Skip to main content
Glama

Netmon (demo)

capture_list

Read-onlyIdempotent

Read-only listing of packet captures. Wraps GET /api/captures. Operators see their own captures; admin (sa) sees all. The upstream endpoint returns the 200 most-recent rows ordered by id desc.

Use this for 'is there a capture running on device X?' / 'do we have packet evidence for the incident?' / 'what captures finished today?' questions. Pair with capture_get to drill into one row.

Each row carries: id, user_id, device_id, label, status (starting|running|stopped|expired|failed), filter (jsonb), started_at, ended_at, expires_at, packets, bytes, byte_cap.

Filters (client-side, AND-combined): device_id, status, search (substring on label).

Read-only is deliberate: capture creation, stop, delete, and pcapng download endpoints are NOT wrapped. PCAP bytes aren't an LLM-shaped payload anyway.

Permission: capture. Examples: capture_list({}) capture_list({status: 'running'}) capture_list({device_id: 42, status: 'stopped'})

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
pageNo1-indexed page number (default 1).
searchNoCase-insensitive substring on label.
statusNoRestrict by lifecycle state.
per_pageNoRows per page (default 50, max 200).
device_idNoRestrict to one device id.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, and the description reinforces this with 'Read-only is deliberate' and explains why pcapng bytes aren't suitable for LLM output. It adds concrete behavioral details beyond annotations: the upstream returns the 200 most-recent rows ordered by id desc, filters are client-side AND-combined, and it lists exact row fields (id, user_id, device_id, status, etc.). This gives the agent a clear model of what to expect without contradicting annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized: it front-loads the core purpose and endpoint, then covers usage, row fields, filters, exclusions, and permission, ending with three concise examples. Every sentence earns its place; no filler. The structure makes it easy to scan for the key decision points, and the examples are short and illustrative. It is appropriately sized for the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only list tool with no output schema, the description is remarkably complete. It specifies the exact row fields returned, pagination defaults (per_page default 50, max 200), filter semantics, and the ordering behavior. It also mentions the permission requirement and provides usage examples. An agent has everything needed to invoke it correctly and interpret the response, so nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so every parameter already has a description in the input schema. The description adds minor context beyond that: it notes filters are 'client-side, AND-combined' and clarifies search is a substring on label (already in schema). It also demonstrates usage with examples like capture_list({status: 'running'}). These are helpful but not essential given the schema's completeness, so a baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise verb-resource pair ('Read-only listing of packet captures') and immediately ties it to a concrete endpoint ('Wraps GET /api/captures'). It also distinguishes itself from sibling capture_get by stating it lists while capture_get drills into a single row, and clarifies what it does NOT cover (creation, stop, delete, pcapng download). An agent can confidently select this tool over siblings without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly tells when to use it via concrete question examples ('is there a capture running on device X?', 'do we have packet evidence?') and pairs it with capture_get for deeper inspection. It also states exclusions ('creation, stop, delete, and pcapng download endpoints are NOT wrapped') and explains why, giving clear when-not guidance. This goes beyond mere context and provides actionable selection criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.