---
id: w2/m1/t002
title: Add a Logs verb to Core + expose over MCP
worker: worker2
status: done
estimate: 30m
depends_on: [w2/m1/t001]
---

## Objective

Give agents log access: add a `Logs` verb to `Core` (streaming pod logs for an App) and expose it as an MCP tool, so "why is my app failing?" is answerable without `kubectl`.

## Context

- `Core` today has no log verb; pod logs come from the app's Deployment pods (`app.bex.co/app=<name>` label selector).
- Pillar 3 names `logs` as one of the MCP verbs; keep it a `Core` method so REST/GraphQL can adopt it later for free.
- Least-privilege RBAC: the api/mcp ServiceAccount currently has App access only — `pods/log` read must be added.

## Steps

1. Add `Core.Logs(id, opts)` reading pod logs via the k8s client (tail + optional follow).
2. Register an MCP `logs` tool over it; stream or chunk lines back to the client.
3. Extend RBAC in `operator/config/` to allow `pods/log` get in `bex-system`.

## Files

- `operator/internal/api/core.go` · `operator/cmd/mcp/main.go` · `operator/config/` (RBAC)

## Acceptance criteria

- [ ] An MCP client can tail the last N log lines of a running App; RBAC grants only `pods/log`.

## Out of scope

- Historical/aggregated logs (no log store); metrics.
