Retrieve user groups known to a Palo Alto firewall via User-ID. Use this to list current user groups for policy checks or troubleshooting without configuration changes.
[READ-ONLY] Retrieves user groups known to the firewall via User-ID. Executes: show user group list.
| Name | Required | Description | Default |
|---|---|---|---|
| firewall | No | Target firewall name (from firewalls.json). Required when multiple firewalls are configured; optional otherwise. |
Changes observed during successful MCP inspections.
v1.3.30Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark this as read-only and non-destructive, and the description reinforces this with the explicit `[READ-ONLY]` label and the underlying `show user group list` command. This adds behavioral context beyond the structured annotations, making the read-only execution model clear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: it declares read-only status, states the action, and includes the exact command in two short sentences. Every element earns its place with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only list operation with one optional parameter and no output schema, the description provides enough to invoke the tool correctly. It could be more complete by noting response format or when to prefer it over sibling User-ID tools, but those are minor gaps given the operation's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single optional `firewall` parameter, so the schema already fully documents parameters. The description adds no additional parameter-level meaning, which is acceptable under the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Retrieves') and resource ('user groups known to the firewall via User-ID'), and backs it with the exact CLI command (`show user group list`). It is clear what the tool does, though it does not explicitly contrast itself with sibling tools like `get_userid_mappings` or `get_userid_config`.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus related siblings, no mention of prerequisites, and no context about the optional `firewall` parameter being needed when multiple firewalls are configured. Usage is only implied by the tool's basic purpose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.