Add TNF two-node fencing diagnostics toolset

build/evals.mk

@@ -7,8 +7,21 @@ MCP_CONFIG_DIR ?= dev/config/mcp-configs
 
 MCPCHECKER = $(shell pwd)/_output/tools/bin/mcpchecker
 MCPCHECKER_VERSION ?= latest
-EVAL_CONFIG ?= evals/openai-agent/eval.yaml
-EVAL_LABEL_SELECTOR ?= suite=kubernetes
+CLAUDE_AGENT_ACP_VERSION ?= latest
+
+# High-level knobs for local single-suite runs, e.g.:
+#   make run-evals SUITE=kubevirt AGENT=claude-code MODEL=sonnet
+# AGENT selects the eval config, SUITE selects the task suite label, and MODEL
+# sets ANTHROPIC_MODEL for the claude-agent-acp adapter (the openai-agent ignores it).
+AGENT ?= openai-agent
+SUITE ?= core
+MODEL ?=
+
+# Prefer a per-suite eval config when one exists: those carry no llmJudge, so a
+# local run needs no OpenAI key. Otherwise fall back to the agent's top-level
+# config (the one CI uses; its llmJudge requires an OpenAI key).
+EVAL_CONFIG ?= $(or $(wildcard evals/tasks/$(SUITE)/$(AGENT)/eval.yaml),evals/$(AGENT)/eval.yaml)
+EVAL_LABEL_SELECTOR ?= suite=$(SUITE)
 EVAL_TASK_FILTER ?=
 EVAL_VERBOSE ?= false
 
@@ -24,9 +37,20 @@ mcpchecker:
 
 ##@ Evals
 
+# Install the claude-agent-acp adapter, required by the claude-code eval agent
+# (evals/claude-code/agent.yaml runs `claude-agent-acp`). No-op if already present.
+.PHONY: claude-agent-acp
+claude-agent-acp: ## Install the claude-agent-acp adapter for the claude-code eval agent
+	@command -v claude-agent-acp >/dev/null 2>&1 || { \
+		set -e ;\
+		echo "Installing claude-agent-acp@$(CLAUDE_AGENT_ACP_VERSION) (npm install -g)..." ;\
+		npm install -g @agentclientprotocol/claude-agent-acp@$(CLAUDE_AGENT_ACP_VERSION) ;\
+		echo "✅ claude-agent-acp installed" ;\
+	}
+
 .PHONY: run-evals
-run-evals: mcpchecker ## Run mcpchecker evaluations against the MCP server
-	$(MCPCHECKER) check $(EVAL_CONFIG) \
+run-evals: mcpchecker $(if $(filter claude-code,$(AGENT)),claude-agent-acp) ## Run mcpchecker evals (knobs: SUITE, AGENT, MODEL; see evals/README.md)
+	$(if $(MODEL),ANTHROPIC_MODEL=$(MODEL) )$(MCPCHECKER) check $(EVAL_CONFIG) \
 		$(if $(EVAL_LABEL_SELECTOR),--label-selector $(EVAL_LABEL_SELECTOR),) \
 		$(if $(EVAL_TASK_FILTER),--run "$(EVAL_TASK_FILTER)",) \
 		$(if $(filter true,$(EVAL_VERBOSE)),--verbose,) \
@@ -52,20 +76,16 @@ diff-evals: mcpchecker ## Diff latest mcpchecker results against baseline
 .PHONY: run-server
 run-server: build ## Start MCP server in background and wait for health check
 	@echo "Starting MCP server on port $(MCP_PORT)..."
-	@if [ -n "$(MCP_LOG_FILE)" ]; then \
-		echo "Redirecting server logs to $(MCP_LOG_FILE)"; \
-		REDIRECT="> $(MCP_LOG_FILE) 2>&1"; \
-	fi; \
-	if [ -n "$(TOOLSETS)" ]; then \
-		eval "./$(BINARY_NAME) --port $(MCP_PORT) --toolsets $(TOOLSETS) --config-dir $(MCP_CONFIG_DIR) $$REDIRECT &" echo $$! > .mcp-server.pid; \
+	@if [ -n "$(TOOLSETS)" ]; then \
+		./$(BINARY_NAME) --port $(MCP_PORT) --toolsets $(TOOLSETS) --config-dir $(MCP_CONFIG_DIR) & echo $$! > .mcp-server.pid; \
 	else \
-		eval "./$(BINARY_NAME) --port $(MCP_PORT) $$REDIRECT &" echo $$! > .mcp-server.pid; \
+		./$(BINARY_NAME) --port $(MCP_PORT) & echo $$! > .mcp-server.pid; \
 	fi
 	@echo "MCP server started with PID $$(cat .mcp-server.pid)"
 	@echo "Waiting for MCP server to be ready..."
 	@elapsed=0; \
 	while [ $$elapsed -lt $(MCP_HEALTH_TIMEOUT) ]; do \
-		if curl -s http://localhost:$(MCP_PORT)/health > /dev/null 2>&1; then \
+		if curl -fsS http://localhost:$(MCP_PORT)/healthz > /dev/null 2>&1; then \
 			echo "MCP server is ready"; \
 			exit 0; \
 		fi; \

docs/README.md

@@ -29,6 +29,7 @@ Choose the guide that matches your needs:
 - **[OADP](OADP.md)** - Tools for OpenShift API for Data Protection (Velero backups, restores, schedules)
 - **[Kiali](KIALI.md)** - Tools for Kiali ServiceMesh with Istio
 - **[KubeVirt](kubevirt.md)** - KubeVirt virtual machine management tools
+- **[TNF](tnf.md)** - Two-Node Fencing diagnostics (pacemaker, STONITH, BMC health)
 
 ## Feature Specifications
 

docs/tnf.md

@@ -0,0 +1,114 @@
+# TNF (Two-Node Fencing) Support
+
+The `tnf` toolset extends the OpenShift MCP server with diagnostics for Two-Node Fencing clusters. These are 2-node bare metal OpenShift clusters that use pacemaker and STONITH for fencing to prevent split-brain scenarios.
+
+## Tools
+
+### tnf_check_fencing_config
+
+Validates fencing configuration and readiness for a TNF cluster. Checks cluster topology (platform, node count, TNF profile), critical operator health (etcd, machine-api, baremetal), Machine/Node/BareMetalHost correlation, BMC addresses and credential secrets, FenceAgentsRemediation templates and active remediations, and NodeHealthCheck resources. Returns a diagnostic summary identifying configuration issues that could prevent fencing from functioning correctly.
+
+**Arguments:**
+- `namespace` (optional): Namespace containing BareMetalHost resources (default: searches all namespaces)
+
+### tnf_check_stonith_status
+
+Creates a temporary privileged debug pod on a control-plane node to run `pcs` diagnostic commands. Returns pacemaker cluster state, STONITH device configuration, quorum status, and recent fencing history. The debug pod is automatically cleaned up after execution.
+
+**Arguments:**
+- `node` (optional): Name of the node to run diagnostics on (default: auto-detects the first control-plane node)
+- `namespace` (optional): Namespace to create the temporary debug pod in (default: `default`)
+- `timeout_seconds` (optional): Maximum time in seconds to wait for the diagnostic commands to complete (default: 120)
+
+## Prompt
+
+### tnf-troubleshoot
+
+Runs a full TNF fencing diagnostic workflow that collects cluster topology, node health, critical operator status, BareMetalHost/BMC health, pacemaker/STONITH status, and remediation operator status into a single structured report. Guides the LLM through analysis using the domain knowledge resource to assess split-brain risk and recommend actions.
+
+**Arguments:**
+- `node` (optional): Preferred node to run STONITH diagnostics from
+
+**Invoke in Claude Code:**
+```text
+/mcp__kubernetes-mcp-server__tnf-troubleshoot
+```
+
+## Resource
+
+### tnf://domain-knowledge/fencing
+
+Static reference material covering:
+- How two-node fencing works (corosync, pacemaker, STONITH)
+- Two-node quorum rules and `wait_for_all` behavior
+- Split-brain risk assessment matrix
+- Common issues and recovery procedures (STONITH disabled, BMC unreachable, node won't rejoin, quorum lost, fence race)
+
+## Enable the TNF Toolset
+
+### Option 1: Command Line
+
+```bash
+kubernetes-mcp-server --toolsets core,config,tnf
+```
+
+### Option 2: Configuration File
+
+```toml
+toolsets = ["core", "config", "tnf"]
+```
+
+### Option 3: MCP Client Configuration
+
+```json
+{
+  "mcpServers": {
+    "kubernetes": {
+      "command": "kubernetes-mcp-server",
+      "args": ["--toolsets", "core,config,tnf"]
+    }
+  }
+}
+```
+
+## Prerequisites
+
+TNF support requires:
+
+1. **Two-node bare metal OpenShift cluster** with pacemaker/STONITH fencing configured
+2. **BareMetalHost CRDs** installed (standard on bare metal clusters via the baremetal-operator)
+3. **Proper RBAC** for reading Nodes, BareMetalHosts, Secrets, and creating debug pods
+
+### Verify TNF Setup
+
+```bash
+# Check for 2-node bare metal cluster
+oc get nodes
+oc get infrastructure cluster -o jsonpath='{.status.platform}'
+
+# Check BareMetalHosts exist
+oc get baremetalhosts -A
+
+# Check pacemaker is running
+oc debug node/<node-name> -- chroot /host pcs status
+```
+
+## What It Diagnoses
+
+| Area | What's Checked |
+|------|---------------|
+| Cluster topology | Platform, node count, TNF profile detection |
+| Node health | Kubernetes Ready status, conditions |
+| BareMetalHost | Provisioning state, power status, BMC address |
+| BMC credentials | Secret existence, username/password keys present |
+| Pacemaker | Cluster name, online/offline/standby nodes |
+| STONITH devices | Configuration, agent type, target node, started status |
+| Quorum | Quorate status, vote count, two-node flags |
+| Fencing history | Recent fencing events, success/failure |
+| Remediation operators | FenceAgentsRemediation and NodeHealthCheck CRD status |
+
+## Limitations
+
+- **API must be reachable**: All tools depend on the Kubernetes API. When the API is unreachable (e.g. during a fencing event that takes down the API server), the tools detect the failure and return an out-of-band recovery guide with BMC access and manual diagnostic procedures instead of raw cluster data. The `tnf-troubleshoot` prompt integrates this fallback automatically.
+- **Read-only diagnostics**: The tools do not trigger, stop, or modify fencing operations.
+- **Debug pod privileges**: The STONITH check requires creating a privileged debug pod with host access (same as `oc debug node/<name>`).

evals/claude-code/eval.yaml

@@ -102,3 +102,13 @@ config:
             toolPattern: ".*"
         minToolCalls: 1
         maxToolCalls: 20
+    # TNF (Two-Node Fencing) tasks - requires 2-node bare metal cluster
+    - glob: ../tasks/tnf/*/*.yaml
+      labelSelector:
+        suite: tnf
+      assertions:
+        toolsUsed:
+          - server: kubernetes
+            toolPattern: "tnf_.*"
+        minToolCalls: 1
+        maxToolCalls: 10

evals/openai-agent/eval.yaml

@@ -102,3 +102,13 @@ config:
             toolPattern: ".*"
         minToolCalls: 1
         maxToolCalls: 20
+    # TNF (Two-Node Fencing) tasks - requires 2-node bare metal cluster
+    - glob: ../tasks/tnf/*/*.yaml
+      labelSelector:
+        suite: tnf
+      assertions:
+        toolsUsed:
+          - server: kubernetes
+            toolPattern: "tnf_.*"
+        minToolCalls: 1
+        maxToolCalls: 10

evals/tasks/tnf/check-fencing-config/task.yaml

@@ -0,0 +1,15 @@
+kind: Task
+metadata:
+  labels:
+    suite: tnf
+  name: check-fencing-config
+  difficulty: easy
+steps:
+  prompt:
+    inline: Check the fencing configuration for this Two-Node Fencing cluster. Verify that BareMetalHost resources exist, BMC credentials are valid, and the cluster topology matches a TNF profile.
+  verify:
+    contains: "BMC"
+  assertions:
+    toolsUsed:
+      - server: kubernetes
+        toolPattern: "tnf_check_fencing_config"

evals/tasks/tnf/check-stonith-status/task.yaml

@@ -0,0 +1,15 @@
+kind: Task
+metadata:
+  labels:
+    suite: tnf
+  name: check-stonith-status
+  difficulty: medium
+steps:
+  prompt:
+    inline: Check the pacemaker and STONITH status on this cluster. Report which STONITH devices are configured, whether they are started, and the current quorum status.
+  verify:
+    contains: "STONITH"
+  assertions:
+    toolsUsed:
+      - server: kubernetes
+        toolPattern: "tnf_check_stonith_status"

evals/tasks/tnf/diagnose-fencing-health/task.yaml

@@ -0,0 +1,15 @@
+kind: Task
+metadata:
+  labels:
+    suite: tnf
+  name: diagnose-fencing-health
+  difficulty: hard
+steps:
+  prompt:
+    inline: Perform a full fencing health assessment for this Two-Node Fencing cluster. Check the fencing configuration, STONITH status, and analyze whether there is any split-brain risk. Provide a summary with an overall health status and any recommended actions.
+  verify:
+    contains: "fencing"
+  assertions:
+    toolsUsed:
+      - server: kubernetes
+        toolPattern: "tnf_.*"

pkg/mcp/modules.go

@@ -13,5 +13,6 @@ import (
 	_ "github.com/containers/kubernetes-mcp-server/pkg/toolsets/oadp"
 	_ "github.com/containers/kubernetes-mcp-server/pkg/toolsets/openshift"
 	_ "github.com/containers/kubernetes-mcp-server/pkg/toolsets/tekton"
+	_ "github.com/containers/kubernetes-mcp-server/pkg/toolsets/tnf"
 	_ "github.com/rhobs/obs-mcp/pkg/toolset"
 )

pkg/mcp/testdata/toolsets-tnf-tools.json

@@ -0,0 +1,53 @@
+[
+  {
+    "annotations": {
+      "destructiveHint": false,
+      "idempotentHint": true,
+      "openWorldHint": false,
+      "readOnlyHint": true,
+      "title": "TNF: Check Fencing Config"
+    },
+    "description": "Check fencing configuration and readiness for a Two-Node Fencing (TNF) cluster. Validates cluster topology, critical operator health (etcd, machine-api, baremetal), Machine/Node/BareMetalHost correlation, BMC addresses and credentials, pacemaker/STONITH fencing status via Kubernetes resources. Returns a diagnostic summary identifying configuration issues that could prevent fencing from functioning correctly.",
+    "inputSchema": {
+      "properties": {
+        "namespace": {
+          "description": "Namespace containing BareMetalHost resources (e.g. 'openshift-machine-api'). If omitted, searches all namespaces.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "name": "tnf_check_fencing_config",
+    "title": "TNF: Check Fencing Config"
+  },
+  {
+    "annotations": {
+      "destructiveHint": false,
+      "idempotentHint": true,
+      "openWorldHint": false,
+      "readOnlyHint": true,
+      "title": "TNF: Check STONITH Status"
+    },
+    "description": "Check STONITH and pacemaker fencing status on a Two-Node Fencing (TNF) cluster. Creates a temporary privileged debug pod on a control-plane node to run pcs diagnostic commands. Returns pacemaker cluster state, STONITH device configuration, quorum status, and recent fencing history. The debug pod is automatically cleaned up after execution.",
+    "inputSchema": {
+      "properties": {
+        "namespace": {
+          "description": "Namespace to create the temporary debug pod in (optional, defaults to 'default').",
+          "type": "string"
+        },
+        "node": {
+          "description": "Name of the node to run diagnostics on. If omitted, auto-detects the first control-plane node.",
+          "type": "string"
+        },
+        "timeout_seconds": {
+          "description": "Maximum time in seconds to wait for the diagnostic commands to complete (optional, defaults to 120).",
+          "minimum": 1,
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    },
+    "name": "tnf_check_stonith_status",
+    "title": "TNF: Check STONITH Status"
+  }
+]

pkg/mcp/toolsets_test.go

@@ -23,6 +23,7 @@ import (
 	mgToolset "github.com/containers/kubernetes-mcp-server/pkg/toolsets/mustgather"
 	"github.com/containers/kubernetes-mcp-server/pkg/toolsets/openshift"
 	"github.com/containers/kubernetes-mcp-server/pkg/toolsets/tekton"
+	"github.com/containers/kubernetes-mcp-server/pkg/toolsets/tnf"
 	"github.com/modelcontextprotocol/go-sdk/mcp"
 	"github.com/stretchr/testify/suite"
 	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
@@ -182,6 +183,7 @@ func (s *ToolsetsSuite) TestGranularToolsetsTools() {
 		&kubevirt.Toolset{},
 		&tekton.Toolset{},
 		&clusterDiagnosticsToolset.Toolset{},
+		&tnf.Toolset{},
 	}
 	for _, testCase := range testCases {
 		s.Run("Toolset "+testCase.GetName(), func() {