MCP Tool Inventory¶

This document introduces the business tool capabilities currently provided by the Owl MCP Server, including tool categories, permission types, usage conventions, tool overview, and typical MCP usage paths.

The visibility of tools and the results of their calls depend on the permissions of the API Key currently in use. If the API Key lacks permissions for relevant resources or operations, corresponding tool calls may fail or return empty results.

Note

This document only describes business tools that can be called directly. It does not include protocol-layer or wrapper-layer tools, such as list_catalogs, list_tools, exec_tool, etc.

Tool Scope¶

The tools exposed by the Owl MCP Server will be continuously updated alongside platform capabilities. The actual visible tools are subject to the tool list returned after the MCP client connects.

The current document covers the following business categories:

Category	Description
`catalog`	Unified Resource Catalog, entity types, entity details, and topology relationships
`dashboard`	Dashboard creation, replacement, and detail retrieval
`data`	Data source discovery, field discovery, log index discovery, and simplified data querying
`errors`	Error Center issue querying and comment management
`event`	Event list querying and event detail retrieval
`incident`	Incident list, incident comments, operation records, and on-call schedules
`infrastructure`	Infrastructure object queries such as hosts, containers, processes
`llm`	LLM observable application list querying
`member`	Workspace member querying
`monitor`	Monitor querying, creation, updating, and external event reception
`pipeline`	Pipeline list querying and sample validation

Permission Types¶

Permission Type	Meaning	Usage Suggestion
Read-only	Querying, retrieving, getting details, validating samples, etc., which do not modify workspace resources	Can be opened to Agents for automatic calling as needed
Write	Creating, updating, appending comments, receiving external events, etc., which modify workspace resources	It is recommended to configure manual confirmation in the Agent client

Usage Conventions¶

Type	Convention
Time Range	Uniformly use 13-digit millisecond timestamps
Pagination Parameters	Typically use `page_size` and `page_index`
Detail Queries	Usually rely on identifiers like UUID, ID, URN returned by list tools
Data Queries	It is recommended to first call discovery tools to obtain `source`, `field`, `index`, then call query tools
Return Structure	Subject to the actual tool response

Tool Overview¶

Tool Set	Tool	Function	Permission
catalog	`owl.catalog.entity_type_query`	Query entity types supported by the unified catalog	Read-only
catalog	`owl.catalog.entity_query`	Query entity list by entity type	Read-only
catalog	`owl.catalog.entity_get`	Get details of a single entity by `urn`	Read-only
catalog	`owl.catalog.entity_topology_query`	Query topology relationships associated with a single entity	Read-only
dashboard	`owl.dashboard.create`	Create a dashboard	Write
dashboard	`owl.dashboard.replace`	Replace the content of an existing dashboard	Write
dashboard	`owl.dashboard.get`	Get dashboard details	Read-only
data	`owl.data.show_dql_namespace`	View DQL namespace	Read-only
data	`owl.data.simple_query`	Automatically assemble query statements through simplified parameters	Read-only
data	`owl.metric.list`	Discover `source` or fields available for metric queries	Read-only
data	`owl.rum.list`	Discover `source` or fields available for RUM queries	Read-only
data	`owl.apm.list`	Discover `source` or fields available for APM queries	Read-only
data	`owl.network.list`	Discover `source` or fields available for Network queries	Read-only
data	`owl.profile.list`	Discover `source` or fields available for Profile queries	Read-only
data	`owl.log_index.list`	List indices available for log queries	Read-only
data	`owl.log_index.get`	Query details of a single log index	Read-only
data	`owl.field_schema.get`	Query the current field catalog for query field completion	Read-only
errors	`owl.errors.list`	Query the Error Center issue list	Read-only
errors	`owl.errors.comment.add`	Add a new comment to an error issue	Write
errors	`owl.errors.comment.list`	Query the comment list under an error issue	Read-only
errors	`owl.errors.comment.update`	Update an existing error comment	Write
event	`owl.event.list`	Query the event list	Read-only
event	`owl.event.get`	Query details of a single event	Read-only
incident	`owl.incident.list`	Query the incident list	Read-only
incident	`owl.incident_comment.list`	Query the incident comment list	Read-only
incident	`owl.incident_comment.add`	Add a new comment to an incident ticket	Write
incident	`owl.incident_operation.list`	Query incident operation records	Read-only
incident	`owl.incident_schedule.list`	Query the on-call schedule list	Read-only
incident	`owl.incident_schedule.get`	Query details of an on-call schedule	Read-only
infrastructure	`owl.infrastructure.list`	Query infrastructure object list	Read-only
infrastructure	`owl.infrastructure.get`	Query details of a single infrastructure object	Read-only
llm	`owl.llm.list`	Query LLM application list	Read-only
member	`owl.member.list`	Query workspace member list	Read-only
monitor	`owl.monitor.list`	Query monitor list	Read-only
monitor	`owl.monitor.upsert`	Create a monitor or update an existing monitor	Write
monitor	`owl.monitor.receive`	Send external events to an existing receiver, or create a receiver first and then send events	Write
monitor	`owl.monitor.get`	Query monitor details	Read-only
pipeline	`owl.pipeline.list`	Query Pipeline list and return decoded content	Read-only
pipeline	`owl.pipeline.validate`	Validate Pipeline processing results with sample data	Read-only

Catalog¶

Used for unified resource catalog entity type discovery, entity querying, entity detail retrieval, and topology relationship querying.

Tool Name	Function	Example Query	Key Parameters	Permission
`owl.catalog.entity_type_query`	Query entity types supported by the unified catalog	List the entity types currently supported by Catalog	`page_size`, `page_index`	Read-only
`owl.catalog.entity_query`	Query entity list by entity type	Query the Catalog entity list of type `host`	`entity_type`, `page_size`, `page_index`	Read-only
`owl.catalog.entity_get`	Get details of a single entity by `urn`	Query the entity details corresponding to this `urn`	`urn`	Read-only
`owl.catalog.entity_topology_query`	Query topology relationships associated with a single entity	View the upstream and downstream topology of this host entity	`urn`	Read-only

Dashboard¶

Used for dashboard creation, replacement, and detail retrieval.

Tool Name	Function	Example Query	Key Parameters	Permission
`owl.dashboard.create`	Create a dashboard	Create a dashboard named "APM Overview"	`name`, `dashboard_json`	Write
`owl.dashboard.replace`	Replace the content of an existing dashboard	Replace the specified dashboard with new `dashboard_json`	`dashboard_uuid`, `dashboard_json`	Write
`owl.dashboard.get`	Get dashboard details	Query the full configuration corresponding to this dashboard UUID	`dashboard_uuid`	Read-only

Data¶

Used for DQL namespace exploration, data source and field discovery, log index discovery, and simplified data querying for MCP clients. Currently, the MCP side provides simplified querying and query assistance tools, not full DQL or PromQL custom execution tools.

Tool Name	Function	Example Query	Key Parameters	Permission
`owl.data.show_dql_namespace`	List currently supported DQL namespaces, indicating whether `index` is supported	List currently supported DQL namespaces	None	Read-only
`owl.data.simple_query`	Automatically assemble query statements through simplified parameters	Use simple query to count CPU usage in the last 30 minutes	`namespace`, `start_time`, `end_time`, `source`, `select_clause`, `where_clause`, `group_by_clause`, `index`	Read-only
`owl.metric.list`	Discover `source` or fields available for metric queries	List available sources in the metric domain	`mode`	Read-only
`owl.rum.list`	Discover `source` or fields available for RUM queries	List available fields in the RUM domain	`mode`	Read-only
`owl.apm.list`	Discover `source` or fields available for APM queries	Query available sources in the APM domain	`mode`	Read-only
`owl.network.list`	Discover `source` or fields available for Network queries	List available fields in the Network domain	`mode`	Read-only
`owl.profile.list`	Discover `source` or fields available for Profile queries	View available sources in the Profile domain	`mode`	Read-only
`owl.log_index.list`	List indices available for log queries	List current log indices	None	Read-only
`owl.log_index.get`	Query details of a single log index	Query details of this log index UUID	`index_uuid`	Read-only
`owl.field_schema.get`	Query the current field catalog for query field completion	List the current available field catalog	None	Read-only

Errors¶

Used for Error Center issue list querying, and comment addition, querying, and updating.

Tool Name	Function	Example Query	Key Parameters	Permission
`owl.errors.list`	Query the Error Center issue list	Query the error issue list for the last 24 hours	`start_time`, `end_time`, `page_size`, `page_index`, `conditions`, `assigner`, `issue_status`	Read-only
`owl.errors.comment.add`	Add a new comment to an error issue	Add a troubleshooting comment to this error issue	`issue_id`, `comment`, `attachment_uuids`, `extend`	Write
`owl.errors.comment.list`	Query the comment list under an error issue	View the comment records for this error issue	`issue_id`, `page_size`, `page_index`	Read-only
`owl.errors.comment.update`	Update an existing error comment	Update the content of this error comment	`comment_uuid`, `comment`, `attachment_uuids`, `extend`	Write

Event¶

Used for Event Center list querying and event detail retrieval.

Tool Name	Function	Example Query	Key Parameters	Permission
`owl.event.list`	Query the event list	Query critical events in the last 1 hour	`start_time`, `end_time`, `status`, `limit`	Read-only
`owl.event.get`	Query details of a single event	Query details of this event `doc_id`	`doc_id`	Read-only

Incident¶

Used for incident list, incident comments, operation records, and on-call schedule querying.

Tool Name	Function	Example Query	Key Parameters	Permission
`owl.incident.list`	Query the incident list	Query all current incident tickets	`search`, `page_size`, `page_index`	Read-only
`owl.incident_comment.list`	Query the incident comment list	View the comment records for this incident ticket	`incident_uuid`	Read-only
`owl.incident_comment.add`	Add a new comment to an incident ticket	Add a processing update to this incident ticket	`incident_uuid`, `comment`	Write
`owl.incident_operation.list`	Query incident operation records	View the operation history of this incident ticket	`incident_uuid`, `page_size`, `page_index`	Read-only
`owl.incident_schedule.list`	Query the on-call schedule list	Query the current on-call schedule list	`search`, `page_size`, `page_index`	Read-only
`owl.incident_schedule.get`	Query details of an on-call schedule	Query the detailed configuration of this on-call schedule	`schedule_uuid`	Read-only

Infrastructure¶

Used for infrastructure object list and detail querying, covering resource objects such as hosts, containers, processes.

Tool Name	Function	Example Query	Key Parameters	Permission
`owl.infrastructure.list`	Query infrastructure object list	Query all current host objects	`resource_type`, `limit`, `filters`	Read-only
`owl.infrastructure.get`	Query details of a single infrastructure object	Query detailed information of this container object	`resource_type`, `identity_value`	Read-only

LLM¶

Used for LLM observable application list querying.

Tool Name	Function	Example Query	Key Parameters	Permission
`owl.llm.list`	Query LLM application list	List all current LLM applications	`search`, `type`, `page_size`, `page_index`	Read-only

Member¶

Used for workspace member list querying and retrieval by name or email keyword.

Tool Name	Function	Example Query	Key Parameters	Permission
`owl.member.list`	Query workspace member list	Search for members whose email contains `alice`	`search`	Read-only

Monitor¶

Used for monitor list querying, detail retrieval, creation or updating, and external event reception.

Tool Name	Function	Example Query	Key Parameters	Permission
`owl.monitor.list`	Query monitor list	Query currently enabled monitors	`search`, `status_list`	Read-only
`owl.monitor.upsert`	Create a monitor or update an existing monitor	Create a new external event monitor	`json_script`, `rule_uuid`, `status`, `secret`, `alert_policy_uuids`, `tags`	Write
`owl.monitor.receive`	Send external events to an existing receiver, or create a receiver first and then send events	Send a test event to this monitor	`event`, `target`, `monitor`, `extra_data`	Write
`owl.monitor.get`	Query monitor details	Query the full configuration of this monitor rule	`rule_uuid`	Read-only

Pipeline¶

Used for Pipeline list querying and sample validation.

Tool Name	Function	Example Query	Key Parameters	Permission
`owl.pipeline.list`	Query Pipeline list and return decoded content	List Pipelines whose names contain nginx	`search`, `scope`, `categories`	Read-only
`owl.pipeline.validate`	Validate Pipeline processing results with sample data	Use this log sample to verify if this Pipeline can parse correctly	`content`, `testData`, `dataType`	Read-only

MCP Usage Paths¶

Data Querying Problems¶

Applicable to problems like "querying metric, log, RUM, APM, Network, Profile data".

Call owl.data.show_dql_namespace to confirm the data namespace.
Call discovery tools based on the data domain:
- Metrics: owl.metric.list
- RUM: owl.rum.list
- APM: owl.apm.list
- Network: owl.network.list
- Profile: owl.profile.list
- Log indices: owl.log_index.list
- Field catalog: owl.field_schema.get
After obtaining necessary source, field, index, call owl.data.simple_query to execute the query.

Troubleshooting Problems¶

Applicable to problems like "querying incidents, tracking incident handling process, adding incident comments".

Call owl.incident.list to query incident tickets.
Based on the incident ticket incident_uuid, call:
- owl.incident_comment.list to view comments
- owl.incident_operation.list to view operation records
When needing to add handling information, call owl.incident_comment.add.

Resource Object Location Problems¶

Applicable to problems like "querying details of infrastructure objects such as hosts, containers, processes".

Call owl.infrastructure.list to find the target object.
Based on the identifier information in the returned results, call owl.infrastructure.get to get object details.

Dashboard Management Problems¶

Applicable to problems like "querying dashboard configuration, creating dashboards, replacing dashboard content".

If you need to view an existing dashboard, call owl.dashboard.get.
If you need to create a dashboard, call owl.dashboard.create.
If you need to replace the content of an existing dashboard, call owl.dashboard.replace.

Monitor Management Problems¶

Applicable to problems like "querying monitors, creating or updating monitors, sending external events".

Call owl.monitor.list to query monitors.
Based on the rule_uuid in the returned results, call owl.monitor.get to view monitor details.
If you need to create or update a monitor, call owl.monitor.upsert
If you need to send external events, call owl.monitor.receive.