Explore
What are the Explore tools for?
Eleven read-only MCP tools handle inventory: listing connected cloud accounts, searching resources, reading one resource in detail, checking whether discovery data is current, and tracing blast radius. All are tier 0, so an assistant can map an entire estate with no write access enabled.
Tools
| Tool | Access | Purpose |
|---|---|---|
get_blast_radius | read | Get what else is affected if you act on a resource — the dependency graph around a target |
get_cloud_account | read | Get details of a specific cloud account |
get_discovery_status | read | Get the status of the last resource discovery refresh |
get_discovery_summary | read | Get discovery summary showing resource counts by provider and type |
get_resource | read | Get full details of a single cloud resource by UID |
get_resource_count | read | Get the number of resources in the organisation, counting the SAME listable set list_resources enumerates — networking/dependent infrastructure (subnets, firewalls, peering, snapshots, replicas, pub/sub topics) is excluded, exactly as it is from list_resources |
get_resource_filters | read | Get the VALID filter values for this org's resources — call this before list_resources instead of guessing filter strings |
get_resource_overview | read | START HERE for any question about ONE cloud resource: 'why is this expensive', 'is this idle', 'what should I do about it' |
get_resource_summary | read | Get resource counts grouped by cloud provider and cloud account |
list_cloud_accounts | read | List connected cloud accounts (AWS/GCP/Azure) |
list_resources | read | List cloud resources (VMs, databases, clusters) across AWS/GCP/Azure |
Where to start
get_resource_overview and get_cost_overview are the two entry points across the whole tool
set. For inventory questions, get_resource_overview returns the shape of one resource (what
it is, what it costs, what fires on it) in a single call rather than three.
For breadth: list_resources with get_resource_filters to discover valid filter values first,
get_resource_count for totals, get_resource_summary for a grouped picture.
Knowing whether the data is current
get_discovery_status and get_discovery_summary matter more than they look. Discovery runs on
a cycle, so an assistant answering “how many instances do we have” should know whether the
inventory is an hour old or a day old. Without these, a confident answer can be quietly stale.
list_cloud_accounts and get_cloud_account cover which accounts are connected and how.
Blast radius
get_blast_radius is the one to reach for before any change. It returns what depends on a
resource, a severity class and a risk score: the same analysis the UI shows before you stop
something. An assistant that calls it before proposing a stop is doing the thing a careful
engineer would do.
Everything here is read-only
No tool in this category mutates. That is why an estate can be fully explored, mapped and reasoned about at the default org setting, with writes left off entirely.
Filters before queries
get_resource_filters returns the valid values for a given filter before you use it. Calling
list_resources with an invented provider or region string returns an empty set that looks
identical to “you have none”. Asking for the filter values first is what makes the difference
between an honest empty answer and a wrong one.
Explore tools: common questions
Can an assistant map my whole estate with writes disabled?
Yes. All eleven tools here read, so inventory, per-resource detail, discovery freshness and blast radius are fully reachable at the default read-only setting.
Why did list_resources come back empty?
Possibly because of an invented filter value. Call get_resource_filters first for the valid values, since a bad provider or region string returns an empty set that looks identical to genuinely having none.
How does an assistant know the inventory is current?
get_discovery_status and get_discovery_summary. Discovery runs on a cycle, so a confident instance count means little without knowing whether the data is an hour or a day old.