MCP server for querying Linux system metrics and systemd journal events with semantic search capabilities
Server has well-structured tool definitions with complete JSON schemas and clear descriptions. All 7 tools follow verb_noun naming (events_*, system_*) and include parameter descriptions. However, output schemas are not formally documented in the code, parameter constraints lack depth (e.g., no min/max for numeric limits), and error handling is minimal. Descriptions average ~100 chars, which is adequate but could be more prescriptive about when to use each tool vs. alternatives. No tool annotations (readOnlyHint, destructiveHint) despite all tools being read-only.
Return the most recent systemd journal events.
Return journal events within a window around a specific past time.
Search systemd journal events by substring (case-insensitive over message + unit).
Semantic search over systemd journal events using local embeddings. Finds entries by meaning, not just keyword.
Return the most recent system metrics sample (CPU %, memory, disk I/O counters, network bytes).
Return system metrics samples within a time range (each sample includes CPU %, memory, disk and network counters).
Return the processes currently using the most CPU or memory.
Output schemas not formally documented. Code shows Invoke() returns map[string]any with fields like 'events', 'count', 'anchor_at', but no JSON Schema definition is visible for return types. LLMs cannot plan downstream operations without knowing response structure.
Numeric parameters lack min/max constraints. 'limit' and 'since_seconds_ago' have no documented bounds. LLMs could pass absurd values (limit=999999, since_seconds_ago=-1) causing performance issues or errors.
No tool annotations despite all tools being read-only. Missing readOnlyHint in schema would help clients optimize caching and retry logic. Current spec supports tool annotations; none are present.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 50 | 2026-07-28+ | v2 |
Error messages are generic. Code shows 'mcp.ErrArg("query is required")' and 'mcp.ErrArg("seconds_ago must be > 0")' but no guidance on recovery. If semantic_search fails due to missing ollama client, error is 'ollama client unavailable; semantic search disabled', no suggestion to enable ollama or use keyword search instead.
Descriptions do not explain when to use each tool vs. alternatives. 'events_search' and 'events_semantic_search' both find events but differ in mechanism. No guidance on which to call first or when keyword search suffices vs. semantic search needed.