Skip to main content
Glama

Netmon (demo)

by com.netmon
OverviewDiscussionsAdmin

top_bandwidth

Read-onlyIdempotent

Top NetFlow conversations over the last N minutes — the 'who's eating bandwidth right now?' question. Wraps GET /api/getTopBandwidth/{mins}, the same query that powers the dashboard live widget.

Use this for short-window 'right now' inquiries. For longer windows (hours-to-days) or filtered top-talkers, use netflow_search instead — that tool has the rich filter set; this one is the live snapshot.

Server-side cap: top 20 conversations by in-window bytes descending. We don't expose top_n — the upstream endpoint hardcodes the limit and there's no value in lying about that to the LLM.

Each row: {src_host, src_id, src_ip, dst_host, dst_id, dst_ip, bytes, bps}. Hostnames come from the _dns view (PTR + custom overrides); src_id/dst_id are populated when the IP matches a monitored device. bytes is the conversation's in-window share (pro-rated), and bps is averaged across the window — not a live rate.

Permission: vne. Examples: top_bandwidth({minutes: 5}) top_bandwidth({minutes: 60})

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
minutesNoLookback window in minutes (1-1440 / 24h). Default 5. Matched by OVERLAP across the raw and aggregated flow tables with bytes pro-rated to the window, so long lookbacks are honest — not capped by the ~15-minute raw horizon.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite rich annotations (readOnlyHint, idempotentHint, destructiveHint), the description adds substantial behavioral context: the hardcoded 20-conversation cap, the absence of top_n, how hostnames are resolved, how bytes are pro-rated, and how bps is averaged. This goes far beyond what annotations provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loaded, with a clear purpose, usage guidance, output row shape, permission, and examples. Every section adds value and no sentence is redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple (one optional parameter), but the description covers the return shape, row semantics, permissions, example calls, and the key sibling comparison. With no output schema, this is fully sufficient for an agent to call the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although schema coverage is 100%, the description enriches the minutes parameter with crucial semantics: the OVERLAP-matching behavior, pro-rating to the window, and why long lookbacks remain honest. This adds meaning beyond the schema's basic type and default.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: it returns top NetFlow conversations over a window, wrapping a specific endpoint and answering a clear question. It distinguishes itself from netflow_search by being the live snapshot tool, so an agent can tell it apart immediately.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage guidance is explicit: use for short-window 'right now' inquiries, and use netflow_search for longer windows or filtered top-talkers. It names the alternative and the condition that selects it, leaving nothing to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Netmon (demo) toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources