Description

Implement the foundational set of read-only NIDS diagnostic tools using native Go libraries (client-go). These tools provide safe, non-mutating inspection of Ingress and DNS resources on a live cluster. This execution replaces the previous CLI-wrapper approach with a robust, product-ready Go implementation.

Goals

1. Create, or adopt, a Go-based MCP server skeleton.
2. Implement inspection tools for Route, Service, Endpoints, and CoreDNS.
3. Ensure strict read-only execution.

Tool Definitions

1. query_prometheus

• Description: Run a Prometheus query_range query against the platform monitoring stack.
• Input Schema:

  {
    "type": "object",
    "properties": {
      "query": { "type": "string", "description": "PromQL expression" },
      "start": { "type": "string", "description": "RFC3339 timestamp" },
      "end": { "type": "string", "description": "RFC3339 timestamp" },
      "step": { "type": "string", "description": "Step duration (e.g., 30s)" }
    },
    "required": ["query", "start", "end", "step"]
  }
  

• Output Schema:

  {
    "status": "success/error",
    "data": {
      "resultType": "matrix/vector",
      "result": [ /* Prometheus result array */ ]
    }
  }
  

Implementation Steps

1. If not adopting an existing MCP server project, initialize Go Project:
   • Set up a new Go module/package for the NIDS tools.
   • Import net/http (for MCP), k8s.io/client-go, and controller-runtime (optional, for client convenience).
2. Implement query_prometheus:
   • Logic:
     • Discover the Thanos Querier route (namespace openshift-monitoring).
     • Obtain a Bearer Token (using the pod's ServiceAccount or the running user's context).
     • Execute the query against the Thanos API using a Go net/http client.
3. Constraint Checklist:
   • No usage of exec.Command("oc", ...) or exec.Command("dig", ...).
   • Must use structured error handling.

Acceptance Criteria

• MCP tool query_prometheus matches schema and successfully queries.
• All implementation is native Go (no shell-outs).