io.github.AIops-tools/symantec-edr-aiops

edr_file_entities

Read-only

Search file entities in Symantec EDR to investigate endpoint incidents and events. Query file records to support read-only security analysis.

Instructions

[READ] Search file entities.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "query": "<query>"
    },
    "name": "edr_file_entities"
  }
}

Input Schema

Name	Required	Description	Default
`limit`	No
`query`	Yes
`next_cursor`	No

Schema Changelog

Changes observed during successful MCP inspections.

First observedv0.1.0Nov 7, 2026

TDQS

C2.4/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, so the "[READ]" prefix adds nothing beyond structured data. Nothing is said about query syntax, result scope, ordering, or how next_cursor pagination behaves, which are the behaviors an agent actually needs for a search tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is terse and front-loaded, but the brevity comes from omission rather than efficiency. The "[READ]" tag is redundant with the readOnlyHint annotation and consumes part of a single-sentence description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a search endpoint with an undocumented required query parameter, no output schema, and a confusing singular sibling, this definition leaves out essentials: query format and the distinction from edr_file_entity. An agent cannot reliably construct a correct call from it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across three parameters, so the description carries the full burden and fails to. The only clue is that "Search" implies query semantics; there is no mention of what query accepts, what limit defaults to, or how next_cursor should be passed back.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

"Search file entities" gives a specific verb and resource, so the basic operation is identifiable. However, it does not distinguish this from the singular sibling edr_file_entity or from edr_adversary_files, leaving the agent unable to tell which file-related tool to pick without opening both schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use or when-not-to-use guidance whatsoever. With a near-identical sibling (edr_file_entity) and other file-oriented siblings, the absence of any routing hint is a real gap rather than an implied triviality.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.