superlog

Search OpenTelemetry logs. Targets the session's active project unless project_id is given. Error rows include flattened exception_type, exception_message, and exception_stacktrace fields when present.

Search OpenTelemetry spans. Targets the session's active project unless project_id is given. Spans with exception events include flattened exception_type, exception_message, and exception_stacktrace fields when present.

Fetch recent metric points across gauge, sum, explicit-histogram, exponential-histogram, and summary tables. Targets the session's active project unless project_id is given. Each point includes its data-point `attributes` (the per-series dimensions like route/status/tenant), `resource_attrs`, start …

List distinct service.name values emitting telemetry in the given window.

List every project the authenticated user can access, across all of their orgs. The active project is marked.

Return the project that tools default to when project_id is omitted.

Change the default project for subsequent tool calls in this session. Persists for the lifetime of the access token.

List the custom MCP servers available to new investigation and Slack-agent sessions for this project. Credentials are always redacted.

Add a trusted HTTPS Streamable HTTP MCP server to this project. Admin only. Authentication accepts none, bearer/API token, arbitrary API-key header, or OAuth. Credential inputs are write-only and never returned.

Update a project MCP server. Admin only. Omit auth to preserve its credential; supplying auth replaces it. A changed URL must be explicitly trusted.

Remove a custom MCP server from this project. Admin only.

Start OAuth authorization-code authentication with discovery, PKCE, resource binding, and dynamic client registration when needed. Admin only. Open the returned authorizationUrl in a browser.

Exchange the configured OAuth client ID and secret using client_credentials, but only when advertised by the authorization server. Admin only.

Erase stored OAuth tokens and disable this custom MCP server. Admin only.

Connect to a configured MCP server, initialize the protocol, and list its tools. Admin only. Secrets are never returned.

Read the project's issue filter: per-kind include/exclude attribute clauses that decide which ERROR events become issues/incidents. Excludes win; a non-empty include list means an event must match at least one clause.

Update the issue filter. Each bucket you provide REPLACES that bucket; omit a bucket to leave it unchanged; pass [] to clear it. Use this to quiet recurring noise (add an exclude clause) or to scope investigations to specific services/routes (add an include clause). Call get_issue_filter first if yo…

Preview which recent ERROR events (last 24h) would still become issues under a candidate filter, WITHOUT saving. Buckets you pass are merged over the project's current filter (same semantics as update_issue_filter); omit all buckets to preview the current saved filter. Returns sample matching events…

Read the project's freeform context — the human-written description of the system (architecture, conventions, key services) that the investigation agent reads on every run.

Overwrite the project's freeform context (max 8000 chars; longer input is truncated). This REPLACES the whole field — call get_project_context first and edit the returned text if you want to preserve existing content. Use for durable, system-level facts that apply to every investigation; for narrowe…

List the investigation agent's stored memories for the project — durable learnings (feedback, terminology, infra, project facts) that are injected into future investigations.

Record a durable, reusable learning so future investigations inherit it. Record a memory whenever you discover something worth remembering across investigations — a root-cause pattern, a piece of infra/architecture, a domain term, or a user correction about how to investigate. Keep the title a short…

Patch a stored memory. Provide only the fields you want to change. Set status='archived' to retire a memory without deleting it (archived memories stop being injected into investigations).

Permanently delete a stored memory by id. To retire one reversibly, prefer update_agent_memory with status='archived'.

List all alerts in the active project (or the project_id you pass).

Fetch a single alert plus its 50 most recent firings.

Create an alert. For logs/traces sources aggregation must be 'count'; for metric source it must be 'sum' or 'avg' and metric_name is required.

Patch an alert. Provide only the fields you want to change. Validation runs on the merged result.

Delete an alert by id.

Evaluate a draft alert spec against current data without saving. Returns whether it would breach right now.

Re-evaluate a saved alert against current data and return the result.

Fetch the active project's shared home command center, including built-ins, data widgets, links, and grid layouts.

Show or hide one of the built-in home widgets: setup_todos, active_incidents, service_map, incoming_signals, incident_count, or agent_pull_requests.

Add a chart, table, or markdown widget directly to the shared project home. Uses the same widget config and 12-column layout as dashboards.

Add a shared link card to project home. URLs must be absolute and use http or https.

Update positions and sizes for home items on the 12-column grid. Read get_home first and send the items that should move.

Remove a built-in, data widget, or link from project home. Read get_home first to discover item ids.

List dashboards in the active project (or project_id).

Fetch a dashboard with its widgets.

Rename a dashboard.

Delete a dashboard and all its widgets.

Remove a widget from a dashboard.