Ingest New Documentation

docs/Netdata AI/MCP/MCP Connections.mdx

@@ -27,7 +27,7 @@ This is the reverse of connecting an AI client *to* Netdata. Here, **Netdata rea
 ## Configure a new integration
 
 1. Go to **Settings → AI → MCP Connections**.
-2. Select an integration, such as **GitHub**, or choose **Custom MCP Server** to point at your own HTTPS MCP endpoint.
+2. Select an integration, such as **GitHub**, or choose **Custom MCP Server** to point at your own HTTPS MCP endpoint (see [Custom MCP Server requirements](#custom-mcp-server-requirements)).
 3. Choose an authentication method (see [Authentication methods](#authentication-methods) below). The available options depend on the integration.
 
    ![Choose an authentication method](https://raw.githubusercontent.com/netdata/docs-images/refs/heads/master/netdata-cloud/netdata-ai/mcp-connections-auth.png)
@@ -114,3 +114,55 @@ See [Investigations](/docs/netdata-ai/investigations) and [Scheduled Reports](/d
 - **Read-only by design.** Only read-only tools can be enabled; mutating actions are never available through Netdata.
 - **OAuth respects your permissions.** With OAuth, each user authenticates individually and is limited to what they can already access in the connected system.
 - **Bearer tokens are Space-wide.** A bearer token is shared by everyone in the Space, so use it for providers where a shared, scoped access token is appropriate.
+
+## Custom MCP Server requirements
+
+The **Custom MCP Server** option accepts any MCP endpoint that meets the following:
+
+- **Transport:** Streamable HTTP over HTTPS. Any path works — Netdata uses the exact URL you configure. The optional standalone `GET` SSE stream isn't used, so the server must work without it.
+- **Authentication:** the token you provide is sent as `Authorization: Bearer <token>` on every request, including discovery. It is stored encrypted.
+- **TLS:** a publicly trusted certificate is required. Netdata validates against the system trust store — private CAs and self-signed certificates are rejected.
+- **Reachability:** the hostname must resolve to a public IP address. Loopback, private (RFC1918/ULA), link-local, CGNAT and multicast addresses are refused, both when you save the configuration and again before each connection.
+- **Redirects:** followed up to 10 hops, but every hop must stay HTTPS, resolve to a public IP, and remain on the same hostname — so your token is never forwarded to another host.
+- **Tool annotations:** only tools that advertise `annotations.readOnlyHint: true` in `tools/list` can be enabled. Read-only tools that omit the annotation are discovered but cannot be selected.
+
+Each MCP request has a 45-second timeout, and each tool result is truncated to 64 KiB before it reaches the model, so keep responses focused.
+
+## FAQ
+
+### Do MCP tool calls consume extra AI credits?
+
+No. There is no per-call or per-response charge.
+
+An investigation or scheduled report costs **1 AI credit when it completes**, no matter how many tools it calls. In conversations, tool results become part of the exchange, so a very verbose MCP server makes a conversation cost slightly more. See [Conversations](/docs/netdata-ai/conversations#ai-credits-consumption) and [Investigations](/docs/netdata-ai/investigations#availability-and-credits).
+
+### Does connecting a server consume credits?
+
+No. Connecting, authorizing and discovering tools never involve an AI model, so they cost nothing.
+
+### Is there a limit on how many tools an investigation may call?
+
+There is no fixed call count. Netdata AI decides which of the enabled tools to call, and how often, based on what it is investigating. Every investigation is bounded by its own time and context budget, so a run cannot loop indefinitely.
+
+### Can I choose which tools are available?
+
+Yes, at two levels:
+
+- **Per Space:** enable or disable each discovered tool, as in step 5 of [Configure a new integration](#configure-a-new-integration). Only enabled tools are ever offered to the model, and re-running discovery preserves your selections.
+- **Per conversation or report:** you pick which servers to include, up to 5 at a time — see [Using MCP servers](#using-mcp-servers). A connection is never used unless you select it.
+
+Selection is per *server*, not per *tool*: a single investigation cannot require or exclude an individual tool beyond what is enabled for the Space.
+
+### Can scheduled reports use MCP connections?
+
+Yes. The servers you select when you create the schedule are stored with it and reused on every run, exactly like an on-demand report.
+
+### Can I see which tools were used?
+
+In a conversation, yes: each tool call appears inline as it happens, with the tool and its result.
+
+Reports do not yet include a tool-call trace.
+
+### Which IP addresses does Netdata connect from?
+
+If your MCP endpoint is behind an IP allowlist, contact support for Netdata Cloud's current outbound addresses.

docs/Network Performance Monitoring/Device Metrics/Integrations/Palo Alto Networks PAN-OS.mdx

@@ -499,7 +499,7 @@ docker logs netdata 2>&1 | grep panos
 
 Verify that BGP is configured and that the account can run PAN-OS XML API operational requests.
 The collector logs when no legacy or Advanced Routing Engine BGP peer command returns peers.
-Advanced Routing Engine parsing is best-effort until validated with sanitized real PAN-OS ARE XML output.
+Advanced Routing Engine peers are parsed from the JSON payload embedded in the XML API result.
 
 
 ### Panorama proxy collection is unsupported

ingest/generated_sidebar_order.json

@@ -2,7 +2,7 @@
   "schema_version": 1,
   "source": "netdata/docs/.map/map.yaml",
   "source_sha256": "05122ef9d443a3bbbe202189d839b27c34108f2065ef11b1aa5a9747c858f16a",
-  "source_corpus_sha256": "c793af41d53ffd92207ccd5c9dd383df48d7758284cc471854ce6cdabdce7c42",
+  "source_corpus_sha256": "73ba294d93b4bbdfd3ab20cb396f01a2696b2e089653d7273b6fbb301585c639",
   "order": [
     {
       "parent_path": "Alerts & Notifications",
@@ -1720,5 +1720,5 @@
       "position": 170
     }
   ],
-  "full_ingest_identity_sha256": "bd53149198bafc2a67af6f8a474b92e2cf1746943af62f76e483dff261dbdeb5"
+  "full_ingest_identity_sha256": "9b0ef4dcce19e003a553a3614a9467918d55906a47f0513433171df2726fc363"
 }

ingest/generated_sidebar_order.json.sha256

@@ -1 +1 @@
-fc6abdb1d7e40d182fe235b651864d742004c7f0283111f6a0854b62ce8beb34  generated_sidebar_order.json
+e0ec159a79570722080f142b2d8a8887afebc6e950a5f827c6ebf32bc7e00758  generated_sidebar_order.json