Get CPU utilization, core counts, and load averages.

Samples CPU for sample_seconds and reports utilization percentage, physical/logical core counts, 1/5/15-minute load averages, and load-per-core (values >= 1.0 indicate saturation).

Returns: str: Markdown summary or JSON object with keys: percent, sample_seconds, physical_cores, logical_cores, load_avg {1min,5min,15min}, load_per_core_1min, per_core_percent (optional).

Get RAM and swap utilization.

Returns: str: Markdown summary or JSON object with keys: virtual {total_gb,used_gb,available_gb,percent} and swap {total_gb,used_gb,percent}.

Get disk usage per partition, flagging any above a warning threshold.

Read-only mounts are listed but never flagged, since space cannot be reclaimed on them (Linux snap squashfs mounts sit at 100% by design).

Returns: str: Markdown summary or JSON object with keys: partitions (list of {mountpoint,device,fstype,total_gb,used_gb,percent,read_only,warning}), warnings (count), warn_percent.

List the top processes by CPU or memory consumption.

Returns: str: Markdown table or JSON object with keys: count, sort_by, processes (list of {pid,name,cpu_percent,memory_percent,username,started}).

Get network interfaces, their addresses, and I/O totals since boot.

Optionally includes TCP connection counts grouped by state, which is useful for spotting connection leaks or unexpected listeners.

Returns: str: Markdown summary or JSON object with keys: interfaces ({name: {is_up, addresses[]}}), io_totals {sent_gb,recv_gb}, tcp_states (optional {state: count}).

Test whether a TCP port is accepting connections.

Performs a TCP connect to host:port with a timeout. Useful for verifying a service is listening ("is Postgres up on 5432?") before deeper diagnosis.

Returns: str: One-line result: open, closed/refused, timed out, or DNS resolution failure, with latency when the port is open.

One-call health snapshot: hostname, uptime, CPU, RAM, swap, fullest disk.

The right first tool to call when asked "how is this box doing?" — it aggregates the key signals and gives a plain-language assessment, so follow-up tools only need to be called where something looks off.

Returns: str: Markdown summary or JSON object with keys: hostname, boot_time, uptime_hours, cpu_percent, memory_percent, swap_percent, max_disk_percent, assessment.

Read the last N lines of a log file, optionally filtered by substring.

For safety, reads are restricted to allowed log roots (default: /var/log) and capped at 500 lines. Symlinks are resolved before the check, so links pointing outside the allowed roots are rejected.

Returns: str: The matching log lines, or an actionable error message.