Cloud DevOps MCP Server

List EKS, AKS or GKE clusters from an explicitly allowlisted cloud scope without changing cluster or cloud state.

Read bounded observability configuration signals: CloudWatch alarms, Azure metric alerts or GCP logging sinks.

Verify the active allowlisted AWS, Azure or GCP identity/scope before live reads. No credentials or tokens are returned.

Run a bounded AWS CloudWatch Logs Insights query against an explicitly allowlisted account, region and log group. It only reads query results and never changes logging resources.

Build a bounded post-deployment evidence timeline across metrics, logs, alerts and Kubernetes signals, then report whether timing shows strong, possible or insufficient evidence of a deployment relationship without claiming root cause.

Correlate supplied metrics, logs, alerts, Kubernetes health and CI/CD evidence into deterministic incident relationships and identify missing evidence needed for triage.

Correlate a representative distributed trace with SLO burn evidence, optional deployment timing and service-dependency edges. The tool reports evidence strength and problematic dependencies while explicitly stopping short of root-cause ranking, which requires broader evidence.

Compare expected cloud resource identifiers and Kubernetes workloads with supplied live identifiers to detect cross-runtime configuration drift while remaining analysis-only and leaving reconciliation to approved workflows.

Send bounded multi-domain incident evidence to the configured private OpsChugex intelligence service and return evidence-ranked probable causes with supporting signals, contradictions, limitations, and next checks. This public MCP tool contains no proprietary scoring rules, accepts no endpoint or credential arguments, performs no remediation, and does not mutate cloud, Kubernetes, Terraform, CI/CD, or observability state.

Calculate remaining SLO downtime budget and, when request counts are supplied, remaining failed-request budget for a fixed period. Use this as a deterministic budget calculator; do not use it to fetch monitoring data or forecast reliability. It performs no external calls and changes no service state.

Generate one concise operational brief from supplied health, incident, deployment, SLO, drift and FinOps summaries so an operator can see current status, risks and next actions without querying or mutating external systems.

Stage only explicitly named repository paths and commit them on a non-protected branch. Supports dry-run preview.

Create and switch to an allowlisted non-protected branch from an approved local repository.

Fetch remote refs for an allowlisted repository using an allowlisted remote.

Pull the currently checked-out branch with --ff-only. Dirty working trees are rejected.

Push only the current non-protected branch to an allowlisted remote. Force-push is never used. Supports dry-run.

Inspect an allowlisted local repository without modifying it.

Inspect failed jobs and bounded job logs for one GitHub Actions run in an explicitly allowlisted repository and classify likely failure categories without rerunning or changing the workflow.

Inspect pull request mergeability and GitHub Actions check runs for an allowlisted repository.

Create a pull request from the current non-protected branch in an explicitly allowlisted GitHub repository.

Merge an open PR only after CI checks pass and confirm is exactly MERGE. Direct protected-branch pushes remain blocked.

Dispatch only an explicitly allowlisted GitHub Actions workflow. confirm must be exactly TRIGGER.

Read a bounded summary of Grafana managed alert rules and active alerts from an explicitly allowlisted Grafana endpoint without changing alert configuration.

Read the current kubectl context and require it to match the configured context allowlist before returning it.

Read bounded metadata and status summaries for allowlisted Kubernetes resource types, contexts and namespaces. Secrets and arbitrary resource types are not exposed.

Read rollout readiness for an allowlisted Deployment, StatefulSet or DaemonSet without watching indefinitely or mutating the cluster.

Read bounded pod health for an explicitly allowlisted Kubernetes context and namespace, including readiness, restart and unhealthy-state summaries without cluster mutation.

Run a bounded, read-only PromQL instant or range query against an explicitly allowlisted Prometheus-compatible endpoint and return normalized series summaries.

Evaluate generic CI/CD production-readiness controls from structured pipeline facts, separating missing evidence from failed controls. Use this for platform-agnostic delivery process review; for raw GitHub Actions YAML, use review_github_actions_workflow. It is analysis-only and does not trigger builds, deployments, approvals, or pipeline changes.

Apply deterministic provider-specific identity policy packs to raw AWS IAM, Azure RBAC or GCP IAM policy documents. Use this for cross-cloud identity security analysis; use review_iam_policy when assessing AWS IAM from mixed structured facts or policy JSON. It analyzes supplied policy JSON only and does not call cloud APIs or change permissions.

Evaluate GitHub Actions workflow security and deployment readiness from structured facts or raw workflow YAML, including triggers, action pinning, token permissions, caching, environment protection and concurrency. Use review_cicd_pipeline for generic non-GitHub delivery-process review. It examines supplied evidence only and does not call GitHub or dispatch workflows.

Evaluate AWS IAM policy risk from structured facts or raw policy JSON, including wildcard scope, privilege-escalation actions and conditions. Use this for AWS IAM operational risk; for provider-specific AWS/Azure/GCP policy-pack checks, use review_cloud_identity_policy. It analyzes supplied policy data only and does not call AWS or modify IAM.

Evaluate Kubernetes workload production readiness and reliability from structured facts or multi-document YAML, including probes, resources, replicas, disruption protection and exposure. Use this for deployability/readiness; for workload security hardening, use review_kubernetes_security. It examines supplied evidence only and does not connect to a Kubernetes cluster.

Apply Kubernetes workload security rules to manifest YAML for privileged mode, host access, Linux capabilities, service accounts, seccomp, filesystem settings and network policy. Use this for security hardening; use review_kubernetes_deployment for reliability and production-readiness checks. It analyzes supplied YAML only and does not connect to a cluster.

Correlate CycloneDX/SPDX SBOM quality with CI action pinning, Kubernetes image immutability, artifact signing and build provenance to assess software-supply-chain risk. Use this when an SBOM is available and supply-chain evidence needs to be evaluated together. It analyzes supplied artifacts only and does not call registries, CI systems, or clusters.

Inspect raw Terraform plan JSON for security-relevant changes such as destructive actions, public exposure, encryption gaps, deletion protection and IAM wildcard risk. Use this for Terraform security posture; use assess_terraform_change for broader release/change risk and governance. It parses the supplied plan only and does not execute Terraform or write state.

Run terraform fmt in check-only mode inside an allowlisted repository. It never rewrites Terraform files.

Run a non-apply Terraform plan with refresh disabled and return only a change summary. The tool never exposes full plan JSON and never runs terraform apply.

Run terraform validate -json inside an allowlisted repository and return bounded diagnostics. It does not initialize providers, plan or apply infrastructure.

Build a deterministic service dependency map from caller-supplied span relationships, including call counts, error counts, error rates and average child-span duration. Use normalized trace evidence from one or more traces; this analysis tool makes no external calls and performs no mutations.

Search an explicitly allowlisted Grafana Tempo or Jaeger trace backend within a bounded time window and return normalized trace summaries. Tempo supports bounded TraceQL; Jaeger uses its stable v3 HTTP trace-summary API. This tool is read-only and never sends spans or changes backend state.

Retrieve one trace by hexadecimal trace ID from an explicitly allowlisted Tempo or Jaeger backend, normalize OpenTelemetry-style resource and span data, and summarize services, operations, errors, roots, duration and slow spans. The tool is bounded, read-only and does not ingest or mutate telemetry.