Skip to main content
Glama

Whisper

by io.github.whisper-sec
OverviewDiscussionsAdmin

lookupTlsFingerprint

whisper_lookupTlsFingerprint
Read-only

Look up a TLS (JA3/JA4) fingerprint in the graph. Answers without an API key. Example call: {"skill":"lookupTlsFingerprint","input":"ja3:771,4865-4866-4867"}

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
inputYesThe indicator to look up: a domain, an IP address, an ASN or a file hash. The example passes ja3:771,4865-4866-4867.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
rowsYesThe answers, one object per row, keyed by the column names above. An empty array means the question was understood and nothing matched, which is an answer and not a failure.
columnsYesThe column names, in order. Every row object has exactly these keys, so this is the row shape and reading it is cheaper than inspecting a row.
statisticsNoWhat the query cost.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • changedOutput schema / (root)
      Previous value: -nullNew value: +{
+  "description": "A tabular graph answer: the column names, the rows keyed by them, and the cost.",
+  "properties": {
+    "columns": {
+      "description": "The column names, in order. Every row object has exactly these keys, so this is the row shape and reading it is cheaper than inspecting a row.",
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "rows": {
+      "description": "The answers, one object per row, keyed by the column names above. An empty array means the question was understood and nothing matched, which is an answer and not a failure.",
+      "items": {
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "statistics": {
+      "description": "What the query cost.",
+      "properties": {
+        "executionTimeMs": {
+          "description": "Milliseconds the graph spent answering.",
+          "type": "integer"
+        },
+        "rowCount": {
+          "description": "How many rows came back.",
+          "type": "integer"
+        }
+      },
+      "required": [
+        "rowCount"
+      ],
+      "type": "object"
+    }
+  },
+  "required": [
+    "columns",
+    "rows"
+  ],
+  "type": "object"
+}
  2. Added
  3. Removed
  4. Added

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, and destructiveHint, so the safety profile is covered. The description adds value by noting that no API key is required, a behavioral trait not present in the annotations. The phrase 'in the graph' gives context about the data source. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise: two sentences plus an example, all informative. The main purpose is front-loaded, and the example call is immediately useful. There is no filler or redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has only one parameter, an output schema, and annotations, so complexity is low. However, the input semantics are ambiguous: the description implies the input should be a TLS fingerprint, while the schema lists domains, IPs, ASNs, and file hashes. The example helps but does not fully clarify whether all these indicator types are accepted or if only JA3/JA4 strings should be passed. This ambiguity prevents a higher score.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description's example call demonstrates a concrete input format, but the schema already contains this example. The description does not clarify the discrepancy between the tool name (TLS fingerprint) and the schema's broader indicator types (domain, IP, ASN, file hash), so it adds minimal semantic value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Look up a TLS (JA3/JA4) fingerprint' and provides an example call. This clearly distinguishes it from sibling tools like lookupTorRelay by the fingerprint type. The 'in the graph' phrase and example make the tool's purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The only guidance is 'Answers without an API key,' which is a benefit rather than a when-to-use condition. It does not mention alternatives, prerequisites, or when not to use this tool. No comparison to siblings like lookupTorRelay is provided, leaving the agent to infer appropriate usage from the name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Whisper toolsInspect
Try in Browser
Context Every Agent Can ShareAgents share what they learn, hand off work, and keep it when you switch models. Start with 5 GB free.fulcradynamics.comAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources