Skip to main content
Glama

list_security_sbom_containers

Read-only

List every container the resource cache says is running on the scoped clusters, init containers included, each joined to the bill of materials of its image or marked absent when the scanner has none for it. This is the tool for "which running containers have no bill of materials" and "what does this workload actually run": absent rows are listed, sorted first, and counted in the inventory block, because a missing bill of materials is a state to act on (SBOM generation off on the cluster, a registry the scanner cannot pull from, a tag rolled since the last scan) - never proof the image is empty. Filter by cluster, namespace, workload (kind and/or name; a bare pod matches its own name) and status. Read-only.

Input Schema

NameRequiredDescriptionDefault
pageNoPage number, starting at 1.
sortNoSort column: status (absent first), image, container, pod, namespace, workload, cluster_name, components, last_seen_at.
orderNoasc or desc.
searchNoMatch image, container, pod, workload or namespace.
statusNopresent (image has a bill of materials), absent (it does not) or any.
namespaceNoOnly containers in this namespace.
page_sizeNoResults per page (default 50).
cluster_idNoOne cluster (UUID); omit for every live cluster of the organisation.
workload_kindNoMatch the resolved workload, its direct owner, or 'pod' for bare pods; case-insensitive.
workload_nameNoMatch the resolved workload, its direct owner, or the pod name; case-insensitive.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint=true, so the description carries the extra burden and delivers: absent rows are listed, sorted first, counted in an inventory block, and explicitly framed as a state to act on rather than proof the image is empty. That is genuinely useful behavioral context. Pagination/response shape details are left to the schema, keeping it short of a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the resource and its distinguishing join, then handles use cases and the absent-row caveat. Dense but nearly every clause earns its place; the parenthetical explanations of why an SBOM can be missing run slightly long.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description still conveys the shape of results (containers joined to SBOMs, absent rows first, counted in an inventory block) and the filter surface. It is close to self-sufficient, though exact response fields and pagination behavior are only implied.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds real nuance beyond the schema: the meaning of the 'absent' filter, that a bare pod matches its own name, and that workload_kind/name match the resolved workload or its direct owner. This meaningfully exceeds what the structured params provide.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource (list containers running on scoped clusters) and immediately names the distinctive scope: joined to each image's bill of materials, init containers included, absent rows listed. An agent can distinguish it from list_security_pods, list_security_sbom_images, and list_security_sbom_components without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly frames the two questions it answers ('which running containers have no bill of materials' and 'what does this workload actually run') and lists the filterable dimensions. It gives clear context for use but does not name sibling tools or state when a different tool would be preferable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources