Skip to main content
Glama

Netmon (demo)

flow_summary

Read-onlyIdempotent

Summarize one host's network conversations: top peers, top ports, and a client-vs-service-side split, each with a residual "other" bucket plus overall totals. Wraps GET /api/aggnetflow/summary (permission: vne). Use this to characterize a host before pulling rows — netflow_search returns the individual conversations once a rollup here points at an interesting peer or port.

Source is the windowed flow view: the raw table's live tail (the last ~15 minutes — cleanup_netflow deletes raw rows as it rolls them up) unioned with the aggregated history (agg_netflow, retained 4 weeks), so one call covers right-now through a month back with no gap at the rollup boundary.

Byte totals are IN-WINDOW estimates, not lifetime totals. The window predicate is OVERLAP — a conversation crossing either edge still matches — but each matching row contributes only its bytes pro-rated to the window (uniform-rate attribution), so the totals approximate window traffic instead of bounding it from above. Still never quote a byte figure as a rate.

Direction is normalized on both arms (the lower port of each conversation becomes dst_port — raw-tail rows are re-oriented the same way on read) and the rollup folds BOTH directions into one row, so sent-vs-received bytes do not exist in this data. The direction split is as_source (host was the client side) vs as_destination (host was the service side), each carrying bidirectional bytes.

conversations counts rows, not distinct conversations — a long-lived conversation contributes one row per 15-minute roll-up tick, plus per-flow rows for its not-yet-rolled-up raw tail.

Window: hours (default 24, max 168) OR start_time+end_time; an explicit window is held to the same 168-hour ceiling server-side — agg_netflow is BRIN-indexed on time now, but a summary still aggregates every overlapping row under a 10s statement timeout. A window too wide comes back as an error asking you to narrow it, not as partial data.

limit is the top-N per rollup (default 20, max 100); what falls outside it is reported in that rollup's other bucket, so totals always reconcile.

Tag-scoped server-side on the conversation ENDPOINTS: for a tag-restricted caller every returned conversation has an in-tag device on one side. The requested host gets no separate membership test, so naming an out-of-scope host is allowed and simply returns the subset of its conversations that touch a device you can already see.

Example: flow_summary({ip: '10.0.0.5', hours: 24, limit: 10})

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
ipYesREQUIRED. The host to summarize. Matched on either side of the conversation (src_ip OR dst_ip) — no direction needs to be known or guessed.
hoursNoLookback hours (1-168). Default 24.
limitNoTop-N entries per rollup (1-100). Default 20. The remainder is summarized in each rollup's `other` bucket.
end_timeNoISO-8601 UTC; pairs with start_time.
start_timeNoISO-8601 UTC; pairs with end_time. The span is still capped at 168 hours.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, destructiveHint, etc., but the description goes far beyond them: byte totals are window-approximate, rows vs conversations distinction, direction semantics (as_source/as_destination), server-side 168-hour ceiling, 10-second statement timeout, tag scoping on endpoints only, and error behavior for too-wide windows. This is rich behavioral context not derivable from annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but every section carries necessary behavioral detail: window semantics, direction handling, row counting, tag scoping, and error behavior. It is front-loaded with the core purpose and organized by topic. Slightly longer than strictly minimal, but every sentence adds value for a complex tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers return structure, default/max limits, window interactions, timeout behavior, row-count semantics, direction normalization, tag scoping, and example usage. It leaves little for an agent to guess. No output schema exists, so the description's explanation of what each returned section means is essential and well supplied.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although schema coverage is 100%, the description adds crucial semantics: ip matches on either endpoint, hours vs start_time/end_time with server-side ceiling, limit meaning with `other` bucket reconciliation, and the row-count vs conversation-count meaning of `conversations`. This goes well beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence names the exact verb and resource ('Summarize one host's network conversations'), specifies the outputs (top peers, top ports, other buckets), and contrasts with netflow_search ('before pulling rows'). This makes the tool's purpose unambiguous and distinct from siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says to use this tool before pulling rows with netflow_search, and gives concrete usage context: when to use hours vs start_time/end_time, how limit behaves, and which sibling to consult for raw rows. This is direct when-to-use guidance with implicit exclusion of alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.