---
title: "Dependency check"
description: "Find what depends on a pattern in your log analyzer (dashboards, alerts, saved searches) before dropping it. Executes against the log analyzer API when creds are present."
icon: material/shield-search
---

Before muting or dropping a pattern, find every dashboard, alert, saved search, or monitor that references it.

Returns the actual dependency list with deep-links when your log analyzer credentials are in the environment, or a paste-ready bash block when they aren't.

The executed path is read-only across every vendor; only GETs are issued.

## :material-code-braces: Example

!!! tenx-ask "You"

    deps on `Payment_Gateway_Timeout` in Splunk

!!! tenx-answer "Log10x"

    Dependency Check on Splunk (executed). 2 alerts, 1 saved search, 3 dashboards reference the pattern:

    **Alerts**

    - `Payments_Timeout_Spike` fires on rate > 50/min · [open](https://splunk.acme.com:8000/en-US/app/search/alert?s=...)
    - `Tenant_Impact_Watch` multi-tenant variant · [open](https://splunk.acme.com:8000/en-US/app/search/alert?s=...)

    **Saved searches**

    - `Payment_Gateway_Timeout_24h_summary` · [open](https://splunk.acme.com:8000/en-US/app/search/search?s=...)

    **Dashboards**

    - `Payments Service Live` · [open](https://splunk.acme.com:8000/en-US/app/search/payments_live)
    - `Incident Triage OPS` · [open](https://splunk.acme.com:8000/en-US/app/search/incident_triage)
    - `Tenant SLA Tracking` · [open](https://splunk.acme.com:8000/en-US/app/search/tenant_sla)

    Redirect or remove these consumers before muting or dropping the pattern.

## :material-chat-question-outline: More to ask

- *"deps on `Retry_Backoff_Exhausted` in Datadog"*
- *"who's using `DEBUG /healthz` in Elasticsearch?"*
- *"can I delete the `cart_validation_failed` log?"*

## :material-check-decagram-outline: Prerequisites

Per vendor, set the env vars below for executed mode. Missing creds → paste-ready bash + a note saying which env to set. `vendor` is auto-detected when exactly one log analyzer is present in the env; pass `vendor=<id>` when multiple are present.

| Vendor | Required env | Notes |
|---|---|---|
| Splunk | `SPLUNK_HOST` + `SPLUNK_TOKEN` | Basic-auth and `~/.splunkrc` also accepted. Web URLs derived by mapping `:8089` → `:8000`. Override with `SPLUNK_WEB_URL`. |
| Datadog | `DD_API_KEY` + `DD_APP_KEY` | `DATADOG_*` aliases work. Site routing via `DD_SITE`. |
| CloudWatch | Standard AWS credential chain | Scans metric filters + metric/composite alarms + dashboards (by name; full-body match would need per-dashboard fetch, kept out of the default path). |
| Elasticsearch | `KIBANA_URL` + `KIBANA_API_KEY` (or `ELASTIC_API_KEY`) | Without a Kibana endpoint, falls back to paste-ready bash with a note. Elasticsearch alone can't surface dashboards / rules. |

## :material-code-json: Schema and samples

??? tenx-input-example "Input example"

    Real call against the demo env (captured by [`scripts/capture-tool-envelopes.mjs`](https://github.com/log-10x/log10x-mcp/blob/main/scripts/capture-tool-envelopes.mjs)).

    ```json
    {
      "pattern": "Payment_Gateway_Timeout",
      "vendor": "datadog",
      "view": "summary"
    }
    ```

??? tenx-input-schema "Input schema"

    Agent-facing JSON Schema (the canonical shape the MCP server publishes via `tools/list`):

    ```json
    {
      "type": "object",
      "properties": {
        "pattern": {
          "type": "string",
          "description": "Pattern name (e.g., \"Payment_Gateway_Timeout\")"
        },
        "vendor": {
          "type": "string",
          "enum": [
            "datadog",
            "splunk",
            "elasticsearch",
            "cloudwatch"
          ],
          "description": "SIEM vendor to scan. Omit to auto-detect from ambient credentials (DD_API_KEY+DD_APP_KEY → datadog; SPLUNK_HOST+SPLUNK_TOKEN → splunk; ELASTIC_URL → elasticsearch; AWS chain → cloudwatch). When multiple SIEMs are configured, the tool returns an \"ambiguous\" error listing them. Pass vendor= to disambiguate. When the resolved SIEM has live credentials the scan runs in-process and returns actual dashboard/alert/saved-search names + URLs; otherwise the tool falls back to a paste-ready bash command."
        },
        "service": {
          "type": "string",
          "description": "Service name to scope the scan"
        },
        "severity": {
          "type": "string",
          "description": "Severity level"
        }
      },
      "required": [
        "pattern"
      ],
      "additionalProperties": false
    }
    ```

    Source: [`src/tools/dependency-check.ts`](https://github.com/log-10x/log10x-mcp/blob/main/src/tools/dependency-check.ts).

??? tenx-output-example "Output example"

    Real envelope from the demo env. `view: "summary"` returns the full `StructuredOutput` with typed `data`. Long arrays + base64 PNG bodies trimmed for readability; the real call returns them in full.

    Headline (the 1-line agent-facing answer):

    > _`Payment\_Gateway\_Timeout`: 0 dependencies found in datadog (recommendation: unverifiable)_

    ```json
    {
      "schema_version": "1.0",
      "schema_epoch": "2026-05-25",
      "tool": "log10x_dependency_check",
      "generated_at": "2026-05-26T15:38:35.775Z",
      "view": "summary",
      "summary": {
        "headline": "`Payment_Gateway_Timeout`: 0 dependencies found in datadog (recommendation: unverifiable)"
      },
      "data": {
        "pattern": "Payment_Gateway_Timeout",
        "vendor": "datadog",
        "execution_mode": "paste_ready",
        "scan_ran": false,
        "dependencies": [],
        "safe_to_drop_recommendation": "unverifiable"
      },
      "actions": [],
      "truncated": false,
      "warnings": []
    }
    ```

??? tenx-output-schema "Output schema"

    The `data` block inside the [StructuredOutput envelope](../index.md#json-by-default-output):

    ```typescript
    interface ToolData {
      pattern: string;
      vendor: string;
      execution_mode: string;
      scan_ran: boolean;
      dependencies: unknown[];
      safe_to_drop_recommendation: string;
    }
    ```

    Envelope-level fields the agent should also read: `summary.headline` (1-line answer), `actions[]` (next-call chain hints as `{tool, args, reason}`), `truncated: boolean`, `images[]` (PNG attachments where applicable), `schema_epoch` (engine-ID stability boundary).