--- title: "Discover env" description: "Read-only scan of the caller's Kubernetes cluster and AWS account. Returns a snapshot the install advisors read to generate paste-ready plans." icon: material/radar --- Before any install advisor runs, sweep the cluster and AWS account to capture what's already deployed and what infra exists. Returns a markdown report plus a `snapshot_id` cached for 30 minutes. These advisors read the snapshot: - Reporter advisor - Receiver advisor - [Retriever advisor](advise-retriever.md) - [Advise](advise-install.md) Probes are read-only: only `kubectl get` and `aws describe` / `list` calls. Every shell command run is recorded in the snapshot's `probeLog`. ## :material-code-braces: Example !!! tenx-ask "You" scan env for install candidates !!! tenx-answer "Log10x" === "Kubernetes side" Probes via `kubectl get`: - Existing workloads: DaemonSets, Deployments, Helm releases - Log forwarder detection: fluent-bit / fluentd / filebeat / logstash / otel-collector / vector - Log10x apps already installed (and in which namespace) - Storage classes, ingress classes - ServiceAccounts with IRSA annotations (IAM roles for pods) Detected on this run: fluent-bit DaemonSet (3 replicas) in `logging` ns · EKS 1.28 · no Log10x apps · 4 storage classes · `gp3` default. === "AWS side" Probes via `aws describe` / `list`: - EKS clusters in the region - S3 buckets matching `log10x` / `tenx` / `retriever` / `bucket_hint` - SQS queues following the [Retriever](../../../retriever/) convention (`*-index-queue`, `*-query-queue`, `*-subquery-queue`, `*-stream-queue`) - CloudWatch log groups Detected on this run: AWS account 123456 · 1 EKS cluster `acme-prod` · S3 bucket `logs-archive` matched · 0 SQS queues · 12 CloudWatch log groups. ## :material-chat-question-outline: More to ask - *"scan us-east-1, cluster `acme-prod`, namespaces logging+observability"* - *"AWS-only, no kubectl available"* - *"K8s-only scan, skip AWS"* ## :material-check-decagram-outline: Prerequisites `kubectl` and/or `aws` CLI on PATH with working credentials. Either is optional; missing probes are reported as `available: false`. No Log10x components needed. ## :material-code-json: Schema and samples ??? tenx-input-example "Input example" Real call against the demo env (captured by [`scripts/capture-tool-envelopes.mjs`](https://github.com/log-10x/log10x-mcp/blob/main/scripts/capture-tool-envelopes.mjs)). ```json { "skip_aws": true, "skip_kubectl": true, "view": "summary" } ``` ??? tenx-input-schema "Input schema" Agent-facing JSON Schema (the canonical shape the MCP server publishes via `tools/list`): ```json { "type": "object", "properties": { "namespaces": { "type": "array", "items": { "type": "string" }, "description": "Explicit list of Kubernetes namespaces to probe. If omitted, the tool auto-picks up to 5 likely candidates (demo, logging, observability, otel-demo, default) plus kube-system." }, "region": { "type": "string", "description": "AWS region to probe. If omitted, uses the region from your AWS CLI profile." }, "eks_cluster_name": { "type": "string", "description": "EKS cluster to describe. If omitted and exactly one cluster exists in the account/region, that one is auto-selected." }, "bucket_hint": { "type": "string", "description": "Substring to match against S3 bucket names. Defaults to \"retriever\"; also matches \"log10x\" and \"tenx\" out of the box." }, "forwarder_hint": { "type": "string", "enum": [ "fluentbit", "fluentd", "filebeat", "logstash", "otel-collector", "vector" ], "description": "Override forwarder detection. Use this if multiple forwarders are running and you want the advisor to target a specific one." }, "namespace_hint": { "type": "string", "description": "Preferred namespace for new installs. Defaults to \"logging\" unless an existing forwarder namespace is found." }, "skip_kubectl": { "type": "boolean", "description": "Skip all kubectl probes (for AWS-only discovery or when cluster access is restricted)." }, "skip_aws": { "type": "boolean", "description": "Skip all AWS probes (for cluster-only discovery)." } }, "additionalProperties": false } ``` Source: [`src/tools/discover-env.ts`](https://github.com/log-10x/log10x-mcp/blob/main/src/tools/discover-env.ts). ??? tenx-output-example "Output example" Real envelope from the demo env. `view: "summary"` returns the full `StructuredOutput` with typed `data`. Long arrays + base64 PNG bodies trimmed for readability; the real call returns them in full. Headline (the 1-line agent-facing answer): > _Snapshot `disc-572502b7-d5b0-42bf-9055-e4856bdf1f54`: forwarder=none, installed=none, kubectl=unavailable, aws=unavailable._ ```json { "schema_version": "1.0", "schema_epoch": "2026-05-25", "tool": "log10x_discover_env", "generated_at": "2026-05-26T15:38:35.785Z", "view": "summary", "summary": { "headline": "Snapshot `disc-572502b7-d5b0-42bf-9055-e4856bdf1f54`: forwarder=none, installed=none, kubectl=unavailable, aws=unavailable." }, "data": { "snapshot_id": "disc-572502b7-d5b0-42bf-9055-e4856bdf1f54", "started_at": "2026-05-26T15:38:35.782Z", "finished_at": "2026-05-26T15:38:35.782Z", "kubectl_available": false, "aws_available": false, "installed_components": { "reporter": false, "receiver": false, "retriever": false }, "namespaces_probed": [], "s3_buckets": [], "sqs_queues": [], "log_groups_count": 0, "probe_log_entry_count": 0 }, "actions": [ { "tool": "log10x_advise_install", "args": { "snapshot_id": "disc-572502b7-d5b0-42bf-9055-e4856bdf1f54" }, "reason": "no Reporter installed. Pick the right install path" } ], "truncated": false, "warnings": [] } ``` ??? tenx-output-schema "Output schema" The `data` block inside the [StructuredOutput envelope](../index.md#json-by-default-output): ```typescript interface ToolData { snapshot_id: string; started_at: string; finished_at: string; kubectl_available: boolean; aws_available: boolean; installed_components: { reporter: boolean; receiver: boolean; retriever: boolean }; namespaces_probed: unknown[]; s3_buckets: unknown[]; sqs_queues: unknown[]; log_groups_count: number; probe_log_entry_count: number; } ``` Envelope-level fields the agent should also read: `summary.headline` (1-line answer), `actions[]` (next-call chain hints as `{tool, args, reason}`), `truncated: boolean`, `images[]` (PNG attachments where applicable), `schema_epoch` (engine-ID stability boundary).