FastBee External AI Client Operations Manual

This document guides customers on how to connect an external AI client to Arthas MCP after the FastBee service is deployed to a server, so the AI can assist in troubleshooting high CPU usage, slow APIs, blocked threads, memory anomalies, log errors, and other issues.

Intended audience: implementation engineers, operations staff, and on-site customer engineers who are using AI-assisted operations for the first time.

Important boundaries:

• The AI is responsible for diagnosis, explaining symptoms, organizing evidence, and giving recommendations.
• The AI must not automatically restart services, delete files, modify production configuration, or run hot-update commands.
• High-risk commands must be confirmed by a human before execution.
• When Arthas MCP is exposed on the public network, a Token and a security-group IP whitelist must be configured.

Official references:

• Arthas MCP Server
• Arthas Spring Boot Starter

1. Overall Principle

After Arthas is integrated into the FastBee backend, it starts an Arthas HTTP service inside the service process. The current project configuration is as follows:

arthas:
  app-name: ${fastbee.name}
  ip: 0.0.0.0
  http-port: 8563
  mcp-endpoint: /admin/mcp
  mcp-protocol: STREAMABLE
  password: "Set a complex password"

After deployment, an external AI client accesses it through the MCP protocol:

http://server-ip:8563/admin/mcp

Once connected, the AI client can invoke the diagnostic tools provided by Arthas, for example:

• dashboard: view the JVM and system runtime dashboard.
• jvm: view JVM parameters, startup information, and runtime information.
• memory: view JVM memory region usage.
• thread: view threads, high-CPU threads, and blocked threads.
• stack: view the method call stack.
• trace: trace API or method latency.
• watch: observe method arguments, return values, and exceptions.
• logger: view logging configuration.
• viewfile: view the contents of log files in allowed directories.

2. Server Preparation

2.1 Add a Production Token to the Configuration File

Production environments must configure arthas.password. So that Linux, Docker, BaoTa, and other deployment methods can share one set of instructions, this document uniformly requires the password to be written in the application.yml actually used by the server, or in the production configuration file.

Add the following to application.yml:

arthas:
  app-name: ${fastbee.name}
  ip: 0.0.0.0
  http-port: 8563
  mcp-endpoint: /admin/mcp
  mcp-protocol: STREAMABLE
  password: "Replace with a sufficiently complex password"

Notes:

• The value of password is the Bearer Token the AI client will use.
• If the password contains special characters such as :, #, @, or spaces, wrap it in English double quotes.
• Do not commit the real production password to a public repository; it is recommended to fill in the real password only in the production configuration file on the server.

Recommended password rules:

• At least 16 characters long.
• Contains uppercase and lowercase letters, digits, and special characters.
• Do not use weak passwords such as the company name, project name, phone number, or birthday.

Example:

arthas:
  app-name: ${fastbee.name}
  ip: 0.0.0.0
  http-port: 8563
  mcp-endpoint: /admin/mcp
  mcp-protocol: STREAMABLE
  password: "FbOps_2026@ChangeMe_9xK!"

2.2 Configure the viewfile Log Whitelist

If you want the AI to read logs, you need to configure the log directories it is allowed to access. It is recommended to open only the log directory, not broad directories such as /, /home, or /root.

Suppose the log directory on your server is:

/var/data/java/logs

Common files in the directory include:

sys-debug.log
sys-error.log
sys-error.2026-06-24.log
sys-info.log
sys-info.2026-06-24.log
sys-warn.log
sys-user.2026-06-24.log

Therefore, the recommended log whitelist configuration is:

export ARTHAS_MCP_VIEWFILE_ALLOWED_DIRS=/var/data/java/logs,/arthas-output

If you use Docker Compose, arthas.password is still written in the application.yml loaded inside the container; you only need to additionally set the log whitelist here:

environment:
  ARTHAS_MCP_VIEWFILE_ALLOWED_DIRS: /var/data/java/logs,/arthas-output

If the FastBee logs are actually in another directory, such as /data/fastbee/logs, replace it with the actual path:

export ARTHAS_MCP_VIEWFILE_ALLOWED_DIRS=/data/fastbee/logs,/arthas-output

Log file selection rules:

• The log currently being written on the day has no date suffix; check /var/data/java/logs/sys-error.log and /var/data/java/logs/sys-info.log first.
• A date suffix is added automatically only after archiving the next day; when investigating a historical date, check /var/data/java/logs/sys-error.YYYY-MM-DD.log, for example /var/data/java/logs/sys-error.2026-06-24.log.
• Current general runtime log: check /var/data/java/logs/sys-info.log.
• Historical general runtime log: check /var/data/java/logs/sys-info.YYYY-MM-DD.log.
• Warning log: check sys-warn.log for the current day and sys-warn.YYYY-MM-DD.log for historical dates, used to supplement WARN-level clues.
• Debug log: sys-debug.log may be very large; read only a small number of recent lines when the AI needs more detailed evidence.
• User behavior log: sys-user.YYYY-MM-DD.log is mainly used to verify the operation timeline and is not the first-choice log for JVM anomalies.

2.3 Open Port 8563

In a public-network Token scenario, all of the following must be satisfied:

• The server firewall allows 8563.
• The cloud server security group allows 8563.
• The security group source IP contains only trusted office IPs, VPN egress IPs, or the on-site customer's public IP.
• The source must not be set to 0.0.0.0/0 and left exposed on the public network for a long time.

Linux firewall example:

firewall-cmd --add-port=8563/tcp --permanent
firewall-cmd --reload
firewall-cmd --list-ports

If you use ufw:

ufw allow from trusted-public-ip to any port 8563 proto tcp
ufw status

Docker Compose port mapping example:

ports:
  - "8563:8563"

BaoTa panel check:

1. Open "Security".
2. Add port 8563 to the allowlist.
3. If BaoTa supports source IP restriction, allow only trusted IPs.
4. Then open the same port in the cloud vendor console security group.

Cloud server security group check:

1. Log in to the Alibaba Cloud, Tencent Cloud, Huawei Cloud, or other cloud console.
2. Find the ECS/cloud host where FastBee runs.
3. Open the security group inbound rules.
4. Add TCP 8563.
5. Set the source to a trusted public IP, for example 203.0.113.10/32.
6. Save and wait for the rule to take effect.

2.4 Restart the FastBee Service

Plain jar deployment example:

ps -ef | grep fastbee
kill -15 process-id
nohup java -jar fastbee-admin.jar > fastbee.out 2>&1 &

systemd deployment example:

systemctl restart fastbee
systemctl status fastbee

Docker Compose deployment example:

docker compose down
docker compose up -d
docker compose logs -f fastbee

2.5 Verify the MCP Address

Replace the variables:

• server-ip: the public IP or domain name of the FastBee server.
• your-arthas.password: the real value of arthas.password in application.yml.

Test with curl:

curl -i \
  -H "Authorization: Bearer your-arthas.password" \
  http://server-ip:8563/admin/mcp

Common results:

• Returns 200, 400, 405, or a response containing MCP-related information: the port and authentication are most likely working; the actual interaction is handled by the MCP client.
• Returns 401 or 403: the Token is wrong or the Authorization header is missing.
• Connection timeout: the port is not open, the security group does not allow it, the service is not started, or the IP is wrong.
• Connection refused: the server is reachable, but no process is listening on 8563.

Check port listening:

ss -lntp | grep 8563

View FastBee logs:

tail -n 200 /var/data/java/logs/sys-error.log

If the log path is different, replace it with the actual path.

3. General MCP Configuration

No matter which AI client you use, the core configuration is the same:

Note: the configuration key used to pass authentication information in MCP clients is http_headers, not headers.

{
  "mcpServers": {
    "fastbee-arthas": {
      "type": "streamableHttp",
      "url": "http://server-ip:8563/admin/mcp",
      "http_headers": {
        "Authorization": "Bearer your-arthas.password"
      }
    }
  }
}

If the client uses the TOML format, the authentication configuration is written as follows:

[mcpServers.fastbee-arthas]
type = "streamableHttp"
url = "http://server-ip:8563/admin/mcp"
http_headers = { "Authorization" = "Bearer your-arthas.password" }

Please replace:

• server-ip with the real server IP or domain name.
• your-arthas.password with the real value of arthas.password in the configuration file.

For example:

{
  "mcpServers": {
    "fastbee-arthas": {
      "type": "streamableHttp",
      "url": "http://203.0.113.10:8563/admin/mcp",
      "http_headers": {
        "Authorization": "Bearer FbOps_2026@ChangeMe_9xK!"
      }
    }
  }
}

After a successful connection, first say to the AI:

Please confirm whether you can see the fastbee-arthas MCP tools. Do not execute high-risk commands yet. Only call dashboard, jvm, memory, and thread to view the current JVM overview, and summarize it in English.

4. Generic MCP Client Template

As long as the client supports Streamable HTTP MCP, fill in the following information:

Configuration Item	Value
Name	fastbee-arthas
Type	streamableHttp
URL	http://server-ip:8563/admin/mcp
HTTP Headers	http_headers = { "Authorization" = "Bearer your-arthas.password" }

JSON template:

{
  "mcpServers": {
    "fastbee-arthas": {
      "type": "streamableHttp",
      "url": "http://server-ip:8563/admin/mcp",
      "http_headers": {
        "Authorization": "Bearer your-arthas.password"
      }
    }
  }
}

TOML template:

[mcpServers.fastbee-arthas]
type = "streamableHttp"
url = "http://server-ip:8563/admin/mcp"
http_headers = { "Authorization" = "Bearer your-arthas.password" }

5. Standard Troubleshooting Workflow

Whenever a problem occurs, it is recommended to ask the AI in a fixed order:

1. Look at the overall status first.
2. Then look at threads and memory.
3. Then look at logs.
4. Only at the end use sampling tools such as trace and watch.
5. When in doubt, stop and let a human decide.

General prompt:

You are the FastBee production operations assistant. Please help me troubleshoot issues through the fastbee-arthas MCP.

Rules:
1. First use only low-risk tools such as dashboard, jvm, memory, thread, logger, sysprop, sc, sm, and viewfile.
2. trace/watch must be limited to a specific class name, method name, and sample count, with at most 5 samples.
3. Do not call heapdump, ognl, redefine, retransform, or vmtool.
4. Do not restart services, do not delete files, and do not modify production configuration.
5. At every step, explain which tool you called, what evidence you saw, and why you take the next step.
6. Output the final conclusion in the format: "symptom, evidence, possible cause, recommended action, whether human intervention is needed".

My issue is: fill in the specific symptom here.

6. Typical Issue Troubleshooting Templates

6.1 CPU Spike

User question:

The CPU usage of the FastBee server is very high. Please troubleshoot using the fastbee-arthas MCP. Do not execute high-risk commands first. Please find the busiest threads, their thread stacks, the business code they may correspond to, and give handling recommendations.

AI-preferred tools:

• dashboard
• thread
• thread -n 5
• jvm

How to judge:

• If a few threads have very high CPU usage, focus on the thread names and the methods at the top of their stacks.
• If a thread stack stays in the same business method for a long time, it may be an infinite loop, frequent computation, or processing a large amount of data.
• If GC threads are very busy, memory pressure may be causing frequent GC.

Suggested next steps:

• Have the AI summarize the stacks of the high-CPU threads.
• Locate the business module based on class names and method names.
• If you need to further locate API latency, consider trace and limit the sample count.

Must escalate to a human:

• The AI suggests executing ognl, vmtool, redefine, or retransform.
• CPU usage is close to 100% and the business is unavailable; a human must evaluate whether to scale up or restart.

6.2 Slow API Response

User question:

A FastBee API responds very slowly. The API path is: /xxx/xxx. Please first check the JVM, threads, and recent error logs, then decide whether trace is needed. When tracing, limit sampling to no more than 5 times.

AI-preferred tools:

• dashboard
• thread
• logger
• viewfile
• trace

How to judge:

• If many threads are waiting for database connections, focus on the database connection pool or slow SQL.
• If threads are blocked on Redis, MQTT, or HTTP calls, focus on external dependencies.
• If trace shows that one method takes the most time, analyze that method's dependencies first.

Suggested next steps:

• After finding the slow point, have the AI output a "latency chain table".
• If it is the database, check the SQL, indexes, and connection pool.
• If it is an external API, check the network and the third-party service.

Must escalate to a human:

• Production database indexes need to be adjusted.
• The service needs to be restarted or the configuration modified.
• trace cannot confirm the specific class name and method name.

6.3 Blocked Threads or Deadlock

User question:

FastBee is suspected of having blocked threads or a deadlock. Please use the fastbee-arthas MCP to check blocked threads, signs of deadlock, and key thread stacks. Do not execute high-risk commands.

AI-preferred tools:

• thread
• thread -b
• dashboard
• jvm

How to judge:

• Many BLOCKED threads indicate possible lock contention.
• Many threads waiting on the same lock, the same connection pool, or the same queue require focused analysis.
• If thread -b finds the blocking source, look at the stack of the lock-holding thread first.

Suggested next steps:

• Have the AI summarize the blocking chain.
• Identify the lock object, the lock-holding thread, and the waiting threads.
• Determine whether the cause is database connection exhaustion, thread pool exhaustion, or improper use of business locks.

Must escalate to a human:

• All threads are stuck for a long time.
• The AI cannot determine whether a restart is acceptable.
• Code changes are needed to release locks or adjust thread pools.

6.4 Continuously Rising Memory

User question:

FastBee memory usage keeps rising. Please use the fastbee-arthas MCP to troubleshoot JVM memory, GC behavior, and thread status. Do not execute heapdump directly unless I explicitly approve it.

AI-preferred tools:

• memory
• jvm
• dashboard
• thread

How to judge:

• If the Old generation keeps rising and does not drop after GC, there may be a memory leak.
• If Metaspace is rising, it may be related to class loading, dynamic proxies, or scripts.
• If the thread count keeps rising, it may be a thread leak or task backlog.

Suggested next steps:

• Observe the memory regions first.
• Then look at the thread count and GC status.
• If a heap snapshot is really necessary, a human must confirm before running heapdump, and ensure sufficient disk space.

Must escalate to a human:

• heapdump needs to be executed.
• The server is low on disk space.
• The service is about to hit OOM, and a decision on scaling or restarting is needed.

6.5 Recent Log Errors

User question:

FastBee has recently reported errors. Please analyze the logs under /var/data/java/logs through the fastbee-arthas MCP.

Please read in this order:
1. First read the last 200 lines of /var/data/java/logs/sys-error.log.
2. If the problem occurred today, continue reading sys-info.log and sys-warn.log (the files without a date suffix).
3. If the problem occurred on a historical date, read the corresponding /var/data/java/logs/sys-error.YYYY-MM-DD.log.
4. If you need to reconstruct the timeline of historical requests, also read sys-info.YYYY-MM-DD.log from the same day.
5. If there were WARN clues before the error, read sys-warn.log for today or sys-warn.YYYY-MM-DD.log for a historical date.
6. sys-debug.log may be very large; read only the last 100 lines when necessary.

Focus on ERROR, Exception, Timeout, Connection refused, OutOfMemoryError, and RejectedExecutionException, and summarize the possible causes along a timeline.

AI-preferred tools:

• logger
• viewfile
• jvm
• thread

How to judge:

• Connection refused: a dependent service is unreachable.
• Timeout: database, Redis, MQTT, or HTTP external calls are timing out.
• OutOfMemoryError: memory anomaly; immediate human intervention is required.
• RejectedExecutionException: the thread pool is full or there are too many tasks.
• sys-error.log: the first choice for locating the root cause of exceptions.
• sys-error.YYYY-MM-DD.log: used to review historical exceptions on a specific day.
• sys-info.log or sys-info.YYYY-MM-DD.log: used to supplement the general runtime timeline of APIs, tasks, and device reporting.
• sys-warn.log: used to discover warnings that occurred before the error.
• sys-debug.log: read only a small amount from the end, to avoid oversized logs slowing down the investigation.

Suggested next steps:

• Have the AI organize the errors along a timeline.
• Analyze only logs within the allowed directories.
• Find the root cause from sys-error.log first, then use sys-info and sys-warn to add context.
• For today's problem, read sys-error.log without a date suffix; for a historical date such as 2026-06-24, read sys-error.2026-06-24.log.

Must escalate to a human:

• Logs involve sensitive information such as database passwords or Tokens.
• The AI requests to read non-log directories.
• Data corruption, permission anomalies, or startup failures occur.

6.6 Database Connection Pool Anomaly

User question:

FastBee is suspected of having a database connection pool anomaly; the symptom is slow APIs or a large number of timeouts. Please check the thread stacks through the Arthas MCP. If the problem occurred today, read the last 200 lines of /var/data/java/logs/sys-error.log; if it occurred on a historical date, read the corresponding sys-error.YYYY-MM-DD.log. Please determine whether there is connection pool exhaustion, slow SQL, or an unreachable database.

AI-preferred tools:

• thread
• dashboard
• viewfile
• logger

How to judge:

• Thread stacks stuck at acquiring a database connection may indicate connection pool exhaustion.
• SQL timeout in the logs may indicate slow SQL or high database load.
• Communications link failure in the logs may indicate a database network or account problem.

Suggested next steps:

• Check the database service status.
• Check the connection pool configuration and the database's maximum connection count.
• Have the AI extract keywords such as SQL timeout, connection, pool, druid, hikari, and mysql from sys-error.
• Collect slow SQL and hand it to the DBA or developers.

Must escalate to a human:

• Connection pool configuration needs to be modified.
• Database connections need to be killed.
• Indexes need to be adjusted or SQL changes executed.

6.7 MQTT or Device Reporting Anomaly

User question:

FastBee device reporting or MQTT is abnormal. Please use the Arthas MCP to check the JVM and threads, and read the recent logs of /var/data/java/logs/sys-error.log and sys-info.log. Focus on content related to mqtt, netty, broker, device, topic, serialNumber, and productId.

AI-preferred tools:

• dashboard
• thread
• viewfile
• logger
• sc
• sm

How to judge:

• MQTT disconnections in the logs: check the network, ports, and authentication.
• Netty thread anomalies: check thread stacks and connection counts.
• No response to device reporting: check the broker, topics, and product protocol parsing.

Suggested next steps:

• Have the AI organize the anomalies by device number, topic, and timestamp.
• For today's anomaly, have the AI read sys-error.log and sys-info.log without a date suffix; for a historical date, also read sys-error.YYYY-MM-DD.log and sys-info.YYYY-MM-DD.log.
• Compare device-side logs with platform logs.
• If it is a protocol parsing anomaly, escalate to developers to confirm protocol adaptation.

Must escalate to a human:

• A batch of devices is going offline.
• Protocol code changes are involved.
• MQTT broker configuration adjustments are involved.

6.8 Service Startup Failure

User question:

The FastBee service failed to start. Please analyze the cause based on /var/data/java/logs/sys-error.log and sys-info.log. If the startup failure occurred on a historical date, read sys-error.YYYY-MM-DD.log and sys-info.YYYY-MM-DD.log for that date. Please read only the allowed log directories and do not execute high-risk commands.

AI-preferred tools:

• viewfile
• logger
• jvm

How to judge:

• Port in use: the logs usually show bind failed.
• Configuration error: the logs usually show placeholder, property, or yaml parsing errors.
• Database unreachable: the logs usually show connection failures or authentication failures.
• Bean initialization failure: the logs usually show Spring Bean creation exceptions.

Suggested next steps:

• Have the AI extract the earliest root-cause exception.
• Do not look only at the last line of the error.
• Find the exception stack from sys-error first, then use sys-info to reconstruct the startup process.
• Troubleshoot in this order: configuration, ports, database, dependent services.

Must escalate to a human:

• Production configuration needs to be changed.
• Database accounts or permissions need to be modified.
• A version rollback is needed.

7. Safe Command List

7.1 Preferred by Default

Tool	Purpose	Risk
dashboard	View overall status	Low
jvm	View JVM information	Low
memory	View memory usage	Low
thread	View threads and blocking	Low
stack	View the call stack	Medium-low
logger	View logging configuration	Medium-low
sysprop	View system properties	Medium-low
sc	Search classes	Low
sm	Search methods	Low
viewfile	View log files	Medium

7.2 Use with Caution

Tool	Risk	Requirements
trace	May increase online overhead	Must specify class name and method name; no more than 5 samples
watch	May output sensitive arguments	Must specify class name and method name; no more than 5 samples
heapdump	May consume a large amount of disk and CPU	Must be confirmed by a human; check disk space first

7.3 Not Recommended for the AI to Execute

Tool	Reason
ognl	Can execute expressions; high risk
redefine	Can hot-update classes; high production risk
retransform	Can modify loaded classes; high production risk
vmtool	Can manipulate internal JVM objects; high risk
jad	May expose code details; do not use unless necessary

Restriction prompt for the AI:

Do not call ognl, redefine, retransform, or vmtool. heapdump must be confirmed with me first. trace/watch must limit the sample count to at most 5.

8. FAQ

8.1 Cannot Connect to 8563

Check in this order:

1. Whether FastBee is started.
2. Whether Arthas started together with the application.
3. Whether the server is listening on 8563.
4. Whether the firewall allows it.
5. Whether the cloud security group allows it.
6. Whether the client's public IP is in the whitelist.

Commands:

ss -lntp | grep 8563
curl -i http://127.0.0.1:8563/admin/mcp

If the address is accessible locally but not from outside, it is usually a firewall or security group problem.

8.2 401 or 403 Token Error

Check:

• Whether arthas.password is configured in application.yml.
• Whether arthas.password takes effect in the configuration file actually loaded by FastBee.
• Whether the AI client's authentication field is written as http_headers.
• Whether http_headers contains "Authorization": "Bearer password".
• Whether there is exactly one space between Bearer and the password.
• Whether the password contains extra spaces, Chinese quotes, or line breaks.

Correct example:

http_headers = { "Authorization" = "Bearer FbOps_2026@ChangeMe_9xK!" }

Incorrect examples:

headers = { "Authorization" = "Bearer FbOps_2026@ChangeMe_9xK!" }
http_headers = { "Authorization" = "FbOps_2026@ChangeMe_9xK!" }
http_headers = { "Authorization" = "Bearer" }
http_headers = { "Authorization" = "Bearer  wrong-password" }

8.3 The Client Cannot See the MCP Tools

How to handle:

1. Check the JSON format.
2. Check whether type is streamableHttp.
3. Check whether the URL includes /admin/mcp.
4. Restart the client after saving.
5. Explicitly state in the prompt: "use the fastbee-arthas MCP tools".

8.4 What to Do If the AI Calls Dangerous Commands

If the AI is about to call ognl, redefine, retransform, or vmtool:

1. Refuse authorization immediately.
2. Tell the AI: "High-risk commands are forbidden. You may only use dashboard, jvm, memory, thread, and viewfile for analysis."
3. If the client supports tool permissions, disable these high-risk tools.
4. Disconnect the MCP connection if necessary.

8.5 The Server CPU Is Already Very High; How to Troubleshoot Conservatively

Run only the following first:

dashboard
thread -n 5
jvm
memory

Do not run the following at the beginning:

• Long-running trace
• Long-running watch
• heapdump
• profiler

Prompt:

The server CPU is already very high. Please troubleshoot with the lowest overhead. Only run dashboard, thread -n 5, jvm, and memory. Do not run trace, watch, or heapdump.

8.6 Log Path Not Found

How to handle:

1. First confirm the actual FastBee log directory.
2. Confirm that the directory is in ARTHAS_MCP_VIEWFILE_ALLOWED_DIRS.
3. Restart FastBee for the log whitelist configuration to take effect.
4. Then have the AI use viewfile to read the logs.

Common log paths:

/var/data/java/logs/sys-error.log
/var/data/java/logs/sys-error.YYYY-MM-DD.log
/var/data/java/logs/sys-info.log
/var/data/java/logs/sys-info.YYYY-MM-DD.log
/var/data/java/logs/sys-warn.log
/var/data/java/logs/sys-debug.log

Your log directory is /var/data/java/logs. When troubleshooting today's problem, have the AI read sys-error.log without a date suffix first. Only when troubleshooting a historical date should it read sys-error.date.log for the corresponding date, for example:

/var/data/java/logs/sys-error.2026-06-24.log

If today's sys-error.log has only the exception stack but lacks business context, have the AI also read today's sys-info.log without a date suffix. For a historical problem, read sys-info.date.log from the same day to supplement preceding and following requests, tasks, device reporting, and other information.

8.7 Public Access Is Unsafe; How to Temporarily Tighten It

After troubleshooting is complete, it is recommended to:

1. Delete the security group rule that allows public access to 8563.
2. Or keep only the current public IP of the operations staff.
3. Change arthas.password in the configuration file.
4. Restart FastBee.
5. Confirm that 8563 is no longer accessible from outside.

9. On-Site Quick Checklist

Confirm before delivery:

• [ ] arthas.mcp-endpoint is configured as /admin/mcp.
• [ ] arthas.mcp-protocol is configured as STREAMABLE.
• [ ] arthas.password is configured for the production environment.
• [ ] A strong arthas.password is set in the production configuration file.
• [ ] Port 8563 is open only to trusted IPs.
• [ ] The AI client URL is http://server-ip:8563/admin/mcp.
• [ ] The AI client authentication field is http_headers, with the value Authorization: Bearer real-password.
• [ ] dashboard, jvm, and thread have been verified as callable.
• [ ] The customer has been told not to authorize high-risk commands.

10. Recommended First Diagnostic Prompt

After the customer's first successful connection, the following can be copied directly:

You are the FastBee production operations assistant. Please perform a safe inspection for me through the fastbee-arthas MCP.

Restrictions:
1. Only dashboard, jvm, memory, thread, logger, and sysprop may be called.
2. heapdump, ognl, redefine, retransform, and vmtool are not allowed.
3. Do not modify any configuration, do not restart services, and do not delete files.
4. At every step, explain which tool was called and what evidence was seen.

Please output:
1. Whether the current JVM is healthy.
2. Whether there are any anomalies in CPU, memory, or threads.
3. Whether there is obvious blocking or high-CPU threads.
4. Suggested next steps.