ClickStack 8月更新：仪表盘变量、PromQL、MCP 与 OIDC

The matcher can reference other dashboard variables, allowing filters to depend on each other. An instance dropdown can use the selected environment to show only instances in that environment, with PromQL charts using those selections to filter their results.

OIDC authentication for the OTLP receiver

The standalone ClickStack collector authenticated incoming telemetry using a single shared token. This was straightforward to set up, but every application sending data needed the same long-lived credential. For teams running larger fleets, rotating that token meant coordinating updates across all of those applications.

The collector now supports OpenID Connect (OIDC) authentication, so applications can send telemetry using short-lived tokens from your existing identity provider or workload identity system.

To configure it, set OIDC_ISSUER_URL and OIDC_AUDIENCE on the collector. Applications then send a JWT in the Authorization: Bearer <token> header with their OTLP requests. The collector retrieves the provider's signing keys and validates the token's signature, issuer, audience, and expiry.

This lets teams manage credentials through their identity provider and issue tokens to individual applications, without distributing one shared secret across the fleet.

OIDC authentication is available in standalone collector mode. Shared-token authentication remains supported, but the two options are mutually exclusive. Setting OIDC_ISSUER_URL enables OIDC.

MCP server improvements

We continue to expand the ClickStack MCP server, using our evaluation framework to test how agents investigate problems and build dashboards. This month, we've added tools for finding changes in log patterns and checking dashboards, along with improvements based on how agents are using the server.

Finding new and disappearing log patterns

The existing pattern tools helped agents find common log messages and compare attribute values, but they couldn't identify a log pattern that had just started appearing. This matters during an investigation, when a new error message might explain what changed.

The new clickstack_emerging_signals tool compares log patterns across two time windows. It reports patterns that are new or becoming more frequent, as well as those that have disappeared.

In our service-health-check evaluation, agents found a planted new log pattern in eight of ten runs with the tool, compared with none without it.

Checking a whole dashboard

Agents previously had to query each tile separately to check whether a dashboard they'd built actually worked. On larger dashboards, this added a lot of calls just to validate the result.

The new clickstack_query_tiles tool checks multiple tiles in one call and returns a summary of results, errors, and query warnings for each. In our dashboard-building evaluation, an agent used it to validate a 17-tile dashboard in a single call.

Helping agents choose the right tools

Production usage showed agents increasingly choosing raw SQL as the number of available tools grew. It accounted for around 73% of querying calls and had roughly twice the error rate of the builder tools.

We've updated the tool descriptions and server instructions to guide agents toward the builder tools first, which, on average, are almost 20% more accurate and use 27% fewer tool calls. These produce charts and tables that users can drill into, while raw SQL remains available for queries that the builder can't express.

Tools also now declare whether they read data or can modify it, helping clients decide which actions need approval.

Span links in both directions

When an application offloads work through Kafka, the producer sending a message and the consumer processing it may appear in separate traces. OpenTelemetry span links connect those operations, letting you follow the work across services.

ClickStack already let you follow these links from a consumer back to its producer. If you started at the producer, though, there was no way to find the consumers that linked to it. That made it harder to investigate what happened after a message was published.

We've added a Linked from section to the span detail panel, so you can find the spans that reference the one you're viewing. You can now follow a consumer's link to its producer and see the consumer listed there.