MCP Tool Inventory¶

This document describes the business tool capabilities currently callable via MCP by the OWL MCP Server, including tool classification, permission types, usage conventions, tool overview, and typical MCP usage paths.

The visibility and invocation results of tools depend on the permissions of the API Key currently in use. If the API Key does not have the required resource or operation permissions, the corresponding tool call may fail or return empty results.

Tool Scope¶

The business tools executable by OWL MCP Server will be continuously updated with the platform capabilities. The actual executable tools are subject to the tool catalog returned by list_catalogs and list_tools.

This document covers the following business categories:

Permission Types¶

Usage Conventions¶

In facade mode, the MCP client should call in the following order:

1. Call list_catalogs to view available categories.
2. Call list_tools, passing catalog_id, to view the business tools and parameters under that category.
3. Call exec_tool, passing tool_name and parameters, to execute the business tool.

In static mode, the client can directly call the business tools returned by tools/list without going through the three wrapper tools. Regardless of the mode used, the tool parameters and permission requirements remain the same.

Tool Overview¶

Account¶

Used to discover other workspaces in the same organization as the current API Key workspace. The obtained workspace_uuid can be used as the workspace_uuids input parameter for owl.data.same_org.trace.query for cross-workspace Trace queries.

Note: The workspace_uuid in the returned results is the parameter for subsequent workspace_uuids; workspace_id is only used for list pagination and should not be passed to the Trace query tool.

Catalog¶

Used for entity type discovery, entity query, entity detail retrieval, and topology relationship query in the unified resource catalog.

Note: Dashboard tools (owl.dashboard.create / owl.dashboard.replace / owl.dashboard.get) are only available in the OWL CLI and will not appear in the MCP tool list. Please refer to the OWL CLI documentation for their usage.

Data¶

Used for DQL namespace exploration, data source and field discovery, log index discovery, SLO queries, log clustering, cross-workspace Trace queries within the same organization, and simplified data queries for MCP clients. Currently, the MCP side provides simplified query and query assistant tools, not full DQL or PromQL custom execution tools.

When workspace_uuids in owl.data.same_org.trace.query is omitted or passed as an empty array, only the current workspace is queried. When the cross-workspace query within the same organization is disabled, only the current workspace is allowed to be queried; passing other workspace UUIDs will return a parameter error.

Errors¶

Used for querying the error center issue list, and adding, querying, and updating comments.

Event¶

Used for event center list queries and event detail retrieval.

• owl.event.list must provide start_time and end_time; optional status values are fatal, critical, error, warning, and nodata; limit defaults to 20, maximum is 100; the return may include the event dimension tag field df_dimension_tags.
• timeRange for owl.event.get is an optional two-element array [start, end], both elements are 13-digit millisecond timestamps, and end must be greater than start. The parameter name is timeRange, do not change it to time_range.

Incident¶

Used for querying incident lists, incident comments, operation records, and on-call schedules.

Infrastructure¶

Used for infrastructure object list and detail queries, covering resource objects such as hosts, containers, and processes.

LLM¶

Used for LLM observability application list queries.

Member¶

Used for workspace member list queries and searching by name or email keyword.

Monitor¶

Used for monitor list queries, detail retrieval, creation or update, and external event reception.

Notes¶

Used to manage notes visible to the current API Key account.

• For owl.nbook_note.list, page_index defaults to 1, page_size defaults to 20, maximum is 100.
• owl.nbook_note.get is the only note tool that returns the Markdown body content, but does not return path, etag, or version; list, add, and modify only return summaries, not content, path, ETag, or version information; delete response retains the original compact structure from the backend.
• type supports normal and runbook. owl.nbook_note.list can filter by type; when omitted, no type filter is applied. owl.nbook_note.add can set type; when omitted, the backend creates a normal note. Responses of get and modify include type, but get, modify, and delete do not accept type as input parameter; the type of an existing note cannot be modified.
• owl.nbook_note.add must provide title and content, and does not accept path; created_source is always set to ai by the server, and the creator account is taken from the current API Key.
• owl.nbook_note.modify must provide at least one of title, content, tags, or tag_kv in addition to note_uuid; when content is omitted, the original body is preserved.
• Retrieval, modification, and deletion all use the note_uuid returned by the list. Do not pass fields managed by the backend such as path, etag, if_match, version, creator, or created_source.
• tagkv_query is a TagKV expression string used by the list tool; tag_kv is a key-value object used by create and modify tools. Do not mix them up.

Pipeline¶

Used for Pipeline list queries and sample validation.

mdsearch¶

Used for searching the unified document corpus, reading a complete document by id or path, and browsing the corpus directory structure. Supports Chinese, English, and mixed queries.

MCP Usage Paths¶

The following steps use the default facade mode as an example. If the server enables static mode, you can directly call the business tools with the same name without going through exec_tool.

Data Query Problems¶

Applicable to problems such as "query metrics, logs, RUM, APM, Network, Profile data".

1. Call owl.data.show_dql_namespace via exec_tool to confirm the data namespace.
2. Based on the data domain, call the discovery tool via exec_tool:
3. Metrics: owl.metric.list
4. RUM: owl.rum.list
5. APM: owl.apm.list
6. Network: owl.network.list
7. Profile: owl.profile.list
8. Logs: owl.logging.list
9. Cloud billing: owl.billing.list
10. Log indices: owl.log_index.list
11. Field catalog: owl.field_schema.get
12. After obtaining the necessary source, field, index, execute the query via exec_tool calling owl.data.simple_query.

Incident Troubleshooting Problems¶

Applicable to problems such as "query incidents, track incident handling process, add incident comments".

1. Call owl.incident.list via exec_tool to query incidents.
2. Based on the incident incident_uuid, call via exec_tool:
3. owl.incident_comment.list to view comments
4. owl.incident_operation.list to view operation records
5. When needing to add processing information, call owl.incident_comment.add via exec_tool.

Resource Object Location Problems¶

Applicable to problems such as "query details of infrastructure objects like hosts, containers, processes".

1. Call owl.infrastructure.list via exec_tool to find the target object.
2. Based on the identification information in the returned results, call owl.infrastructure.get via exec_tool to get the object details.

Cross-Workspace Trace Query Problems¶

Applicable to problems such as "query a Trace by trace_id across multiple workspaces in the same organization".

1. Call owl.account.workspace.same_org.list via exec_tool to discover candidate workspaces in the same organization.
2. Extract workspace_uuid from the returned results (do not use workspace_id).
3. Call owl.data.same_org.trace.query via exec_tool, passing the required trace_id, and the selected workspace_uuid as workspace_uuids; when omitted or passed as an empty array, only the current workspace is queried.
4. If additional filtering is needed, use a where_clause without outer curly braces, and do not add the trace_id condition again. Do not fall back to owl.data.simple_query for cross-workspace Trace queries.

Note Management Problems¶

Applicable to problems such as "search, read, create, modify, or delete notes".

1. Call owl.nbook_note.list via exec_tool to search for notes and obtain the note_uuid.
2. To read the Markdown body, call owl.nbook_note.get.
3. To create a note, call owl.nbook_note.add; to update, call owl.nbook_note.modify.
4. To delete, call owl.nbook_note.delete; add, modify, and delete are write tools, and manual confirmation should be performed by the client before execution.

Monitor Management Problems¶

Applicable to problems such as "query monitors, create or update monitors, send external events".

1. Call owl.monitor.list via exec_tool to query monitors.
2. Based on the rule_uuid in the returned results, call owl.monitor.get via exec_tool to view monitor details.
3. To create or update a monitor, call owl.monitor.upsert via exec_tool.
4. To send an external event, call owl.monitor.receive via exec_tool.