Catalog Tools

Tools for searching and exploring configuration items in the catalog.

list_catalog_types

List all available configuration types in the system.

Call this first — knowing the available types makes every subsequent search more accurate.

Example Usage

Prompt: "What configuration types are available?"

AI Response: "I'll list all the available configuration types for you."

Result: Returns a list of all configuration types like AWS::EC2::Instance, Kubernetes::Pod, Azure::VM::Instance, etc.

search_catalog

Search across the entire configuration catalog. Returns summaries — for the full config body, follow up with describe_catalog.

Field	Description	Scheme
query*	Search query using the supported grammar	ResourceSelector#search
limit	Number of items to return	number
select	Columns to return. Defaults to id,name,type,health,status,description,updated_at,created_at. Narrow this to keep responses small	[]string

Features:

• Supports complex filtering by type, name, namespace, labels, tags, health status, and dates
• Wildcard matching for flexible searches
• Date range queries with relative date math

Cross-agent searches

Searches are scoped to the local agent by default. Add agent=all to the query to search across every agent.

Example Usage

Prompt: "Find all unhealthy AWS EC2 instances"

AI Response: "I'll search for unhealthy AWS EC2 instances in your configuration catalog."

Query Used: type=AWS::EC2::Instance health=unhealthy

Result: Returns all EC2 instances that have an unhealthy status with details like instance ID, region, and other information.

---

Prompt: "Show me all Kubernetes pods in the production namespace created in the last 24 hours"

AI Response: "I'll find all Kubernetes pods in the production namespace that were created in the last 24 hours."

Query Used: type=Kubernetes::Pod namespace=production created_at>now-24h

Result: Returns recent pods with full resource data

describe_catalog

Return the complete record for a single config item, including its config body.

Field	Description	Scheme
id*	Config item ID (UUID) from search_catalog results	string

Each described config item includes an available_tools field listing the tools that can act on it. Those tools accept config_id=<id>.

Example Usage

Prompt: "Describe this deployment" (with config ID: 550e8400-e29b-41d4-a716-446655440000)

Result: Returns the full config item — its manifest, properties, labels, tags, health and the tools that can be run against it.

search_catalog_changes

Search configuration change events, either globally or for a config item and its related configs.

Field	Description	Scheme
config_id	Config UUID whose changes should be returned. Use instead of query	string
depth	Maximum related config traversal depth. Requires config_id and related. Defaults to 5	integer
limit	Number of results to return	number
query	Global search query. Required unless config_id is given	ResourceSelector#search
related	Traverse related configs. Requires config_id. Defaults to none	none | downstream | upstream | all
select	Columns to return. Avoid config, details and diff unless needed — they carry large JSON payloads	[]string
soft	Include soft relationships in the traversal. Requires config_id and related. Defaults to false	boolean

Features:

• Search by change-specific fields like severity, change type, and summary
• Same query syntax as search_catalog with additional change-related fields

Example Usage

Prompt: "Show me critical changes from the last week"

AI Response: "I'll search for critical severity changes that occurred in the last week."

Query Used: severity=critical first_observed>now-7d

Result: Returns critical configuration changes with details about what changed, when, and the impact severity.

---

Prompt: "Find the last 10 changes to AWS resources"

AI Response: "I'll find the most recent 10 changes made to AWS resources."

Query Used: type=AWS::* with limit=10

Result: Returns the 10 most recent changes to any AWS resources including the change type, summary, and affected resources.

get_related_configs

Find configurations related to a specific config item by relationships and dependencies.

Field	Description	Scheme
id*	Config item ID (UUID format)	string

Example Usage

Prompt: "What resources are related to this EC2 instance?" (with config ID: 550e8400-e29b-41d4-a716-446655440000)

AI Response: "I'll find all configurations related to this EC2 instance."

Result: Returns related resources like security groups, VPC, subnets, load balancers, and other dependent or associated AWS resources with their relationships explained.

Access tools

Tools for auditing who has access to a resource and how that access has been used. See Identity & Access.

search_catalog_access_mapping

Search the current access state and RBAC mappings for infrastructure resources, to audit who currently holds permissions.

Field	Description	Scheme
query*	Search query to filter config items by name or type e.g. type=Kubernetes::*, name=my-app	ResourceSelector#search
limit	Max results to return	number

Returns config item name and type, user email and type, assigned role, group name, and timestamps for last sign-in and last review.

Prompt: "Who has access to this app?"

search_catalog_access_log

Search historical sign-in and access activity for a specific config item.

Field	Description	Scheme
config_id*	Config item ID (UUID)	string
limit	Max results to return. Defaults to 50	number
user_id	External user ID (UUID) to filter by. Use resolve_external_user to find one by name or email	string

Returns a chronological log with user name and email, MFA status, total access count, and activity timestamp.

Prompt: "When was this resource last accessed, and was MFA used?"

search_catalog_access_reviews

Search access review and certification events, to verify when permissions were last audited.

Field	Description	Scheme
config_id	Config item ID (UUID). If omitted, searches across all configs	string
limit	Max results to return. Defaults to 50	number
since	How far back to search e.g. 90d, 30d, 24h. Defaults to 90d	Duration

Returns config item details, the reviewed user and role, the review source, and the certification timestamp.

Prompt: "Which resources haven't been access-reviewed in the last 90 days?"

Resolve tools

Turn a human-readable name into the UUID that the other tools expect. All three accept partial name matches.

resolve_config

Resolve a config item by ID or name to get its UUID, for use with describe_catalog, search_catalog_access_log and others.

Field	Description	Scheme
query*	Config item UUID or name to search for	string
limit	Max results to return. Defaults to 10	number
type	Config type filter e.g. Kubernetes::Deployment, AWS::EC2::Instance	string

resolve_external_user

Resolve an external user by ID, name or email to get their UUID and details, for use with the access audit tools.

Field	Description	Scheme
query*	User UUID, name or email to search for	string
limit	Max results to return. Defaults to 10	number

resolve_external_group

Resolve an external group by ID or name to get its UUID and details.

Field	Description	Scheme
query*	Group UUID or name to search for	string
limit	Max results to return. Defaults to 10	number