Observability skills for KubeSense, grouped by telemetry surface.
Skills
| Skill | Description |
|---|---|
| kubesense-mcp | The tool layer — connection, auth, the full tool inventory, the WHERE/field-name contract every query skill inherits. Start here. |
| kubesense-logs | Search and aggregate logs |
| kubesense-traces | Spans, latency percentiles, error rates, distributed-trace waterfalls |
| kubesense-metrics | PromQL/MetricsQL over Kubernetes, infrastructure and cloud-provider (AWS/GCP/Azure/Atlas/Confluent/Kong) metrics |
| kubesense-spl | SPL — the piped log query language, and its inverted field contract |
| kubesense-sql | Raw ClickHouse SQL over logs and traces — joins, CTEs, window functions |
| kubesense-infra | Cluster inventory: clusters, nodes, pods, workloads, infra failures, recent deploys |
| kubesense-alerts | List, investigate, and create alert rules; generate import JSON; migrate Datadog monitors |
| kubesense-dashboards | Create dashboards, or generate preset JSON to import |
| kubesense-slo | Create and manage service level objectives; error budgets, burn-rate alerting, Datadog SLO migration |
Routing
| The user is asking… | Skill |
|---|---|
| "show me errors / grep the logs" | kubesense-logs |
| "p99 latency / slow requests / which service is failing" | kubesense-traces |
| "CPU, memory, disk, saturation, capacity" | kubesense-metrics |
| "how is my RDS / EC2 / Azure VM / Atlas cluster doing" | kubesense-metrics |
| "what's running / why is this pod restarting / what changed" | kubesense-infra |
| "alert me when… / what's firing / convert this Datadog monitor" | kubesense-alerts |
| "build me a dashboard" | kubesense-dashboards |
| "track an SLO / error budget / port a Datadog SLO" | kubesense-slo |
| a query needing a join, CTE, or window function | kubesense-sql |
| "search the logs with a pipeline" / SPL tab | kubesense-spl |
| "this alert fired — what's wrong?" | kubesense-alerts, then kubesense-infra |
| a tool returned a field-name or WHERE error | kubesense-mcp |
Prerequisites
Every skill except kubesense-dashboards, kubesense-alerts and kubesense-slo
(which can generate JSON offline) needs the KubeSense MCP server connected. Those
three need it for their validate and create tools, and for discovering real metric and
field names — offline they fall back to JSON built from names the user supplies.
kubesense-slo has no MCP tools at all: it drives the REST API directly, and uses the
MCP query tools only to discover names.
The MCP server is served by kubeapi at /mcp over Streamable HTTP and authenticates
with the same credentials as the REST API.
claude mcp add --scope user --transport http kubesense \
https://<your-kubesense-host>/mcp \
--header "x-api-key: <your-api-key>"
See kubesense-mcp for auth alternatives and verification.
Two Rules That Apply Everywhere
-
Discover before querying. Never invent a field name, metric name, cluster name, or label. Every surface has a discovery tool; a guessed name either errors or — worse — returns an empty result that reads like "zero".
-
Field names are catalog labels, not storage columns. Logs/traces queries take
type,instance,service,method,status_code— notlevel,pod_name,app_service,subtype,return_code. The alert engine accepts a different set. See kubesense-mcp for the contract and kubesense-alerts for the divergence.
Install
npx skills add kubesense-ai/kubesense-mcp-skills --full-depth -y
[!IMPORTANT]
--full-depthis required. Without it the installer stops at this rootSKILL.mdand installs only this index — 1 skill instead of 11 — with no warning.If you are reading this as the only installed KubeSense skill, that is what happened. Re-run the command above with
--full-depth.
Verify with npx skills add kubesense-ai/kubesense-mcp-skills --list --full-depth, which
should report 11 skills. Or pick individual skills — see the README.