Retrieves recent login and boot session records for managed endpoints, filtered by target and look-back window, to aid login-storm analysis and auditing.
[READ] Recent login/boot sessions (endpoint, user, login_ms, boot_ms, result).
Args: since_hours: Look-back window in hours (1..720, default 24). target: Endpoint-management target name from config; omit for the default.
| Name | Required | Description | Default |
|---|---|---|---|
| target | No | ||
| since_hours | No |
Changes observed during successful MCP inspections.
v0.1.0Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true plus the '[READ]' tag make the safety profile explicit, so the description isn't carrying that burden. It adds value by listing the returned record fields, but says nothing about result ordering, pagination, volume limits, or what 'result' encodes, and the 1..720 hour cap is the only real constraint surfaced.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the [READ] marker and resource, then a compact Args block covering both parameters. No filler sentences; every line carries information the agent needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter read tool with no output schema, the description compensates by enumerating returned fields and documenting both args. It is nearly complete, though it omits ordering/pagination behavior and any note on whether the default target requires configured credentials.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% (the schema only carries titles and defaults), so the description must compensate and largely does: since_hours is documented with its range and default (1..720, default 24), and target is explained as an endpoint-management target name from config with the omit-for-default behavior. Only minor gaps remain, e.g., what a named target actually scopes.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb+resource ('[READ] Recent login/boot sessions') and enumerates the returned fields (endpoint, user, login_ms, boot_ms, result), so the agent knows exactly what comes back. It distinguishes itself functionally from login_storm_analysis and endpoint_list by being a raw session feed, but it does not explicitly route against those siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: 'Recent login/boot sessions' plus a since_hours look-back window suggests a time-bounded recent-activity query, but there is no explicit when-to-use, when-not-to-use, or named alternative (e.g., login_storm_analysis for aggregated anomaly detection). The target arg's 'omit for the default' note gives minor contextual guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.