Loading ToolBench
MCP for OpenObserve with multi-instance support, batching, and parallel queries
Strong tool naming (all verb-first: search_, batch_, list_, get_) and comprehensive descriptions (150-300 chars each). Input schemas are well-defined with Zod validation visible in imports. However, output schemas are not formally documented in the code, only inferred from TypeScript types. Parameter descriptions are present but some lack constraint details (e.g., limit ranges, time format specifics). Error handling is basic; no recovery guidance or actionable error messages visible in handler implementations.
Execute multiple SQL log queries in parallel across OpenObserve instances and return all results together. Each query specifies its own instance, SQL, and time range. Useful for comparing data across instances or fetching related signals in a single round trip.
Fetch log records immediately before and after a specific timestamp in a stream. Returns up to size records centered on the anchor timestamp. Useful for viewing the context surrounding a known event without writing a SQL query.
Return the field names and data types for one or more log streams on an OpenObserve instance. Accepts a single stream name or an array; schemas are fetched in parallel. Results are cached for 10 minutes.
List the configured OpenObserve instances available to this server. Returns each instance's ID, name, URL, capabilities (logs, traces, metrics), and tags. Optionally filter by one or more tags or by a specific capability.
List all log streams available on one or more OpenObserve instances. Returns stream names, types, storage type, and document/storage statistics.
Output schemas not formally documented. TypeScript types exist (SearchLogsResult, GetStreamSchemaResult, etc.) but are not exposed in tool registration or descriptions. LLMs cannot predict response structure without explicit schema documentation.
Parameter constraints underspecified. 'limit' parameter lacks min/max bounds; 'startTime' and 'endTime' accept 'ISO 8601 or Unix ms' but no validation rules or examples shown. LLMs may pass invalid formats.
Error handling lacks recovery guidance. safeSerialize() catches oversized responses with a generic hint ('Use a narrower time range or add filters') but no tool-specific recovery paths. No categorization of retryable vs. fatal errors.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 63 | 2026-07-28+ | v2 |
Search log streams with SQL across one or more OpenObserve instances. Automatically applies the most efficient query strategy based on time range: raw fetch for ≤1 h, sampling for 1–6 h, hourly aggregation for 6 h–7 d, daily aggregation beyond 7 d. SQL supports =, !=, >, <, >=, <=, IS NULL, IS NOT NULL, AND, OR, NOT, COUNT, SUM, AVG, MIN, MAX, GROUP BY, ORDER BY, histogram(_timestamp). String values use single quotes; stream names use double quotes. match_all('text') performs full-text search across indexed fields with wildcard support (*). Do not add WHERE _timestamp filters — time range is handled by startTime and endTime parameters. Examples: SELECT * FROM "mystream" WHERE match_all('error*') | SELECT code, COUNT(*) FROM "mystream" GROUP BY code
Pagination not implemented for list_streams and list_instances. No limit, offset, or cursor parameters. Large result sets could exhaust context window.
No tool annotations (readOnlyHint, idempotentHint). All tools are read-only but this is not declared in schema. Agents cannot infer safety properties.