MCP Tools List¶

This document introduces the business tool capabilities currently provided by the Owl MCP Server, including tool categories, permission types, usage conventions, tool overview, and typical MCP usage paths.

The visibility and call results of tools depend on the permissions of the currently connected API Key. If the API Key lacks relevant resource or operation permissions, the corresponding tool call may fail or return empty results.

Note

This document only describes business tools that can be directly called within the MCP client, and does not include protocol-layer or wrapper-layer tools, such as list_catalogs, list_tools, exec_tool, etc. Some tools are only available in the Owl CLI and will not appear in the MCP tool list (e.g., dashboard-related tools). This document has been annotated accordingly for the MCP tool list.

Tool Scope¶

The tools exposed by the Owl MCP Server will be continuously updated along with platform capabilities. The actual visible tools are subject to the tool list returned after the MCP client connects.

The current document covers the following business categories:

Category	Description
`account`	Workspace discovery within the same organization
`catalog`	Unified Resource Catalog, entity types, entity details, and topology relationships
`data`	Data source/field discovery, log index discovery, SLO, log clustering, billing discovery, and simplified data query
`errors`	Error center issue query and comment management
`event`	Event list query and event detail retrieval
`incident`	Incident list, incident comments, operation records, and on-call schedules
`infrastructure`	Infrastructure object queries such as hosts, containers, processes
`llm`	LLM observable application list query
`member`	Workspace member query
`mdsearch`	Unified document corpus search, document reading, and directory browsing
`monitor`	Monitor query, creation, update, and external event reception
`pipeline`	Pipeline list query and sample validation

Permission Types¶

Permission Type	Meaning	Usage Suggestion
Read-only	Query, search, get details, validate samples, etc., which do not modify workspace resources	Can be opened to Agents for automatic calls as needed
Write	Create, update, append comments, receive external events, etc., which modify workspace resources	It is recommended to configure manual confirmation in the Agent client

Usage Conventions¶

Type	Convention
Time Range	Uniformly use 13-digit millisecond timestamps
Pagination Parameters	Typically use `page_size` and `page_index`
Detail Query	Usually relies on identifiers like UUID, ID, URN returned by list tools
Data Query	It is recommended to first call discovery tools to obtain `source`, `field`, `index`, then call query tools
Return Structure	Subject to the actual tool response

Tool Overview¶

Tool Set	Tool	Function	Permission
account	`owl.account.workspace.same_org.list`	List workspaces in the same organization as the current API Key's workspace	Read-only
catalog	`owl.catalog.entity_type_query`	Query entity types supported by the unified catalog	Read-only
catalog	`owl.catalog.entity_query`	Query entity list by entity type	Read-only
catalog	`owl.catalog.entity_get`	Get single entity details by `urn`	Read-only
catalog	`owl.catalog.entity_topology_query`	Query topology relationships associated with a single entity	Read-only
data	`owl.data.show_dql_namespace`	View DQL namespace	Read-only
data	`owl.data.simple_query`	Automatically assemble query statements through simplified parameters	Read-only
data	`owl.metric.list`	Discover `source` or fields available for metric query	Read-only
data	`owl.rum.list`	Discover `source` or fields available for RUM query	Read-only
data	`owl.apm.list`	Discover `source` or fields available for APM query	Read-only
data	`owl.network.list`	Discover `source` or fields available for Network query	Read-only
data	`owl.profile.list`	Discover `source` or fields available for Profile query	Read-only
data	`owl.logging.list`	Discover `source` or fields available for log query	Read-only
data	`owl.logging.cluster_task.create`	Create asynchronous log clustering analysis task	Read-only
data	`owl.logging.cluster_task.get`	Get log clustering analysis task results	Read-only
data	`owl.billing.list`	Discover `source` or fields available for cloud billing query	Read-only
data	`owl.slo.list`	Query SLO list of the current workspace	Read-only
data	`owl.log_index.list`	List indexes available for log query	Read-only
data	`owl.log_index.get`	Query single log index details	Read-only
data	`owl.field_schema.get`	Query current field catalog	Read-only
errors	`owl.errors.list`	Query error center issue list	Read-only
errors	`owl.errors.comment.add`	Add a new comment to an error issue	Write
errors	`owl.errors.comment.list`	Query comment list under an error issue	Read-only
errors	`owl.errors.comment.update`	Update an existing error comment	Write
event	`owl.event.list`	Query event list	Read-only
event	`owl.event.get`	Query single event details	Read-only
incident	`owl.incident.list`	Query incident list	Read-only
incident	`owl.incident_comment.list`	Query incident comment list	Read-only
incident	`owl.incident_comment.add`	Add a new comment to an incident ticket	Write
incident	`owl.incident_operation.list`	Query incident operation records	Read-only
incident	`owl.incident_schedule.list`	Query on-call schedule list	Read-only
incident	`owl.incident_schedule.get`	Query on-call schedule details	Read-only
infrastructure	`owl.infrastructure.list`	Query infrastructure object list	Read-only
infrastructure	`owl.infrastructure.get`	Query single infrastructure object details	Read-only
llm	`owl.llm.list`	Query LLM application list	Read-only
member	`owl.member.list`	Query workspace member list	Read-only
mdsearch	`mdsearch_search`	Search unified document corpus, return candidate documents	Read-only
mdsearch	`mdsearch_document`	Read complete document by `id` or path	Read-only
mdsearch	`mdsearch_catalog`	Browse the directory structure of the document corpus	Read-only
monitor	`owl.monitor.list`	Query monitor list	Read-only
monitor	`owl.monitor.upsert`	Create a monitor or update an existing monitor	Write
monitor	`owl.monitor.receive`	Send external events to an existing receiver, or create a receiver first and then send events	Write
monitor	`owl.monitor.get`	Query monitor details	Read-only
pipeline	`owl.pipeline.list`	Query Pipeline list and return decoded content	Read-only
pipeline	`owl.pipeline.validate`	Validate Pipeline processing results with sample data	Read-only

Account¶

Used to discover other workspaces within the same organization as the current API Key's workspace. The obtained workspace_uuid can be used as the same_org_workspace_uuids input parameter for owl.data.simple_query for cross-workspace queries.

Tool Name	Function	Example Query	Key Parameters	Permission
`owl.account.workspace.same_org.list`	List workspaces in the same organization as the current workspace, sorted by workspace id descending	List workspaces in the same organization as the current workspace	`workspace_uuids`, `page_size`, `before_workspace_id`	Read-only

Note: The workspace_uuid in the returned results is the subsequent same_org_workspace_uuids input parameter. Do not pass workspace_id.

Catalog¶

Used for entity type discovery, entity query, entity detail retrieval, and topology relationship query in the unified Resource Catalog.

Tool Name	Function	Example Query	Key Parameters	Permission
`owl.catalog.entity_type_query`	Query entity types supported by the unified catalog	List entity types currently supported by the Catalog	`page_size`, `page_index`	Read-only
`owl.catalog.entity_query`	Query entity list by entity type	Query Catalog entity list of type `host`	`entity_type`, `page_size`, `page_index`	Read-only
`owl.catalog.entity_get`	Get single entity details by `urn`	Query entity details corresponding to this `urn`	`urn`	Read-only
`owl.catalog.entity_topology_query`	Query topology relationships associated with a single entity	View the upstream and downstream topology of this host entity	`urn`	Read-only

Note: Dashboard tools (owl.dashboard.create / owl.dashboard.replace / owl.dashboard.get) are only provided in the Owl CLI and will not appear in the MCP tool list. For related usage, please refer to the Owl CLI documentation.

Data¶

Used for DQL namespace exploration, data source and field discovery, log index discovery, SLO query, log clustering analysis, and simplified data queries for MCP clients. The current MCP side provides simplified queries and query assistance tools, and does not include full DQL or PromQL custom execution tools.

Tool Name	Function	Example Query	Key Parameters	Permission
`owl.data.show_dql_namespace`	List currently supported DQL namespaces, indicating whether `index` is supported	List currently supported DQL namespaces	None	Read-only
`owl.data.simple_query`	Automatically assemble query statements through simplified parameters	Use simple query to count CPU usage rate in the last 30 minutes	`namespace`, `start_time`, `end_time`, `source`, `select_clause`, `where_clause`, `group_by_clause`, `index`, `same_org_workspace_uuids`	Read-only
`owl.metric.list`	Discover `source` or fields available for metric query	List available sources for the metric domain	`mode`	Read-only
`owl.rum.list`	Discover `source` or fields available for RUM query	List available fields for the RUM domain	`mode`	Read-only
`owl.apm.list`	Discover `source` or fields available for APM query	Query available sources for the APM domain	`mode`	Read-only
`owl.network.list`	Discover `source` or fields available for Network query	List available fields for the Network domain	`mode`	Read-only
`owl.profile.list`	Discover `source` or fields available for Profile query	View available sources for the Profile domain	`mode`	Read-only
`owl.logging.list`	Discover `source` or fields available for log query	List available sources for the logging domain	`mode`, `source`	Read-only
`owl.logging.cluster_task.create`	Create asynchronous log clustering analysis task, return `task_id`	Cluster recent error logs by similar messages	`timeRange`, `analysisField`, `namespace`, `conditions`, `query`, `indexes`	Read-only
`owl.logging.cluster_task.get`	Get log clustering analysis results by `task_id`	Query the results of this log clustering task	`task_id`	Read-only
`owl.billing.list`	Discover `source` or fields available for cloud billing query	List available sources for cloud billing	`mode`, `source`	Read-only
`owl.slo.list`	Query SLO list of the current workspace, supports search by name or monitor UUID	List SLOs of the current workspace	`search`	Read-only
`owl.log_index.list`	List indexes available for log query	List current log indexes	None	Read-only
`owl.log_index.get`	Query single log index details	Query details of this log index UUID	`index_uuid`	Read-only
`owl.field_schema.get`	Query current field catalog for query field completion	List current available field catalog	None	Read-only

Errors¶

Used for error center issue list query, and comment addition, query, and update.

Tool Name	Function	Example Query	Key Parameters	Permission
`owl.errors.list`	Query error center issue list	Query error issue list from the last 24 hours	`start_time`, `end_time`, `page_size`, `page_index`, `conditions`, `assigner`, `issue_status`	Read-only
`owl.errors.comment.add`	Add a new comment to an error issue	Add a troubleshooting comment to this error issue	`issue_id`, `comment`, `attachment_uuids`, `extend`	Write
`owl.errors.comment.list`	Query comment list under an error issue	View comment records for this error issue	`issue_id`, `page_size`, `page_index`	Read-only
`owl.errors.comment.update`	Update an existing error comment	Update the content of this error comment	`comment_uuid`, `comment`, `attachment_uuids`, `extend`	Write

Event¶

Used for event center list query and event detail retrieval.

Tool Name	Function	Example Query	Key Parameters	Permission
`owl.event.list`	Query event list	Query critical events from the last 1 hour	`start_time`, `end_time`, `status`, `limit`	Read-only
`owl.event.get`	Query single event details	Query details of this event `doc_id`	`doc_id`	Read-only

Incident¶

Used for incident list, incident comments, operation records, and on-call schedule query.

Tool Name	Function	Example Query	Key Parameters	Permission
`owl.incident.list`	Query incident list	Query all current incident tickets	`search`, `page_size`, `page_index`	Read-only
`owl.incident_comment.list`	Query incident comment list	View comment records for this incident ticket	`incident_uuid`	Read-only
`owl.incident_comment.add`	Add a new comment to an incident ticket	Add a progress update to this incident ticket	`incident_uuid`, `comment`	Write
`owl.incident_operation.list`	Query incident operation records	View operation history for this incident ticket	`incident_uuid`, `page_size`, `page_index`	Read-only
`owl.incident_schedule.list`	Query on-call schedule list	Query current on-call schedule list	`search`, `page_size`, `page_index`	Read-only
`owl.incident_schedule.get`	Query on-call schedule details	Query detailed configuration of this on-call schedule	`schedule_uuid`	Read-only

Infrastructure¶

Used for infrastructure object list and detail query, covering resource objects such as hosts, containers, processes.

Tool Name	Function	Example Query	Key Parameters	Permission
`owl.infrastructure.list`	Query infrastructure object list	Query all current host objects	`resource_type`, `limit`, `filters`	Read-only
`owl.infrastructure.get`	Query single infrastructure object details	Query detailed information of this container object	`resource_type`, `identity_value`	Read-only

LLM¶

Used for LLM observable application list query.

Tool Name	Function	Example Query	Key Parameters	Permission
`owl.llm.list`	Query LLM application list	List all current LLM applications	`search`, `type`, `page_size`, `page_index`	Read-only

Member¶

Used for workspace member list query and search by name, email keywords.

Tool Name	Function	Example Query	Key Parameters	Permission
`owl.member.list`	Query workspace member list	Search for members whose email contains `alice`	`search`	Read-only

Monitor¶

Used for monitor list query, detail retrieval, creation or update, and external event reception.

Tool Name	Function	Example Query	Key Parameters	Permission
`owl.monitor.list`	Query monitor list	Query currently enabled monitors	`search`, `status_list`	Read-only
`owl.monitor.upsert`	Create a monitor or update an existing monitor	Create a new external event monitor	`json_script`, `rule_uuid`, `status`, `secret`, `alert_policy_uuids`, `tags`	Write
`owl.monitor.receive`	Send external events to an existing receiver, or create a receiver first and then send events	Send a test event to this monitor	`event`, `target`, `monitor`, `extra_data`	Write
`owl.monitor.get`	Query monitor details	Query the complete configuration of this monitor rule	`rule_uuid`	Read-only

Pipeline¶

Used for Pipeline list query and sample validation.

Tool Name	Function	Example Query	Key Parameters	Permission
`owl.pipeline.list`	Query Pipeline list and return decoded content	List Pipelines whose name contains nginx	`search`, `scope`, `categories`	Read-only
`owl.pipeline.validate`	Validate Pipeline processing results with sample data	Use this log sample to verify if this Pipeline can parse correctly	`content`, `testData`, `dataType`	Read-only

mdsearch¶

Used to search unified document corpus, read complete documents by id or path, and browse corpus directory structure, supporting Chinese, English, and mixed queries.

Tool Name	Function	Example Query	Key Parameters	Permission
`mdsearch_search`	Search unified document corpus and return sorted candidate documents	Search for documents containing "DQL time range"	`q`, `top`, `path_prefix`, `tags`, `mode`, `sort`	Read-only
`mdsearch_document`	Read complete document by `id` or path	Read the complete content of this document id	`id`, `meta`	Read-only
`mdsearch_catalog`	Browse top-level directories and representative documents of the document corpus	See what directories the document corpus has	None	Read-only

MCP Usage Paths¶

Data Query Problems¶

Applicable to problems like "query metrics, logs, RUM, APM, Network, Profile data".

Call owl.data.show_dql_namespace to confirm data namespace.
Call discovery tools based on the data domain:
Metrics: owl.metric.list
RUM: owl.rum.list
APM: owl.apm.list
Network: owl.network.list
Profile: owl.profile.list
Logs: owl.logging.list
Cloud billing: owl.billing.list
Log indexes: owl.log_index.list
Field catalog: owl.field_schema.get
After obtaining necessary source, field, index, call owl.data.simple_query to execute the query.

Troubleshooting Problems¶

Applicable to problems like "query incidents, track incident handling process, supplement incident comments".

Call owl.incident.list to query incident tickets.
Based on the incident ticket incident_uuid, call:
owl.incident_comment.list to view comments
owl.incident_operation.list to view operation records
When needing to supplement handling information, call owl.incident_comment.add.

Resource Object Location Problems¶

Applicable to problems like "query host, container, process and other infrastructure object details".

Call owl.infrastructure.list to find the target object.
Based on the identification information in the returned results, call owl.infrastructure.get to obtain object details.

Cross-Workspace Query Problems¶

Applicable to problems like "query data across multiple workspaces within the same organization in one query".

Call owl.account.workspace.same_org.list to discover candidate workspaces within the same organization.
Take workspace_uuid from the returned results (do not take workspace_id).
Pass these workspace_uuid as same_org_workspace_uuids into owl.data.simple_query to execute cross-workspace queries, up to 20 workspaces.

Monitor Management Problems¶

Applicable to problems like "query monitors, create or update monitors, send external events".

Call owl.monitor.list to query monitors.
Based on the rule_uuid in the returned results, call owl.monitor.get to view monitor details.
If needing to create or update a monitor, call owl.monitor.upsert
If needing to send external events, call owl.monitor.receive.