LoginLlama
Server Details
Ask questions about your login security data: risk scores, blocked logins, Tor, VPN and bot traffic.
- Status
- Healthy
- Uptime
- 41.3% over 21 days
- Last Tested
- Transport
- Streamable HTTP · MCP 2024-11-05
- URL
- ChatGPT
- –
- Claude
- –
TDQS
Scored across 5 tools
get_average_risk_score overlaps heavily with get_login_stats (which also returns average risk score and supports the same filters), and get_login_breakdown returns per-group averages too, so three tools can produce risk-score numbers. Descriptions do distinguish the shapes (single number vs. summary vs. grouped), but an agent could easily pick the wrong one for a 'what's my average risk score' question.
All five tools follow a strict get_<noun> snake_case pattern (get_account_usage, get_average_risk_score, get_login_breakdown, get_login_stats, get_recent_logins). No mixing of verbs or casing styles.
Five tools is a well-scoped surface for a login-risk analytics server, with one account tool and four analytics tools. The only quibble is that get_average_risk_score is largely subsumed by get_login_stats, making it slightly padded.
The read-only analytics lifecycle is reasonably covered (usage, summary, breakdown, recent list, aggregate score), but there is no way to fetch a single login check by ID or drill into an individual high-risk event, and no trend/time-series operation. These are notable gaps for investigating flagged logins.
Available Tools
5 toolsget_account_usageAInspect
Your LoginLlama account usage: remaining API credits for production and staging, and plan name.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry behavioral disclosure. It indicates a read-only retrieval (via 'get' and 'Your account usage') and enumerates some return content, but does not state auth requirements, rate limits, or confirm no side effects. For a simple no-param read tool this is adequate but not fully transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence that immediately states the resource and the key return fields. Every clause contributes useful information with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter account-usage tool without an output schema, the description gives the essential return values: production and staging credit balances plus plan name. It could be slightly more complete by noting read-only behavior or authentication needs, but it is sufficient for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the schema baseline is 4. The description appropriately adds no parameter detail because none exist, and instead focuses on return values.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the exact resource (LoginLlama account usage) and specifies the returned data: remaining API credits for production and staging, and plan name. This clearly distinguishes it from sibling tools like get_login_stats and get_recent_logins, which report login activity rather than account-level usage.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The purpose implies the tool is used when an agent needs to check account status or remaining API credits, but the description offers no explicit when-to-use guidance or comparison with sibling tools. The implied context is sufficient to select it for account usage, but it doesn't help an agent choose between this and other account-related queries if any existed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_average_risk_scoreAInspect
Average login risk score (0-10) across matching logins. Use the filters to answer questions like "what is my average login risk score for the chrome browser".
| Name | Required | Description | Default |
|---|---|---|---|
| os | No | Filter by operating system e.g. "windows". | |
| days | No | Look back this many days (default 30). Omit for all time. | |
| device | No | Filter by device e.g. "iphone". | |
| browser | No | Filter by browser, case-insensitive partial match e.g. "chrome". | |
| country | No | Filter by country e.g. "United States". | |
| identity_key | No | Filter to a single user identifier (email, user id, etc). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It does disclose the output scale (0-10) and that the result is an average across matching logins, which is useful. It omits key behaviors such as permission requirements, what happens when no logins match, and whether all-time data is included when filters are omitted.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences and front-loads the metric and scale before giving the usage example. Every sentence adds information without repetition or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only aggregate tool with fully documented parameters and no output schema, the description covers the core return value (0-10 average risk score) and filtering intent. It is nearly complete, though it could mention empty-result behavior or default scope.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all six parameters in detail. The description adds only a single example showing that filters answer targeted questions; it does not add syntax, combination behavior, or precedence beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the exact metric returned (average login risk score, 0-10) and the domain (matching logins). It does not explicitly distinguish this aggregate metric from siblings like get_login_stats or get_login_breakdown, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The example question ('what is my average login risk score for the chrome browser') gives an implied usage scenario and shows how filters apply. However, it provides no explicit when-to-use versus alternatives, no exclusions, and no guidance on choosing between this and sibling tools such as get_login_stats.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_login_breakdownAInspect
Group logins by a dimension (browser, os, device, country, or status) and return counts, average risk score and high-risk counts per group. Good for "which browser has the highest risk".
| Name | Required | Description | Default |
|---|---|---|---|
| os | No | Filter by operating system e.g. "windows". | |
| days | No | Look back this many days (default 30). Omit for all time. | |
| top_n | No | Max groups to return (default 20). | |
| device | No | Filter by device e.g. "iphone". | |
| browser | No | Filter by browser, case-insensitive partial match e.g. "chrome". | |
| country | No | Filter by country e.g. "United States". | |
| dimension | Yes | The attribute to group by. | |
| identity_key | No | Filter to a single user identifier (email, user id, etc). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden; it does disclose the return payload shape (grouped counts, average risk, high-risk counts), which is genuinely useful. However, it does not say how groups are ordered or what top_n truncates by, nor whether this is a permissioned read, leaving a material ambiguity for an 8-parameter aggregation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the operation and its output, then a usage example. No filler or redundant restatement of the title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 8 parameters, no annotations and no output schema, the description does well to describe the returned fields. But the ordering/truncation behavior behind top_n and the scope of the filters relative to grouping are unstated, leaving a notable gap for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so every parameter including the dimension enum is already documented, and the description largely restates the dimension values. It adds no syntax or interaction semantics (e.g., how dimension interacts with the browser/os/device filters) beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Group logins by a dimension") and enumerates the dimensions, plus what each group returns (counts, average risk score, high-risk counts). It is clearly an aggregation tool, implicitly distinct from get_recent_logins or get_login_stats, but it never names a sibling to sharpen the boundary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The line "Good for 'which browser has the highest risk'" gives a concrete selection scenario, which is real guidance rather than none. It offers no exclusions or explicit alternatives (e.g., when to use get_average_risk_score instead), so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_login_statsAInspect
Overall login security summary for your team: total checks, average risk score, high-risk count, blocked/failed logins, and bot/Tor/VPN counts. Supports filtering by browser, OS, country, device, user and time window.
| Name | Required | Description | Default |
|---|---|---|---|
| os | No | Filter by operating system e.g. "windows". | |
| days | No | Look back this many days (default 30). Omit for all time. | |
| device | No | Filter by device e.g. "iphone". | |
| browser | No | Filter by browser, case-insensitive partial match e.g. "chrome". | |
| country | No | Filter by country e.g. "United States". | |
| identity_key | No | Filter to a single user identifier (email, user id, etc). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the full behavioral burden. It does disclose the returned metrics and the fact that results are scoped 'for your team', but says nothing about read-only semantics, permissions, or whether counts are aggregated across the team versus per user.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero waste: the metric list comes first, then the supported filters. Nothing redundant and nothing buried.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description correctly enumerates the return values an agent needs. Filtering and team scope are covered; only the aggregation granularity and read-only nature are left unstated, which are minor for a stats endpoint.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the six filter parameters (os, days, device, browser, country, identity_key) are already fully documented with examples. The description's list of filter dimensions only restates the schema and adds no syntax, default, or matching-behavior detail beyond it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Names a specific resource (login security summary) and enumerates the metrics it returns (total checks, average risk score, high-risk count, blocked/failed logins, bot/Tor/VPN counts). It does not distinguish itself from siblings such as get_average_risk_score or get_login_breakdown, which overlap on the same subject matter.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Overall login security summary' implies a dashboard-style aggregate use, but the description never states when to prefer this over get_login_breakdown, get_average_risk_score, or get_recent_logins. Usage is left to be inferred from the wording.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_recent_loginsBInspect
List the most recent login checks (newest first) with risk score, status, location and device. Supports the same filters.
| Name | Required | Description | Default |
|---|---|---|---|
| os | No | Filter by operating system e.g. "windows". | |
| days | No | Look back this many days (default 30). Omit for all time. | |
| limit | No | How many to return (default 25, max 100). | |
| device | No | Filter by device e.g. "iphone". | |
| status | No | Filter by status, e.g. "valid" or "invalid". | |
| browser | No | Filter by browser, case-insensitive partial match e.g. "chrome". | |
| country | No | Filter by country e.g. "United States". | |
| identity_key | No | Filter to a single user identifier (email, user id, etc). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden; it does disclose default sort order and the shape of returned records, which is useful. It stops short of stating read-only semantics, that limits are capped, or how results paginate past the default 25.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core action and ordering, with no filler. The dangling 'same filters' clause is the only weak spot, but the text is otherwise tight.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description partially compensates by naming returned fields, and the fully documented schema covers inputs. However, the unresolved 'same filters' reference and the absence of any read-only/safety framing leave an agent with open questions for an 8-parameter tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all 8 parameters are already documented with examples and defaults in the schema, setting a baseline of 3. The description adds nothing parameter-specific beyond the vague 'same filters' phrase.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List the most recent login checks') and adds ordering (newest first) plus the fields returned (risk score, status, location, device). It implies a raw-listing tool, distinguishable from aggregate siblings like get_login_stats and get_login_breakdown, though it never names them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Supports the same filters' refers to filters the agent cannot see defined anywhere in this definition or schema, forcing inference. There is no statement of when to use this listing versus get_login_breakdown, get_login_stats, or get_average_risk_score.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
- First observed
get_account_usage - First observed
get_average_risk_score - First observed
get_login_breakdown - First observed
get_login_stats - First observed
get_recent_logins
Related MCP Connectors
Check IPDetective usage and investigate IP bot, VPN, proxy, ASN and country signals.
Signup fraud checks: score emails and IPs, look up IPs and manage your blocklist.
Fraud risk score for signups and orders from email, IP, phone and user-agent
Ask questions about your support tickets, chats, agents and AI answer quality, with cited tickets.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceEnables IP address lookups and risk assessments for IPv4/IPv6, providing geolocation, ISP/ASN, and security flags such as VPN, proxy, Tor, datacenter, and mobile with a risk score.652 npmMIT
- AlicenseNot gradedqualityDmaintenanceProvides comprehensive IP and domain security intelligence, enabling analysis of IP addresses and domains for threat and reputation information.1MIT

relayshield-mcpofficial
AlicenseAqualityBmaintenanceSecurity intelligence for AI agents — breach detection, SIM swap, domain lookalikes, OAuth watchlist, and malware scanning. Subscription or x402 PAYG.11MIT- FlicenseNot gradedqualityDmaintenanceEnables querying and managing AI logs through tools like listing logs, retrieving jobs, and performing AI-powered chat queries. Also provides access to gateway security reports and guardrail testing.-
Glama MCP Gateway
Add one secure layer between your agents and this server.