.",
+        "dimensions": [
+          "ClusterName",
+          "ClusterName,InstanceId,NodeName"
+        ],
+        "name": "node_gpu_usage_total"
+      },
+      {
+        "description": "The percentage of GPU currently being reserved on the node. The formula is, node_gpu_request / node_gpu_limit.",
+        "dimensions": [
+          "ClusterName",
+          "ClusterName,InstanceId,NodeName"
+        ],
+        "name": "node_gpu_reserved_capacity"
+      },
+      {
+        "description": "The total percentage of file system capacity being used on nodes in the cluster.",
+        "dimensions": [
+          "NodeName,ClusterName,InstanceId",
+          "ClusterName"
+        ],
+        "name": "node_filesystem_utilization"
+      },
+      {
+        "description": "The maximum amount of memory, in bytes, that can be assigned to a single node in this cluster.",
+        "dimensions": [
+          "ClusterName"
+        ],
+        "name": "node_memory_limit"
+      },
+      {
+        "description": "The percentage of memory currently being used on the nodes in the cluster.",
+        "dimensions": [
+          "NodeName,ClusterName,InstanceId",
+          "ClusterName"
+        ],
+        "name": "node_memory_reserved_capacity"
+      },
+      {
+        "description": "The percentage of memory currently being used by the node or nodes. It is the percentage of node memory usage divided by the node memory limitation.",
+        "dimensions": [
+          "NodeName,ClusterName,InstanceId",
+          "ClusterName"
+        ],
+        "name": "node_memory_utilization"
+      },
+      {
+        "description": "The amount of memory, in bytes, being used in the working set of the nodes in the cluster.",
+        "dimensions": [
+          "ClusterName"
+        ],
+        "name": "node_memory_working_set"
+      },
+      {
+        "description": "The total number of bytes per second transmitted and received over the network per node in a cluster.",
+        "dimensions": [
+          "NodeName,ClusterName,InstanceId",
+          "ClusterName"
+        ],
+        "name": "node_network_total_bytes"
+      },
+      {
+        "description": "The number of running containers per node in a cluster.",
+        "dimensions": [
+          "NodeName,ClusterName,InstanceId",
+          "ClusterName"
+        ],
+        "name": "node_number_of_running_containers"
+      },
+      {
+        "description": "The number of running pods per node in a cluster.",
+        "dimensions": [
+          "NodeName,ClusterName,InstanceId",
+          "ClusterName"
+        ],
+        "name": "node_number_of_running_pods"
+      }
+    ]
+  },
+  "pod": {
+    "metrics": [
+      {
+        "description": "The CPU capacity that is reserved per pod in a cluster.",
+        "dimensions": [
+          "PodName,Namespace,ClusterName",
+          "ClusterName"
+        ],
+        "name": "pod_cpu_reserved_capacity"
+      },
+      {
+        "description": "The percentage of CPU units being used by pods.",
+        "dimensions": [
+          "PodName,Namespace,ClusterName",
+          "Namespace,ClusterName",
+          "Service,Namespace,ClusterName",
+          "ClusterName"
+        ],
+        "name": "pod_cpu_utilization"
+      },
+      {
+        "description": "The percentage of CPU units being used by pods relative to the pod limit.",
+        "dimensions": [
+          "PodName,Namespace,ClusterName",
+          "Namespace,ClusterName",
+          "Service,Namespace,ClusterName",
+          "ClusterName"
+        ],
+        "name": "pod_cpu_utilization_over_pod_limit"
+      },
+      {
+        "description": "The GPU requests for the pod. This value must always be equal to pod_gpu_limit.",
+        "dimensions": [
+          "ClusterName",
+          "ClusterName,Namespace,PodName",
+          "ClusterName,FullPodName,Namespace,PodName"
+        ],
+        "name": "pod_gpu_request"
+      },
+      {
+        "description": "The maximum number of GPU(s) that can be assigned to the pod in a node.",
+        "dimensions": [
+          "ClusterName",
+          "ClusterName,Namespace,PodName",
+          "ClusterName,FullPodName,Namespace,PodName"
+        ],
+        "name": "pod_gpu_limit"
+      },
+      {
+        "description": "The number of GPU(s) being allocated on the pod.",
+        "dimensions": [
+          "ClusterName",
+          "ClusterName,Namespace,PodName",
+          "ClusterName,FullPodName,Namespace,PodName"
+        ],
+        "name": "pod_gpu_usage_total"
+      },
+      {
+        "description": "The percentage of GPU currently being reserved for the pod. The formula is - pod_gpu_request / node_gpu_reserved_capacity.",
+        "dimensions": [
+          "ClusterName",
+          "ClusterName,Namespace,PodName",
+          "ClusterName,FullPodName,Namespace,PodName"
+        ],
+        "name": "pod_gpu_reserved_capacity"
+      },
+      {
+        "description": "The percentage of memory that is reserved for pods.",
+        "dimensions": [
+          "PodName,Namespace,ClusterName",
+          "ClusterName"
+        ],
+        "name": "pod_memory_reserved_capacity"
+      },
+      {
+        "description": "The percentage of memory currently being used by the pod or pods.",
+        "dimensions": [
+          "PodName,Namespace,ClusterName",
+          "Namespace,ClusterName",
+          "Service,Namespace,ClusterName",
+          "ClusterName"
+        ],
+        "name": "pod_memory_utilization"
+      },
+      {
+        "description": "The percentage of memory that is being used by pods relative to the pod limit. If any containers in the pod don't have a memory limit defined, this metric doesn't appear.",
+        "dimensions": [
+          "PodName,Namespace,ClusterName",
+          "Namespace,ClusterName",
+          "Service,Namespace,ClusterName",
+          "ClusterName"
+        ],
+        "name": "pod_memory_utilization_over_pod_limit"
+      },
+      {
+        "description": "The number of bytes per second being received over the network by the pod.",
+        "dimensions": [
+          "PodName,Namespace,ClusterName",
+          "Namespace,ClusterName",
+          "Service,Namespace,ClusterName",
+          "ClusterName"
+        ],
+        "name": "pod_network_rx_bytes"
+      },
+      {
+        "description": "The number of bytes per second being transmitted over the network by the pod.",
+        "dimensions": [
+          "PodName,Namespace,ClusterName",
+          "Namespace,ClusterName",
+          "Service,Namespace,ClusterName",
+          "ClusterName"
+        ],
+        "name": "pod_network_tx_bytes"
+      },
+      {
+        "description": "The total number of container restarts in a pod.",
+        "dimensions": [
+          "PodName,Namespace,ClusterName"
+        ],
+        "name": "pod_number_of_container_restarts"
+      }
+    ]
+  },
+  "service": {
+    "metrics": [
+      {
+        "description": "The number of pods running the service or services in the cluster.",
+        "dimensions": [
+          "Service,Namespace,ClusterName",
+          "ClusterName"
+        ],
+        "name": "service_number_of_running_pods"
+      }
+    ]
+  }
+}

awslabs/eks_mcp_server/eks_kb_handler.py

@@ -1,13 +1,16 @@
 # Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 #
-# Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance
-# with the License. A copy of the License is located at
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
 #
-#    http://www.apache.org/licenses/LICENSE-2.0
+#     http://www.apache.org/licenses/LICENSE-2.0
 #
-# or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES
-# OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions
-# and limitations under the License.
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
 """Knowledge Base Retrival handler for the EKS MCP Server."""
 

awslabs/eks_mcp_server/eks_stack_handler.py

@@ -1,13 +1,16 @@
 # Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 #
-# Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance
-# with the License. A copy of the License is located at
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
 #
-#    http://www.apache.org/licenses/LICENSE-2.0
+#     http://www.apache.org/licenses/LICENSE-2.0
 #
-# or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES
-# OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions
-# and limitations under the License.
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
 """EKS stack handler for the EKS MCP Server."""
 
@@ -36,7 +39,7 @@ from awslabs.eks_mcp_server.models import (
 from mcp.server.fastmcp import Context
 from mcp.types import EmbeddedResource, ImageContent, TextContent
 from pydantic import Field
-from typing import Dict, List, Optional, Tuple, Union, cast
+from typing import Any, Dict, List, Optional, Tuple, Union, cast
 
 
 class EksStackHandler:
@@ -135,6 +138,13 @@ class EksStackHandler:
         mechanism for creating and managing EKS clusters through CloudFormation, enabling standardized
         cluster creation, configuration updates, and resource cleanup.
 
+        IMPORTANT: Use this tool instead of 'aws eks create-cluster', 'aws eks delete-cluster',
+        'eksctl create cluster', 'eksctl delete cluster', or similar CLI commands.
+
+        IMPORTANT: Use this tool's standardized templates for creating EKS clusters with proper VPC configuration,
+        networking, security groups, and EKS auto mode. DO NOT create EKS clusters by generating CloudFormation
+        templates from scratch.
+
         ## Requirements
         - The server must be run with the `--allow-write` flag for generate, deploy, and delete operations
         - For deploy and delete operations, the stack must have been created by this tool
@@ -319,7 +329,7 @@ class EksStackHandler:
         - Security groups for cluster communication
         - IAM roles for the EKS cluster and worker nodes
         - An EKS cluster in Auto Mode with:
-          - Compute configuration with general-purpose and system node pools
+          - Compute configuration for automatic node management
           - Kubernetes network configuration with elastic load balancing
           - Block storage configuration
           - API authentication mode
@@ -345,6 +355,10 @@ class EksStackHandler:
             if 'Parameters' in template_yaml and 'ClusterName' in template_yaml['Parameters']:
                 template_yaml['Parameters']['ClusterName']['Default'] = cluster_name
 
+            # Remove checkov metadata from the EKS cluster resource
+            if 'Resources' in template_yaml and 'EksCluster' in template_yaml['Resources']:
+                self._remove_checkov_metadata(template_yaml['Resources']['EksCluster'])
+
             # Convert back to YAML
             modified_template = yaml.dump(template_yaml, default_flow_style=False)
 
@@ -589,6 +603,22 @@ class EksStackHandler:
                 outputs={},
             )
 
+    def _remove_checkov_metadata(self, resource: Dict[str, Any]) -> None:
+        """Remove checkov metadata from a resource and clean up empty Metadata sections.
+
+        Args:
+            resource: The resource dictionary to process
+        """
+        if 'Metadata' in resource:
+            # Check if there's checkov metadata
+            if 'checkov' in resource['Metadata']:
+                # Remove only the checkov metadata
+                del resource['Metadata']['checkov']
+
+                # If Metadata is now empty, remove it entirely
+                if not resource['Metadata']:
+                    del resource['Metadata']
+
     async def _delete_stack(
         self, ctx: Context, stack_name: str, cluster_name: str
     ) -> DeleteStackResponse:

awslabs/eks_mcp_server/iam_handler.py

@@ -1,13 +1,16 @@
 # Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 #
-# Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance
-# with the License. A copy of the License is located at
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
 #
-#    http://www.apache.org/licenses/LICENSE-2.0
+#     http://www.apache.org/licenses/LICENSE-2.0
 #
-# or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES
-# OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions
-# and limitations under the License.
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
 """IAM handler for the EKS MCP Server."""
 
@@ -63,6 +66,9 @@ class IAMHandler:
         permissions, identify missing or excessive permissions, troubleshoot EKS cluster issues,
         and verify trust relationships for service roles.
 
+        IMPORTANT: Use this tool instead of 'aws iam get-role', 'aws iam list-attached-role-policies',
+        'aws iam list-role-policies', and 'aws iam get-role-policy' commands.
+
         ## Requirements
         - The role must exist in your AWS account
         - Valid AWS credentials with permissions to read IAM role information
@@ -156,6 +162,8 @@ class IAMHandler:
         for granting EKS clusters access to AWS services, enabling worker nodes to access resources, and
         configuring permissions for CloudWatch logging and ECR access.
 
+        IMPORTANT: Use this tool instead of 'aws iam put-role-policy' commands.
+
         ## Requirements
         - The server must be run with the `--allow-write` flag
         - The role must exist in your AWS account

awslabs/eks_mcp_server/k8s_apis.py

@@ -1,19 +1,23 @@
 # Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 #
-# Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance
-# with the License. A copy of the License is located at
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
 #
-#    http://www.apache.org/licenses/LICENSE-2.0
+#     http://www.apache.org/licenses/LICENSE-2.0
 #
-# or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES
-# OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions
-# and limitations under the License.
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
 """Kubernetes API client for the EKS MCP Server."""
 
 import base64
 import os
 import tempfile
+from awslabs.eks_mcp_server import __version__
 from awslabs.eks_mcp_server.models import Operation
 from loguru import logger
 from typing import Any, Dict, List, Optional
@@ -72,6 +76,9 @@ class K8sApis:
             # Create base API client
             self.api_client = client.ApiClient(configuration)
 
+            # Set user-agent directly on the ApiClient
+            self.api_client.user_agent = f'awslabs/mcp/eks-mcp-server/{__version__}'
+
             # Create dynamic client
             self.dynamic_client = dynamic.DynamicClient(self.api_client)
 
@@ -407,22 +414,26 @@ class K8sApis:
             Pod logs as a string
         """
         try:
-            # Get the Pod resource using the dynamic client
-            pod_resource = self.dynamic_client.resources.get(api_version='v1', kind='Pod')
+            from kubernetes import client
 
-            # Prepare parameters for the log subresource
+            # Create CoreV1Api client
+            core_v1_api = client.CoreV1Api(self.api_client)
+
+            # Prepare parameters for the read_namespaced_pod_log method
             params = {}
             if container_name:
                 params['container'] = container_name
             if since_seconds:
-                params['sinceSeconds'] = since_seconds
+                params['since_seconds'] = since_seconds
             if tail_lines:
-                params['tailLines'] = tail_lines
+                params['tail_lines'] = tail_lines
             if limit_bytes:
-                params['limitBytes'] = limit_bytes
+                params['limit_bytes'] = limit_bytes
 
-            # Call the log subresource (note: singular 'log', not 'logs')
-            logs_response = pod_resource.log.get(name=pod_name, namespace=namespace, **params)
+            # Call the read_namespaced_pod_log method
+            logs_response = core_v1_api.read_namespaced_pod_log(
+                name=pod_name, namespace=namespace, **params
+            )
 
             return logs_response
 

awslabs/eks_mcp_server/k8s_client_cache.py

@@ -1,13 +1,16 @@
 # Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 #
-# Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance
-# with the License. A copy of the License is located at
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
 #
-#    http://www.apache.org/licenses/LICENSE-2.0
+#     http://www.apache.org/licenses/LICENSE-2.0
 #
-# or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES
-# OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions
-# and limitations under the License.
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
 """Kubernetes client cache for the EKS MCP Server."""
 

awslabs/eks_mcp_server/k8s_handler.py

@@ -1,13 +1,16 @@
 # Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 #
-# Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance
-# with the License. A copy of the License is located at
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
 #
-#    http://www.apache.org/licenses/LICENSE-2.0
+#     http://www.apache.org/licenses/LICENSE-2.0
 #
-# or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES
-# OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions
-# and limitations under the License.
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
 """Kubernetes handler for the EKS MCP Server."""
 
@@ -111,6 +114,8 @@ class K8sHandler:
         and can create or update resources, useful for deploying applications, creating
         Kubernetes resources, and applying complete application stacks.
 
+        IMPORTANT: Use this tool instead of 'kubectl apply -f' commands.
+
         ## Requirements
         - The server must be run with the `--allow-write` flag
         - The YAML file must exist and be accessible to the server
@@ -334,6 +339,9 @@ class K8sHandler:
         custom resources, update specific fields, read detailed information, and delete
         resources that are no longer needed.
 
+        IMPORTANT: Use this tool instead of 'kubectl create', 'kubectl edit', 'kubectl patch',
+        'kubectl delete', or 'kubectl get' commands.
+
         ## Requirements
         - The server must be run with the `--allow-write` flag for mutating operations
         - The server must be run with the `--allow-sensitive-data-access` flag for Secret resources
@@ -534,6 +542,8 @@ class K8sHandler:
         for listing pods in a namespace, finding services with specific labels, or
         checking resources in a specific state.
 
+        IMPORTANT: Use this tool instead of 'kubectl get' commands.
+
         ## Response Information
         The response includes a summary of each resource with name, namespace, creation timestamp,
         labels, and annotations.
@@ -780,6 +790,37 @@ class K8sHandler:
                 output_file_path='',
             )
 
+    def _remove_checkov_skip_annotations(self, content: str) -> str:
+        """Remove checkov skip annotations from YAML content.
+
+        Args:
+            content: YAML content as string
+
+        Returns:
+            YAML content with checkov skip annotations removed
+        """
+        # Use yaml to parse and modify the content
+        yaml_content = yaml.safe_load(content)
+        if (
+            yaml_content
+            and 'metadata' in yaml_content
+            and 'annotations' in yaml_content['metadata']
+        ):
+            # Remove all checkov skip annotations
+            annotations = yaml_content['metadata']['annotations']
+            checkov_keys = [key for key in annotations.keys() if key.startswith('checkov.io/skip')]
+            for key in checkov_keys:
+                del annotations[key]
+
+            # If annotations is now empty, remove it
+            if not annotations:
+                del yaml_content['metadata']['annotations']
+
+            # Convert back to YAML string
+            content = yaml.dump(yaml_content, default_flow_style=False)
+
+        return content
+
     def _load_yaml_template(self, template_files: list, values: Dict[str, Any]) -> str:
         """Load and process Kubernetes template files.
 
@@ -804,6 +845,10 @@ class K8sHandler:
             for key, value in values.items():
                 content = content.replace(key, value)
 
+            # Remove checkov skip annotations if present
+            if template_file == 'deployment.yaml':
+                content = self._remove_checkov_skip_annotations(content)
+
             template_contents.append(content)
 
         # Combine templates into a single YAML document with separator
@@ -840,6 +885,8 @@ class K8sHandler:
         to filter by container, time range, and size. It's useful for debugging application
         issues, monitoring behavior, investigating crashes, and verifying startup configuration.
 
+        IMPORTANT: Use this tool instead of 'kubectl logs' commands.
+
         ## Requirements
         - The server must be run with the `--allow-sensitive-data-access` flag
         - The pod must exist and be accessible in the specified namespace
@@ -965,6 +1012,8 @@ class K8sHandler:
         are useful for troubleshooting pod startup failures, investigating deployment issues,
         understanding resource modifications, and diagnosing scheduling problems.
 
+        IMPORTANT: Use this tool instead of 'kubectl describe' or 'kubectl get events' commands.
+
         ## Requirements
         - The server must be run with the `--allow-sensitive-data-access` flag
         - The resource must exist and be accessible in the specified namespace