Skip to main content
Glama

Find the lines that are lying

find_impersonators
Read-onlyIdempotent

Only the lines claiming a crawler whose operator publishes address ranges, from an address in none of them — 1984 IPv4 and 1062 IPv6 prefixes, 15 sources. Reverse-DNS operators come back with the command to run: this server makes no outbound request. Example: log='203.0.113.9 Googlebot/2.1' returns one impersonation.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
logYesThe log text. Lines need an address to be checkable.

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint and idempotentHint annotations, the description adds valuable behavioral context: the server makes no outbound request, and reverse-DNS operators come back with a command to run. This clarifies a non-obvious implementation detail and helps the agent understand side-effect-free behavior. The data scope (1984 IPv4, 1062 IPv6 prefixes, 15 sources) also adds transparency about what the tool knows.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is relatively short and includes essential information: what it does, data scope, behavioral note, and an example. However, the first sentence is grammatically dense and awkwardly structured, which reduces readability. The information is packed but not optimally organized or front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description should clarify the return value. It states 'returns one impersonation' and mentions a command to run, but the exact output format is vague (e.g., just the line, a structured result, or a command string). The behavioral note about no outbound requests is helpful, but the return contract could be more explicit for an agent to invoke the tool confidently.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although the schema already describes the 'log' parameter and notes that an address is needed, the description adds meaningful semantics: the expected format (e.g., '203.0.113.9 Googlebot/2.1'), the filtering logic, and an example output. This goes beyond the schema's basic description, giving the agent concrete expectations for input.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific function: it filters log lines that claim a crawler identity whose source IP is not in the operator's published address ranges, i.e., detects impersonations. This is distinct from the sibling tools' focus areas (robots extraction, operator summary, triage, WAF rules). The first sentence is somewhat convoluted, so it loses a point for clarity, but the title and example reinforce the purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied: given a log line with an IP address, the tool determines whether a claimed crawler is impersonated. The example demonstrates how to invoke it. However, there is no explicit guidance on when to choose this tool over siblings or when not to use it, leaving the agent to infer the appropriate context from the description and tool name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A3.6/5.0
Disambiguation4/5

Most tools have clearly separate deliverables: triage_log is the full per-line report with rollups, summarize_by_operator is aggregate-only, find_impersonators is contradiction-only, and the two config generators produce different artifacts. Some overlap exists because triage_log can also surface rollups and address contradictions, but the descriptions make the boundaries clear.

Naming Consistency3/5

The names mix conventions: verb+object (find_impersonators, triage_log), verb+preposition+object (summarize_by_operator), and output+from_log (robots_from_log, waf_ruleset_from_log). The from_log suffix is a useful clue, but the set lacks a single predictable naming pattern.

Tool Count5/5

Five tools is well-scoped for a cawler log triage server: one full analyzer, two focused analyzers, and two artifact generators. Each tool has a clear deliverable and none feels like filler.

Completeness4/5

The workflow from raw log input to analysis, aggregation, Impoersonation detection, and defensive config generation is covered. A minor gap is the absence of a direct prefix-allowlist generator, since the WAF guidance points at allowlisting published prefixes as the real fix for impersonation.

Resources