Context

This issue tracks improvements to the SYSTEM_PROMPT constant in components/clp-mcp-server/clp_mcp_server/server/constants.py to provide more comprehensive guidance for LLM query generation.

Background

Discussion in PR #1401: #1401 (comment)

Improvements to address:

1. KQL Syntax specifics: Mention CLP's specific KQL syntax

   • Use double quotes for string values
   • Escape special characters
   • Reference: https://docs.yscope.com/clp/main/user-docs/reference-json-search-syntax.html

2. Auto-generated keys: Explain handling of auto-generated keys that are queryable but not returned in responses

3. File-level metadata: Consider if/how to mention file-level metadata queries (pending clp-json support)

4. Timestamp handling:

   • Specify timestamp granularity (Unix epoch in milliseconds/nanoseconds)
   • Clarify which key to use for timestamps
   • Address timezone considerations (see related issue about timezoneless timestamps)

5. Fuzzy match support: Clarify that CLP doesn't support fuzzy matches (e.g., "system error" won't match "system shutdown error")

6. Query validation: Evaluate if the current point about syntactic correctness actually improves query accuracy

Related

• PR feat(clp-mcp-server): Introduce session-based MCP capabilities: #1401
• User: @20001020ycx