Skip to main content

Use Cases & Example Prompts

Real-world scenarios showing how LLM clients can use the MCP tools to assist with infrastructure operations. Each scenario lists example prompts you can use directly with Claude Desktop, Cursor, or Claude Code.

Incident Response​

When an alert fires or users report issues, the LLM can help investigate by correlating logs, metrics, changes, and compliance state — all from a single conversation.

Scenario: Service outage on a production host​

"web-03.prod is returning 502 errors. What's going on?"

The LLM will typically chain multiple tools:

  1. get_host_details — check if the host is online, agent status, uptime
  2. get_host_metrics — look at CPU, memory, disk for spikes or exhaustion
  3. search_logs — search for errors around the time of the incident
  4. get_changes — check what changed recently on that host

Follow-up prompts:

"Show me CPU and memory usage on web-03.prod for the last 6 hours"
"Search for OOM or killed process logs on web-03.prod"
"What changed on web-03.prod in the last 24 hours?"
"Is nginx running on web-03.prod? What version?"

Scenario: Multiple hosts affected​

"Are any production hosts showing high CPU right now?"
"Show me all offline hosts in the staging environment"
"Compare web-01 and web-02 — are they configured the same?"

Scenario: Webhook delivery failures​

"Are our GitLab webhook deliveries failing?"
"Show me recent deliveries for the argocd-prod webhook source"
"List all webhook sources and their status"

Inventory Audit​

Use the LLM to explore and audit your infrastructure inventory — find hosts, check versions, spot inconsistencies.

Scenario: Environment inventory review​

"How many hosts do we have in production? Give me a summary by OS"
"List all hosts running Ubuntu 20.04 — we need to plan the upgrade to 22.04"
"Which hosts in the staging environment are offline?"

Scenario: Service discovery​

"Which hosts are running PostgreSQL? What versions?"
"Find all hosts running nginx in the acme-corp client"
"Is Redis running anywhere in production?"

Scenario: Host comparison and drift detection​

"Compare db-01 and db-02 — are they identical?"
"Get full details for web-01.prod including packages and open ports"
"Show me all hosts with agent version older than 0.4.0"

Compliance Review​

Review compliance posture across hosts, environments, or clients. Drill down from high-level scores to individual control evaluations.

Scenario: Executive compliance summary​

"What's the overall compliance score for the production environment?"
"Show me compliance scores for all clients"
"Which compliance frameworks are we using?"

Scenario: Finding and fixing compliance failures​

"What are the top 10 failing compliance controls in production?"
"Show me all failing compliance evaluations for web-01"
"Show me security-category compliance failures on db-01 with remediation steps"

Scenario: Compliance comparison across environments​

"Compare compliance scores between staging and production"
"Get compliance score for acme-corp client — how are they doing?"
"Are there any critical severity failing controls in the dev environment?"

Security Investigation​

Investigate vulnerabilities, review security findings, and check security-related compliance controls.

Scenario: Vulnerability assessment​

"Are there any critical CVEs on db-01?"
"Show me all high and critical security findings on web-01"
"Check web-03.prod for vulnerabilities — any new ones?"

Scenario: Security compliance posture​

"Show me security-category compliance failures across production"
"What security controls are failing on our database hosts?"
"Get compliance evaluations for web-01 filtered to just failures"

Change Tracking​

Understand what changed, when, and where — useful for post-incident reviews, audit trails, and change management.

Scenario: Recent change review​

"What changed across production in the last 7 days?"
"Show me all package installations on web-01 in the last 24 hours"
"Were there any critical severity changes in the staging environment today?"

Scenario: Post-incident timeline​

"Show me all changes on web-03.prod between 6 hours ago and now"
"What file modifications happened on db-01 in the last hour?"
"List all service changes across the production environment in the last 24 hours"

Log Analysis​

Search and analyze infrastructure logs using natural language. The LLM translates your intent into LogsQL queries.

Scenario: Error investigation​

"Search for error logs on web-01 in the last hour"
"Find any logs mentioning 'connection refused' on db-01"
"Are there any OOM killer logs across production?"

Scenario: Pattern detection​

"Search for authentication failure logs in the last 6 hours"
"Find logs mentioning disk space or disk full on any host"
"Show me the last 100 warning and error logs on web-03.prod"

Daily Operations Workflows​

Multi-step workflows that combine several tools for common operational tasks.

Morning infrastructure check​

"Give me a morning status report:
1. Any offline hosts?
2. Any hosts with CPU above 90%?
3. Any critical compliance failures?
4. Any webhook delivery errors?"

New host onboarding verification​

"I just added web-05.prod to the fleet. Can you verify:
1. Is it showing up in inventory?
2. Is the agent online?
3. What's its compliance score?
4. Are there any critical findings?"

Pre-maintenance review​

"I'm about to patch db-01. Before I start:
1. Show me its current status and metrics
2. What services is it running?
3. What's its compliance score?
4. Compare it with db-02 to make sure they match"

Client environment review​

"Give me a complete picture of the acme-corp client:
1. How many hosts do they have?
2. What's their compliance posture?
3. Any critical vulnerabilities?
4. Any recent high-severity changes?"

Tips for Effective Prompts​

  • Be specific about scope: "in production" or "for acme-corp" helps the LLM pick the right filters
  • Ask follow-up questions: The LLM remembers context — "now show me the details for that host" works
  • Request comparisons: "Compare X and Y" triggers the compare_hosts tool for structured diff output
  • Chain investigations: Start broad ("any issues in prod?") then drill down ("show me the logs for that host")
  • Use natural time ranges: "in the last hour", "over the past 7 days", "since yesterday"