Skip to content

MCP tools

You will learn the Cordo MCP tool catalogue.

Endpoint: https://<api-host>/mcp (streamable HTTP). Auth: Authorization: Bearer lxp_… (personal access token).

Setup: Connect MCP.

Tools

Tool Purpose
cordo_context Session primer: user, non-empty streams, views
cordo_help Tool catalogue plus short investigation recipes
describe_stream Stream metadata + learned field catalog
top_values Top values for one field; optional normalize_uri and time_basis
query Aggregates / search with filters, lookbacks, optional time_basis, optional complete-event raw_search, listed aliases (level, severity, message, …), optional compare, and freshness / truncation
sample_events Matching samples; optional time_basis, raw_search, and order_by for top-N
recent_events Raw Postgres ingest tail
summarize_stream Volume + top values + samples in one call
ops_digest Ops triage: volume, status/level, slow routes, failing jobs
get_trace Request timeline by request_id (or configured field)
event_context Neighbours before/after one event_id (optional same-request correlate)
manage_views Saved view CRUD (visibility: private or stream)
resolve_view / tail_view Run or live-tail a view you can see
manage_streams Stream CRUD (including retention)
manage_stream_api_keys Ingest key create / list / revoke
ingest_events Write sample JSON events (prefer stream keys for production)

Detect tools

Tool Purpose
manage_metrics Recorded metric CRUD + series (metric_id UUID or name); includes recording health
manage_monitors Detection monitor CRUD plus immutable history (action: history); includes evaluation health and eval_offset
manage_channels Notification channel CRUD, test-fire, and attach to monitors; includes delivery health
manage_alerts List / get alerts and bounded evidence (action: list / get / evidence)

Concepts: Detect and alert. Web steps: Detect and alert.

References

stream_id and view_id accept a UUID or name (case-insensitive) after context is loaded.

View visibility

manage_views create/update accept visibility: private (creator only) or stream (any member who can query the stream). The alias workspace maps to stream. New views default to private. List, resolve_view, and tail_view return only views the caller may open. Update and delete stay owner-only.

Concept: Views.

Typical flow: cordo_context → describe_stream → query / ops_digest.

Complete event text

query, sample_events, and saved view queries managed through manage_views accept:

{
  "raw_search": {
    "term": "downstream timeout",
    "mode": "literal"
  }
}

literal is a Unicode case-insensitive substring (3–256 characters). regex uses RE2 (1–256 characters) and is case-sensitive unless the pattern opts in. It searches complete stored JSON, including nested keys/values and non-string scalars. raw_search and learned-field filters combine with AND.

Inspect monitors and alerts

To answer "what has this monitor been doing, and what fired?":

  1. manage_monitors action=list — check health.status (error / never_evaluated / ok) and health.evaluation (pending_open / firing / pending_resolve / cooldown).
  2. manage_monitors action=history with monitor_id and either relative=1h|6h|24h|7d or from/to — read state/value samples, lifecycle events, and explicit unknown gaps. Pass group_hash for one grouped series; reuse next_cursor for the next page.
  3. manage_alerts action=list with status=firing — note each id and its investigation_path.
  4. manage_alerts action=evidence with alert_id — monitor snapshot, immutable fire/resolve values, and a bounded contributing-event sample.