An Agentic Framework for Real-Time Root Cause Analysis in Kubernetes via the Model Context Protocol - Designing and Evaluating an MCP-Grounded LLM Agent for Kubernetes Incident Triage in a ChatOps Environment

Sammanfattning

Root cause analysis in Kubernetes incident triage is fragmented across observabilitytools and operator expertise, and large language models proposed as diagnosticassistants typically lack a standardised mechanism for accessing live system state.This thesis investigates whether the Model Context Protocol (MCP) can be used toground a commercial language model in live Kubernetes telemetry, in collaborationwith an industry partner referred to as Company X.Following a Design Science Research process across three iteration cycles, the resulting artifact we developed, ARGUS, combines Claude Sonnet 4.6 with MCP-mediatedread-only access to Kubernetes, Prometheus, Loki, and NATS, retrieval-augmentedfew-shot context from past incidents, and an eARCO-structured prompt that drivesa ReAct investigation loop. The output is a structured RCA summary posted as aSlack thread reply to the incoming alert.ARGUS was evaluated on a dedicated test cluster through three complementarymethods: tool-trace analysis across ten controlled fault injection scenarios, a structured rubric scored independently by two raters and a third-party adjudicator, andsemi-structured interviews with six on-call engineers. The agent retrieved sufficientevidence to name the correct root cause in every scenario, with all observed tool-callfailures originating in the MCP infrastructure layer rather than in the agent’s reasoning. Rubric scores were strong on Correctness and Evidence backing and showeda clearly bounded weakness on Actionability, the only dimension on which any Notmet cell was returned. The interview themes converged on the same asymmetry:the diagnostic core of the output was trusted but the Recommended Fixes blockwas consistently questioned, and the tool’s value was largest where the responderwas least familiar with the affected subsystem or incident alert.The thesis contributes a working composition of existing components into an MCPgrounded RCA assistant deployed at an industrial site, a three-method evaluationdesign that separates evidence retrieval from reasoning quality and practitioner perception, and the load-bearing finding that the diagnostic reliability of such agentssits well ahead of their prescriptive reliability.