Dora NodaThe dashboard said nothing was wrong
Conventional application monitoring showed zero errors and nothing to investigate. Meanwhile, users were having a visibly degraded experience, and nobody could say why. The culprit turned out to be network conditions the app-layer monitors never looked at: shrinking TCP window sizes, climbing retransmit counts, zero-window stalls.
In a live deployment NETSCOUT describes, packet-level evidence — minimum window size, total retransmit count, zero-window event count — preserved exactly what happened across the wire. Fed to an AI assistant, that evidence let the model verify facts rather than infer reality from the absence of errors. No dashboard would have gotten there. A queryable evidence layer did.
That anecdote is the whole thesis behind NETSCOUT's September 2026 announcement: Model Context Protocol connectivity for its Omnis AI Insights solution, giving AI assistants and agents on-demand access to what the company calls AI-ready Smart Data — real-time operational evidence packaged for machine consumption rather than human dashboarding. A network observability vendor now sells "trusted context for agent decisions" as the product instead of charts.
Tenant agents operating apps on any platform will soon expect logs, metrics, and traces as callable tools, not screenshots. If your platform cannot serve that evidence natively, your tenants will wire a third-party vendor into the loop instead — and that vendor, not you, will own the operational truth about your own infrastructure.
What NETSCOUT actually shipped — and the three interface lessons in it
The September 22 announcement is the middle beat of a deliberate three-release September sequence: a Data Platform expansion on September 3, MCP connectivity on September 22, and the nGenius Copilot assistant capping the strategy. The sequencing matters. NETSCOUT built the evidence pipeline first, opened it to agents second, and shipped its own agent-facing assistant third. The protocol interface came before the vendor's own copilot.
Technically, the pipeline has two stages. Omnis Sensor performs semantic extraction at network vantage points, turning raw packet capture from the company's patented Adaptive Service Intelligence technology into compact metadata at the point of observation. Omnis Streamer then curates that output through customizable playbooks — with templates for healthcare, financial services, and telecom environments — and serves it three ways: streamed through Kafka, integrated into platforms like Splunk, ELK, Datadog, ServiceNow, and Dynatrace, and now on demand to AI assistants and agents through a built-in MCP server.
The framing quote from Phil Gray, NETSCOUT's AVP of product management, is unusually honest about the economics: the goal is a "compact, curated, trusted source of network truth rather than fragmented operational signals that suffer from hallucinations and high token spends." Raw telemetry is expensive for agents to consume and unreliable for them to reason over. Curated evidence is the product.
Strip away the vendor branding and there are three interface-shape lessons any platform should copy:
- Curate and compact evidence at the source, before it reaches the model. Enrichment at collection time — semantic extraction, context attachment, volume reduction — beats dumping raw telemetry into a context window and hoping the agent finds the signal.
- Serve it on-demand at agent runtime, not streamed-by-default. Streaming fits pipelines; agents work in request/response loops. An MCP tool the agent calls when it needs evidence matches how agents actually investigate.
- Ship guide tools, not just data access. NETSCOUT explicitly provides tools that steer agents toward the evidence that matters and help them interpret it. A raw query endpoint with no guidance is a footgun; a surface that teaches the agent what to ask is a product.
The checklist: a read-scoped MCP surface for your own telemetry stack
Here is the concrete payoff: the minimum MCP tool surface a self-hosted PaaS should expose over its own telemetry, so tenant agents get first-party evidence instead of reaching for a third-party vendor. Every tool below is read-only, tenant-scoped, and audit-logged — governed like any other agent tool, not bolted on as an afterthought.
| Signal | Tool | Query shape |
|---|---|---|
| Metrics | query_metrics | PromQL instant and range queries against the tenant's namespace, bounded time windows, capped series counts |
| Logs | search_logs | Loki filtered tail and historical search, tenant label enforced server-side, redacted secret patterns |
| Traces | get_trace | Tempo/Jaeger trace-by-ID lookup plus slow-trace search within the tenant's services |
| Alerts | list_alerts | Firing and recently-resolved alert rules with current state, same source the platform pages from |
| Deploys | get_deploy_status | Current rollout state per app: revision, progress, recent failures with timestamps |
| Fleet | get_fleet_health | Node pressure and capacity summary scoped to what the tenant is allowed to see |
Three governance properties apply to the whole surface. First, read-only by construction: these tools query, they never mutate, so the blast radius of a confused agent is a wasted investigation, not a deleted workload. Second, tenant scoping enforced server-side: the agent's identity resolves to a namespace or project, and every query is filtered there — the agent never sees a parameter it could tamper with to escape. Third, audit logging on every call: which agent asked what, when, and what it got back, retained like any other access log.
Note what this checklist deliberately excludes: no raw database access, no shell execution, no cluster-admin views. The NETSCOUT lesson is curation — the platform decides what evidence agents need and serves exactly that, compact and pre-interpreted, rather than handing agents the keys to Prometheus and wishing them luck.
September was the month MCP left the dev-tools ghetto
NETSCOUT did not act alone. September 2026 reads, in retrospect, as the month Model Context Protocol stopped being a developer-tools phenomenon and became every vendor's default agent interface:
- September 16: Google opened early access to a Home MCP server, letting Claude, ChatGPT, and other MCP-capable agents control smart-home devices, review camera summaries, and query home event history.
- September 22: NETSCOUT's Omnis MCP connectivity put packet-derived network evidence behind MCP tools.
- September 30: DocuSign's MCP server went generally available, exposing agreement intelligence and governed actions — powered by its Iris AI engine — to Claude, ChatGPT, Gemini, Copilot, Slack, and any MCP client.
Smart homes, packet capture, and contracts have nothing in common except the interface. That is precisely the point: MCP has become the USB-C port of agent capability, and vendors across unrelated domains all reached for the same connector in the same month.
The ecosystem numbers back the vibe. By March 2026 the protocol counted 97 million monthly SDK downloads and more than 10,000 active public servers, with OpenAI, Google DeepMind, Microsoft, and AWS all adopted. Anthropic donated MCP to the Agentic AI Foundation under the Linux Foundation in December 2025, co-founded with Block and OpenAI, neutralizing the governance. And the 2026 Stacklok State of MCP report found 41% of surveyed software teams already using MCP in production. This is not an experiment to watch. It is an installed base to interoperate with.
Why evidence beats dashboards for agents
The mechanism is straightforward. Agents cannot read screenshots — or rather, they can, badly and expensively, through vision models that turn a Grafana panel into a low-fidelity guess. Every incident workflow that today ends with "paste a screenshot into chat" is a workflow waiting to be replaced by a tool call returning structured evidence.
Raw telemetry has the opposite problem: too much fidelity at too high a price. A full Prometheus scrape or an unfiltered log tail burns context-window budget on noise, and the agent's conclusions degrade as the signal-to-noise ratio falls. NETSCOUT's "high token spends" line names the cost directly. Curated, compact, on-demand evidence is simultaneously cheaper and more accurate — the rare tradeoff that cuts both ways in your favor.
The market is already organizing itself around this shape. Grafana Labs ships an official open-source MCP server that lets agents search dashboards, run PromQL and LogQL, and read alert state — and it works against self-hosted Grafana 9.0+, which makes it the existence proof that a self-hosted telemetry stack can serve agents without buying a SaaS evidence vendor. Meanwhile the hyperscalers are building the consumer side: Azure SRE Agent and AWS DevOps Agent, both GA in March 2026, aggregate across observability platforms through a single agent interface. Producers on one side, aggregating consumers on the other, MCP in the middle. The hourglass is forming, and the waist is the protocol.
Ship it before your tenants route around you
Here is the consequence nobody in the press releases states outright. The moment tenant agents can call a third-party evidence vendor's MCP server, every platform without a native evidence surface becomes invisible to the agents operating on it. The agent will troubleshoot your tenant's app using Datadog's tools or NETSCOUT's tools or whoever the tenant connected — reasoning over evidence you neither curate nor govern, about infrastructure you own.
That is a worse outcome than building the surface yourself in every dimension that matters. You lose the curation decision: which signals agents see and how they are compacted. You lose the governance decision: scoping, audit, retention. And you lose the cost decision: evidence egress to a third party, then token spend on whatever shape it arrives in, instead of compact first-party answers served on demand.
The good news is that the checklist in this post is small. Six read-only tools over telemetry you already collect, scoped to identities you already manage, logged to pipelines you already run. NETSCOUT spent September proving that evidence-behind-MCP is a sellable product. For a self-hosted PaaS, it is table stakes — the difference between a platform agents can operate and a platform they route around.
Bex.co is the open-source, AI-native Render alternative — push a git repo, get a running HTTPS service on machines you own. Agents are first-class operators: machine-readable deploy state and fleet health are part of the platform, not a dashboard add-on. Star the repo on GitHub or deploy your first app today.
