Skip to main content
All tools are accessible via crcli mcp. The AI assistant discovers them automatically on connect — no manual configuration required.
Every tool returns a JSON object. The AI uses the returned data to answer follow-up questions without additional calls.

​
🔍 Identity & Context

Get the authenticated caller’s identity and active account scope.Returns is_admin (bool), account_id (UUID), and user_id (UUID).No parameters. Call this first to confirm which account is in scope.
Set the active tenant for all subsequent tool calls.Injected by crcli — not a server-side tool. Only available when connecting via crcli mcp.

​
👥 Accounts

These tools are admin-only and not available to customer accounts.
List all active accounts.Returns uuid, tenant (name), and display_name for each account. Use the uuid with account_id parameters on other tools to scope calls to a specific tenant.No parameters.

​
🖥️ Device Groups

List operational device groups for an account.Returns uuid, name, agent, account, platform, and status for each group. Only returns groups in an online, non-pending state.
Get full details for a single device group.Returns uuid, name, agent, account, platform, status, and credential state (locked, rotated).
List all devices that belong to a device group.Returns uuid, name, management_ip, platform, account, device_group, agent, and state (software version + HA status). Use state.status to identify active vs standby before running scripts.

​
📟 Devices

List all online devices for an account.Returns uuid, name, management_ip, platform, account, device_group, agent, and state.
Get full details for a single device, including software version and HA status (active / standby / standalone).
List UCS backups for a device in reverse-chronological order.Returns uuid, filename, status, and created_at for each backup.
List the metric catalog for a device’s platform (BIG-IP or F5OS).Returns metric names, descriptions, and units. Use the names with pull_device_metric or query_device_metrics.
Pull a single metric time series from a device. Defaults to the last hour.
Use query_device_metrics to fetch multiple metrics in a single request.
Fetch multiple metrics for a device in a single ClickHouse request. More efficient than multiple pull_device_metric calls.

​
⚙️ Orchestration

Orchestration tools require Write permission on the target device group.
Run a script on a single device via SSH and return the output.
Run a script on all devices in a group and return per-device output.
Upload a file to a device via SCP.
Upload a file to all devices in a group via SCP in parallel.
Download a file from a device via SCP.Returns file content as base64 (max 512 KB).

​
🔌 iControl REST

iControl REST tools require Write permission on the target device group. Always call delete_icontrol_session when done.
Authenticate to a device’s iControl REST API via the tunnel and return a session token.Returns session_id — pass this to icontrol_request and delete_icontrol_session.
Make an iControl REST API request to a device directly via the tunnel.
Invalidate an iControl session before it expires.Call this when done with icontrol_request to avoid leaving live credentials cached on the server.

​
🔎 Log Search

Log search tools are only available when log search is configured for your account.
The AI follows a mandatory workflow when answering log-related questions:
1

list_logtypes

Discover available log sources
2

get_schema

Learn the table structure and query rules
3

get_logtype_doc

Get field names and value shapes for the target log type
4

query_logs

Execute the SQL query — each response includes a query_id
5

submit_session

Record the investigation — called exactly once after answering
List all available F5 log types.Returns namespace, name, source, and description for each type.No parameters. Call this first to discover which log types exist before writing queries.
Get the ClickHouse logs table schema, column reference, mandatory filter rules, time-window guidance, and common query patterns.No parameters. Read this before writing any SQL query.
Get the field reference documentation for a specific log type — all LogAttributes keys, ResourceAttributes keys, SeverityText vocabulary, gotchas, and example queries.
Discover which LogAttribute keys are present in your account’s data for a log type, ranked by frequency over the past 7 days.
Fetch a small sample of recent log rows for a given log type, in descending timestamp order.
Execute a ClickHouse SELECT query against the F5 logs table.Returns rows as JSON with context.query_id — the AI records every query_id for submit_session.Rules enforced server-side: ServiceNamespace filter required, ServiceName filter required, bounded Timestamp window required, LIMIT required (max 10 000).
Record the completed log-search investigation for telemetry and quality improvement.Called exactly once after the AI answers (or fails to answer) a log-related question. Must include every query_id received from query_logs, sample_logs, or get_log_keys.

​
🤖 Agents

Admin-only. Not available to customer accounts.
List tunnel agents registered to an account.Returns uuid, name, and account for each online agent. Agents are the network proxies that relay SSH and iControl traffic to device groups.