Superlog

Remove a widget from a dashboard.

Erase stored OAuth tokens and disable this custom MCP server. Admin only.

Return the project that tools default to when project_id is omitted.

Fetch a single alert plus its 50 most recent firings.

Fetch a dashboard with its widgets.

Fetch the active project's shared home command center, including built-ins, data widgets, links, and grid layouts.

Fetch one incident by its id — the uuid at the end of a superlog.sh/app/org/<org>/project/<project>/incidents/<id> link — and everything needed to explain it. No project_id is required; the project is resolved from the incident. Returns: the incident summary with the agent's findings (root_cause_text, agent_summary, estimated_impact_text) and its project_id; every linked issue with a stored telemetry `sample` (trace_id, span_id, stacktrace, span/log/resource attributes); and a pointer to the latest investigation run. To pull live telemetry, take a sample's trace_id and call query_traces, or fi…

Read the project's issue filter: per-kind include/exclude attribute clauses that decide which ERROR events become issues/incidents. Excludes win; a non-empty include list means an event must match at least one clause.

Read the project's freeform context — the human-written description of the system (architecture, conventions, key services) that the investigation agent reads on every run.

Returns the full grouping context for one candidate incident by id. Use this before joining.

List the custom MCP servers available to new investigation and Slack-agent sessions for this project. Credentials are always redacted.

List the investigation agent's stored memories for the project — durable learnings (feedback, terminology, infra, project facts) that are injected into future investigations.

List all alerts in the active project (or the project_id you pass).

List dashboards in the active project (or project_id).

Returns counts for structured facets across candidate incidents: services, environments, exception types, endpoint hosts, endpoint kinds, and investigation states. Use this to slice the candidate set before inspecting individual incidents.

Lists candidate incident titles and compact metadata so you can see whether any open incident is even close before inspecting details.

List the active memories of the project under investigation. Call before save_memory if you are unsure whether a fact is already recorded.

List every project the authenticated user can access, across all of their orgs. The active project is marked.

List distinct service.name values emitting telemetry in the given window.

Retrieve a Notion page's metadata and properties (including its title) by page id. For the page body use notion_get_page_content.

Read the child blocks (the actual text content) of a Notion page or block by id. Paginate with start_cursor when has_more is true.

List the entries (rows) of a Notion database by database id. Paginate with start_cursor when has_more is true.

Search the connected Notion workspace by title for pages and databases shared with the integration. Omit query to list everything shared. Returns page/database ids and titles; follow up with notion_get_page_content to read a page.

Evaluate a draft alert spec against current data without saving. Returns whether it would breach right now.

Preview which recent ERROR events (last 24h) would still become issues under a candidate filter, WITHOUT saving. Buckets you pass are merged over the project's current filter (same semantics as update_issue_filter); omit all buckets to preview the current saved filter. Returns sample matching events.

Terminal for this turn: open or update one validated PR per repository, then wait for review. Pass a non-empty pullRequests array; every repository and patchFilePath must be unique. Each patch must be a unified diff under /mnt/session/outputs/ that changes only its repository. A new branchName opens a PR; reusing the same repository and branchName pushes a follow-up commit. If validation or delivery fails, the call is rejected and the turn stays active so you can retry only failed entries. NOT for noise: a patch that only quiets a signal is the wrong outcome. Do not call resolve_incident in th…

Call exactly once when you've decided whether the incident appears to be resolved. This ends the investigation. If you set looks_resolved=false, the incident is left open and no human is paged. If looks_resolved=true, a Slack message will be posted asking a human to confirm — so prefer being conservative when evidence is weak.

Your final grouping of the system into logical services, node relabels, and suggested links.

Returns hourly counts of exception events on the incident's service whose exception.type matches one of the live issues linked to this incident. This is a strict superset of the actual incident events (an unrelated issue sharing the same exception type would also match), so a non-zero count does not by itself prove the underlying error is still firing — but a sustained drop to zero is a strong recovery signal. Use alongside query_service_traffic to distinguish recovery from a traffic dropout. Returns zero if the incident has no live (non-silenced) linked issues.

Search OpenTelemetry logs. Targets the session's active project unless project_id is given. Error rows include flattened exception_type, exception_message, and exception_stacktrace fields when present.

Fetch recent metric points across gauge, sum, explicit-histogram, exponential-histogram, and summary tables. Targets the session's active project unless project_id is given. Each point includes its data-point `attributes` (the per-series dimensions like route/status/tenant), `resource_attrs`, start time, and aggregation temporality where applicable. Gauge/sum points carry a scalar `value`; histogram/summary points carry `count` and `sum` (plus `min`/`max` for histograms) instead, since they have no scalar value.

Returns the total span count for the incident's service over the lookback window, broken down by hour. If this is flat or rising while query_incident_activity is zero, the operation is still being exercised — strong signal that the error path is genuinely recovered, not just unused.

Search OpenTelemetry spans. Targets the session's active project unless project_id is given. Spans with exception events include flattened exception_type, exception_message, and exception_stacktrace fields when present.

Remove a custom MCP server from this project. Admin only.

Remove a built-in, data widget, or link from project home. Read get_home first to discover item ids.

Terminal: report an established root cause outside the systems available for remediation. This ends the turn and leaves the Incident and every linked Issue open while the session waits for an external change or human update. Use ask_human instead when a concrete answer or decision is needed.

Record what the investigation found. Call this before any classification, PR, or resolution tool; call it again to revise — include `summary` on every call (repeat the current one when it hasn't changed); every other field overwrites its previous value when provided and is kept when omitted.

Terminal: resolve the Incident only when everything required has been done and impact has ceased, or when no remediation is needed. Include exactly one outcome for every linked Issue. Error Issues may be resolved, silenced, or placed under observation; alert-episode Issues must be resolved. The platform validates and applies all Issue outcomes and the Incident resolution atomically. If any entry is invalid, nothing changes and the turn stays active. Do not resolve while waiting for an open PR; propose_pr ends that turn instead.

Cancel a running test execution.

Create a new Revyl test from a YAML definition. Use AFTER revyl_validate_yaml passes. The worker auto-tags the test with superlog_incident_id and superlog_session_id.

Retrieve current status and result of a previously triggered test run.

Retrieve current status of a previously triggered workflow run.

Trigger an async run of an existing Revyl test by id. Returns a task_id; poll with revyl_get_test_run.

Trigger an async run of a Revyl workflow (a sequence of tests).

Pre-flight a YAML test definition before creating it. Returns is_valid + per-line messages.

List recent runs of a workflow. Use to correlate against an incident time window.

Save a durable fact for future investigations of this project: terminology, infra/project structure, or a lesson from human feedback. Save when a human corrects you or teaches you something, and when you learn a stable fact the hard way (which repo owns a service, what a team-specific term means, how the infra is laid out). Memories are scoped to the current project and injected into every future run's prompt for it. Keep them short, general, and self-contained. Do not save incident-specific findings, secrets, or anything already in the memories list.

Search incidents in the active project (or project_id). Incidents are auto-grouped error/anomaly investigations; each row carries the agent's findings (agent_summary, root_cause_text) when available. Filter by status, severity, service, a free-text substring over title/codename, and a last_seen time window. Results are newest-activity-first. By default agent-classified noise (status='autoresolved_noise') is hidden; pass status='all' to include it or status='autoresolved_noise' to inspect just the noise pile. Use get_incident to drill into a single incident's linked issues and telemetry.

Change the default project for subsequent tool calls in this session. Persists for the lifetime of the access token.

Replace a dashboard's template-variable list. Pass the FULL set you want to keep — this overwrites the existing list (read the current one with get_dashboard first). Variables let one dropdown drive filters across many widgets: define a variable here, then point widget filters at it with value:"$name". Dashboard template variables — a named picklist that drives widget filters. Each entry is { name, options[], defaultValue?, label?, attributeKey? }. A widget filter references a variable by putting the token "$name" (or "${name}") in a filter value — e.g. resourceAttrs: [{ key: "deployment.envir…

Show or hide one of the built-in home widgets: setup_todos, active_incidents, service_map, incoming_signals, incident_count, or agent_pull_requests.

Overwrite the project's freeform context (max 8000 chars; longer input is truncated). This REPLACES the whole field — call get_project_context first and edit the returned text if you want to preserve existing content. Use for durable, system-level facts that apply to every investigation; for narrower learnings prefer create_agent_memory.

Start OAuth authorization-code authentication with discovery, PKCE, resource binding, and dynamic client registration when needed. Admin only. Open the returned authorizationUrl in a browser.

Connect to a configured MCP server, initialize the protocol, and list its tools. Admin only. Secrets are never returned.

Re-evaluate a saved alert against current data and return the result.

Update a project MCP server. Admin only. Omit auth to preserve its credential; supplying auth replaces it. A changed URL must be explicitly trusted.

Patch a stored memory. Provide only the fields you want to change. Set status='archived' to retire a memory without deleting it (archived memories stop being injected into investigations).

Patch an alert. Provide only the fields you want to change. Validation runs on the merged result.

Rename a dashboard.

Patch a widget's title, config, or layout. As with add_dashboard_widget, a filter value may reference a dashboard variable with the token "$name" (or "${name}").

Update positions and sizes for home items on the 12-column grid. Read get_home first and send the items that should move.

Update the issue filter. Each bucket you provide REPLACES that bucket; omit a bucket to leave it unchanged; pass [] to clear it. Use this to quiet recurring noise (add an exclude clause) or to scope investigations to specific services/routes (add an include clause). Call get_issue_filter first if you want to add to the existing rules rather than overwrite them.

Update or archive an existing memory by id (ids come from the memories list in your prompt or from list_memories). Use this instead of save_memory when a fact changed or turned out to be wrong — set status=archived to retire it.