Demo Audit Tracker Update Code Review

# tracker_auditor.py
"""Unified FinOps agent: audit cluster labels via K8s MCP and post tickets via tracker MCP."""
import asyncio
from pathlib import Path

from mcp_client import run_agent

# Keep the tool surface small so the agent spends steps on create_issue, not discovery.
ALLOWED_TOOLS = {"kubectl_get", "create_issue", "list_issues"}

PROMPT = """
You are a FinOps agent with Kubernetes kubectl_get and issue tracker tools (create_issue, list_issues).

Execute this exact plan — do not invent extra discovery steps:

Step 1 — Collect (1 kubectl_get call only):
 - kubectl_get resourceType=deployments namespace=payment output=json

Step 2 — Evaluate labels on each Deployment against the tagging rules.
A required tag is missing when NONE of its label_mappings keys appear on the resource.

Step 3 — For EVERY non-compliant Deployment, call create_issue (one call per resource).
Required fields:
 - title: "[FinOps] {namespace}/{resource_name} - {CATEGORY}"
 - summary, body, namespace, resource_name, resource_kind
 - category: missing-owner | unallocated | orphaned | missing-labels
 - priority: critical | high | medium | low
 - suggested_owner, suggested_cost_center, reasoning
 - source: "mcp-llm-agent"

Step 4 — Call list_issues once and stop.

Hard rules:
 - Follow Step 1's scope exactly — do not invent extra kubectl_get calls.
 - Do not fetch configmaps, PVCs, or individual resources by name.
 - Do not write a plain-English audit report instead of creating tickets.
 - Your run is a failure if you end without at least one create_issue call when
   non-compliant Deployments exist in the scoped result set.
"""

TAGGING_RULES_PATH = (
    Path(__file__).parents[2] / "07-llm-structured-agent" / "config" / "tagging-rules.yaml"
)

def load_tagging_rules() -> str:
    if TAGGING_RULES_PATH.exists():
        return TAGGING_RULES_PATH.read_text()
    return ""

async def main() -> None:
    result = await run_agent(
        PROMPT,
        tagging_rules=load_tagging_rules(),
        max_tokens=4096,
        allowed_tools=ALLOWED_TOOLS,
    )

    print(result)
    print("\n--- Done. Verify tickets at http://localhost:8085 ---")

if __name__ == "__main__":
    asyncio.run(main())

# mcp_client.py (excerpt)
from dotenv import load_dotenv
import os
from pathlib import Path

load_dotenv(Path(__file__).parents[3] / ".env")

K8S_MCP_URL = os.getenv("K8S_MCP_URL", "http://localhost:8000/mcp")
TRACKER_MCP_URL = os.getenv("TRACKER_MCP_URL", "http://localhost:8086/sse")

MCP_SERVERS = {
    "k8s": {
        "url": K8S_MCP_URL,
        "transport": "streamable_http",
    },
    "tracker": {
        "url": TRACKER_MCP_URL,
        "transport": "sse",
    },
}

# mcp_client.py (continued, excerpt)
import os
from typing import Optional
from langchain.chat_models import ChatOpenAI
from langchain.schema import SystemMessage, HumanMessage

# Helper to construct the Chat LLM client
def build_llm(max_tokens: Optional[int] = None) -> ChatOpenAI:
    return ChatOpenAI(
        openai_api_key=os.environ["OPENAI_API_KEY"],
        temperature=float(os.getenv("OPENAI_TEMPERATURE", "0.2")),
        max_tokens=max_tokens or int(os.getenv("OPENAI_MAX_TOKENS", "512")),
    )

async def run_agent(
    prompt: str,
    max_tokens: Optional[int] = None,
    tagging_rules: Optional[str] = None,
    allowed_tools: Optional[set[str]] = None,
) -> str:
    tools, cleanup = await get_mcp_tools()
    try:
        if allowed_tools is not None:
            tools = [tool for tool in tools if tool.name in allowed_tools]
            missing = allowed_tools - {tool.name for tool in tools}
            if missing:
                raise RuntimeError(f"Required MCP tools not found: {sorted(missing)}")

        agent = create_agent(build_llm(max_tokens=max_tokens), tools)
        messages = []

        if tagging_rules:
            # Tagging rules are passed as a system message, so the agent treats them as
            # authoritative policy when evaluating resources.
            messages.append(
                SystemMessage(
                    content=(
                        "Apply the tagging rules below when evaluating cluster resources. "
                        "Treat label_mappings as the only accepted keys for each required tag. "
                        "Do not invent extra policy, exclusions, or judgments beyond this YAML.\n\n"
                        f"Tagging rules (YAML):\n{tagging_rules}"
                    )
                )
            )

        messages.append(HumanMessage(content=prompt))

        # Audit + many create_issue calls can require a higher recursion/step budget.
        result = await agent.ainvoke(
            {"messages": messages},
            config={"recursion_limit": 100},
        )

        # Return the last assistant message content
        return result["messages"][-1].content
    finally:
        await cleanup()