Skip to content

supported-tools.md

Latest commit

 

History

History
112 lines (82 loc) · 4.57 KB

supported-tools.md

File metadata and controls

112 lines (82 loc) · 4.57 KB
Raw

Supported Tools

  • Status: Reference
  • Version: current
  • Canonical for: supported tool matrix and adapter coverage
  • Audience: public

Evidra supports two related integration surfaces:

  • core evidence recording, which stores declared intent and outcomes
  • optional companion adapters, which may produce CanonicalAction
  • controller evidence sources, which emit reconcile lifecycle evidence without pretending to be artifact adapters

MCP DevOps Tools

When running evidra-mcp in DevOps server mode, the MCP surface stays intentionally small:

  • run_command for direct kubectl, helm, terraform, and aws operations
  • collect_diagnostics for one bundled Kubernetes diagnosis pass over a workload
  • write_file for agent-authored manifests or config files under the workspace or temp directories
  • describe_tool for loading the full schema of deferred protocol tools on demand
  • prescribe_smart, report, and get_event for explicit evidence control
  • optional prescribe_full when the server is started with --full-prescribe

The default workflow is still run_command plus auto-evidence. prescribe_smart and report remain available in the default tool list, but their full schemas are deferred until the agent calls describe_tool.

collect_diagnostics is not a new artifact adapter. It is a read-only MCP helper that reduces repeated get / describe / events / logs turns for common Kubernetes debugging workflows.

Kubernetes (k8s/v1)

Tool CLI flag Artifact Notes
kubectl --tool kubectl YAML manifest(s) Multi-doc YAML supported
Helm --tool helm Rendered templates (helm template output) K8s adapter parses the YAML
Kustomize --tool kustomize Build output (kustomize build output) K8s adapter parses the YAML
OpenShift (oc) --tool oc YAML manifest(s) Handles DeploymentConfig, Route, BuildConfig, ImageStream
ArgoCD rendered manifests --tool kubectl Rendered sync manifests Explicit rendered output still flows through the Kubernetes adapter

Legacy adapter note: companion canonicalizers may strip managedFields, uid, resourceVersion, creationTimestamp, last-applied-configuration, and other server-set fields before producing optional canonical_action.

Legacy detector note: detector output is not generated by the core prescribe write path. Use an external scanner/policy engine to supply assessment context.

Terraform (terraform/v1)

Tool CLI flag Artifact Notes
Terraform --tool terraform Plan JSON (terraform show -json) Extracts resource_changes

Artifact preparation:

terraform plan -out=tfplan
terraform show -json tfplan > plan.json

Legacy detector note: Terraform risk detection is companion/external assessment logic, not core write-path behavior.

Docker (docker/v1)

Tool CLI flag Artifact Notes
Docker --tool docker Container inspect JSON docker inspect output

Legacy detector note: Docker risk detection is companion/external assessment logic, not core write-path behavior.

Generic fallback (generic/v1)

Any tool not listed above can still be recorded through declared intent. Core recording computes artifact digest when bytes are supplied and does not require resource-level identity or domain-specific detectors.

For tools with structured output (Pulumi, Ansible, CDK), use --canonical-action only when you already have pre-built resource identity:

evidra prescribe \
  --tool pulumi \
  --operation update \
  --artifact state.json \
  --canonical-action '{"resource_identity": [...], "resource_count": 2, "operation_class": "mutate"}'

Adding tool support

Companion adapters historically implement the canon.Adapter interface:

type Adapter interface {
    Name() string
    CanHandle(tool string) bool
    Canonicalize(tool, operation, environment string, rawArtifact []byte) (CanonResult, error)
}

See internal/canon/ for existing adapter implementations.

GitOps / Controller Evidence Sources

Source Primary path What Evidra captures Notes
Argo CD Controller-first self-hosted integration Reconcile start/completion evidence, observed outcome, optional explicit prescription linkage Primary v1 GitOps story
Argo CD webhook /v1/hooks/argocd Mapped lifecycle events Supported push path; adjacent to controller mode

Argo CD does not currently ship as a dedicated argocd/v1 artifact adapter. When customers have rendered manifests, Evidra still recommends sending them through the Kubernetes path.