MCP Tool List¶

This document describes the business tools currently available for invocation through MCP wrapper tools in the OWL MCP Server, including tool categories, permission types, usage conventions, a tool overview, and typical MCP usage paths.

The visibility and invocation results of tools depend on the permissions of the API Key currently in use. If the API Key does not have the necessary permissions for related resources or operations, the corresponding tool invocation may fail or return empty results.

Tool Scope¶

The business tools executable by the OWL MCP Server will be continuously updated with platform capabilities. The actual executable tools shall be based on the tool catalog returned by list_catalogs and list_tools.

This document currently covers the following business categories:

Permission Types¶

Usage Conventions¶

The MCP client should call in the following order:

1. Call list_catalogs to view available categories.
2. Call list_tools with the catalog_id parameter to view the business tools and their parameters under that category.
3. Call exec_tool with tool_name and parameters to execute the business tool.

Tool Overview¶

Account¶

Used to discover other workspaces in the same organization as the current API Key workspace. The obtained workspace_uuid can be used as the workspace_uuids parameter for owl.data.same_org.trace.query for cross-workspace Trace queries.

Note: The workspace_uuid in the returned results is the parameter for subsequent workspace_uuids. The workspace_id is only used for list pagination and should not be passed to the Trace query tool.

Catalog¶

Used for entity type discovery, entity queries, entity detail retrieval, and topology relationship queries in the unified resource catalog.

Note: Dashboard tools (owl.dashboard.create / owl.dashboard.replace / owl.dashboard.get) are only available in the OWL CLI and will not appear in the MCP tool list. Please refer to the OWL CLI documentation for usage.

Data¶

Used for DQL namespace exploration, data source and field discovery, log index discovery, SLO queries, log clustering analysis, cross-workspace Trace queries within the same organization, and simplified data queries for MCP clients. The MCP side currently provides simplified query and query assistant tools, not full DQL or PromQL custom execution tools.

When workspace_uuids in owl.data.same_org.trace.query is omitted or an empty array is passed, only the current workspace is queried. When the cross-workspace query within the same organization is disabled, only the current workspace can be queried. Passing other workspace UUIDs will return a parameter error.

Errors¶

Used for querying the error center issue list, and adding, querying, and updating comments.

Event¶

Used for event center list queries and event detail retrieval.

• owl.event.list must provide start_time and end_time. The optional values for status are fatal, critical, error, warning, and nodata. The default value of limit is 20, with a maximum of 100. The returned items may include the event dimension tag field df_dimension_tags.
• The timeRange of owl.event.get is an optional two-element array [start, end], both elements are 13-digit millisecond timestamps, and end must be greater than start. The parameter name is timeRange, do not change it to time_range.

Incident¶

Used for incident list, incident comments, operation records, and on-call schedule queries.

Infrastructure¶

Used for infrastructure object list and detail queries, covering resource objects such as hosts, containers, processes, etc.

LLM¶

Used for LLM observable application list queries.

Member¶

Used for workspace member list queries and search by name or email keyword.

Monitor¶

Used for monitor list queries, detail retrieval, creation or update, and external event reception.

Notes¶

Used to manage notes visible to the current API Key account.

• The default value of page_index in owl.nbook_note.list is 1, the default value of page_size is 20, with a maximum of 100.
• owl.nbook_note.get is the only note tool that returns the Markdown content content, but does not return path, etag, or version. list, add, and modify only return summaries, not content, path, ETag, or version information. The delete response maintains the original concise structure from the backend.
• type supports normal and runbook. owl.nbook_note.list can filter by type, and when omitted, no type filtering is applied. owl.nbook_note.add can set type, and when omitted, the backend creates a normal note. The get and modify responses include type, but get, modify, and delete do not accept type as a parameter. The note type of an existing note cannot be modified.
• owl.nbook_note.add must provide title and content, and does not accept path. created_source is fixed to ai by the server, and the creator is taken from the current API Key.
• owl.nbook_note.modify must provide at least one of title, content, tags, or tag_kv in addition to note_uuid. When content is omitted, the original body is preserved.
• Retrieval, modification, and deletion all use the note_uuid returned by the list. Do not pass fields like path, etag, if_match, version, creator, or created_source that are managed by the backend.
• tagkv_query is a TagKV expression string used by the list tool. tag_kv is a key-value object used by the creation and modification tools. Do not mix them.

Pipeline¶

Used for Pipeline list queries and sample validation.

mdsearch¶

Used to search the unified document corpus, read complete documents by id or path, and browse the corpus catalog structure. Supports Chinese, English, and mixed queries.

MCP Usage Paths¶

Data Query Problems¶

Suitable for problems like "Query metrics, logs, RUM, APM, Network, Profile data".

1. Use exec_tool to call owl.data.show_dql_namespace to confirm the data namespace.
2. Use exec_tool to call discovery tools based on the data domain:
3. Metrics: owl.metric.list
4. RUM: owl.rum.list
5. APM: owl.apm.list
6. Network: owl.network.list
7. Profile: owl.profile.list
8. Logs: owl.logging.list
9. Cloud Billing: owl.billing.list
10. Log Indexes: owl.log_index.list
11. Field Catalog: owl.field_schema.get
12. After obtaining the necessary source, field, and index, use exec_tool to call owl.data.simple_query to execute the query.

Incident Troubleshooting Problems¶

Suitable for problems like "Query incidents, trace the incident handling process, add incident comments".

1. Use exec_tool to call owl.incident.list to query incident tickets.
2. Based on the incident_uuid of the incident ticket, use exec_tool to call:
3. owl.incident_comment.list to view comments
4. owl.incident_operation.list to view operation records
5. When supplementary handling information is needed, use exec_tool to call owl.incident_comment.add.

Resource Object Locating Problems¶

Suitable for problems like "Query details of infrastructure objects such as hosts, containers, processes".

1. Use exec_tool to call owl.infrastructure.list to find the target object.
2. Based on the identification information in the returned results, use exec_tool to call owl.infrastructure.get to get the object details.

Cross-Workspace Trace Query Problems¶

Suitable for problems like "Query a trace spanning multiple workspaces in the same organization by trace_id".

1. Use exec_tool to call owl.account.workspace.same_org.list to discover candidate workspaces in the same organization.
2. Extract workspace_uuid from the returned results (do not use workspace_id).
3. Use exec_tool to call owl.data.same_org.trace.query, passing the required trace_id and the selected workspace_uuid as workspace_uuids. When omitted or an empty array is passed, only the current workspace is queried.
4. If additional filtering is needed, use where_clause without outer curly braces, and do not add the trace_id condition again. Do not fall back to owl.data.simple_query for cross-workspace Trace queries.

Note Management Problems¶

Suitable for problems like "Search, read, create, modify, or delete notes".

1. Use exec_tool to call owl.nbook_note.list to search for notes and obtain note_uuid.
2. When needing to read the Markdown content, call owl.nbook_note.get.
3. Call owl.nbook_note.add to create a note, and owl.nbook_note.modify to update.
4. Call owl.nbook_note.delete to delete. add, modify, and delete are write tools, and manual confirmation by the client should be performed before execution.

Monitor Management Problems¶

Suitable for problems like "Query monitors, create or update monitors, send external events".

1. Use exec_tool to call owl.monitor.list to query monitors.
2. Based on the rule_uuid in the returned results, use exec_tool to call owl.monitor.get to view monitor details.
3. To create or update a monitor, use exec_tool to call owl.monitor.upsert.
4. To send an external event, use exec_tool to call owl.monitor.receive.