[joemckenney]

Summary

System-wide process ranker, peer of pids_in_cgroup. Returns the top N processes by rss_bytes desc, optionally scoped to a cgroup subtree.

Tool shape

top_processes(n=10, cgroup_prefix=None, redact_args=true)
  → walks /proc, filters by cgroup_prefix (path-aware), sorts by rss desc, takes top N

• cgroup_prefix is path-aware: system.slice matches system.slice itself and any descendant (system.slice/nginx.service) but never siblings (system.slice2/...). Empty/omitted = no filter.
• Sort is memory-only for now: CPU rate sampling is planned but deferred to keep this first ship blocking-free. Description flags this so the agent doesn't assume CPU support.
• Same redact_args policy as pids_in_cgroup: redact *key=*/*token=*/*password=*/*secret=* by default, opt out via redact_args=false.

Refactor along the way

ProcessEntry + format_cmdline + redaction logic moved from pids_in_cgroup.rs into a shared src/mcp/process_entry.rs with a ProcessEntry::from_snapshot(snap, redact) constructor. Both tools now project identical-shaped entries.

Files

• src/mcp/process_entry.rs (new): shared wire-shape projection + redaction
• src/mcp/tools/top_processes.rs (new): the tool, plus inline tests for the prefix-match function
• src/mcp/tools/pids_in_cgroup.rs: stripped of duplicated types/helpers, now imports from process_entry
• tests/mcp_server.rs: 10 new integration tests covering rank+filter+sort, n cap, default n, kernel-thread sort placement, redaction, prefix validation, sibling-mismatch, empty prefix == no filter, skipped count

Test plan

• 24 unit + 21 integration tests pass
• cargo fmt, clippy -D warnings, release build all clean
• tool_list_snapshot reviewed; only diff is the new tool addition
• After merge: smoke test by asking Claude something like "what's using the most memory under user.slice?"

🤖 Generated with Claude Code