topologylisted

# Cortex Topology & Correlation Answer "what's connected to what" and "what else was happening" questions across the fleet, backed by cortex's inventory graph and heartbeat state. This is distinct from `incidents` (error/alert triage) and `troubleshoot` (fixing a specific broken thing) — use this skill when the question is about structure or cross-host timing, not about diagnosing a failure. ## Workflow ### 1. Inventory and dependency questions — `map` `cortex action=map [mode=...] [host=...] [domain=...] [service=...] [host_limit=N] [include_sections=[...]] [finding_types=[...]]` **No CLI equivalent exists for this action** — it's MCP/REST-only (`POST /mcp` action=map, or the `/api` surface). `mode` selects the answer shape: - omitted or `snapshot` — full inventory dump: `nodes`, `services`, `compose_projects`, `reverse_proxies`, `networks`, `storage`, `media_services`, `projects`, plus a `cortex_overlay` summary. Use for "what's out there" broad surveys. - `host_services` (needs `host`) — services running on one host. - `service_dependencies` (needs `service`, as a `service_instance` key `host/name` — e.g. `tootie/plex` — or `host` + bare name) — what a service depends on / is depended on by. Legacy `host:name` identities are rejected with `rejected_legacy_shape`. - `domain_routes` (needs `domain`) — which reverse-proxy routes serve a public domain. - `findings` — scans for `potential_public_route`, `risky_mounts`, and `collector_health` issues; narrow