ET Ducky
Server Details
Read-only access to an ET Ducky organization's agents, alerts, and fleet summary
- Status
- Healthy
- Uptime
- 100.0% over 21 days
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-11-25
- URL
- ChatGPT
- –
- Claude
- –
TDQS
Scored across 5 tools
get_agent and get_device_context both return single-device health and alert data, so an agent may briefly hesitate between them; descriptions clarify that get_device_context is the support-ticket bundle while get_agent is a lightweight lookup. list_agents and list_alerts are clearly distinct, and get_fleet_summary is unambiguous.
All tools use a consistent snake_case get_/list_ verb-noun pattern: get_agent, get_device_context, get_fleet_summary, list_agents, list_alerts. The convention is predictable and readable throughout.
Five tools is well-scoped for a read-only endpoint monitoring/support server. Each tool has a clear role: fleet summary, agent listing, alert listing, single-agent health, and a consolidated device context for support tickets.
The surface covers the core read-only support workflow: fleet counts, agent inventory, alerts, single-agent health, and a one-call device context with dashboard links. Minor gaps exist, such as no standalone alert-detail or acknowledgement operation and no history/time-range filtering, but agents can largely work around these.
Available Tools
5 toolsget_agentGet agentARead-onlyInspect
One agent with its latest health sample (CPU, memory, free space on C:, uptime, pending reboot, make and model) and its number of active alerts.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | The agentId from list_agents. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so safety is covered. The description adds valuable behavioral detail by enumerating the exact payload fields returned, which is important because there is no output schema. It still omits error behavior (e.g., unknown agent_id) and the freshness semantics of 'latest'.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single, front-loaded clause with no filler, and the parenthetical list of fields is an efficient way to convey return shape. The only mild structural weakness is that it is a noun phrase rather than an explicit verb-led instruction, and the parenthetical is dense.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read tool with no output schema, the description compensates by naming the returned fields and the active alert count, and annotations cover the safety profile. It is nearly complete, missing only error handling and freshness precision, which are minor for this complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single agent_id parameter, and its schema description ('The agentId from list_agents') already explains sourcing. The tool description adds no further parameter semantics or format details, making the baseline 3 appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear resource and scope ('One agent') and enumerates the returned data (CPU, memory, free space, uptime, pending reboot, make/model, active alerts), which distinguishes it from the plural list_agents. It lacks an explicit verb and does not name the sibling alternatives, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use guidance, no conditions for choosing this tool over list_agents, get_fleet_summary, or list_alerts, and no prerequisites or exclusions. The singular scope only weakly implies usage, leaving the agent to infer context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_device_contextGet device contextARead-onlyInspect
Everything about one device for a support ticket in one call: the agents matching a hostname (the full name or, when no agent has it, the first DNS label cut to 15 characters) or an agent_id, each with its latest health sample, its active alerts (newest 10) and dashboard links that open Live Session or remote control after a technician signs in and confirms. matchedBy says how the device was found; "short_name" can be a different computer whose name starts the same way, and "none" means no agent matched. Give hostname or agent_id.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | No | An agentId from list_agents. Takes precedence over hostname. | |
| hostname | No | The device name as the PSA or ticket holds it, for example APP01 or app01.corp.example.com. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint and openWorldHint annotations, the description discloses substantial behavior: hostname matching fallback with first DNS label truncated to 15 characters, matchedBy values including short_name ambiguity and none, active alerts capped at newest 10, and dashboard links requiring technician sign-in and confirmation. This gives an agent the practical context needed to interpret ambiguous matches and side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The purpose is front-loaded and every sentence contains relevant operational detail. The paragraph is dense with nested parentheticals and packed clauses, which slightly reduces scanability, but there is no clearly wasted wording.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a two-parameter, read-only lookup with no output schema, the description is complete enough: it explains matching behavior, what is returned, the alerts cap, dashboard-link requirements, and matchedBy failure modes. An agent has enough information to call it correctly and interpret ambiguous results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema already documents agent_id precedence and gives hostname examples. The description adds meaningful semantics beyond the schema by explaining how hostname matching works, including the truncated short-name fallback and the risk that short_name may refer to a different computer, plus how matchedBy reports the result.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: retrieving everything about one device for a support ticket in one call, including agents, health samples, alerts, and dashboard links. It implies differentiation from list_agents and get_agent by aggregating device-specific context, but it does not name or explicitly contrast those siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied: it is for a support-ticket lookup on a single device, and the caller should give hostname or agent_id. However, there is no explicit guidance on when to choose this tool over get_agent, list_agents, list_alerts, or get_fleet_summary, nor any stated exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_fleet_summaryGet fleet summaryARead-onlyInspect
Counts for this organization: agents, online, offline, Windows, Linux, other OS, isolated, and active alerts by severity.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true and openWorldHint=false, so safety is covered. The description adds substantial value by enumerating exactly which counts are returned (agents, online, offline, Windows, Linux, other OS, isolated, active alerts by severity), compensating for the absence of an output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with no filler. Every item in the list earns its place by describing the return payload.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-param, read-only summary tool with annotations covering safety and no output schema, the description adequately conveys what data is returned. Minor gaps include data freshness or scope caveats, but nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Zero parameters, so the baseline is 4. The description correctly does not introduce parameter concepts that don't exist.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific purpose: counts of agents broken down by status, OS, isolation, and alerts by severity for this organization. Clearly distinguishable from sibling list/get tools, but does not explicitly name or route away from them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like list_agents or list_alerts. The agent must infer that this is the summary-view tool rather than a listing tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_agentsList agentsBRead-onlyInspect
List this organization's ET Ducky agents (Windows and Linux endpoints) with OS, agent version, online state, last heartbeat, last signed-in user, isolation state and tags. Sorted by hostname.
| Name | Required | Description | Default |
|---|---|---|---|
| os | No | Only agents of this OS family. | |
| tag | No | Only agents carrying this exact tag name. | |
| limit | No | Most rows to return. Defaults to 100. | |
| online | No | true for agents with a heartbeat in the last 5 minutes, false for the rest. | |
| search | No | Case-insensitive part of the hostname. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds useful context by listing the returned fields and stating the sort order (by hostname), but it says nothing about result caps or truncation behavior for large fleets.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single dense sentence that front-loads the resource and scope and then enumerates return fields. No filler, nothing redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description correctly compensates by enumerating the returned fields, which is the key missing piece. It is nearly complete for a read-only list tool, with only pagination/truncation behavior left implicit.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with each filter (os, tag, limit, online, search) documented in the schema itself, so the baseline is 3. The description adds no filter syntax or interaction detail (e.g. combining os and tag) beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb (List) and resource (agents) and enumerates the returned fields, so the agent knows exactly what it retrieves. However, it offers no differentiation from siblings like get_agent or get_fleet_summary, which matters given three closely related tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus get_agent (single agent) or get_fleet_summary (aggregate). The description is a pure capability statement with no context or exclusions, leaving the agent to infer routing from the names alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_alertsList alertsBRead-onlyInspect
Alerts raised for this organization's agents, newest first.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Most rows to return. Defaults to 100. | |
| status | No | Alert status. Defaults to active. | |
| agent_id | No | Only alerts for this agent. | |
| severity | No | Only alerts of this severity, for example critical or warning. | |
| since_hours | No | How far back to look. Defaults to 168 (7 days). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so safety is covered. The description adds useful context that results are org-scoped and sorted newest-first, but says nothing about pagination, truncation at the limit, or what happens when status='any'.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; scope and ordering are stated immediately and nothing is repeated from the structured fields.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-required-param read-only list tool with full schema coverage this is close to adequate, but with no output schema the description could usefully sketch what an alert record contains or note pagination behavior. Ordering is the only return-value hint provided.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter including defaults (limit=100, status=active, since_hours=168) is already documented in the schema. The description adds no parameter-level meaning such as filter interaction or severity values, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a clear resource (alerts), scope (this organization's agents), and ordering (newest first), which is enough to distinguish it from the agent-oriented siblings list_agents and get_agent. It does not explicitly name those siblings or contrast itself with them, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no mention of alternatives such as get_fleet_summary for aggregate health, and no exclusions or prerequisites. The agent must infer from the name alone that this is the tool for retrieving alert rows.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
1 tool update
- Added
get_device_context
4 tool updates
- First observed
get_agent - First observed
get_fleet_summary - First observed
list_agents - First observed
list_alerts
Related MCP Connectors
Read-only honeypot observations and evidence. Invite-only API key; request access on our website.
Read-only access to your Auditon vulnerability scans: findings, endpoints, reports and changes.
Read-only MCP access to a documented IT fleet: state, changes, posture. 15 tools.
Read-only access to your Infrly services, deploys, logs, metrics and billing.
Related MCP Servers
- AlicenseNot gradedqualityBmaintenanceEnables AI agents to read protected computers and their check-ins, computer groups, approval requests, the unified audit log, and child organizations through a zero-trust endpoint security portal API. Every operation is read-only, with credentials supplied per request as headers and never stored.Apache 2.0
- AlicenseNot gradedqualityBmaintenanceEnables MCP clients to query endpoint agent fleets through a local read-only bridge to a hosted upstream, listing agents, retrieving per-agent health details, viewing alerts, and getting organisation-level summaries.MIT
- AlicenseAqualityBmaintenanceEnables read-only access to Teramind's employee-monitoring metadata, including computer and agent inventory, departments, alerts, anomaly rules, behavior policies, and monitoring profiles.16Apache 2.0
- AlicenseCqualityBmaintenanceProvides read-only access to DNSFilter's DNS security and filtering API, enabling users to query organizations, networks, policies, categories, block pages, and traffic and threat reports.57Apache 2.0
Glama MCP Gateway
Add one secure layer between your agents and this server.