ThinkNEO Control Plane

thinkneo_audit_export

Read-onlyIdempotent

Export audit events from the live gateway. Supports JSON and CSV formats with date range filtering for SIEM integration.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`format`	No	Output format: ndjson or csv	ndjson
`end_date`	No	End date ISO format
`workspace`	No	Workspace identifier	default
`start_date`	No	Start date ISO format

Output Schema

TableJSON Schema

Name	Required	Description	Default
`result`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed2 schema fields changedJun 5, 2026
- changedInput schema / properties / format / default
```
Previous value: -"json"New value: +"ndjson"
```
- changedInput schema / properties / format / description
```
Previous value: -"Output format: json, csv"New value: +"Output format: ndjson or csv"
```

Changed12 schema fields changedMay 11, 2026

addedInput schema / properties / end_date

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "End date ISO format",
+  "title": "End Date"
+}

removedInput schema / properties / event_types

Removed value: -{
-  "anyOf": [
-    {
-      "type": "string"
-    },
-    {
-      "type": "null"
-    }
-  ],
-  "default": null,
-  "description": "Comma-separated event types to filter (e.g., 'tool_call,task_sent')",
-  "title": "Event Types"
-}

changedInput schema / properties / format / description

Previous value: -"Output format: cef, csv, json, leef, syslog"New value: +"Output format: json, csv"

removedInput schema / properties / hmac_key

Removed value: -{
-  "anyOf": [
-    {
-      "type": "string"
-    },
-    {
-      "type": "null"
-    }
-  ],
-  "default": null,
-  "description": "HMAC key for signing (required if sign_hmac=true)",
-  "title": "Hmac Key"
-}

removedInput schema / properties / limit

Removed value: -{
-  "default": 1000,
-  "description": "Max events to export (1-10000)",
-  "title": "Limit",
-  "type": "integer"
-}

removedInput schema / properties / period

Removed value: -{
-  "default": "7d",
-  "description": "Export period: 1d, 7d, 30d, 90d",
-  "title": "Period",
-  "type": "string"
-}

removedInput schema / properties / sign_hmac

Removed value: -{
-  "default": false,
-  "description": "Sign export with HMAC SHA-256 for integrity",
-  "title": "Sign Hmac",
-  "type": "boolean"
-}

addedInput schema / properties / start_date

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "Start date ISO format",
+  "title": "Start Date"
+}

removedInput schema / properties / workspace / anyOf

Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]

changedInput schema / properties / workspace / default
```
Previous value: -nullNew value: +"default"
```

changedInput schema / properties / workspace / description

Previous value: -"Filter by workspace"New value: +"Workspace identifier"

addedInput schema / properties / workspace / type
```
Added value: +"string"
```

AddedApr 25, 2026

TDQS

A3.8/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds value by specifying the data source ('live gateway'), supported formats, and date-range filtering, but does not disclose potential size limits, pagination, or other operational nuances.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence with the primary verb and object upfront. Every phrase earns its place: 'live gateway' indicates source, 'JSON and CSV' indicates formats, and 'SIEM integration' indicates use case.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the low tool complexity, complete 100% schema parameter coverage, and presence of an output schema, the description is largely sufficient. It clearly states purpose and context, though a brief mention of output size or time-range limits would make it fully comprehensive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all four parameters (format, start_date, end_date, workspace). The description reinforces the date-range filtering and format choice but does not add significant meaning beyond the schema fields.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the action ('Export audit events'), the resource ('live gateway'), and the scope ('date range filtering for SIEM integration'). This distinguishes it from sibling tools like thinkneo_a2a_audit or thinkneo_get_observability_dashboard, which are not explicitly export-focused.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives context ('for SIEM integration') that implies when to use the tool, but it does not explicitly state when to prefer this over alternatives or mention any exclusions. Sibling tools suggest related audit/log capabilities, but no direct comparison is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All ThinkNEO Control Plane tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.