Skip to main content
Glama
Sign In

PatrolTech

by online.patroltech
OverviewDiscussionsAdmin

Incident list

patroltech_incidents_list
Read-onlyIdempotent

Use when you want to see open or recent incidents, with their status and priority. Returns incidents from newest to oldest with their position in the list (number), id, title, status (open, in_progress, resolved, closed or dismissed), priority (low, medium, high or critical), assignee and date (UTC). Incidents older than the data retention period come without their title. To refer to one later, use its title or id. Do not use when you need scans or rounds.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "patroltech_incidents_list"
  }
}

Input Schema

NameRequiredDescriptionDefault
statusNoOnly the incidents with this status. Omit it to see all.
organizationNoOmit unless the account has more than one organization; then the exact name (or id) as listed by patroltech_account_get_context.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnly, idempotent, non-destructive), and the description adds behavior annotations do not: sort order (newest to oldest), a positional `number`, UTC dating, and the non-obvious retention rule that old incidents lose their title. That retention caveat is exactly the kind of surprise an agent needs warned about before interpreting results.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The trigger comes first, the return shape second, the retention edge case third, and the exclusion last — a sensible priority order. Every sentence carries distinct information with no filler or repetition of the title.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the full burden of describing the return shape, and it does so thoroughly (ordering, identifier fields, enum domains, assignee, date). The one gap is scale: nothing says whether the list is bounded, paginated, or unlimited, which matters for an agent deciding whether to call it or narrow the query.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so both parameters are already fully documented, including the status enum and the organization-omission rule. The description restates the status values and mentions using title or `id` to refer back, but contributes no syntax or filtering nuance the schema lacks. Baseline 3 applies when the schema carries the load.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource ("see open or recent incidents") and immediately scopes it with the fields returned (status, priority). It is trivially distinguishable from patroltech_incidents_get (single incident) and the rounds/scans siblings, which it explicitly names.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives both a positive trigger ("Use when you want to see open or recent incidents") and an explicit exclusion ("Do not use when you need scans or rounds"). What it omits is the sibling alternative patroltech_incidents_get for fetching a single incident's full detail, so the routing between the two incident tools is left implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All PatrolTech toolsInspect
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources