Skip to main content
Glama

Netmon (demo)

by com.netmon
OverviewDiscussionsAdmin

log_severity_summary

Read-onlyIdempotent

Count log events grouped by severity over a time window. One tool, three backends — pass stream to pick which.

stream='syslog' → wraps /api/syslog/sevSum (severity 0-7, syslog scheme) stream='eventlog' → wraps /api/eventlog/sevSum (severity 0-5, Windows scheme) stream='eve' → wraps /api/eve/sevSum (severity 1-3, Suricata scheme)

Use this for triage before pulling rows: 'how many criticals on host X today' returns one tight rollup instead of 1000 sample rows. Every result includes both the numeric key and a label so the LLM doesn't have to memorize three different scales.

Window: hours (1-168, default 24) OR start_time+end_time (ISO-8601 UTC). Optional device_id narrows to one device — for eve, the controller translates this to a src_ip OR dst_ip match automatically (eve_log has no device_id column).

ALL-ZERO IS NOT THE SAME AS CLEAN. A dead feed and a quiet network produce byte-identical answers here, so every response carries meta.stream_health: active — events landed inside your window; the counts mean what they say. stale — your window is empty, but the stream produced up to last_event_at, before it. The feed is alive and the empty window is real. silent — nothing in your window AND nothing in the 168h before it. Never report 'clean' from this state; note names the producer to check first. unknown — freshness could not be established. The zeros prove nothing. stale/silent come from re-asking the same stream over a window that strictly contains yours (one extra call, and only when every bucket is zero). No staleness threshold is guessed: stale means exactly 'the newest event predates the window you asked for', which on a 1-hour window is unremarkable. checked_back_hours and events_before_window say how much history the verdict rests on.

Permission: logs. Tag-scoped server-side.

Example: log_severity_summary({stream: 'syslog', hours: 1, device_id: 42})

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
hoursNoLookback hours (1-168). Default 24.
streamYesWhich log stream to summarize: 'syslog', 'eventlog', or 'eve'.
end_timeNoISO-8601 UTC; pairs with start_time.
device_idNoRestrict to a single device id (for eve, translated to src_ip/dst_ip server-side).
start_timeNoISO-8601 UTC; pairs with end_time.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the readOnlyHint/idempotentHint/destructiveHint annotations by spelling out the surprising safety property: all-zero results are not proof the stream is clean. It enumerates the four stream_health states, the extra verification call for stale/silent verdicts, and the permission requirement, giving an agent a robust model of the tool's runtime behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is paragraph-form but extremely well structured: a one-sentence summary, a stream list, a usage guidance note, and a separate stream-health section. Every sentence earns its place; no fluff or repetition. The most critical safety information (ALL-ZERO IS NOT SAME AS CLEAN) is emphasized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given three backends, a window selection, device filtering, and the risk of misleading zero-results, the description covers all branches. It even mentions the permission model ('logs. Tag-scoped server-side') and explains the meaning of meta.stream_health. There is no output schema, but the description says what to expect ('numeric key and label') and how to interpret it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description coverage is already 100%, but the tool description adds parameter meaning beyond the schema: it maps the stream enum to the underlying endpoints and severity ranges (0-7, 0-5, 1-3), explains the window alternatives, and clarifies the eve device_id translation. This fills in the semantics the schema alone cannot convey.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb, resource, and scope: 'Count log events grouped by severity over a time window.' It distinguishes itself from row-returning same-family tools by saying it returns 'one tight rollup instead of 1000 sample rows,' so an agent can tell when to call this vs syslog_search/eve_search/eventlog_search.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit usage rule: 'Use this for triage before pulling rows.' It also details stream selection, end-time pairing, and the device_id translation for eve. Does not name the exact sibling tools to switch to when rows are needed, but the distinction from 'pulling rows' is clear and actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Netmon (demo) toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources