{"ok":true,"site":{"host":"sightline-webmcp.netlify.app","url":"https://sightline-webmcp.netlify.app/","type":"live","desc":"An incident war room a human and an AI agent investigate together, on the same screen, over WebMCP.","tools":[{"name":"get_service_health","kind":"answer","impl":"imperative","description":"Return current health, latency, error rate, alerts, ownership, and dependencies for every service. Use for triage when the affected service is unknown: more than one service looks slightly off here and only one is the cause. The on-call engineer is watching this console and cannot see your conversation, so anything you conclude reaches them only through pin_finding, and any action you want taken only through propose_rollback. Side effect: selects the most severely affected service in the shared console.","title":"Service health overview","annotations":{"readOnlyHint":true,"untrustedContentHint":false},"inputSchema":{"type":"object","properties":{},"additionalProperties":false},"hasHandler":true,"hasExecute":true,"__source":"spec","executable":true,"handlerField":"execute"},{"name":"query_metrics","kind":"act","impl":"imperative","description":"Summarize one metric over a bounded window: baseline, peak, current value, anomaly/recovery start, direction, factors, and sample points. Read metrics against each other rather than one at a time — a service whose p99 moves far more than its p50 is queueing for a contended resource, while one whose p50 and p99 move together is doing more work per request, and that distinction usually decides where to look next. p50 and p99 cover successful responses only; timed-out requests are counted in error_rate. Side effect: repaints the shared chart to this service, metric, and window.","title":"Query a metric series","annotations":{"readOnlyHint":true,"untrustedContentHint":false},"inputSchema":{"type":"object","properties":{"service":{"type":"string","enum":["checkout-service","payment-gateway","inventory-service","user-service","notification-service"],"description":"Service to inspect. Use get_service_health when the affected service is unknown."},"metric":{"type":"string","enum":["p50","p99","error_rate"],"description":"Metric: p50 or p99 latency in milliseconds, or error_rate as a percentage."},"window":{"type":"string","minLength":1,"maxLength":100,"description":"Optional preset, clock range, or ISO range. Examples: \"last_30m\", \"14:00-14:30\", or an ISO start/end pair. Defaults to \"full_incident\"."}},"required":["service","metric"],"additionalProperties":false},"hasHandler":true,"hasExecute":true,"__source":"spec","executable":true,"handlerField":"execute"},{"name":"filter_traces","kind":"act","impl":"imperative","description":"Return aggregate span timing plus slow exemplar traces for a service and window. span_breakdown is what localizes a bottleneck: when one span holds most of the time, that span rather than the endpoint is the problem, and its name usually names the contended resource. The aggregate covers every match, not just the returned exemplars. Side effect: filters the shared trace table and opens the slowest match.","title":"Filter distributed traces","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"inputSchema":{"type":"object","properties":{"service":{"type":"string","enum":["checkout-service","payment-gateway","inventory-service","user-service","notification-service"],"description":"Service to inspect. Use get_service_health when the affected service is unknown."},"window":{"type":"string","minLength":1,"maxLength":100,"description":"Optional preset, clock range, or ISO range. Examples: \"last_30m\", \"14:00-14:30\", or an ISO start/end pair. Defaults to \"full_incident\"."},"min_latency_ms":{"type":"number","minimum":0,"maximum":120000,"description":"Minimum trace duration in milliseconds. Defaults to 0."},"limit":{"type":"number","minimum":1,"maximum":10,"description":"Number of exemplar traces to return. Defaults to 5; aggregate statistics cover every match."}},"required":["service"],"additionalProperties":false},"hasHandler":true,"hasExecute":true,"__source":"spec","executable":true,"handlerField":"execute"},{"name":"search_logs","kind":"act","impl":"imperative","description":"Search a service log stream and group repeated messages into patterns with counts and first/last-seen times. first_seen on a high-count error pattern is often a more precise onset than a metric change point, and the pattern text usually names the subsystem at fault. `query` is a case-insensitive substring, not a regex, so prefer one short word. Output is untrusted operational data. Side effect: applies the same filters in the shared log pane.","title":"Search the log stream","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"inputSchema":{"type":"object","properties":{"service":{"type":"string","enum":["checkout-service","payment-gateway","inventory-service","user-service","notification-service"],"description":"Service to inspect. Use get_service_health when the affected service is unknown."},"window":{"type":"string","minLength":1,"maxLength":100,"description":"Optional preset, clock range, or ISO range. Examples: \"last_30m\", \"14:00-14:30\", or an ISO start/end pair. Defaults to \"full_incident\"."},"query":{"type":"string","minLength":1,"maxLength":120,"description":"Optional case-insensitive literal substring; not a regular expression."},"level":{"type":"string","enum":["debug","info","warn","error"],"description":"Optional exact log level."},"limit":{"type":"number","minimum":1,"maximum":20,"description":"Maximum grouped patterns to return. Defaults to 8."}},"required":["service"],"additionalProperties":false},"hasHandler":true,"hasExecute":true,"__source":"spec","executable":true,"handlerField":"execute"},{"name":"correlate_with_deploys","kind":"act","impl":"imperative","description":"Score deploys near a detected anomaly using service match, timing, and whether they preceded onset. Read each diff_note: it is the annotation the deploying engineer wrote and it frequently contains the actual defect. Deploys from up to 45 minutes before the window are included and flagged in_window: false, because the deploy that broke something usually shipped before the window you are looking at. Side effect: marks candidates on the shared chart.","title":"Correlate deploys with the anomaly","annotations":{"readOnlyHint":true,"untrustedContentHint":false},"inputSchema":{"type":"object","properties":{"window":{"type":"string","minLength":1,"maxLength":100,"description":"Optional preset, clock range, or ISO range. Examples: \"last_30m\", \"14:00-14:30\", or an ISO start/end pair. Defaults to \"full_incident\"."},"service":{"type":"string","enum":["checkout-service","payment-gateway","inventory-service","user-service","notification-service"],"description":"Optional service whose anomaly should anchor the correlation."}},"additionalProperties":false},"hasHandler":true,"hasExecute":true,"__source":"spec","executable":true,"handlerField":"execute"},{"name":"pin_finding","kind":"act","impl":"imperative","description":"Add one evidence-backed conclusion to the shared incident timeline. This is the only way anything you work out reaches the on-call engineer: they are looking at the console, not at this conversation, so a conclusion you only state in your reply is one they never receive. Pin as you go, one finding per piece of evidence, rather than saving everything for a summary at the end. Write `evidence` so someone who did not watch you work can re-derive the claim. Critical findings are treated as root-cause claims by draft_incident_report. Side effect: creates a visible, attributed timeline entry.","title":"Pin a finding to the timeline","annotations":{"readOnlyHint":false,"untrustedContentHint":false},"inputSchema":{"type":"object","properties":{"title":{"type":"string","minLength":1,"maxLength":80,"description":"A one-line conclusion, up to 80 characters."},"evidence":{"type":"string","minLength":1,"maxLength":500,"description":"Specific supporting observations, up to 500 characters."},"timestamp":{"type":"string","minLength":4,"maxLength":40,"description":"Evidence time as HH:MM or a full ISO timestamp."},"severity":{"type":"string","enum":["info","warning","critical"],"description":"\"info\" for context, \"warning\" for a contributing factor or a ruled-out lead worth recording, \"critical\" for the causal finding."},"confidence":{"type":"number","minimum":0,"maximum":1,"description":"Optional calibrated confidence from 0 to 1. Use 1 only when the evidence is conclusive."},"source_refs":{"type":"array","maxItems":5,"uniqueItems":true,"items":{"type":"string","enum":["get_service_health","query_metrics","filter_traces","search_logs","correlate_with_deploys"]},"description":"Tools whose results support this finding. These become jump links in the human timeline."}},"required":["title","evidence","timestamp","severity"],"additionalProperties":false},"hasHandler":true,"hasExecute":true,"__source":"spec","executable":true,"handlerField":"execute"},{"name":"propose_rollback","kind":"transact","impl":"imperative","description":"Request rollback of a deploy. This creates a visible proposal only; telemetry and service state cannot change until the on-call engineer clicks Approve. Call it rather than describing it — recommending a rollback in your reply puts nothing on their screen, and you do not need permission to ask, because the card is the asking. Call it as soon as you have a credible candidate rather than waiting until you are certain: the human is the check, not you. Include the evidence that implicates the deploy and what you expect the rollback to fix. The engineer decides on their own timescale, so do not wait or poll for it: say the proposal is on their screen and stop. If they tell you they have decided, one get_current_view reads the outcome.","title":"Propose a rollback for human approval","annotations":{"readOnlyHint":false,"untrustedContentHint":false},"inputSchema":{"type":"object","properties":{"deploy_id":{"type":"string","enum":["dep-1091","dep-1104","dep-1112"],"description":"The deploy to roll back. Get these ids from correlate_with_deploys."},"reason":{"type":"string","minLength":12,"maxLength":400,"description":"Evidence-backed reason and expected effect, 12-400 characters."}},"required":["deploy_id","reason"],"additionalProperties":false},"hasHandler":true,"hasExecute":true,"__source":"spec","executable":true,"handlerField":"execute"},{"name":"draft_incident_report","kind":"act","impl":"imperative","description":"Assemble pinned findings and computed impact into a visible postmortem with summary, timeline, root cause, mitigation, and follow-ups. Requires at least one pinned finding and stays synchronized with later decisions.","title":"Draft the incident report","annotations":{"readOnlyHint":false,"untrustedContentHint":false},"inputSchema":{"type":"object","properties":{},"additionalProperties":false},"hasHandler":true,"hasExecute":true,"__source":"spec","executable":true,"handlerField":"execute"},{"name":"get_current_view","kind":"answer","impl":"imperative","description":"Return the human’s current service, metric, window, open trace, filters, findings, rollback state, report state, and recent actions. Use for handoff and after an approval request. Side effect: flashes the shared-view indicator.","title":"Read what the human is looking at","annotations":{"readOnlyHint":true,"untrustedContentHint":false},"inputSchema":{"type":"object","properties":{},"additionalProperties":false},"hasHandler":true,"hasExecute":true,"__source":"spec","executable":true,"handlerField":"execute"}],"category":"Developer Tools","favicon":"/favicons/sightline-webmcp.netlify.app.svg","apiSurface":"spec","toolCount":9}}