scry_timeseries
Bucketed observation counts over time. Detect bursts, plot trends, sanity-check whether attacker activity is rising or falling.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| bucket | No | ||
| since_ms | No | ||
| until_ms | No |
Scry
TDQS
B3.3/5.0
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully disclose behavioral traits. It states it returns counts but does not mention whether it is read-only, any authentication needs, rate limits, or side effects. The read-only nature is implied but not explicit.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the core action and purpose. No redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, the description lacks detail on what 'observation counts' are, the source resource, output format, and filtering behavior. It is insufficient for an agent to fully understand the tool's behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters2/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage and 3 parameters, the description should compensate. It explains 'bucketed' implying the bucket parameter and 'over time' implying since_ms/until_ms, but does not specify that timestamps are epoch milliseconds or clarify the meaning of the integer values.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool provides 'bucketed observation counts over time' with specific use cases: detect bursts, plot trends, sanity-check activity trends. This distinguishes it from sibling tools which focus on specific entities like ASN or campaign.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines3/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for trend analysis and anomaly detection but does not explicitly state when to avoid this tool or mention alternatives among siblings. No when-not or exclusion criteria are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Try in Browser
Glama MCP Gateway
Add one secure layer between your agents and this server.
TDQS
A3.6/5.0
Disambiguation5/5
Each tool targets a unique resource or operation: single IP lookup, bulk IP lookup, ASN roll-up, country roll-up, campaign detail, campaign list, recent observations, stats, timeseries, tool detail, tool list, and top sources. There is no overlap or ambiguity, and descriptions explicitly state when each tool should or should not be used.
Naming Consistency5/5
All tool names follow the consistent pattern 'scry_' plus a descriptive noun (e.g., scry_asn, scry_check, scry_timeseries). The naming is uniform, lowercase with underscores, and logically reflects the tool's purpose.
Tool Count5/5
With 12 tools, the set is well-scoped for a threat intelligence server. It provides sufficient granularity without being overly large or sparse, covering core functionality without redundancy.
Completeness5/5
The tool surface covers key operations for IP triage, campaign analysis, statistical overviews, time-series trends, and tool detection. There are no obvious gaps; all common use cases for network observation and threat intelligence are addressed.