IBM Instana MCP Server

Unified Instana application resource manager for metrics, alerts, configurations, and catalog.

Resource Types:

• "metrics": Query application metrics, services, and endpoints
• "alert_config": Manage application-specific alert configurations
• "global_alert_config": Manage global application alert configurations
• "settings": Manage application configurations
• "catalog": Access application tag and metric catalog information
• "resources": Query application resources, services, endpoints
• "analyze": Analyze application traces and calls

CRITICAL WORKFLOW - ALWAYS FOLLOW THIS ORDER:

1. FIRST: Call get_metric_catalog to get valid metrics

• resource_type="catalog", operation="get_metric_catalog"
• Returns: Available metrics with metricId, aggregations, and data sources

2. SECOND: Call get_tag_catalog to get valid tag names

• resource_type="catalog", operation="get_tag_catalog"
• params: {"use_case": "GROUPING", "data_source": "CALLS"}

3. THIRD: Use ONLY the tag names and metrics returned from catalog operations

• Metric names must match those from get_metric_catalog
• Tag names must match those from get_tag_catalog
• NEVER guess or invent tag names or metric names

4. FOURTH: Call metrics operations with validated tag names and metrics

• Example invalid: "calls.error.count" (not in catalog)
• Example valid: "calls" with aggregation "SUM"

METRICS (resource_type="metrics"): operation: get_grouped_calls_metrics params: {time_frame, metrics, tag_filter_expression, group, order, pagination, include_internal, include_synthetic}

Aggregations: SUM, MEAN, MAX, MIN, P25, P50, P75, P90, P95, P98, P99, DISTINCT_COUNT, SUM_POSITIVE Operators: EQUALS, NOT_EQUAL, CONTAINS, NOT_CONTAIN, STARTS_WITH, ENDS_WITH, GREATER_THAN, GREATER_OR_EQUAL_THAN, LESS_THAN, LESS_OR_EQUAL_THAN, NOT_EMPTY, IS_EMPTY

time_frame: {"to": <timestamp_or_datetime>, "windowSize": <milliseconds>}

• to: Unix timestamp (ms) OR datetime string (e.g., "19 March 2026, 2:47 PM|IST")
• windowSize: Duration in milliseconds (default: 3600000 = 1 hour)

tag_filter_expression: CRITICAL - Entity field is REQUIRED for ALL tag filters

ENTITY FIELD VALUES:

"SOURCE" or "DESTINATION" → Tag identifies an infrastructure/service component (what/where: hosts, services, containers, databases, endpoints) (catalog hint: canApplyToSource/canApplyToDestination = true)

"NOT_APPLICABLE" → Tag describes call behavior or metadata (how/what happened: call metrics, trace properties, geo data, business context) (catalog hint: canApplyToSource/canApplyToDestination = false)

Never omit entity field or set to null - it is MANDATORY.

Examples:

• Entity component: {"type": "TAG_FILTER", "name": "service.name", "entity": "DESTINATION", ...}
• Call metadata: {"type": "TAG_FILTER", "name": "call.latency", "entity": "NOT_APPLICABLE", ...}
• Geographic: {"type": "TAG_FILTER", "name": "geo.country", "entity": "NOT_APPLICABLE", ...}

ALERT_CONFIG (resource_type="alert_config"): operations: find_active, find_versions, find, create, update, delete, enable, disable, restore, update_baseline params: {application_id OR application_name, id, alert_ids, valid_on, created, payload}

GLOBAL_ALERT_CONFIG (resource_type="global_alert_config"): operations: find_active, find_versions, find, create, update, delete, enable, disable, restore params: {application_id OR application_name, id, alert_ids, valid_on, created, payload}

SETTINGS (resource_type="settings"): operations: get_all, get, create, update, delete params: {resource_subtype, id, application_name, service_name, service_id, payload, request_body} resource_subtypes: "application"

Creating application (resource_subtype="application", operation="create"): REQUIRED: label | OPTIONAL: scope, boundaryScope, accessRules, tagFilterExpression Minimal: params={"resource_subtype": "application", "payload": {"label": "My App"}}

RESOURCES (resource_type="resources"): operations: get_applications, get_services, get_application_services, get_application_endpoints params: {application_id, service_id, endpoint_id, name_filter, types, technologies, application_boundary_scope, include_snapshot_ids}

get_applications - Get application perspectives params: {name_filter, application_boundary_scope} Returns: Paginated list of applications with their configurations and metadata

get_services - Get all services for application monitoring params: {name_filter, include_snapshot_ids} Returns: Paginated list of services across all applications

get_application_services - Get services for a specific application perspective params: {application_id, service_id, name_filter, application_boundary_scope, include_snapshot_ids} Returns: Paginated services filtered by application context

get_application_endpoints - Get endpoints for an application service params: {application_id, service_id, endpoint_id, name_filter, types, technologies, application_boundary_scope} Returns: Paginated endpoints with type and technology metadata

CATALOG (resource_type="catalog"): operations: get_tag_catalog, get_metric_catalog params: {use_case, data_source, var_from}

get_metric_catalog - Get application metrics catalog with metadata (metricId, label, aggregations, beaconTypes) get_tag_catalog - Get valid tag names for use_case and data_source Valid use_case: "GROUPING", "FILTERING", "SERVICE_MAPPING", "SMART_ALERTS" Valid data_source: "CALLS", "TRACES"

ANALYZE (resource_type="analyze"): operations: get_all_traces, get_trace_details, get_trace_groups

time_frame: {"to": <timestamp_or_datetime>, "windowSize": <milliseconds>}

• to: Unix timestamp in milliseconds OR datetime string (e.g., "19 March 2026, 2:47 PM|IST")
• If timezone not specified in datetime string, defaults to UTC
• windowSize: Duration in milliseconds (default: 3600000 = 1 hour)

get_all_traces - params: {payload} payload: {timeFrame, includeInternal, includeSynthetic, tagFilterExpression, pagination, order} timeFrame.to: Unix timestamp (ms) OR datetime string with timezone

get_trace_details - params: {id, retrievalSize, offset, ingestionTime} Returns: items, itemCount, canLoadMore, cursor for pagination

get_trace_groups - params: {payload} payload: {group, metrics, timeFrame, tagFilterExpression, pagination, order, includeInternal, includeSynthetic} NOTE: 'group' and 'metrics' are mandatory payload fields. The 'group' object must include 'groupbyTag' and 'groupbyTagEntity'. Supported groupbyTag values are 'trace.endpoint.name' and 'trace.service.name'. Allowed groupbyTagEntity values are 'NOT_APPLICABLE', 'DESTINATION', and 'SOURCE'.

CRITICAL: The "calls" metric is NOT supported for trace operations. Use "traces" or other trace-specific metrics. Use get_metric_catalog first to look up valid metric names and aggregations as described in the critical workflow.

Args: resource_type: "metrics", "alert_config", "global_alert_config", "settings", "catalog", "resources", or "analyze" operation: Specific operation for the resource type params: Operation-specific parameters (optional) ctx: MCP context (internal)

Returns: Dictionary with results from the appropriate tool

Examples: # CATALOG operations resource_type="catalog", operation="get_metric_catalog" resource_type="catalog", operation="get_tag_catalog", params={"use_case": "GROUPING", "data_source": "CALLS", "var_from": 1710658800000}

# METRICS operations resource_type="metrics", operation="get_grouped_calls_metrics", params={"metrics": [{"metric": "calls", "aggregation": "SUM"}, {"metric": "latency", "aggregation": "MEAN"}], "tag_filter_expression": {"type": "TAG_FILTER", "name": "application.name", "operator": "EQUALS", "entity": "DESTINATION", "value": "All Services"}, "group": {"groupbyTag": "service.name", "groupbyTagEntity": "DESTINATION"}, "time_frame": {"to": 1710658800000, "windowSize": 3600000}, "order": {"by": "calls", "direction": "DESC"}, "pagination": {"page": 1, "pageSize": 50}, "include_internal": False, "include_synthetic": False}

# ALERT_CONFIG operations resource_type="alert_config", operation="find_active", params={"application_name": "All Services", "alert_ids": ["alert-1", "alert-2"]} resource_type="alert_config", operation="find_versions", params={"application_id": "app-123", "id": "alert-456"} resource_type="alert_config", operation="find", params={"application_id": "app-123", "id": "alert-456", "valid_on": 1710658800000} resource_type="alert_config", operation="create", params={"application_id": "app-123", "payload": {"name": "High Error Rate", "severity": 5}} resource_type="alert_config", operation="update", params={"application_id": "app-123", "id": "alert-456", "payload": {"name": "Updated Alert"}} resource_type="alert_config", operation="delete", params={"application_id": "app-123", "id": "alert-456"} resource_type="alert_config", operation="enable", params={"application_id": "app-123", "id": "alert-456"} resource_type="alert_config", operation="disable", params={"application_id": "app-123", "id": "alert-456"} resource_type="alert_config", operation="restore", params={"application_id": "app-123", "id": "alert-456", "created": 1710658800000} resource_type="alert_config", operation="update_baseline", params={"application_id": "app-123", "id": "alert-456"}

# GLOBAL_ALERT_CONFIG operations resource_type="global_alert_config", operation="find_active", params={"application_name": "All Services"} resource_type="global_alert_config", operation="find_versions", params={"application_id": "app-123", "id": "alert-789"} resource_type="global_alert_config", operation="find", params={"application_id": "app-123", "id": "alert-789", "valid_on": 1710658800000} resource_type="global_alert_config", operation="create", params={"application_id": "app-123", "payload": {"name": "Global Alert"}} resource_type="global_alert_config", operation="update", params={"application_id": "app-123", "id": "alert-789", "payload": {"name": "Updated Global Alert"}} resource_type="global_alert_config", operation="delete", params={"application_id": "app-123", "id": "alert-789"} resource_type="global_alert_config", operation="enable", params={"application_id": "app-123", "id": "alert-789"} resource_type="global_alert_config", operation="disable", params={"application_id": "app-123", "id": "alert-789"} resource_type="global_alert_config", operation="restore", params={"application_id": "app-123", "id": "alert-789", "created": 1710658800000}

# SETTINGS operations resource_type="settings", operation="get_all", params={"resource_subtype": "application"} resource_type="settings", operation="get", params={"resource_subtype": "application", "application_name": "My App"} resource_type="settings", operation="create", params={"resource_subtype": "application", "payload": {"label": "My App", "scope": "INCLUDE_ALL_DOWNSTREAM", "boundaryScope": "ALL"}} resource_type="settings", operation="update", params={"resource_subtype": "application", "id": "config-123", "payload": {"label": "Updated App"}} resource_type="settings", operation="delete", params={"resource_subtype": "application", "id": "config-123"} resource_type="settings", operation="order", params={"resource_subtype": "application", "request_body": ["config-1", "config-2", "config-3"]}

# RESOURCES operations resource_type="resources", operation="get_applications", params={"name_filter": "My App"} resource_type="resources", operation="get_services", params={"name_filter": "My Service", "include_snapshot_ids": True} resource_type="resources", operation="get_application_services", params={"application_id": "app-123", "service_id": "svc-456", "name_filter": "API"} resource_type="resources", operation="get_application_endpoints", params={"application_id": "app-123", "service_id": "svc-456", "endpoint_id": "ep-789", "name_filter": "/api/users", "types": ["HTTP"], "technologies": ["Java"]}

# ANALYZE operations resource_type="analyze", operation="get_all_traces", params={"payload": {"timeFrame": {"windowSize": 3600000, "to": 1710658800000}, "includeInternal": False, "includeSynthetic": False, "pagination": {"retrievalSize": 200}}} resource_type="analyze", operation="get_trace_details", params={"id": "trace-123", "retrievalSize": 100, "offset": 0, "ingestionTime": 1725519793} resource_type="analyze", operation="get_trace_groups", params={"payload": {"group": {"groupbyTag": "trace.service.name", "groupbyTagEntity": "DESTINATION"}, "metrics": [{"metric": "traces", "aggregation": "SUM"}], "timeFrame": {"to": 1710658800000, "windowSize": 3600000}}}

Unified Instana automation action manager for catalog and execution history.

Resource Types:

• "catalog": Browse and search automation actions
• "history": View action execution history

CATALOG (resource_type="catalog"): operations: get_actions, get_action_details, get_action_matches, get_action_matches_by_id_and_time_window, get_action_types, get_action_tags

List all actions: operation="get_actions"

Get action details: operation="get_action_details", params={"action_id": "action-uuid"}

Search for matching actions: operation="get_action_matches" params:

• payload (required): dict with "name" and/or "description" fields
• target_snapshot_id (optional): snapshot ID to filter results Example: params={"payload": {"name": "CPU spends significant time waiting for input/output", "description": "Checks whether the system spends significant time waiting for input/output."}, "target_snapshot_id": "snapshot-id"}

Get action matches by ID and time window: operation="get_action_matches_by_id_and_time_window" params:

• application_id (optional): application ID (either this or snapshot_id required)
• snapshot_id (optional): snapshot ID (either this or application_id required)
• to (optional): timestamp - milliseconds OR datetime string (e.g., "19 March 2026, 2:47 PM|IST") If timezone not specified, defaults to UTC
• window_size (optional): time window in milliseconds Example: params={"application_id": "app-123", "snapshot_id": "snap-456", "to": "19 March 2026, 2:47 PM|IST", "window_size": 3600000}

Get action types: operation="get_action_types"

Get action tags: operation="get_action_tags"

HISTORY (resource_type="history") operations: list, get_details

List action instances: operation="list" params (all optional):

• window_size: time window in milliseconds
• to: timestamp - milliseconds OR datetime string (e.g., "19 March 2026, 2:47 PM|IST") If timezone not specified, defaults to UTC
• page: page number
• page_size: items per page
• target_snapshot_id: filter by snapshot ID
• event_id: filter by event ID
• event_specification_id: filter by event specification ID
• search: search text
• types: list of action types
• action_statuses: list of statuses (e.g., ["SUCCESS", "FAILED"])
• order_by: column name for sorting
• order_direction: "ASC" or "DESC" Example: params={"window_size": 3600000, "to": 1234567890000, "page": 1, "page_size": 50, "target_snapshot_id": "snapshot-id", "event_id": "event-id", "event_specification_id": "spec-id", "search": "search text", "types": ["type1", "type2"], "action_statuses": ["SUCCESS", "FAILED"], "order_by": "column_name", "order_direction": "ASC"}

Get action instance details: operation="get_details" params:

• action_instance_id (required): instance UUID
• window_size (optional): time window in milliseconds (default: 10 minutes)
• to (optional): timestamp - milliseconds OR datetime string (e.g., "19 March 2026, 2:47 PM|IST") If timezone not specified, defaults to UTC Example: params={"action_instance_id": "instance-uuid", "window_size": 600000, "to": "19 March 2026, 2:47 PM|IST"}

Args: resource_type: "catalog" or "history" operation: Specific operation for the resource type params: Operation-specific parameters (optional) ctx: MCP context (internal)

Returns: Dictionary with results from the appropriate tool

Examples: resource_type="catalog", operation="get_actions" resource_type="catalog", operation="get_action_matches", params={"payload": {"name": "CPU", "description": "monitoring"}} resource_type="catalog", operation="get_action_matches_by_id_and_time_window", params={"application_id": "app-123", "to": "19 March 2026, 2:47 PM|IST", "window_size": 3600000} resource_type="history", operation="list", params={"window_size": 3600000, "to": 1234567890000, "page_size": 20} resource_type="history", operation="get_details", params={"action_instance_id": "instance-uuid", "to": "19 March 2026, 2:47 PM|IST"}

Unified Instana custom dashboard manager for CRUD operations.

Operations: get_all, get, create, update, delete, get_shareable_users, get_shareable_api_tokens

Parameters (params dict):

• dashboard_id: Dashboard ID (for get, update, delete only)
• custom_dashboard: Dashboard config (for create, update) - see model below
• query: Search filter (for get_all)
• page_size: Items per page (for get_all)
• page: Page number, 0-indexed (for get_all)
• with_total_hits: Include total count (for get_all)

Note: get_shareable_users and get_shareable_api_tokens return ALL users/tokens globally, not for a specific dashboard

CustomDashboard Model:

• title: string (min 1 char) - REQUIRED
• accessRules: array[1-64] of {accessType: "READ"|"READ_WRITE", relationType: "USER"|"API_TOKEN"|"ROLE"|"TEAM"|"GLOBAL", relatedId: string|null} - defaults to global READ_WRITE if omitted
• widgets: array[0-128] of {id: string(max 64), type: string(min 1), config: object} - defaults to [] if omitted

Widget Fields (all optional except id, type, config): title (string), x (int 0-11), y (int >=0), width (int 1-12), height (int >=1)

Examples: get_all: operation="get_all", params={"page_size": 20, "query": "prod"} get: operation="get", params={"dashboard_id": "abc123"} create: operation="create", params={"custom_dashboard": {"title": "My Dashboard", "accessRules": [{"accessType": "READ_WRITE", "relationType": "GLOBAL"}], "widgets": []}} create with widget: operation="create", params={"custom_dashboard": {"title": "Metrics", "accessRules": [{"accessType": "READ_WRITE", "relationType": "GLOBAL"}], "widgets": [{"id": "w1", "type": "chart", "config": {"metric": "latency"}, "x": 0, "y": 0, "width": 6, "height": 4}]}} update: operation="update", params={"dashboard_id": "abc123", "custom_dashboard": {"title": "Updated", "accessRules": [{"accessType": "READ_WRITE", "relationType": "GLOBAL"}], "widgets": []}} delete: operation="delete", params={"dashboard_id": "abc123"}

Unified Instana events resource manager for events monitoring operations.

Operations:

• "get_events": Get all events
• "get_event": Get a specific event by ID
• "get_kubernetes_info_events": Get Kubernetes info events with detailed analysis
• "get_agent_monitoring_events": Get agent monitoring events with detailed analysis
• "get_events_by_ids": Get multiple events by their IDs

Parameters (params dict):

• For "get_event" and "get_events_by_ids", pass flat params:
• event_id: Event ID (required for get_event)
• event_ids: List of event IDs or comma-separated string (required for get_events_by_ids)
• For "get_kubernetes_info_events" and "get_agent_monitoring_events", pass flat params:
• from_time: Start timestamp - milliseconds OR datetime string (e.g., "19 March 2026, 2:47 PM|IST" or "19 March 2026, 2:47 PM") If timezone not specified in datetime string, defaults to UTC
• to_time: End timestamp - milliseconds OR datetime string (e.g., "19 March 2026, 2:47 PM|IST" or "19 March 2026, 2:47 PM") If timezone not specified in datetime string, defaults to UTC
• time_range: Natural language time range like "last 24 hours", "last 2 days"
• query: Optional query string for agent monitoring events
• max_events: Maximum number of events to process for analysis (optional, default 50) NOTE: This is a post-processing limit, not an API parameter
• For "get_events", pass a nested filters object:
• filters: Dictionary containing event filters.
• from_time: Start timestamp - milliseconds OR datetime string
• to_time: End timestamp - milliseconds OR datetime string
• time_range: Natural language time range like "last 24 hours", "last 2 days"
• query: Optional query string
• max_events: Maximum number of events to process for analysis (optional, default 50)
• filter_event_updates: Boolean flag to filter results to only show events with state changes within timeframe (optional, default True)
• exclude_triggered_before: Boolean flag to exclude events triggered before the timeframe (optional, default True) NOTE: This is a boolean flag, not a timestamp
• event_type_filters: List of event type filters (optional, e.g., ["INCIDENT", "ISSUE", "CHANGE"]). NOTE: Allowed values: INCIDENT, ISSUE, CHANGE. Invalid values will result in an error.
• entity_type: Affected entity type to filter by (optional)
• Allowed values (case-insensitive): "INFRASTRUCTURE", "SERVICE", "APPLICATION", "ENDPOINT"
• For infrastructure incidents (hosts, docker, kubernetes, etc.): Use "INFRASTRUCTURE"
• For application incidents: Use "APPLICATION"
• For service incidents: Use "SERVICE"
• For endpoint incidents: Use "ENDPOINT"
• entity_name: Affected entity name (category/type) to filter by (optional, supports partial matches)
• Examples: "Kubernetes Pod", "Kubernetes Deployment", "Process", "IBM MQ Subscription", "IBM MQ Queue Usage", "Service", "Application", "Endpoint"
• This represents the human-readable category/type of the entity, not the specific instance name
• entity_label: Specific entity instance identifier to filter by (optional, supports partial matches)
• Examples: "qotd-load/qotd-load-7fd7f4c4b8-46z7c", "recommendation-agent", "POST /pay/{id}", "All Services"
• This is the actual name/identifier of the specific entity instance
• state: Event state to filter by (e.g., "open", "closed", "manually closed") (optional)
• problem: Problem description to filter events by (e.g., "CPU usage high", "High error rate", "online") (optional)
• severity: Event severity to filter by (exact match only). (optional) NOTE: Allowed values (strict): -1 → change (informational events), 5 → warning, 10 → critical.
• event_specification_id: Filter events by event specification ID (optional)
• rca: Boolean flag to filter events by root cause analysis availability (optional)
• Set to true to return only events where probableCause.found is true (events with RCA)
• Set to false to return only events where probableCause.found is false or missing (events without RCA)
• If not provided, returns all events regardless of RCA status

Args: operation: Operation to perform params: Operation-specific parameters (optional) ctx: MCP context (internal)

Returns: Dictionary with results from the appropriate tool

Examples: operation="get_event", params={"event_id": "1a2b3c4d5e6f"} operation="get_kubernetes_info_events", params={"time_range": "last 24 hours", "max_events": 50} operation="get_agent_monitoring_events", params={"query": "Monitoring issue", "from_time": "19 March 2026, 2:47 PM|IST", "to_time": "20 March 2026, 2:47 PM|IST", "max_events": 100} operation="get_events", params={"filters": {"time_range": "last 24 hours", "event_type_filters": ["INCIDENT"], "entity_type": "service", "entity_name": "payment-service", "entity_label": "payment-service-v2", "state": "open", "problem": "High error rate", "severity": 10, "max_events": 50, "filter_event_updates": True, "exclude_triggered_before": False}} operation="get_events_by_ids", params={"event_ids": ["1a2b3c4d5e6f", "7g8h9i0j1k2l"]}

Unified Instana infrastructure resource manager for comprehensive infrastructure monitoring.

Resource Types:

• "analyze": Query infrastructure entity data with grouping or filtering
• "catalog": Get available plugins, metrics, and tags for infrastructure monitoring
• "resources": Get snapshot details and monitoring state

RECOMMENDED WORKFLOW FOR ANALYZE:

1. FIRST: Call get_plugins to discover available entity types

• Returns list of plugins with their IDs - these IDs are required for subsequent calls
• Example: [{"id": "plugin_name1", ...}, {"id": "plugin_name2", ...}]

2. SECOND: Call get_plugin_schema with a VALID plugin ID from step 1

• Combines get_metrics + get_tag_catalog into ONE efficient call
• IMPORTANT: Plugin ID must be from get_plugins - invalid IDs return HTTP 400
• Returns: {"metrics": ["memory.usage", ...], "tags": ["host.name", ...]}

3. THIRD: Use the discovered entity types, metrics, and tags in analyze operations

• Build queries with proper type, metrics, and tagFilterExpression
• The router auto-normalizes tagFilterExpression format to prevent HTTP 422 errors

ANALYZE (resource_type="analyze"): operations: get_entities, get_entity_groups params: {payload}

IMPORTANT AUTO-ROUTING: The router automatically detects the correct endpoint based on payload:

• If payload contains "groupBy" → automatically routes to get_entity_groups endpoint
• If payload does NOT contain "groupBy" → automatically routes to get_entities endpoint You can specify either operation, but the router will auto-correct based on payload content.

Aggregations: MAX, MEAN, MIN, SUM Operators: EQUALS, NOT_EQUAL, CONTAINS, NOT_CONTAIN, STARTS_WITH, ENDS_WITH, GREATER_THAN, GREATER_OR_EQUAL_THAN, LESS_THAN, LESS_OR_EQUAL_THAN

payload (required): Complete request payload as dictionary

• type (required): Entity type from get_plugins
• metrics (required): Array of metric objects
• metric (required): Metric name from get_metrics
• granularity (required): Time granularity in milliseconds (e.g., 3600000 for 1 hour)
• aggregation (required): Aggregation type (MAX, MEAN, MIN, SUM)
• timeFrame (required): Time range for query
• windowSize (required): Duration in milliseconds (e.g., 3600000 for 1 hour)
• to (optional): End timestamp in milliseconds (default: now)
• tagFilterExpression (optional): Filter expression for entities
• type: "TAG_FILTER" for single filter, "EXPRESSION" for multiple
• entity: "NOT_APPLICABLE" (required for TAG_FILTER)
• name: Tag name from get_tag_catalog
• operator: Filter operator (EQUALS, CONTAINS, etc.)
• value: Filter value
• logicalOperator: "AND" or "OR" (for EXPRESSION type)
• elements: Array of TAG_FILTER objects (for EXPRESSION type)
• pagination: Pagination settings
• retrievalSize: Number of items to retrieve (default: 200 for entities, 20 for groups)
• groupBy (optional, for get_entity_groups only): Array of tag names from get_tag_catalog
• order (optional, for get_entity_groups only): Ordering settings
• by: Field to order by (e.g., "label")
• direction: "ASC" or "DESC"

get_entities - Get individual infrastructure entities with metrics get_entity_groups - Get grouped infrastructure entities with aggregated metrics (requires groupBy parameter)

CATALOG (resource_type="catalog"): operations: get_plugins, get_plugin_schema, get_metrics, get_tag_catalog params: {plugin, filter}

get_plugins - Get all available entity types (plugins) in your Instana installation Returns: List of plugin IDs that can be used as entity types This is the FIRST step - discover what entity types are available in your environment

get_plugin_schema - Get complete schema (metrics + tags) for a plugin in ONE call (RECOMMENDED)

• plugin (required): Plugin ID from get_plugins (e.g., "host", "jvmRuntimePlatform")
• filter (optional): "builtin" or "custom" to filter metric types Returns: Dictionary with both metrics and tags for the plugin { "plugin": "host", "metrics": ["cpu.used", "memory.used", ...], "tags": {"host.name": {...}, "host.type": {...}, ...}, "summary": {"total_metrics": 50, "total_tags": 25} } This COMBINES get_metrics and get_tag_catalog into a single call

get_metrics - Get infrastructure metrics catalog for a specific plugin

• plugin (required): Plugin ID from get_plugins (e.g., "host", "jvmRuntimePlatform")
• filter (optional): "builtin" or "custom" to filter metric types Returns: List of metric names available for the plugin Use returned metric names exactly in analyze operations

get_tag_catalog - Get valid tag names for a specific plugin

• plugin (required): Plugin ID from get_plugins (e.g., "host", "kubernetesPod") Returns: Available tag names for filtering and grouping Use returned tag names exactly in analyze operations

RESOURCES (resource_type="resources"): operations: get_snapshot, get_snapshots params: {snapshot_id, to_time, window_size, query, from_time, size, plugin, offline, detailed}

get_snapshot - Get detailed information for a specific snapshot ID

• snapshot_id (required): The snapshot ID to retrieve details for
• to_time (optional): End timestamp in milliseconds
• window_size (optional): Window size in milliseconds Returns: Complete snapshot details including configuration, metrics, and state Use this when you have a specific snapshot ID and need its full details

get_snapshots - Search and discover multiple snapshots matching criteria

• query (optional): Search query string to filter snapshots
• from_time (optional): Start timestamp in milliseconds (default: 1 hour ago)
• to_time (optional): End timestamp in milliseconds (default: now)
• size (optional): Maximum number of results to return (default: 100)
• plugin (optional): Entity type to filter by (e.g., "host", "jvmRuntimePlatform")
• offline (optional): Include offline snapshots (default: false)
• detailed (optional): Return full raw data vs summarized (default: false) Returns: List of snapshots matching the search criteria Use this to discover entities, search infrastructure, or find components

Args: resource_type: "analyze", "catalog", or "resources" operation: Specific operation for the resource type params: Operation-specific parameters (optional)

Returns: Dictionary with results from the appropriate tool

Examples: resource_type="catalog", operation="get_plugins" resource_type="catalog", operation="get_metrics", params={"plugin": "host"} resource_type="catalog", operation="get_plugin_schema", params={"plugin": "host"} resource_type="catalog", operation="get_metrics", params={"plugin": "jvmRuntimePlatform", "filter": "builtin"} resource_type="catalog", operation="get_tag_catalog", params={"plugin": "host"} resource_type="analyze", operation="get_entities", params={"payload": {"type": "host", "metrics": [{"metric": "cpu.used", "granularity": 3600000, "aggregation": "MEAN"}], "timeFrame": {"windowSize": 3600000}}} resource_type="analyze", operation="get_entities", params={"payload": {"type": "jvmRuntimePlatform", "metrics": [{"metric": "memory.used", "granularity": 3600000, "aggregation": "MAX"}, {"metric": "threads.blocked", "granularity": 3600000, "aggregation": "MEAN"}], "timeFrame": {"to": 1743923995000, "windowSize": 3600000}, "tagFilterExpression": {"type": "TAG_FILTER", "entity": "NOT_APPLICABLE", "name": "host.name", "operator": "EQUALS", "value": "server1"}, "pagination": {"retrievalSize": 200}}} resource_type="analyze", operation="get_entity_groups", params={"payload": {"type": "kubernetesPod", "groupBy": ["kubernetes.namespace.name"], "metrics": [{"metric": "cpu.requests", "granularity": 3600000, "aggregation": "SUM"}], "timeFrame": {"windowSize": 7200000}, "tagFilterExpression": {"type": "EXPRESSION", "logicalOperator": "AND", "elements": []}, "pagination": {"retrievalSize": 20}, "order": {"by": "label", "direction": "ASC"}}} resource_type="resources", operation="get_snapshot", params={"snapshot_id": "abc123xyz"} resource_type="resources", operation="get_snapshots", params={"plugin": "host", "size": 50} resource_type="resources", operation="get_snapshots", params={"query": "high cpu", "from_time": 1617994800000, "to_time": 1618081200000, "detailed": true}

Unified Instana maintenance window manager for lifecycle management.

Resource Types:

• "window": Create, modify, close, and list maintenance windows
• "templates": Retrieve available maintenance window templates

WINDOW (resource_type="window"): operations: create, modify, close, list_active, list_scheduled, list_all, list_expired, bulk_create, validate

create - Create a new maintenance window Required: imap_code OR application_id, start_time Optional: end_time, duration_minutes, duration_hours, duration_days, reason, template, change_request_id, affected_services, notification_channels, use_tag_filter_expression, tag_name, rrule, until_date

modify - Modify an existing maintenance window Required: window_id Optional: end_time, duration_minutes, reason, rrule, until_date

close - Close and document a maintenance window Required: window_id Optional: completion_notes

list_active - List all currently active maintenance windows Optional: imap_code, application_id

list_scheduled - List all upcoming scheduled maintenance windows Optional: imap_code, application_id

list_all - List all maintenance windows (active, scheduled, and expired) Optional: imap_code, application_id

list_expired - List all expired/completed maintenance windows Optional: imap_code, application_id

bulk_create - Create maintenance windows for multiple applications at once Required: application_ids OR imap_codes, start_time Optional: duration_minutes, duration_hours, duration_days, reason, template, change_request_id, use_tag_filter_expression, tag_name

validate - Validate maintenance window parameters without creating Required: imap_code OR application_id, start_time Optional: duration_minutes, template

TEMPLATES (resource_type="templates"): operations: get

get - Retrieve all available maintenance window templates No parameters required

Args: resource_type: "window" or "templates" (default: "window") operation: Operation to perform (default: "list_scheduled") application_id: Single application ID (legacy support) application_ids: Comma-separated or JSON array of application IDs imap_code: Single IMAP code (e.g., "EAL-012512") imap_codes: Comma-separated or JSON array of IMAP codes window_id: Maintenance window ID (for modify/close) start_time: Start time (Unix timestamp ms or ISO string) end_time: End time (Unix timestamp ms or ISO string) duration_minutes: Duration in minutes (e.g., "120") duration_hours: Duration in hours (e.g., "2") duration_days: Duration in days (e.g., "1") reason: Reason/description for the maintenance window template: Template name ("deployment", "database_migration", "infrastructure_upgrade", "emergency", "routine") change_request_id: ServiceNow change request ID affected_services: Comma-separated or JSON array of service names notification_channels: Comma-separated or JSON array of channels completion_notes: Notes when closing a window use_tag_filter_expression: "true" or "false" tag_name: Tag name for filter expression rrule: Recurrence rule (RFC 5545) until_date: End date for recurring windows (ISO string) ctx: MCP context (internal)

Returns: Dictionary with results from the appropriate tool

Examples: # WINDOW operations - create (covers: imap_code, duration_minutes, duration_hours, template, recurring) resource_type="window", operation="create", imap_code="EAL-012471", start_time="1748786400000", duration_minutes="120", reason="Scheduled deployment" resource_type="window", operation="create", imap_code="EAL-012471", start_time="1748786400000", duration_hours="2", template="deployment", change_request_id="CHG0012345" resource_type="window", operation="create", imap_code="ORZ-000012", start_time="1748786400000", duration_minutes="30", rrule="FREQ=DAILY;INTERVAL=1", until_date="2026-06-17T23:59:59Z"

# WINDOW operations - modify (covers: duration_minutes, end_time, reason) resource_type="window", operation="modify", window_id="mw-789", duration_minutes="60" resource_type="window", operation="modify", window_id="mw-789", end_time="1748790000000", reason="Extended maintenance" resource_type="window", operation="modify", window_id="mw-789", duration_hours="3", rrule="FREQ=DAILY;INTERVAL=2"

# WINDOW operations - close (covers: with/without notes) resource_type="window", operation="close", window_id="mw-789" resource_type="window", operation="close", window_id="mw-789", completion_notes="Completed successfully" resource_type="window", operation="close", window_id="mw-789", completion_notes="Completed with issues - rollback performed"

# WINDOW operations - list_active resource_type="window", operation="list_active" resource_type="window", operation="list_active", imap_code="EAL-012471" resource_type="window", operation="list_active", application_id="app-123"

# WINDOW operations - list_scheduled resource_type="window", operation="list_scheduled" resource_type="window", operation="list_scheduled", imap_code="EAL-012471" resource_type="window", operation="list_scheduled", application_id="app-123"

# WINDOW operations - list_all resource_type="window", operation="list_all" resource_type="window", operation="list_all", imap_code="EAL-012471" resource_type="window", operation="list_all", application_id="app-123"

# WINDOW operations - list_expired resource_type="window", operation="list_expired" resource_type="window", operation="list_expired", imap_code="EAL-012471" resource_type="window", operation="list_expired", application_id="app-123"

# WINDOW operations - bulk_create resource_type="window", operation="bulk_create", imap_codes="EAL-012471,ORZ-000012", start_time="1748786400000", duration_hours="2", reason="Coordinated deployment" resource_type="window", operation="bulk_create", application_ids="app-123,app-456", start_time="1748786400000", duration_minutes="120", reason="Multi-app maintenance" resource_type="window", operation="bulk_create", imap_codes="EAL-012471,ORZ-000012", start_time="1748786400000", template="deployment", change_request_id="CHG0012345"

# WINDOW operations - validate resource_type="window", operation="validate", imap_code="EAL-012471", start_time="1748786400000", duration_minutes="120" resource_type="window", operation="validate", application_id="app-123", start_time="1748786400000", duration_hours="2" resource_type="window", operation="validate", imap_code="EAL-012471", start_time="1748786400000", template="deployment"

# TEMPLATES operations (covers: get templates) resource_type="templates", operation="get"

Unified Instana mobile app resource manager for beacon monitoring, catalog, configuration, and alert operations.

Resource Types:

• "analyze": Query mobile app beacon data with grouping or filtering
• "catalog": Get available metrics and tags for mobile app monitoring
• "configuration": Get mobile app configurations
• "advanced_config": Retrieve advanced configurations (geo-location, IP masking, geo rules, source map upload config, get_mobile_app_source_map_upload_config_by_id) - READ ONLY
• "alert": Get available alert configurations for mobile app monitoring
• "session_replay": Query mobile app session replay data

WORKFLOW DECISION: ├─ Are you using resource_type="analyze"? └─ YES → Adhere to ANALYZE WORKFLOW at all times when making decisions └─ NO → Ignore ANALYZE WORKFLOW entirely and adhere to resource description

ANALYZE WORKFLOW:

1. FIRST: Call get_mobile_app_metric_catalog to get valid metrics

• resource_type="catalog", operation="get_mobile_app_metric_catalog"
• Returns: Available metrics with metricId, aggregations, and beacon types

2. SECOND: Call get_mobile_app_tag_catalog to get valid tag names

• resource_type="catalog", operation="get_mobile_app_tag_catalog"
• params: {"beacon_type": "SESSION_START", "use_case": "FILTERING"}

3. THIRD: Use ONLY the tag names and metrics returned from catalog operations

• Tag names MUST start with "mobileBeacon." (e.g., "mobileBeacon.mobileApp.name")
• Metric names must match those from get_mobile_app_metric_catalog
• NEVER guess or invent tag names or metric names

4. FOURTH: Call analyze operations with validated tag names and metrics

• ALWAYS include "entity": "NOT_APPLICABLE" in EVERY TAG_FILTER

Default beacon_type: "SESSION_START" | Default use_case for get_all_mobile_app_beacons: "FILTERING"

ANALYZE (resource_type="analyze"): operations:

• get_all_mobile_app_beacons params: {time_frame, beacon_type, pagination, tag_filter_expression (optional), filter_fields (optional)}

• get_mobile_app_beacon_groups params: {time_frame, beacon_type, fill_time_series, pagination, tag_filter_expression (optional), metrics (optional), group (optional), order (optional)}

Aggregations: SUM, MEAN, MAX, MIN, P25, P50, P75, P90, P95, P98, P99, P99_9, P99_99, DISTINCT_COUNT, SUM_POSITIVE, PER_SECOND, INCREASE Operators: EQUALS, NOT_EQUAL, CONTAINS, NOT_CONTAIN, STARTS_WITH, ENDS_WITH, NOT_STARTS_WITH, NOT_ENDS_WITH, GREATER_THAN, GREATER_OR_EQUAL_THAN, LESS_THAN, LESS_OR_EQUAL_THAN, NOT_EMPTY, IS_EMPTY, NOT_BLANK, IS_BLANK, REGEX_MATCH

time_frame: {"to": <timestamp_or_datetime>, "windowSize": <milliseconds>}

• to: Unix timestamp in milliseconds OR datetime string (e.g., "19 March 2026, 2:47 PM|IST")
• If timezone not specified in datetime string, defaults to UTC
• windowSize: Duration in milliseconds (default: 3600000 = 1 hour)

tag_filter_expression: CRITICAL - Entity field is REQUIRED for ALL tag filters

• ALWAYS set "entity": "NOT_APPLICABLE" for ALL mobile app beacon tags
• This applies to ALL tags: mobileBeacon.mobileApp.*, mobileBeacon.view.*, mobileBeacon.device.*, mobileBeacon.geo.*, etc.
• The entity field is MANDATORY - never omit it or set it to null
• Tag names MUST start with "mobileBeacon." - get valid names from get_mobile_app_tag_catalog first

Examples:

• {"type": "TAG_FILTER", "name": "mobileBeacon.mobileApp.name", "operator": "EQUALS", "entity": "NOT_APPLICABLE", "value": "Robot Shop"}
• {"type": "TAG_FILTER", "name": "mobileBeacon.view.name", "operator": "EQUALS", "entity": "NOT_APPLICABLE", "value": "Products"}
• {"type": "TAG_FILTER", "name": "mobileBeacon.device.model", "operator": "EQUALS", "entity": "NOT_APPLICABLE", "value": "iPhone 12"}

filter_fields (optional, default: True):

• Controls which fields are included in each returned beacon.
• True / None / omitted — essential fields only
• False — all fields returned by the REST endpoint (unfiltered, larger payload)

get_all_mobile_app_beacons - Use for individual beacon data (e.g., "list all session start beacons") get_mobile_app_beacon_groups - Use for grouped/aggregated beacon metrics (e.g., "beacon count per mobile app")

CATALOG (resource_type="catalog"): operations: get_mobile_app_metric_catalog, get_mobile_app_tag_catalog params: {beacon_type, use_case}

get_mobile_app_metric_catalog - Get mobile app metrics catalog with necessary metadata for query planning (metricId, label, description, formatter, aggregations, beaconTypes). Use params.view="full" to retrieve raw SDK metadata (rarely needed).

get_mobile_app_tag_catalog - MUST CALL THIS FIRST before using any tag names Returns: List of valid tag names that start with "mobileBeacon." Valid beacon_type: "SESSION_START", "VIEW_CHANGE", "HTTP_REQUEST", "CUSTOM", "CRASH", "PERF", "DROP_BEACON" Valid use_case: "GROUPING", "FILTERING", "SERVICE_MAPPING", "SMART_ALERTS", etc.

Example call: resource_type="catalog", operation="get_mobile_app_tag_catalog", params={"beacon_type": "SESSION_START", "use_case": "FILTERING"}

CONFIGURATION (resource_type="configuration"): operations: get_all, get params: {mobile_app_id, mobile_app_name}

get_all - List all mobile apps get - Get mobile app by ID or name (supports name resolution)

NOTE: Create, Update, Delete operations are not available. Use the Instana UI for mobile app configuration modifications.

ADVANCED_CONFIG (resource_type="advanced_config"): operations: get_geo_config, get_ip_masking, get_geo_rules, get_source_map_upload_config, get_mobile_app_source_map_upload_config_by_id params: {mobile_app_id, mobile_app_name, config_id (for get_mobile_app_source_map_upload_configuration_by_id)}

NOTE: These are READ-ONLY operations for retrieving advanced configurations. Use the Instana UI for modifications. Source map operations are not currently available due to authentication limitations.

get_geo_config - Get geo-location configuration Returns: geoDetailRemoval setting and geoMappingRules array get_ip_masking - Get IP masking configuration Returns: ipMasking setting (DEFAULT ,STRICT ,REMOVE_ALL_DETAILS) get_geo_rules - Get custom geo mapping rules Returns: Array of geo mapping rules with CIDR ranges and location data get_source_map_upload_config - Get source map upload configuration details Returns: Source map upload configuration settings get_mobile_app_source_map_upload_config_by_id - Get specific source map upload configuration by ID Returns: Source map upload configuration settings for the specified ID

ALERT (resource_type="alert"): operations: find_active_mobile_app_alert_configs, find_mobile_app_alert_config params: {mobile_app_id, alert_ids, id, valid_on}

find_active_mobile_app_alert_configs - Get all alert configurations for a mobile app

• mobile_app_id: Mobile app ID to get alert configs for (required)
• alert_ids: Optional list of specific alert IDs to filter (optional)

find_mobile_app_alert_config - Get a specific alert configuration by ID

• id: Specific alert config ID to retrieve (required)
• valid_on: Unix timestamp to retrieve config valid at that time (optional, defaults to latest active version)

SESSION_REPLAY (resource_type="session_replay"): operations: get_session_replay_action_beacons params: {mobile_app_id (required), session_id (required), cursor (optional), page_size (optional)}

get_session_replay_action_beacons - Get paginated session replay action beacons by mobile app id and session id Required parameters:

• mobile_app_id: Mobile app ID that owns the session
• session_id: Session ID to retrieve action beacons for

Optional pagination parameters:

• cursor: Zero-based offset of the first beacon to return
• Use cursor=0 for the first page
• Do NOT treat cursor as a timestamp
• Use cursor=0 for the first page. If the response has hasMore=true, call again with cursor=nextCursor until hasMore=false.
• page_size: Maximum number of beacons to return in one request
• Use a small value like 1 for debugging
• Use a larger value like 100 for normal retrieval
• Maximum value of 1000

Response fields:

• beacons: List of action beacons returned for this page
• nextCursor: Offset to use in the next request
• hasMore: Whether more beacons remain after this page

PAGINATION RULES - FOLLOW EXACTLY:

1. Start with cursor=0.
2. Read the returned beacons.
3. If hasMore=true, call again with cursor=nextCursor.
4. Repeat until hasMore=false.
5. Combine all returned beacons in order.

PAGINATION EXAMPLE: First request: params={"mobile_app_id": "app-123", "session_id": "session-456", "cursor": 0, "page_size": 100}

Example response: {"beacons": [...], "nextCursor": 100, "hasMore": true}

Second request: params={"mobile_app_id": "app-123", "session_id": "session-456", "cursor": 100, "page_size": 100}

Final response example: {"beacons": [...], "nextCursor": null, "hasMore": false}

Args: resource_type: "analyze", "catalog", "configuration", or "advanced_config", "alert", "session_replay" operation: Specific operation for the resource type params: Operation-specific parameters (optional)

Returns: Dictionary with results from the appropriate tool

Examples: resource_type="catalog", operation="get_mobile_app_tag_catalog", params={"beacon_type": "SESSION_START", "use_case": "GROUPING"} resource_type="analyze", operation="get_mobile_app_beacon_groups", params={"metrics": [{"metric": "beaconCount", "aggregation": "SUM"}], "group": {"groupByTag": "mobileBeacon.view.name"}, "time_frame": {"to": "19 March 2026, 2:47 PM|IST", "windowSize": 3600000}, "beacon_type": "SESSION_START"} resource_type="analyze", operation="get_all_mobile_app_beacons", params={"time_frame": {"to": 1234567890000, "windowSize": 3600000}, "beacon_type": "SESSION_START", "pagination": {"retrievalSize": 50}, "filter_fields": True} resource_type="catalog", operation="get_mobile_app_metric_catalog" resource_type="configuration", operation="get_all" resource_type="configuration", operation="get", params={"mobile_app_name": "robot-shop"} resource_type="advanced_config", operation="get_geo_config", params={"mobile_app_name": "robot-shop"} resource_type="session_replay", operation="get_session_replay_action_beacons", params={"mobile_app_id": "i1IsNS7FQAegEljBTkNBMQ", "session_id": "1d616527-2635-407f-89fc-de7136b66fb4", "cursor": 10, "page_size": 100}

Unified releases manager for tracking deployments and analyzing release impact.

Operations: get_all_releases, get_release, create_release, update_release, delete_release

GET_ALL_RELEASES - List releases in time range with pagination and filtering params: from_time, to_time, name_filter, page_number, page_size Time params support: milliseconds (1742369820000) OR "datetime|timezone" ("19 March 2026, 2:47 PM|IST") name_filter: Filter releases by name (case-insensitive substring match) page_number: Page number (1-based, use with page_size) page_size: Results per page (default: 50)

GET_RELEASE - Get release by ID params: release_id (required) Returns: id, name, start, applications, services, scopes Use release.start with manage_applications/manage_events to analyze post-release performance/incidents

CREATE_RELEASE - Create new release params: name (required), start (required), applications, services name: Release identifier (e.g., "frontend/release-2000") start: Deployment timestamp - milliseconds OR "datetime|timezone" applications: [{"name": "app_name"}] services: [{"name": "service_name", "scopedTo": {...}}]

UPDATE_RELEASE - Update existing release params: release_id (required), name (required), start (required), applications, services Same format as create_release

DELETE_RELEASE - Delete release params: release_id (required)

Examples: # List all operation="get_all_releases"

# List with time range operation="get_all_releases", params={"from_time": "19 March 2026, 2:00 PM|IST", "to_time": "19 March 2026, 5:00 PM|IST"}

# List with name filter operation="get_all_releases", params={"name_filter": "frontend"}

# List with pagination operation="get_all_releases", params={"page_number": 1, "page_size": 50}

# List with all filters operation="get_all_releases", params={"from_time": "19 March 2026, 2:00 PM|IST", "to_time": "19 March 2026, 5:00 PM|IST", "name_filter": "release", "page_number": 1, "page_size": 20}

# Get by ID operation="get_release", params={"release_id": "l1wgr3DsQkGLf8u18JiGsg"}

# Create operation="create_release", params={"name": "frontend/release-2000", "start": "19 March 2026, 2:47 PM|IST", "applications": [{"name": "My App"}]}

# Update operation="update_release", params={"release_id": "l1wgr3DsQkGLf8u18JiGsg", "name": "frontend/release-2001", "start": 1742349976000}

# Delete operation="delete_release", params={"release_id": "l1wgr3DsQkGLf8u18JiGsg"}

Unified SLO manager for configurations, reports, alerts, and corrections.

CONFIGURATION (resource_type="configuration") - Operations: get_all, get_by_id, create, update, delete, get_tags get_all: List/filter configs - params: page_size (default: 10), page, order_by, order_direction, query, tag, entity_type, infra_entity_types, kubernetes_cluster_uuid, blueprint, slo_ids, slo_status, entity_ids, grouped, refresh, rbac_tags page_size: Number of items per page (default: 10) query: Filter by name or matching names (e.g., query="my-slo" to find SLOs with "my-slo" in name) get_by_id: Get config by ID - params: id (required), refresh create: Create config - params: payload (required) with name, entity, indicator, target (0.0-0.9999), timeWindow, tags entity: {type: "application", applicationId: "...", boundaryScope: "ALL"/"INBOUND"/"DEFAULT"} (boundaryScope REQUIRED) indicator: {type: "timeBased"/"eventBased", blueprint: "latency"/"availability", threshold: 100, aggregation: "P90"/"P95"} timeWindow: {type: "rolling"/"fixed", duration: 1, durationUnit: "week"/"day"/"hour"/"minute"} update: Update config (requires ALL fields) - params: id (required), payload (required, same as create) CRITICAL: MUST use ID (not name). Fetch via get_by_id first, merge changes, then update with complete payload delete: Delete config - params: id (required) get_tags: List tags - params: query, tag, entity_type

REPORT (resource_type="report") - Operations: get get: Generate SLO report - params: slo_id (required), var_from, to, exclude_correction_id, include_correction_id Returns: SLI value, SLO target, error budget (remaining/spent/total), burn rate, time range, charts Time params: var_from/to can be provided as:

• Unix timestamp in milliseconds (e.g., 1741604400000)
• Human-readable datetime string (e.g., "10 March 2026, 2:00 PM")
• Datetime with timezone (e.g., "10 March 2026, 2:00 PM|IST")
• If no timezone specified, UTC is assumed Supported datetime formats: "10 March 2026, 2:00 PM", "2026-03-10 14:00:00", "March 10, 2026 2 PM", etc.

ALERT (resource_type="alert") - Operations: find_active, find, find_versions, create, update, delete, disable, enable, restore find_active: Find active alerts - params: slo_id, alert_ids find: Get alert by ID - params: id (required), valid_on find_versions: Get alert versions - params: id (required) create: Create alert - params: payload (required) with name, description, sloIds, rule, severity, alertChannelIds, timeThreshold, customPayloadFields REQUIRED FIELDS: name, description, sloIds (list), rule, severity (5 or 10 ONLY), alertChannelIds (list), timeThreshold, customPayloadFields (list, can be empty) rule: {alertType: "ERROR_BUDGET", metric: "BURN_RATE"/"BURNED_PERCENTAGE"/"BURN_RATE_V2"} OR {alertType: "SERVICE_LEVELS_OBJECTIVE"} timeThreshold: {expiry: 604800000, timeWindow: 604800000} (values in milliseconds - NOT type/value format) customPayloadFields: [{type: "staticString", key: "foo", value: "bar"}] (use proper discriminated union types) threshold (optional): {type: "staticThreshold", operator: ">=", value: 20.0} (required for some alert types) burnRateTimeWindows (REQUIRED for BURN_RATE metric): {longTimeWindow: {duration: 1, durationType: "hour"}, shortTimeWindow: {duration: 5, durationType: "minute"}} update: Update alert (requires ALL fields) - params: id (required), payload (required, same as create) CRITICAL: MUST use ID (not name). Fetch via find first, merge changes, then update with complete payload delete: Delete alert - params: id (required) disable: Disable alert - params: id (required) enable: Enable alert - params: id (required) restore: Restore alert to version - params: id (required), created (required - timestamp from version)

CORRECTION (resource_type="correction") - Operations: get_all, get_by_id, create, update, delete get_all: List correction windows - params: page_size (default: 10), page, order_by, order_direction, query, tag, id, slo_id, refresh page_size: Number of items per page (default: 10) query: Filter by name or matching names (e.g., query="maintenance" to find corrections with "maintenance" in name) get_by_id: Get correction by ID - params: id (required) create: Create correction window - params: payload (required) with name, scheduling, sloIds, description, tags, active REQUIRED FIELDS: name, scheduling (with duration, durationUnit, startTime optional, recurrent optional, recurrentRule optional) scheduling: {duration: 1, durationUnit: "hour"/"day"/"week"/"month", startTime: <timestamp_or_datetime>, recurrent: true/false, recurrentRule: "..."} durationUnit: Must be one of: millisecond, second, minute, hour, day, week, month startTime: Can be provided as:

• Unix timestamp in milliseconds (e.g., 1741604400000)
• Human-readable datetime string (e.g., "10 March 2026, 2:00 PM")
• Datetime with timezone (e.g., "10 March 2026, 2:00 PM|IST")
• If no timezone specified, UTC is assumed
• CRITICAL: Always include timezone for correction windows to ensure accurate time context update: Update correction window - params: id (required), payload (required, same as create) CRITICAL: MUST use ID (not name). Always update by ID only delete: Delete correction window - params: id (required)

Examples: # Config: List all resource_type="configuration", operation="get_all"

# Config: Get by ID resource_type="configuration", operation="get_by_id", params={"id": "slo-123"}

# Config: Create resource_type="configuration", operation="create", params={"payload": {"name": "API SLO", "entity": {"type": "application", "applicationId": "app-123", "boundaryScope": "ALL"}, "indicator": {"type": "timeBased", "blueprint": "latency", "threshold": 100, "aggregation": "P90"}, "target": 0.95, "timeWindow": {"type": "rolling", "duration": 1, "durationUnit": "week"}, "tags": ["api"]}}

# Report: Get with datetime resource_type="report", operation="get", params={"slo_id": "slo-123", "var_from": "10 March 2026, 2:00 PM|IST", "to": "17 March 2026, 2:00 PM|IST"}

# Alert: Find active resource_type="alert", operation="find_active", params={"slo_id": "slo-123"}

# Alert: Create (all required fields) resource_type="alert", operation="create", params={"payload": {"name": "Burn Rate Alert", "description": "High burn rate", "sloIds": ["slo-123"], "rule": {"alertType": "ERROR_BUDGET", "metric": "BURN_RATE"}, "severity": 10, "alertChannelIds": ["ch-123"], "timeThreshold": {"expiry": 604800000, "timeWindow": 604800000}, "customPayloadFields": [{"type": "staticString", "key": "env", "value": "prod"}], "threshold": {"type": "staticThreshold", "operator": ">=", "value": 2.0}, "burnRateTimeWindows": {"longTimeWindow": {"duration": 1, "durationType": "hour"}, "shortTimeWindow": {"duration": 5, "durationType": "minute"}}}}

# Correction: List all resource_type="correction", operation="get_all"

# Correction: Create with datetime resource_type="correction", operation="create", params={"payload": {"name": "Maintenance", "scheduling": {"duration": 2, "durationUnit": "hour", "startTime": "12 March 2026, 1:47 AM|IST"}, "sloIds": ["slo-123"], "description": "Planned maintenance", "tags": ["maint"], "active": True}}

# Elicitation: Missing timezone # Input: resource_type="report", operation="get", params={"slo_id": "abc", "var_from": "10 March 2026, 2:00 PM"} # Response: {"elicitation_needed": True, "message": "I need timezone...", "missing_parameters": ["timezone"]}

# Elicitation: Missing alert fields # Input: resource_type="alert", operation="create", params={"payload": {"name": "Alert"}} # Response: {"elicitation_needed": True, "message": "I need...", "missing_parameters": [...]}

Unified Instana website resource manager for beacon monitoring, catalog, configuration and alert operations.

Resource Types:

• "analyze": Query website beacon data with grouping or filtering
• "catalog": Get available metrics and tags for website monitoring
• "configuration": Get website configurations
• "advanced_config": Retrieve advanced configurations (geo-location, IP masking, geo rules) - READ ONLY
• "alert": Get mobile app alert configurations

CRITICAL WORKFLOW: BEFORE calling analyze operations, you MUST call get_tag_catalog to get valid tag names. Default beacon_type: "PAGELOAD" | Default use_case: get_beacon_groups="GROUPING", get_beacons="FILTERING"

ANALYZE (resource_type="analyze"): operations: get_beacon_groups, get_beacons params: {metrics, group, tag_filter_expression, time_frame, beacon_type, fill_time_series, order, pagination}

Aggregations: SUM, MEAN, MAX, MIN, P25, P50, P75, P90, P95, P98, P99, P99_9, P99_99, DISTINCT_COUNT, SUM_POSITIVE, PER_SECOND, INCREASE Operators: EQUALS, NOT_EQUAL, CONTAINS, NOT_CONTAIN, STARTS_WITH, ENDS_WITH, NOT_STARTS_WITH, NOT_ENDS_WITH, GREATER_THAN, GREATER_OR_EQUAL_THAN, LESS_THAN, LESS_OR_EQUAL_THAN, NOT_EMPTY, IS_EMPTY, NOT_BLANK, IS_BLANK, REGEX_MATCH

tag_filter_expression: CRITICAL - Entity field REQUIRED for ALL tag filters. ALWAYS set "entity": "NOT_APPLICABLE" for website beacon tags. time_frame: {"to": <timestamp_or_datetime>, "windowSize": <milliseconds>} - Default: 3600000 (1 hour) to: Unix timestamp (ms) OR datetime string (e.g., "19 March 2026, 2:47 PM|IST")

Examples: metrics: [{"metric": "beaconCount", "aggregation": "SUM"}, {"metric": "onLoadTime", "aggregation": "P95"}] tag_filter_expression: {"type": "TAG_FILTER", "name": "beacon.page.name", "operator": "CONTAINS", "entity": "NOT_APPLICABLE", "value": "checkout"}

get_beacon_groups - Use for grouped/aggregated data (e.g., "beacon count per page") get_beacons - Use for individual beacon data (e.g., "list all page load beacons")

CATALOG (resource_type="catalog"): operations: get_metrics, get_tag_catalog params: {beacon_type, use_case}

get_metrics - Get website metrics catalog with necessary metadata for query planning (metricId, label, description, formatter, aggregations, beaconTypes). Use returned metricId values exactly; they are authoritative over examples. Use params.view="full" to retrieve raw SDK metadata (rarely needed). get_tag_catalog - Get valid tag names for beacon_type and use_case Valid beacon_type: "PAGELOAD", "PAGE_CHANGE", "RESOURCELOAD", "CUSTOM", "HTTPREQUEST", "ERROR" Valid use_case: "GROUPING", "FILTERING", "SERVICE_MAPPING", "SMART_ALERTS", etc.

CONFIGURATION (resource_type="configuration"): operations: get_all, get params: {website_id, website_name}

get_all - List all websites get - Get website by ID or name (supports name resolution)

NOTE: Create, Update, Delete operations are not available. Use the Instana UI for website configuration modifications.

ADVANCED_CONFIG (resource_type="advanced_config"): operations: get_geo_config, get_ip_masking, get_geo_rules params: {website_id, website_name}

NOTE: These are READ-ONLY operations for retrieving advanced configurations. Use the Instana UI for modifications. Source map operations are not currently available due to authentication limitations.

get_geo_config - Get geo-location configuration Returns: geoDetailRemoval setting and geoMappingRules array get_ip_masking - Get IP masking configuration Returns: ipMasking setting (DEFAULT, ANONYMIZE_IP, etc.) get_geo_rules - Get custom geo mapping rules Returns: Array of geo mapping rules with CIDR ranges and location data

ALERT (resource_type="alert"): operations: find_active_website_alert_configs, find_website_alert_config params: {website_id, alert_ids, id, valid_on}

find_active_website_alert_configs - Get all alert configurations for a website

• website_id: Website ID to get alert configs for (required)
• alert_ids: Optional list of specific alert IDs to filter (optional)

find_website_alert_config - Get a specific alert configuration by ID

• id: Specific alert configuration ID to retrieve (required)
• valid_on: Unix timestamp (ms) to retrieve the configuration active at that time (optional, default is latest active version)

Args: resource_type: "analyze", "catalog", "configuration", "advanced_config", or "alert" operation: Specific operation for the resource type params: Operation-specific parameters (optional)

Returns: Dictionary with results from the appropriate tool

Examples: resource_type="catalog", operation="get_tag_catalog", params={"beacon_type": "PAGELOAD", "use_case": "GROUPING"} resource_type="analyze", operation="get_beacon_groups", params={"metrics": [{"metric": "beaconCount", "aggregation": "SUM"}], "group": {"groupByTag": "beacon.page.name"}, "time_frame": {"to": "19 March 2026, 2:47 PM|IST", "windowSize": 3600000}, "beacon_type": "PAGELOAD"} resource_type="analyze", operation="get_beacons", params={"time_frame": {"to": 1234567890000, "windowSize": 3600000}, "beacon_type": "PAGELOAD", "pagination": {"retrievalSize": 50}} resource_type="catalog", operation="get_metrics" resource_type="configuration", operation="get_all" resource_type="configuration", operation="get", params={"website_name": "robot-shop"} resource_type="advanced_config", operation="get_geo_config", params={"website_name": "robot-shop"} resource_type="alert", operation="find_active_website_alert_configs", params={"website_id": "website-abc123"} resource_type="alert", operation="find_website_alert_config", params={"id": "alert-123", "valid_on": 1234567890000}