OneUptime

List Security Cases

list_security_cases

Read-only

List Security Cases, with the total count.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "list_security_cases"
  }
}

Input Schema

Name	Required	Description
`skip`	No
`sort`	No	For example {"createdAt":"DESC"}.
`limit`	No	Default: 10, maximum: 100.
`query`	No	A field's value, or an operator such as {"_type":"GreaterThan","value":...}. Fields and operators: oneuptime_describe_resource.
`select`	No	Omit for all but entities, mitreTactics, mitreTechniques, customFields.

Schema Changelog

Changes observed during successful MCP inspections.

Changed5 schema fields changedNov 6, 2026

changedInput schema / properties / limit / description

Previous value: -"Records to return. Default: 10, maximum: 100."New value: +"Default: 10, maximum: 100."

changedInput schema / properties / query / description

Previous value: -"Filter. Each field takes a value (exact match) or an operator, such as {\"_type\":\"GreaterThan\",\"value\":...}. Fields and operators: oneuptime_describe_resource."New value: +"A field's value, or an operator such as {\"_type\":\"GreaterThan\",\"value\":...}. Fields and operators: oneuptime_describe_resource."

changedInput schema / properties / select / description

Previous value: -"Field names to return. Omit for all but these large fields: entities, mitreTactics, mitreTechniques, customFields."New value: +"Omit for all but entities, mitreTactics, mitreTechniques, customFields."

removedInput schema / properties / skip / description
```
Removed value: -"Records to skip. Default: 0."
```

changedInput schema / properties / sort / description

Previous value: -"Fields to sort by. Example: {\"createdAt\":\"DESC\"}."New value: +"For example {\"createdAt\":\"DESC\"}."

Changed9 schema fields changedNov 4, 2026

changedInput schema / properties / limit / description

Previous value: -"Maximum number of records to return. Default: 10, Maximum: 100."New value: +"Records to return. Default: 10, maximum: 100."

changedInput schema / properties / query / additionalProperties
```
Previous value: -falseNew value: +true
```

changedInput schema / properties / query / description

Previous value: -"Filter criteria for Security Cases. Each field accepts a direct value (exact match) or an operator object {\"_type\": \"<Operator>\", \"value\": ...}. Operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween (numbers/dates), Search (partial text), Includes (array of values). Example — items from the last 24 hours: {\"createdAt\": {\"_type\": \"GreaterThan\", \"value\": \"2026-01-01T00:00:00.000Z\"}}."New value: +"Filter. Each field takes a value (exact match) or an operator, such as {\"_type\":\"GreaterThan\",\"value\":...}. Fields and operators: oneuptime_describe_resource."

removedInput schema / properties / query / properties

Removed value: -{
-  "_id": {
-    "description": "Query operators for _id field of type Object ID. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes",
-    "example": {
-      "_type": "EqualTo",
-      "value": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-    },
-    "type": "object"
-  },
-  "acknowledgeDueAt": {
-    "description": "Query operators for acknowledgeDueAt field of type Date. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween",
-    "example": {
-      "_type": "EqualTo",
-      "value": "2023-01-01T00:00:00.000Z"
-    },
-    "type": "object"
-  },
-  "acknowledgeMissedAt": {
-    "description": "Query operators for acknowledgeMissedAt field of type Date. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween",
-    "example": {
-      "_type": "EqualTo",
-      "value": "2023-01-01T00:00:00.000Z"
-    },
-    "type": "object"
-  },
-  "acknowledgeWarnedAt": {
-    "description": "Query operators for acknowledgeWarnedAt field of type Date. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween",
-    "example": {
-      "_type": "EqualTo",
-      "value": "2023-01-01T00:00:00.000Z"
-    },
-    "type": "object"
-  },
-  "acknowledgedAt": {
-    "description": "Query operators for acknowledgedAt field of type Date. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween",
-    "example": {
-      "_type": "EqualTo",
-      "value": "2023-01-01T00:00:00.000Z"
-    },
-    "type": "object"
-  },
-  "aiSuggestedPlaybookId": {
-    "description": "Query operators for aiSuggestedPlaybookId field of type Object ID. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes",
-    "example": {
-      "_type": "EqualTo",
-      "value": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-    },
-    "type": "object"
-  },
-  "aiSuggestedSecurityCasePriorityId": {
-    "description": "Query operators for aiSuggestedSecurityCasePriorityId field of type Object ID. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes",
-    "example": {
-      "_type": "EqualTo",
-      "value": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-    },
-    "type": "object"
-  },
-  "aiTriagePromptInjectionSuspected": {
-    "description": "Query operators for aiTriagePromptInjectionSuspected field of type Boolean. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull",
-    "example": {
-      "_type": "EqualTo",
-      "value": true
-    },
-    "type": "object"
-  },
-  "aiTriageReport": {
-    "description": "Query operators for aiTriageReport field of type Markdown. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes",
-    "example": {
-      "_type": "EqualTo",
-      "value": "example_value_1"
-    },
-    "type": "object"
-  },
-  "aiTriagedAt": {
-    "description": "Query operators for aiTriagedAt field of type Date. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween",
-    "example": {
-      "_type": "EqualTo",
-      "value": "2023-01-01T00:00:00.000Z"
-    },
-    "type": "object"
-  },
-  "aiVerdict": {
-    "description": "Query operators for aiVerdict field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes",
-    "example": {
-      "_type": "EqualTo",
-      "value": "John Doe"
-    },
-    "type": "object"
-  },
-  "assignedToTeamId": {
-    "description": "Query operators for assignedToTeamId field of type Object ID. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes",
-    "example": {
-      "_type": "EqualTo",
-      "value": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-    },
-    "type": "object"
-  },
-  "assignedToUserId": {
-    "description": "Query operators for assignedToUserId field of type Object ID. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes",
-    "example": {
-      "_type": "EqualTo",
-      "value": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-    },
-    "type": "object"
-  },
-  "caseNumber": {
-    "description": "Query operators for caseNumber field of type Number. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween",
-    "example": {
-      "_type": "EqualTo",
-      "value": 50
-    },
-    "type": "object"
-  },
-  "caseNumberWithPrefix": {
-    "description": "Query operators for caseNumberWithPrefix field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes",
-    "example": {
-      "_type": "EqualTo",
-      "value": "John Doe"
-    },
-    "type": "object"
-  },
-  "closedAt": {
-    "description": "Query operators for closedAt field of type Date. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween",
-    "example": {
-      "_type": "EqualTo",
-      "value": "2023-01-01T00:00:00.000Z"
-    },
-    "type": "object"
-  },
-  "closedByUserId": {
-    "description": "Query operators for closedByUserId field of type Object ID. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes",
-    "example": {
-      "_type": "EqualTo",
-      "value": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-    },
-    "type": "object"
-  },
-  "closingNote": {
-    "description": "Query operators for closingNote field of type Markdown. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes",
-    "example": {
-      "_type": "EqualTo",
-      "value": "example_value_1"
-    },
-    "type": "object"
-  },
-  "containDueAt": {
-    "description": "Query operators for containDueAt field of type Date. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween",
-    "example": {
-      "_type": "EqualTo",
-      "value": "2023-01-01T00:00:00.000Z"
-    },
-    "type": "object"
-  },
-  "containMissedAt": {
-    "description": "Query operators for containMissedAt field of type Date. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween",
-    "example": {
-      "_type": "EqualTo",
-      "value": "2023-01-01T00:00:00.000Z"
-    },
-    "type": "object"
-  },
-  "containWarnedAt": {
-    "description": "Query operators for containWarnedAt field of type Date. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween",
-    "example": {
-      "_type": "EqualTo",
-      "value": "2023-01-01T00:00:00.000Z"
-    },
-    "type": "object"
-  },
-  "containedAt": {
-    "description": "Query operators for containedAt field of type Date. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween",
-    "example": {
-      "_type": "EqualTo",
-      "value": "2023-01-01T00:00:00.000Z"
-    },
-    "type": "object"
-  },
-  "createdAt": {
-    "description": "Query operators for createdAt field of type Date. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween",
-    "example": {
-      "_type": "EqualTo",
-      "value": "2023-01-01T00:00:00.000Z"
-    },
-    "type": "object"
-  },
-  "createdByUserId": {
-    "description": "Query operators for createdByUserId field of type Object ID. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes",
-    "example": {
-      "_type": "EqualTo",
-      "value": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-    },
-    "type": "object"
-  },
-  "deletedAt": {
-    "description": "Query operators for deletedAt field of type Date. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween",
-    "example": {
-      "_type": "EqualTo",
-      "value": "2023-01-01T00:00:00.000Z"
-    },
-    "type": "object"
-  },
-  "deletedByUserId": {
-    "description": "Query operators for deletedByUserId field of type Object ID. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes",
-    "example": {
-      "_type": "EqualTo",
-      "value": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-    },
-    "type": "object"
-  },
-  "description": {
-    "description": "Query operators for description field of type Markdown. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes",
-    "example": {
-      "_type": "EqualTo",
-      "value": "example_value_1"
-    },
-    "type": "object"
-  },
-  "detectionCount": {
-    "description": "Query operators for detectionCount field of type Number. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween",
-    "example": {
-      "_type": "EqualTo",
-      "value": 50
-    },
-    "type": "object"
-  },
-  "entities": {
-    "description": "Query operators for entities field of type JSON. Supported operators: EqualTo, NotEqual, IsNull, NotNull",
-    "example": {
-      "_type": "EqualTo",
-      "value": "example_value_1"
-    },
-    "type": "object"
-  },
-  "firstDetectedAt": {
-    "description": "Query operators for firstDetectedAt field of type Date. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween",
-    "example": {
-      "_type": "EqualTo",
-      "value": "2023-01-01T00:00:00.000Z"
-    },
-    "type": "object"
-  },
-  "groupingKey": {
-    "description": "Query operators for groupingKey field of type Long Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes",
-    "example": {
-      "_type": "EqualTo",
-      "value": "example_value_1"
-    },
-    "type": "object"
-  },
-  "incidentId": {
-    "description": "Query operators for incidentId field of type Object ID. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes",
-    "example": {
-      "_type": "EqualTo",
-      "value": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-    },
-    "type": "object"
-  },
-  "labels": {
-    "description": "Query operators for labels field of type Entity Array. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes",
-    "example": {
-      "_type": "EqualTo",
-      "value": "example_value_1"
-    },
-    "type": "object"
-  },
-  "lastDetectedAt": {
-    "description": "Query operators for lastDetectedAt field of type Date. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween",
-    "example": {
-      "_type": "EqualTo",
-      "value": "2023-01-01T00:00:00.000Z"
-    },
-    "type": "object"
-  },
-  "mitreTactics": {
-    "description": "Query operators for mitreTactics field of type JSON. Supported operators: EqualTo, NotEqual, IsNull, NotNull",
-    "example": {
-      "_type": "EqualTo",
-      "value": "example_value_1"
-    },
-    "type": "object"
-  },
-  "mitreTechniques": {
-    "description": "Query operators for mitreTechniques field of type JSON. Supported operators: EqualTo, NotEqual, IsNull, NotNull",
-    "example": {
-      "_type": "EqualTo",
-      "value": "example_value_1"
-    },
-    "type": "object"
-  },
-  "nextDueAt": {
-    "description": "Query operators for nextDueAt field of type Date. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween",
-    "example": {
-      "_type": "EqualTo",
-      "value": "2023-01-01T00:00:00.000Z"
-    },
-    "type": "object"
-  },
-  "nextTargetCheckAt": {
-    "description": "Query operators for nextTargetCheckAt field of type Date. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween",
-    "example": {
-      "_type": "EqualTo",
-      "value": "2023-01-01T00:00:00.000Z"
-    },
-    "type": "object"
-  },
-  "notifiedSecurityCasePriorityId": {
-    "description": "Query operators for notifiedSecurityCasePriorityId field of type Object ID. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes",
-    "example": {
-      "_type": "EqualTo",
-      "value": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-    },
-    "type": "object"
-  },
-  "projectId": {
-    "description": "Query operators for projectId field of type Object ID. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes",
-    "example": {
-      "_type": "EqualTo",
-      "value": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-    },
-    "type": "object"
-  },
-  "securityCasePriorityId": {
-    "description": "Query operators for securityCasePriorityId field of type Object ID. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes",
-    "example": {
-      "_type": "EqualTo",
-      "value": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-    },
-    "type": "object"
-  },
-  "securityCaseStatusId": {
-    "description": "Query operators for securityCaseStatusId field of type Object ID. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes",
-    "example": {
-      "_type": "EqualTo",
-      "value": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-    },
-    "type": "object"
-  },
-  "source": {
-    "description": "Query operators for source field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes",
-    "example": {
-      "_type": "EqualTo",
-      "value": "John Doe"
-    },
-    "type": "object"
-  },
-  "title": {
-    "description": "Query operators for title field of type Long Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes",
-    "example": {
-      "_type": "EqualTo",
-      "value": "example_value_1"
-    },
-    "type": "object"
-  },
-  "updatedAt": {
-    "description": "Query operators for updatedAt field of type Date. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween",
-    "example": {
-      "_type": "EqualTo",
-      "value": "2023-01-01T00:00:00.000Z"
-    },
-    "type": "object"
-  },
-  "verdict": {
-    "description": "Query operators for verdict field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes",
-    "example": {
-      "_type": "EqualTo",
-      "value": "John Doe"
-    },
-    "type": "object"
-  },
-  "version": {
-    "description": "Query operators for version field of type Number. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween",
-    "example": {
-      "_type": "EqualTo",
-      "value": 50
-    },
-    "type": "object"
-  }
-}

changedInput schema / properties / select / description

Previous value: -"Optional: field names to return for each Security Case (e.g. [\"_id\", \"name\"]). Omit to get all readable fields. Large fields excluded by default (request explicitly if needed): entities, mitreTactics, mitreTechniques."New value: +"Field names to return. Omit for all but these large fields: entities, mitreTactics, mitreTechniques, customFields."

changedInput schema / properties / skip / description

Previous value: -"Number of records to skip for pagination. Default: 0. Example: skip=10 to start from the 11th record."New value: +"Records to skip. Default: 0."

changedInput schema / properties / sort / additionalProperties

Previous value: -falseNew value: +{
+  "enum": [
+    "ASC",
+    "DESC"
+  ],
+  "type": "string"
+}

changedInput schema / properties / sort / description

Previous value: -"Sort order for results. Use \"ASC\" for ascending or \"DESC\" for descending. Example: {\"createdAt\": \"DESC\"} to sort by newest first."New value: +"Fields to sort by. Example: {\"createdAt\":\"DESC\"}."

removedInput schema / properties / sort / properties

Removed value: -{
-  "_id": {
-    "description": "Sort order for _id field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "acknowledgeDueAt": {
-    "description": "Sort order for acknowledgeDueAt field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "acknowledgeMissedAt": {
-    "description": "Sort order for acknowledgeMissedAt field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "acknowledgeWarnedAt": {
-    "description": "Sort order for acknowledgeWarnedAt field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "acknowledgedAt": {
-    "description": "Sort order for acknowledgedAt field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "aiSuggestedPlaybookId": {
-    "description": "Sort order for aiSuggestedPlaybookId field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "aiSuggestedSecurityCasePriorityId": {
-    "description": "Sort order for aiSuggestedSecurityCasePriorityId field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "aiTriagePromptInjectionSuspected": {
-    "description": "Sort order for aiTriagePromptInjectionSuspected field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "aiTriagedAt": {
-    "description": "Sort order for aiTriagedAt field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "aiVerdict": {
-    "description": "Sort order for aiVerdict field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "assignedToTeamId": {
-    "description": "Sort order for assignedToTeamId field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "assignedToUserId": {
-    "description": "Sort order for assignedToUserId field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "caseNumber": {
-    "description": "Sort order for caseNumber field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "caseNumberWithPrefix": {
-    "description": "Sort order for caseNumberWithPrefix field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "closedAt": {
-    "description": "Sort order for closedAt field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "closedByUserId": {
-    "description": "Sort order for closedByUserId field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "containDueAt": {
-    "description": "Sort order for containDueAt field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "containMissedAt": {
-    "description": "Sort order for containMissedAt field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "containWarnedAt": {
-    "description": "Sort order for containWarnedAt field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "containedAt": {
-    "description": "Sort order for containedAt field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "createdAt": {
-    "description": "Sort order for createdAt field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "createdByUserId": {
-    "description": "Sort order for createdByUserId field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "deletedAt": {
-    "description": "Sort order for deletedAt field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "deletedByUserId": {
-    "description": "Sort order for deletedByUserId field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "detectionCount": {
-    "description": "Sort order for detectionCount field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "firstDetectedAt": {
-    "description": "Sort order for firstDetectedAt field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "groupingKey": {
-    "description": "Sort order for groupingKey field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "incidentId": {
-    "description": "Sort order for incidentId field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "lastDetectedAt": {
-    "description": "Sort order for lastDetectedAt field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "nextDueAt": {
-    "description": "Sort order for nextDueAt field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "nextTargetCheckAt": {
-    "description": "Sort order for nextTargetCheckAt field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "notifiedSecurityCasePriorityId": {
-    "description": "Sort order for notifiedSecurityCasePriorityId field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "projectId": {
-    "description": "Sort order for projectId field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "securityCasePriorityId": {
-    "description": "Sort order for securityCasePriorityId field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "securityCaseStatusId": {
-    "description": "Sort order for securityCaseStatusId field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "source": {
-    "description": "Sort order for source field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "title": {
-    "description": "Sort order for title field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "updatedAt": {
-    "description": "Sort order for updatedAt field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "verdict": {
-    "description": "Sort order for verdict field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  },
-  "version": {
-    "description": "Sort order for version field",
-    "enum": [
-      "ASC",
-      "DESC"
-    ],
-    "example": "ASC",
-    "type": "string"
-  }
-}

Changed16 schema fields changedOct 30, 2026

addedInput schema / properties / query / properties / acknowledgeDueAt

Added value: +{
+  "description": "Query operators for acknowledgeDueAt field of type Date. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween",
+  "example": {
+    "_type": "EqualTo",
+    "value": "2023-01-01T00:00:00.000Z"
+  },
+  "type": "object"
+}

addedInput schema / properties / query / properties / acknowledgeMissedAt

Added value: +{
+  "description": "Query operators for acknowledgeMissedAt field of type Date. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween",
+  "example": {
+    "_type": "EqualTo",
+    "value": "2023-01-01T00:00:00.000Z"
+  },
+  "type": "object"
+}

addedInput schema / properties / query / properties / acknowledgeWarnedAt

Added value: +{
+  "description": "Query operators for acknowledgeWarnedAt field of type Date. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween",
+  "example": {
+    "_type": "EqualTo",
+    "value": "2023-01-01T00:00:00.000Z"
+  },
+  "type": "object"
+}

addedInput schema / properties / query / properties / containDueAt

Added value: +{
+  "description": "Query operators for containDueAt field of type Date. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween",
+  "example": {
+    "_type": "EqualTo",
+    "value": "2023-01-01T00:00:00.000Z"
+  },
+  "type": "object"
+}

addedInput schema / properties / query / properties / containMissedAt

Added value: +{
+  "description": "Query operators for containMissedAt field of type Date. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween",
+  "example": {
+    "_type": "EqualTo",
+    "value": "2023-01-01T00:00:00.000Z"
+  },
+  "type": "object"
+}

addedInput schema / properties / query / properties / containWarnedAt

Added value: +{
+  "description": "Query operators for containWarnedAt field of type Date. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween",
+  "example": {
+    "_type": "EqualTo",
+    "value": "2023-01-01T00:00:00.000Z"
+  },
+  "type": "object"
+}

addedInput schema / properties / query / properties / nextDueAt

Added value: +{
+  "description": "Query operators for nextDueAt field of type Date. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween",
+  "example": {
+    "_type": "EqualTo",
+    "value": "2023-01-01T00:00:00.000Z"
+  },
+  "type": "object"
+}

addedInput schema / properties / query / properties / nextTargetCheckAt

Added value: +{
+  "description": "Query operators for nextTargetCheckAt field of type Date. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween",
+  "example": {
+    "_type": "EqualTo",
+    "value": "2023-01-01T00:00:00.000Z"
+  },
+  "type": "object"
+}

addedInput schema / properties / sort / properties / acknowledgeDueAt

Added value: +{
+  "description": "Sort order for acknowledgeDueAt field",
+  "enum": [
+    "ASC",
+    "DESC"
+  ],
+  "example": "ASC",
+  "type": "string"
+}

addedInput schema / properties / sort / properties / acknowledgeMissedAt

Added value: +{
+  "description": "Sort order for acknowledgeMissedAt field",
+  "enum": [
+    "ASC",
+    "DESC"
+  ],
+  "example": "ASC",
+  "type": "string"
+}

addedInput schema / properties / sort / properties / acknowledgeWarnedAt

Added value: +{
+  "description": "Sort order for acknowledgeWarnedAt field",
+  "enum": [
+    "ASC",
+    "DESC"
+  ],
+  "example": "ASC",
+  "type": "string"
+}

addedInput schema / properties / sort / properties / containDueAt

Added value: +{
+  "description": "Sort order for containDueAt field",
+  "enum": [
+    "ASC",
+    "DESC"
+  ],
+  "example": "ASC",
+  "type": "string"
+}

addedInput schema / properties / sort / properties / containMissedAt

Added value: +{
+  "description": "Sort order for containMissedAt field",
+  "enum": [
+    "ASC",
+    "DESC"
+  ],
+  "example": "ASC",
+  "type": "string"
+}

addedInput schema / properties / sort / properties / containWarnedAt

Added value: +{
+  "description": "Sort order for containWarnedAt field",
+  "enum": [
+    "ASC",
+    "DESC"
+  ],
+  "example": "ASC",
+  "type": "string"
+}

addedInput schema / properties / sort / properties / nextDueAt

Added value: +{
+  "description": "Sort order for nextDueAt field",
+  "enum": [
+    "ASC",
+    "DESC"
+  ],
+  "example": "ASC",
+  "type": "string"
+}

addedInput schema / properties / sort / properties / nextTargetCheckAt

Added value: +{
+  "description": "Sort order for nextTargetCheckAt field",
+  "enum": [
+    "ASC",
+    "DESC"
+  ],
+  "example": "ASC",
+  "type": "string"
+}

Changed16 schema fields changedOct 26, 2026

removedInput schema / properties / query / properties / aiSuggestedPriority

Removed value: -{
-  "description": "Query operators for aiSuggestedPriority field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes",
-  "example": {
-    "_type": "EqualTo",
-    "value": "John Doe"
-  },
-  "type": "object"
-}

addedInput schema / properties / query / properties / aiSuggestedSecurityCasePriorityId

Added value: +{
+  "description": "Query operators for aiSuggestedSecurityCasePriorityId field of type Object ID. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes",
+  "example": {
+    "_type": "EqualTo",
+    "value": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
+  },
+  "type": "object"
+}

removedInput schema / properties / query / properties / notifiedPriority

Removed value: -{
-  "description": "Query operators for notifiedPriority field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes",
-  "example": {
-    "_type": "EqualTo",
-    "value": "John Doe"
-  },
-  "type": "object"
-}

addedInput schema / properties / query / properties / notifiedSecurityCasePriorityId

Added value: +{
+  "description": "Query operators for notifiedSecurityCasePriorityId field of type Object ID. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes",
+  "example": {
+    "_type": "EqualTo",
+    "value": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
+  },
+  "type": "object"
+}

removedInput schema / properties / query / properties / priority

Removed value: -{
-  "description": "Query operators for priority field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes",
-  "example": {
-    "_type": "EqualTo",
-    "value": "John Doe"
-  },
-  "type": "object"
-}

addedInput schema / properties / query / properties / securityCasePriorityId

Added value: +{
+  "description": "Query operators for securityCasePriorityId field of type Object ID. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes",
+  "example": {
+    "_type": "EqualTo",
+    "value": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
+  },
+  "type": "object"
+}

addedInput schema / properties / query / properties / securityCaseStatusId

Added value: +{
+  "description": "Query operators for securityCaseStatusId field of type Object ID. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes",
+  "example": {
+    "_type": "EqualTo",
+    "value": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
+  },
+  "type": "object"
+}

removedInput schema / properties / query / properties / status

Removed value: -{
-  "description": "Query operators for status field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes",
-  "example": {
-    "_type": "EqualTo",
-    "value": "John Doe"
-  },
-  "type": "object"
-}

removedInput schema / properties / sort / properties / aiSuggestedPriority

Removed value: -{
-  "description": "Sort order for aiSuggestedPriority field",
-  "enum": [
-    "ASC",
-    "DESC"
-  ],
-  "example": "ASC",
-  "type": "string"
-}

addedInput schema / properties / sort / properties / aiSuggestedSecurityCasePriorityId

Added value: +{
+  "description": "Sort order for aiSuggestedSecurityCasePriorityId field",
+  "enum": [
+    "ASC",
+    "DESC"
+  ],
+  "example": "ASC",
+  "type": "string"
+}

removedInput schema / properties / sort / properties / notifiedPriority

Removed value: -{
-  "description": "Sort order for notifiedPriority field",
-  "enum": [
-    "ASC",
-    "DESC"
-  ],
-  "example": "ASC",
-  "type": "string"
-}

addedInput schema / properties / sort / properties / notifiedSecurityCasePriorityId

Added value: +{
+  "description": "Sort order for notifiedSecurityCasePriorityId field",
+  "enum": [
+    "ASC",
+    "DESC"
+  ],
+  "example": "ASC",
+  "type": "string"
+}

removedInput schema / properties / sort / properties / priority

Removed value: -{
-  "description": "Sort order for priority field",
-  "enum": [
-    "ASC",
-    "DESC"
-  ],
-  "example": "ASC",
-  "type": "string"
-}

addedInput schema / properties / sort / properties / securityCasePriorityId

Added value: +{
+  "description": "Sort order for securityCasePriorityId field",
+  "enum": [
+    "ASC",
+    "DESC"
+  ],
+  "example": "ASC",
+  "type": "string"
+}

addedInput schema / properties / sort / properties / securityCaseStatusId

Added value: +{
+  "description": "Sort order for securityCaseStatusId field",
+  "enum": [
+    "ASC",
+    "DESC"
+  ],
+  "example": "ASC",
+  "type": "string"
+}

removedInput schema / properties / sort / properties / status

Removed value: -{
-  "description": "Sort order for status field",
-  "enum": [
-    "ASC",
-    "DESC"
-  ],
-  "example": "ASC",
-  "type": "string"
-}

Changed11 schema fields changedOct 23, 2026

addedInput schema / properties / query / properties / aiSuggestedPlaybookId

Added value: +{
+  "description": "Query operators for aiSuggestedPlaybookId field of type Object ID. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes",
+  "example": {
+    "_type": "EqualTo",
+    "value": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
+  },
+  "type": "object"
+}

addedInput schema / properties / query / properties / aiSuggestedPriority

Added value: +{
+  "description": "Query operators for aiSuggestedPriority field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes",
+  "example": {
+    "_type": "EqualTo",
+    "value": "John Doe"
+  },
+  "type": "object"
+}

addedInput schema / properties / query / properties / aiTriagePromptInjectionSuspected

Added value: +{
+  "description": "Query operators for aiTriagePromptInjectionSuspected field of type Boolean. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull",
+  "example": {
+    "_type": "EqualTo",
+    "value": true
+  },
+  "type": "object"
+}

addedInput schema / properties / query / properties / aiTriageReport

Added value: +{
+  "description": "Query operators for aiTriageReport field of type Markdown. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes",
+  "example": {
+    "_type": "EqualTo",
+    "value": "example_value_1"
+  },
+  "type": "object"
+}

addedInput schema / properties / query / properties / aiTriagedAt

Added value: +{
+  "description": "Query operators for aiTriagedAt field of type Date. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween",
+  "example": {
+    "_type": "EqualTo",
+    "value": "2023-01-01T00:00:00.000Z"
+  },
+  "type": "object"
+}

addedInput schema / properties / query / properties / aiVerdict

Added value: +{
+  "description": "Query operators for aiVerdict field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes",
+  "example": {
+    "_type": "EqualTo",
+    "value": "John Doe"
+  },
+  "type": "object"
+}

addedInput schema / properties / sort / properties / aiSuggestedPlaybookId

Added value: +{
+  "description": "Sort order for aiSuggestedPlaybookId field",
+  "enum": [
+    "ASC",
+    "DESC"
+  ],
+  "example": "ASC",
+  "type": "string"
+}

addedInput schema / properties / sort / properties / aiSuggestedPriority

Added value: +{
+  "description": "Sort order for aiSuggestedPriority field",
+  "enum": [
+    "ASC",
+    "DESC"
+  ],
+  "example": "ASC",
+  "type": "string"
+}

addedInput schema / properties / sort / properties / aiTriagePromptInjectionSuspected

Added value: +{
+  "description": "Sort order for aiTriagePromptInjectionSuspected field",
+  "enum": [
+    "ASC",
+    "DESC"
+  ],
+  "example": "ASC",
+  "type": "string"
+}

addedInput schema / properties / sort / properties / aiTriagedAt

Added value: +{
+  "description": "Sort order for aiTriagedAt field",
+  "enum": [
+    "ASC",
+    "DESC"
+  ],
+  "example": "ASC",
+  "type": "string"
+}

addedInput schema / properties / sort / properties / aiVerdict

Added value: +{
+  "description": "Sort order for aiVerdict field",
+  "enum": [
+    "ASC",
+    "DESC"
+  ],
+  "example": "ASC",
+  "type": "string"
+}

Changed2 schema fields changedOct 22, 2026

addedInput schema / properties / query / properties / notifiedPriority

Added value: +{
+  "description": "Query operators for notifiedPriority field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes",
+  "example": {
+    "_type": "EqualTo",
+    "value": "John Doe"
+  },
+  "type": "object"
+}

addedInput schema / properties / sort / properties / notifiedPriority

Added value: +{
+  "description": "Sort order for notifiedPriority field",
+  "enum": [
+    "ASC",
+    "DESC"
+  ],
+  "example": "ASC",
+  "type": "string"
+}

First observedOct 19, 2026

TDQS

C2.8/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, destructiveHint=false, and openWorldHint=false, so the safety profile is covered without the description's help. The description contributes one behavioral fact beyond the annotations: the response includes a total count alongside the records, which matters for pagination decisions. It stops short of describing default ordering, whether the count reflects post-filter totals, or result-set size behavior, so it only partially earns credit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The single clause is front-loaded and free of padding; nothing is wasted and the one value-adding detail (total count) is stated immediately. However, brevity here shades into under-specification rather than disciplined economy, which keeps it from a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a five-parameter listing tool with a nested query object and no output schema, so the description carries real explanatory burden: which entity fields are filterable, what a case record contains, how total count interacts with skip/limit. It delivers only one return-value fact and defers filterable-field knowledge to oneuptime_describe_resource without naming it here. For a tool of this complexity, that leaves meaningful gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 80%, so the schema already explains limit defaults (10, max 100), sort syntax, query operator conventions, and select omissions. The description adds no parameter meaning at all. With coverage this high, a baseline 3 is the appropriate score and no penalty applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description restates the tool name and title almost verbatim ('List Security Cases') and adds one substantive detail: results come back 'with the total count.' That detail hints at the return shape, but nothing distinguishes it from close siblings such as count_security_cases, list_security_case_evidence, or get_security_case, so an agent must infer the boundary itself.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool rather than count_security_cases (same resource, count only) or get_security_case (single record). No prerequisites, no mention of pagination strategy even though skip/limit exist, and no exclusions. The agent gets the topic but not the routing rule.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All OneUptime tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.