AWS‑IReveal‑MCP
AWS-IReveal-MCP provides a unified interface for querying and analyzing AWS services for incident response and security investigations via the Model Context Protocol. You can use it to:
CloudTrail: Investigate management and data events with granular filtering by IP, role, user, and bucket.
Athena: Run SQL queries against CloudTrail logs for detailed analysis.
CloudWatch: Search, filter, and analyze log groups and streams for operational insights.
GuardDuty: List detectors, retrieve findings, and get statistics to identify threats.
AWS Config: Track recorder status, discovered resources, configuration history, and compliance status.
VPC Flow Logs: Describe and analyze network traffic metadata.
Network Access Analyzer: List scopes, start analyses, and retrieve findings for network reachability.
IAM Access Analyzer: Examine access policies and findings to identify potential security issues.
Provides a unified interface to AWS services for security investigation, including CloudTrail, Athena, CloudWatch, GuardDuty, AWS Config, VPC Flow Logs, Network Access Analyzer, and IAM Access Analyzer for tracing activities, examining data events, searching logs, and analyzing security alerts.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@AWS‑IReveal‑MCPanalyze activity by IP 192.168.1.100 in the last 3 days"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
AWS‑IReveal‑MCP
AWS‑IReveal‑MCP is a Model Context Protocol (MCP) server designed to give security teams and incident responders a unified interface to AWS services useful for investigation. By connecting AWS‑IReveal‑MCP to any MCP client (such as Claude Desktop or Cline), you can invoke queries and analyses across multiple AWS services without leaving your LLM‑driven workspace.
Features
AWS‑IReveal‑MCP integrates with the following AWS services and functionalities:
CloudTrail — Management event logs for API activity
Amazon Athena — SQL queries over CloudTrail logs
CloudWatch — Operational logs and ad hoc analysis
Amazon GuardDuty — Threat detection and finding investigation
AWS Config — Resource configuration history and compliance status
VPC Flow Logs — Network traffic metadata for forensic analysis
Network Access Analyzer — Reachability checks across SG/NACL/VPC
IAM Access Analyzer — Policy and resource‑based access findings
Together, these services let you
Trace “who did what, when, and where” (CloudTrail, Config)
Examine detailed data events (Athena)
Search and visualize logs (CloudWatch, VPC Flow Logs)
Surface security alerts (GuardDuty, IAM Access Analyzer)
Verify network reachability and configuration (Network Access Analyzer)
Example Prompts
analyze activity by IP x.x.x.x in the last 5 days
analyze activity by role 'sysadmin' in the last 24 hours
investigate suspicious activity on cloudtrail in the last 7 days on us-west-2
is there any data event on buckets with name containing 'customers' in the last 7 days?
investigate cloudwatch logs related to Bedrock
propose remediations for GuardDuty findings with high risk happened in the last 2 days
identify non-compliant resources, explain violated rules, and suggest remediation
Related MCP server: mcp-server-wazuh
Installation
Prerequisites
Install UV with:
curl -Ls https://astral.sh/uv/install.sh | shClone the repo and set up the environment (this will install the required dependencies):
git clone https://github.com/Brucedh/aws-ireveal-mcp.git
cd aws-ireveal-mcp
uv venv
source .venv/bin/activateConfiguration
Add the following configuration to your MCP client's settings file:
{
"mcpServers": {
"aws-ireveal": {
"command": "uv",
"args": [
"--directory",
"/path_to_your/aws-ireveal-mcp",
"run",
"server.py"
],
"env": {
"AWS_PROFILE": "<YOUR_PROFILE>"
}
}
}
}Available Tools
25 toolsaccessanalyzer_get_analyzerB
Retrieve details of a specific analyzer by name.
Parameters:
aws_region (str): The AWS region - use 'us-east-1' if not specified.
analyzer_name (str): The name of the analyzer to retrieve.
Returns:
str: JSON-formatted details of the analyzer.
| Name | Required | Description | Default |
|---|---|---|---|
| aws_region | Yes | ||
| analyzer_name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool retrieves details (implying a read-only operation) and returns JSON-formatted data, but lacks information on authentication requirements, error handling, rate limits, or whether it's a safe operation. This leaves significant gaps for a tool interacting with AWS services.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized and front-loaded with the core purpose in the first sentence. The parameter and return sections are structured clearly with bullet points, avoiding redundancy. Every sentence adds value without waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 2 parameters with 0% schema coverage and an output schema (which handles return values), the description is moderately complete. It explains parameter meanings and return format, but as a tool with no annotations and AWS context, it should ideally mention authentication or error behaviors to be fully helpful for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaningful semantics beyond the input schema, which has 0% description coverage. It explains that 'aws_region' is 'The AWS region' with a default value hint ('use us-east-1 if not specified'), and 'analyzer_name' is 'The name of the analyzer to retrieve'. This compensates well for the schema's lack of descriptions, though it doesn't detail format constraints or examples.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Retrieve' and the resource 'details of a specific analyzer by name', which is specific and unambiguous. However, it doesn't explicitly differentiate from sibling tools like 'accessanalyzer_list_analyzers' (list vs. get specific), though the 'by name' specification implies this distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'accessanalyzer_list_analyzers' for listing all analyzers or 'accessanalyzer_get_finding' for different data. It lacks explicit when/when-not instructions or prerequisite context, offering only basic parameter hints.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
accessanalyzer_get_findingA
Retrieve detailed information about a single finding.
Parameters:
aws_region (str): The AWS region - use 'us-east-1' if not specified.
analyzer_arn (str): The ARN of the analyzer.
finding_id (str): The ID of the finding to retrieve.
Returns:
str: JSON-formatted details of the finding.
| Name | Required | Description | Default |
|---|---|---|---|
| aws_region | Yes | ||
| analyzer_arn | Yes | ||
| finding_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool 'retrieves' information, implying a read-only operation, but doesn't clarify authentication requirements, rate limits, error conditions, or what 'detailed information' includes beyond the return statement. For a tool with zero annotation coverage, this leaves significant behavioral gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and appropriately sized. It starts with a clear purpose statement, then lists parameters with brief explanations, and ends with return information. Every sentence adds value without redundancy, making it easy to parse and understand quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (3 parameters, no annotations, but with an output schema), the description is reasonably complete. It covers the purpose, parameters, and return format. The output schema existence means the description doesn't need to detail return values, but it could benefit from more behavioral context (e.g., error handling). It's adequate but not exhaustive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds substantial meaning beyond the input schema, which has 0% description coverage. It explains each parameter's purpose: 'aws_region' with a default value hint, 'analyzer_arn' as the ARN of the analyzer, and 'finding_id' as the ID to retrieve. This fully compensates for the schema's lack of descriptions, providing clear semantic context for all three parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Retrieve detailed information about a single finding.' It uses a specific verb ('retrieve') and identifies the resource ('single finding'). However, it doesn't explicitly distinguish this from sibling tools like 'accessanalyzer_list_findings' or 'guardduty_get_findings', which would require a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention sibling tools like 'accessanalyzer_list_findings' for listing multiple findings or 'guardduty_get_findings' for similar functionality in a different service. There's no context about prerequisites or when-not-to-use scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
accessanalyzer_list_analyzersB
List all IAM Access Analyzer analyzers in the specified region.
Parameters:
aws_region (str): The AWS region - use 'us-east-1' if not specified.
Returns:
str: JSON-formatted list of analyzers.
| Name | Required | Description | Default |
|---|---|---|---|
| aws_region | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden but offers minimal behavioral context. It mentions the return format ('JSON-formatted list'), but lacks details on permissions required, rate limits, pagination, error handling, or what constitutes an 'analyzer' in this context. This is inadequate for a tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is highly concise and well-structured, with three clear sections (purpose, parameters, returns) in just three sentences. Every sentence adds value without redundancy, making it easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple input schema (1 parameter) and presence of an output schema (implied by 'Returns' statement), the description is moderately complete. However, with no annotations and minimal behavioral context, it falls short of fully preparing an agent for effective use, especially regarding operational constraints.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaningful context for the single parameter by specifying a default value ('use 'us-east-1' if not specified'), which isn't in the schema (0% coverage). However, it doesn't explain the parameter's role beyond 'AWS region' or validate region formats, leaving some gaps in understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('List all IAM Access Analyzer analyzers') and resource ('in the specified region'), making the purpose unambiguous. However, it doesn't explicitly differentiate from sibling tools like 'accessanalyzer_list_findings' or 'guardduty_list_detectors', which prevents a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention sibling tools like 'accessanalyzer_get_analyzer' for detailed views or 'accessanalyzer_list_findings' for related data, nor does it specify prerequisites or exclusions for usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
accessanalyzer_list_findingsA
List findings for an analyzer, with optional filter.
filter: {'resourceType': {'eq': ['AWS::S3::Bucket']}, ...}
Parameters:
aws_region (str): The AWS region - use 'us-east-1' if not specified.
analyzer_arn (str): The ARN of the analyzer to list findings for.
filter (dict, optional): Filter criteria for findings.
max_results (int): Maximum number of findings to return.
Returns:
str: JSON-formatted list of findings.
| Name | Required | Description | Default |
|---|---|---|---|
| aws_region | Yes | ||
| analyzer_arn | Yes | ||
| filter | No | ||
| max_results | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It mentions optional filtering and a max_results parameter, which hints at pagination/limiting behavior, but lacks details on permissions, rate limits, error handling, or what 'JSON-formatted list' entails. It adds some context but is incomplete for a mutation-like list operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a purpose statement, parameter details, and return info in bullet points. Every sentence adds value, though the filter example could be more concise. It's front-loaded with the core functionality.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations, 4 parameters with 0% schema coverage, and an output schema (implied by 'Returns'), the description does well by explaining all parameters and the return format. However, it lacks behavioral details like auth needs or error cases, keeping it from a 5.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It provides clear semantics for all 4 parameters: aws_region (with a default example), analyzer_arn, filter (with an example structure), and max_results. This adds significant value beyond the bare schema, though it could detail filter syntax more.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('List') and resource ('findings for an analyzer'), and distinguishes it from siblings like 'accessanalyzer_get_finding' (singular) and 'accessanalyzer_list_analyzers' (different resource). The mention of 'optional filter' adds specificity about functionality.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for listing findings with filtering, but does not explicitly state when to use this vs. alternatives like 'accessanalyzer_get_finding' (for a single finding) or other security tools in the sibling list. No exclusions or prerequisites are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
athena_create_cloudtrail_tableA
Create an Athena table for CloudTrail logs with partition projection.
<IMPORTANT>
Before using this tool ask the user for OUTPUT bucket, unless it is provided.
This is necessary to create the table correctly. If the API fails, interrupt the process and ask the user for the OUTPUT BUCKET.
</IMPORTANT>
Parameters:
cloudtrail_bucket (str): The S3 bucket for CloudTrail logs - you can retrieve it using the 'cloudtrail_describe_trails' tool.
is_org_trail (bool): Indicates if the trail is for the organization.
account_id (str): Your AWS account ID - you can retrieve it.
output_bucket (str): Ask the user if not specified, S3 bucket URI (e.g. 's3://my-athena-query-results/') for query results - different from cloudtrail_bucket.
output_region (str): The AWS region for the output bucket - use 'us-east-1' if not specified.
partition_region (str): The region of the events to be queried. It is used to create the S3 path for the Athena table.
database (str): Athena database name to be used.
Returns:
str: An empty result if successful, or an error message if there was an issue.
| Name | Required | Description | Default |
|---|---|---|---|
| cloudtrail_bucket | Yes | ||
| is_org_trail | Yes | ||
| account_id | Yes | ||
| output_bucket | Yes | ||
| output_region | Yes | ||
| partition_region | Yes | ||
| database | No | default |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden and does well: it discloses the tool's interactive nature (asking users for missing parameters), error handling behavior (interrupt process on API failure), and clarifies the relationship between different buckets. It doesn't mention permissions, rate limits, or cost implications, but covers key operational behaviors.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections (IMPORTANT notice, Parameters, Returns) and front-loads the core purpose. Every sentence earns its place by providing necessary information. It could be slightly more concise in the IMPORTANT section but remains efficient given the complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex 7-parameter creation tool with no annotations, the description is remarkably complete: it covers purpose, parameter semantics, usage guidance, behavioral expectations, and return values. The presence of an output schema reduces the need to detail return formats, and the description focuses appropriately on the operational context and parameter relationships.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description fully compensates by providing detailed semantics for all 7 parameters: it explains what each parameter represents, gives retrieval methods for some (cloudtrail_bucket, account_id), provides default values (output_region), distinguishes similar parameters (output_bucket vs cloudtrail_bucket), and includes format examples (S3 URI format). This adds substantial value beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('Create an Athena table for CloudTrail logs') and distinguishes it from siblings by mentioning 'with partition projection' - a technical feature not present in other Athena/CloudTrail tools. It precisely identifies both the resource (Athena table) and the data source (CloudTrail logs).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use this tool vs alternatives: it references the 'cloudtrail_describe_trails' tool for obtaining the cloudtrail_bucket parameter, and the IMPORTANT section gives clear conditional instructions about when to ask the user for OUTPUT bucket. It also distinguishes the output bucket from the cloudtrail bucket, preventing confusion with other S3-related tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
athena_query_eventsA
Query Athena for granular granular searches on CloudTrail logs.
<IMPORTANT>
Before calling this tool, you must call the athena_create_cloudtrail_table tool to create the table.
If the user asks for a different region, you must call the athena_create_cloudtrail_table tool to create the table in that region.
</IMPORTANT>
Parameters:
aws_region: The AWS region - use 'us-east-1' if not specified.
start_time: ISO string of the start time
end_time: ISO string of the end time
database: Athena database name to be used - use 'default' if not specified.
output_bucket: S3 bucket URI (e.g. 's3://my-athena-query-results/') for query results - different from cloudtrail_bucket.
event_names: List of event names to filter on (e.g. ["GetObject", "DeleteObject"])
principal_id: Optional principal ID to filter on. Use the percent sign (%) as a wildcard character.
user_arn: Optional user ARN to filter on. Use the percent sign (%) as a wildcard character. This is the ARN of the user performing the action.
user_name: Optional user name to filter on. This is the name of the user performing the action.
role_name: Optional role name to filter on. This is the name of the role assumed by the user performing the action.
ip_address: Optional IP address to filter on. Use the percent sign (%) as a wildcard character. This is the IP address of the user performing the action.
bucket_name: Optional bucket name to filter on. Use the percent sign (%) as a wildcard character.
limit: Maximum number of results to return (default is 50).
Returns:
str: JSON-formatted result of the Athena query.
| Name | Required | Description | Default |
|---|---|---|---|
| aws_region | Yes | ||
| start_time | Yes | ||
| end_time | Yes | ||
| database | Yes | ||
| output_bucket | Yes | ||
| event_names | Yes | ||
| principal_id | No | ||
| user_arn | No | ||
| user_name | No | ||
| role_name | No | ||
| ip_address | No | ||
| bucket_name | No | ||
| limit | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions prerequisites and that results are JSON-formatted, but lacks details on error handling, rate limits, authentication needs, or query execution time. It partially compensates by noting the output format and dependencies, but more behavioral context would be helpful for a mutation/query tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a clear purpose statement, important prerequisites in a dedicated section, and organized parameter explanations. It's appropriately sized for a complex tool but could be slightly more concise by integrating the parameter list more seamlessly. Every sentence adds value, though minor trimming is possible.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (13 parameters, no annotations, but has an output schema), the description is largely complete. It covers prerequisites, parameter semantics, and notes the JSON return format. However, it lacks details on error cases, performance implications, or how results are paginated/limited, leaving some gaps for a query tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 0%, so the description must fully compensate. It provides detailed semantics for all 13 parameters, including defaults (e.g., 'use 'us-east-1' if not specified'), examples (e.g., 's3://my-athena-query-results/'), wildcard usage (percent sign %), and clarifications (e.g., 'different from cloudtrail_bucket'). This adds significant value beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Query Athena for granular searches on CloudTrail logs.' It specifies the verb ('query'), resource ('Athena'), and target data ('CloudTrail logs'), making the function evident. However, it doesn't explicitly differentiate from sibling tools like 'cloudtrail_lookup_events' or 'athena_create_cloudtrail_table', which would be needed for a score of 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit usage guidelines in the <IMPORTANT> section, stating prerequisites (must call 'athena_create_cloudtrail_table' first, and again for different regions). This clearly defines when to use this tool versus alternatives, including specific conditions and dependencies.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cloudtrail_describe_trailsB
Describe all CloudTrail trails configured in the AWS account.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states what the tool does but lacks details on behavior: no mention of output format (e.g., JSON list), pagination, rate limits, authentication requirements, or error handling. This is a significant gap for a tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence that directly states the tool's purpose without any fluff or repetition. It's front-loaded and appropriately sized for a simple tool, making it easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of annotations and output schema, the description is incomplete. It doesn't explain what the tool returns (e.g., trail configurations, statuses) or behavioral aspects like permissions or limitations. For a tool that likely returns structured data about AWS resources, more context is needed to guide effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0 parameters with 100% coverage, so no parameter documentation is needed. The description appropriately doesn't discuss parameters, avoiding redundancy. A baseline score of 4 is applied as it efficiently handles the lack of parameters without adding unnecessary information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Describe') and resource ('all CloudTrail trails configured in the AWS account'), making the tool's purpose immediately understandable. However, it doesn't explicitly differentiate from sibling tools like 'cloudtrail_lookup_events' or 'athena_query_events', which also involve CloudTrail data but serve different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites (e.g., AWS permissions), use cases (e.g., auditing, troubleshooting), or comparisons to siblings like 'cloudtrail_lookup_events' for event-level queries or 'athena_query_events' for complex analysis.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cloudtrail_lookup_eventsA
Lookup CloudTrail events using filters.
If the user request falls into one of these scenarios, use the Athena tools instead:
- EventName is a data event (e.g. GetObject, DeleteObject, PutObject);
- the user wants to filter by role name;
- the user wants to filter by principal ID;
- the user wants to filter by IP address;
- the user wants to filter by bucket name;
- the user wants to filter by file object in buckets;
- the user wants to filter using regex;
When filtering for EventName, note that the event name is case-sensitive and must match the exact name of the event.
If you want to use operators like 'equals', 'not equals', 'contains', etc., you must use the Athena tools instead.
<IMPORTANT>
Call datetime.datetime.now() to get the current date and time before providing the start and end times.
If the user asks for events happened in the last 7 days, run 'datetime.datetime.now() - datetime.timedelta(days=7)' to get the start date.
Print out the start and end times to the user.
</IMPORTANT>
Parameters:
aws_region (str): The AWS region - use 'us-east-1' if not specified.
attribute_key (str): The name of the event to search for.
Valid attributes keys: EventId | EventName | ReadOnly | Username | ResourceType | ResourceName | EventSource | AccessKeyId
attribute_value (str): The value of the event to search for.
If no key-value pair is provided, use 'ReadOnly'='false'.
start_time (str): start timestamp with format 'YYYY-MM-DD HH:MM:SS' (e.g. '2025-04-10 12:45:50').
If not provided, use 'datetime.datetime.now() - datetime.timedelta(days=7)' to get the start date.
end_time (str): end timestamp with format 'YYYY-MM-DD HH:MM:SS' (e.g. '2025-04-11 12:45:50').
If not provided, use 'datetime.datetime.now()' to get the end date.
max_results (int): Maximum number of events to return.
Returns:
list: A list of CloudTrail events matching the specified criteria.
| Name | Required | Description | Default |
|---|---|---|---|
| aws_region | Yes | ||
| attribute_key | Yes | ||
| attribute_value | Yes | ||
| start_time | Yes | ||
| end_time | Yes | ||
| max_results | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It effectively describes key behaviors: the tool filters CloudTrail events, has case-sensitive EventName matching, requires specific datetime handling, and returns a list of events. It also mentions constraints like not supporting regex or certain operators. However, it doesn't cover aspects like rate limits, authentication requirements, or error handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately structured with clear sections (purpose, usage guidelines, important notes, parameters, returns). However, it includes some redundancy (datetime instructions appear in both the IMPORTANT section and parameter descriptions) and could be more concise. The length is justified by the complexity of the tool, but some sentences could be tightened.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 6 parameters, 0% schema coverage, no annotations, and no output schema, the description provides substantial context. It covers purpose, usage guidelines, parameter semantics, and return format. The main gap is lack of output structure details (what fields events contain), but given the tool's complexity, the description is reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Given 0% schema description coverage, the description fully compensates by providing detailed parameter semantics. It explains each parameter's purpose, default values, valid options for attribute_key, format requirements for timestamps, and default behaviors when parameters aren't provided. This adds significant value beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Lookup CloudTrail events using filters.' It specifies the resource (CloudTrail events) and action (lookup with filters). However, it doesn't explicitly differentiate from sibling tools like 'athena_query_events' beyond mentioning when to use Athena tools instead, which is more about usage guidelines than purpose distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use this tool versus alternatives: it lists six specific scenarios where Athena tools should be used instead (e.g., data events, filtering by role name, principal ID, etc.). It also includes important operational instructions about datetime handling and printing times to the user, which are clear usage directives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cloudwatch_describe_log_groupsA
Describes available CloudWatch log groups in the specified region.
Parameters:
aws_region (str): The AWS region - use 'us-east-1' if not specified.
log_group_name_pattern (str): The pattern to filter log group names.
Pattern: [\.\-_/#A-Za-z0-9]*
If you specify a string for this parameter, the operation returns only log groups that have names that match the string based on a case-sensitive substring search.
For example, if you specify Foo, log groups named FooBar, aws/Foo, and GroupFoo would match, but foo, F/o/o and Froo would not match.
Thus, if you don't find any results with uppercase letters, try using lowercase letters.
Returns:
str: JSON-formatted list of log groups.
| Name | Required | Description | Default |
|---|---|---|---|
| aws_region | Yes | ||
| log_group_name_pattern | Yes | ||
| limit | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It effectively describes key behaviors: it's a read operation (implied by 'describes'), includes filtering capabilities via pattern matching with case-sensitive substring search, provides a default region, and notes the JSON-formatted return. However, it doesn't mention rate limits, authentication needs, or pagination (though the 'limit' parameter in the schema hints at this).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections (purpose, parameters, returns), uses bullet-like formatting for readability, and avoids unnecessary fluff. Every sentence adds value, such as the pattern matching explanation. It could be slightly more concise by integrating the pattern details more tightly, but overall it's efficient and front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (3 parameters, no annotations, but with an output schema), the description is reasonably complete. It covers the tool's purpose, parameter semantics, and return format. The presence of an output schema means it doesn't need to detail return values extensively. However, it could improve by addressing the undocumented 'limit' parameter and providing more context on when to use this tool versus siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds significant meaning beyond the input schema, which has 0% description coverage. It explains the purpose of 'aws_region' with a default value, details 'log_group_name_pattern' with pattern syntax and matching behavior (including examples and case-sensitivity notes), and implies filtering functionality. Although it doesn't mention the 'limit' parameter from the schema, it compensates well for the low schema coverage by enriching the documented parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Describes available CloudWatch log groups in the specified region.' It specifies the verb ('describes') and resource ('CloudWatch log groups'), and while it doesn't explicitly differentiate from sibling tools, the specificity of 'log groups' distinguishes it from other CloudWatch tools like 'cloudwatch_filter_log_events' or 'cloudwatch_list_log_streams'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage through parameter explanations (e.g., default region, pattern matching behavior), but it doesn't explicitly state when to use this tool versus alternatives like 'cloudwatch_list_log_streams' or other AWS monitoring tools. It provides some context for parameter usage but lacks clear guidance on tool selection among siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cloudwatch_filter_log_eventsA
Filters log events in a specified CloudWatch log group using FilterLogEvents API.
Parameters:
aws_region (str): The AWS region - use 'us-east-1' if not specified.
log_group (str): The name of the log group.
start_time (str): ISO formatted start timestamp (e.g. '2025-04-10T00:00:00Z').
end_time (str): ISO formatted end timestamp (e.g. '2025-04-11T00:00:00Z').
filter_pattern (str): A filter pattern to match events.
limit (int): Maximum number of log events to return.
**Supported regex syntax:**
- When using regex to search and filter log data, you must surround your expressions with %.
- Filter patterns with regex can only include the following:
- Alphanumeric characters - An alphanumeric character is a character that is either a letter (from A to Z or a to z) or a digit (from 0 to 9).
- Supported symbol characters - These include: '_', '#', '=', '@','/', ';', ',', and '-'. For example, %something!% would be rejected since '!' is not supported.
- Supported operators - These include: '^', '$', '?', '[', ']', '{', '}', '|', '', '*', '+', and '.'.
- The ( and ) operators are not supported. You cannot use parentheses to define a subpattern.
- Multi-byte characters are not supported.
Returns:
str: JSON-formatted list of matching log events.
| Name | Required | Description | Default |
|---|---|---|---|
| aws_region | Yes | ||
| log_group | Yes | ||
| start_time | Yes | ||
| end_time | Yes | ||
| filter_pattern | No | ||
| limit | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden and does well by disclosing important behavioral details: it specifies regex syntax constraints (what characters and operators are supported/unsupported), mentions the API being used, and describes the return format. However, it doesn't cover rate limits, authentication requirements, or pagination behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections (purpose, parameters, regex syntax, returns) and efficiently conveys necessary information. While comprehensive, it maintains focus without unnecessary verbosity, though the regex syntax section is somewhat lengthy but justified given its importance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (6 parameters, regex constraints, time-based filtering) and the presence of an output schema (which handles return value documentation), the description provides complete context. It covers all parameters, explains behavioral constraints, and references the underlying API, making it fully adequate for agent understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description fully compensates by providing detailed semantic information for all 6 parameters: it explains what each parameter represents, provides format examples for timestamps, specifies default values (aws_region: 'us-east-1', filter_pattern: empty string, limit: 20), and documents regex syntax constraints that apply to the filter_pattern parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('Filters log events') and resource ('in a specified CloudWatch log group'), distinguishing it from sibling tools like cloudwatch_describe_log_groups or cloudwatch_list_log_streams. It explicitly references the underlying AWS API (FilterLogEvents API), providing precise technical context.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for filtering log events within a time range and pattern, but doesn't explicitly state when to use this tool versus alternatives like cloudtrail_lookup_events or athena_query_events. It provides some context through parameter descriptions but lacks explicit guidance on tool selection scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cloudwatch_list_log_streamsB
Lists log streams in a specified CloudWatch log group.
Parameters:
aws_region (str): The AWS region - use 'us-east-1' if not specified.
log_group (str): The name of the log group.
limit (int): Maximum number of log streams to return.
Returns:
str: JSON-formatted list of log streams.
| Name | Required | Description | Default |
|---|---|---|---|
| aws_region | Yes | ||
| log_group | Yes | ||
| limit | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the action ('Lists') and return format ('JSON-formatted list'), but lacks critical behavioral details: it doesn't mention whether this is a read-only operation (though implied by 'Lists'), authentication requirements for AWS, potential rate limits, pagination behavior beyond the 'limit' parameter, error handling, or what happens if the log group doesn't exist. For a cloud service tool with zero annotation coverage, this leaves significant gaps in understanding how the tool behaves in practice.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is efficiently structured with a clear purpose statement followed by labeled sections for 'Parameters' and 'Returns'. Each sentence earns its place by providing essential information without redundancy. The total length is appropriate for the tool's complexity, and key details are front-loaded in the opening sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 3 parameters, no annotations, and an output schema exists (implied by 'Returns: str: JSON-formatted list'), the description is moderately complete. It covers the basic purpose and parameters but lacks behavioral context like authentication, error handling, or performance considerations. The output schema handles return values, so the description doesn't need to detail them. However, for a cloud service tool with no annotations, more behavioral disclosure would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaningful semantics beyond the input schema, which has 0% description coverage. It explains that 'aws_region' is 'The AWS region' with a default hint ('use 'us-east-1' if not specified'), 'log_group' is 'The name of the log group', and 'limit' is 'Maximum number of log streams to return'. This clarifies the purpose of each parameter, though it doesn't provide format details (e.g., region syntax) or constraints beyond the default. With 3 parameters and low schema coverage, the description compensates well but not exhaustively.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Lists') and resource ('log streams in a specified CloudWatch log group'), making the purpose immediately understandable. It distinguishes from sibling tools like 'cloudwatch_describe_log_groups' by specifying it operates on log streams within groups rather than listing groups themselves. However, it doesn't explicitly contrast with 'cloudwatch_filter_log_events' which also involves log streams.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context by specifying it lists streams 'in a specified CloudWatch log group,' suggesting it should be used when you have a specific log group to examine. It doesn't provide explicit guidance on when to use this tool versus alternatives like 'cloudwatch_filter_log_events' (which filters events within streams) or mention prerequisites like needing AWS credentials. The default region hint ('use 'us-east-1' if not specified') offers some implicit guidance but not comprehensive alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
config_describe_compliance_by_resourceB
List compliance summaries for resources, optionally filtered by type.
Parameters:
aws_region (str): The AWS region - use 'us-east-1' if not specified.
resource_type (str): optional AWS resource type filter.
Returns:
JSON list of ComplianceByResource objects.
| Name | Required | Description | Default |
|---|---|---|---|
| aws_region | Yes | ||
| resource_type | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions listing and filtering but lacks details on permissions, rate limits, pagination, or error handling. For a tool that likely interacts with AWS Config, this is insufficient to inform the agent about operational constraints or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and front-loaded: the first sentence states the purpose, followed by clear sections for parameters and returns. Every sentence adds value without redundancy, making it easy for an agent to parse quickly and efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (2 parameters, no annotations), the description covers the basics: purpose, parameters, and returns. However, it lacks behavioral context (e.g., AWS authentication needs, potential errors) and doesn't leverage sibling tool names for differentiation. The presence of an output schema reduces the need to detail return values, but overall completeness is only adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It adds meaningful context: 'aws_region' is explained with a default value ('use 'us-east-1' if not specified'), and 'resource_type' is clarified as an optional filter. This goes beyond the bare schema, though it doesn't detail possible resource type values or format constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'List compliance summaries for resources, optionally filtered by type.' It specifies the verb ('List') and resource ('compliance summaries for resources'), making the action clear. However, it doesn't explicitly differentiate from sibling tools like 'config_describe_config_rules' or 'config_list_discovered_resources', which prevents a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides minimal guidance: it mentions optional filtering by type but doesn't specify when to use this tool versus alternatives like 'config_describe_config_rules' or 'config_get_resource_config_history'. No context, prerequisites, or exclusions are given, leaving the agent with little direction on appropriate usage scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
config_describe_config_rulesA
Describe one or more AWS Config rules, or all rules if none specified.
Parameters:
aws_region (str): The AWS region - use 'us-east-1' if not specified.
rule_names (list): optional list of Config rule names.
Returns:
JSON list of ConfigRule objects.
| Name | Required | Description | Default |
|---|---|---|---|
| aws_region | Yes | ||
| rule_names | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It mentions the tool describes AWS Config rules and returns a JSON list, but doesn't disclose behavioral traits such as required permissions, rate limits, pagination, error handling, or whether it's a read-only operation. For a tool with no annotations, this leaves significant gaps in understanding its behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized and front-loaded: the first sentence states the core purpose, followed by clear parameter and return sections. Every sentence adds value without redundancy, making it easy to scan and understand quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has an output schema (indicating returns are documented elsewhere) and no annotations, the description is reasonably complete: it covers the purpose, parameters, and return type. However, for a tool with no annotations, it could benefit from more behavioral context (e.g., safety, limitations) to fully guide an agent, though the output schema reduces the need to explain returns.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaningful semantics beyond the input schema, which has 0% description coverage. It explains that 'aws_region' is 'The AWS region' with a default of 'us-east-1', and 'rule_names' is an 'optional list of Config rule names'. This clarifies purpose and defaults, compensating well for the schema's lack of descriptions, though it doesn't detail format constraints (e.g., region format).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Describe') and resource ('AWS Config rules'), specifying it can handle one, multiple, or all rules. However, it doesn't explicitly differentiate from sibling tools like 'config_describe_compliance_by_resource' or 'config_describe_recorder_status', which also describe AWS Config-related entities but focus on different aspects.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage by stating it can describe 'one or more AWS Config rules, or all rules if none specified', which provides some context on when to use it (e.g., for listing rules). However, it lacks explicit guidance on when to choose this tool over alternatives like 'config_list_discovered_resources' or other 'describe' tools in the sibling list, and doesn't mention prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
config_describe_recorder_statusB
Describe status of AWS Config recorder(s).
Parameters:
aws_region (str): The AWS region - use 'us-east-1' if not specified.
Returns:
JSON list of ConfigurationRecorderStatus objects.
| Name | Required | Description | Default |
|---|---|---|---|
| aws_region | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden for behavioral disclosure. It states what the tool does but doesn't mention authentication requirements, rate limits, error conditions, whether it's read-only or has side effects, or any performance characteristics. The description is functional but lacks important operational context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is efficiently structured with clear sections: purpose statement, parameters with explanation, and return value specification. Every sentence earns its place, and the information is front-loaded with the core purpose first. No wasted words or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has an output schema (returns JSON list of ConfigurationRecorderStatus objects), the description doesn't need to detail return values. For a single-parameter read operation with output schema, the description covers the essentials: what it does, the parameter meaning, and return type. The main gap is lack of behavioral context that annotations would normally provide.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaningful context beyond the schema. While the schema only shows 'aws_region' as a required string parameter, the description specifies it's for AWS region selection and provides a default value suggestion ('use "us-east-1" if not specified'). This compensates well for the 0% schema description coverage with a single parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('describe') and resource ('status of AWS Config recorder(s)'), making the purpose immediately understandable. However, it doesn't differentiate from sibling tools like 'config_describe_compliance_by_resource' or 'config_describe_config_rules' beyond the specific resource type.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. There's no mention of prerequisites, when this operation is appropriate, or how it differs from other config_* tools in the sibling list. The only contextual hint is the default region suggestion in the parameter section.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
config_get_resource_config_historyA
Fetch configuration snapshots for a resource between two ISO timestamps.
Parameters:
aws_region (str): The AWS region - use 'us-east-1' if not specified.
resource_type (str): e.g. 'AWS::S3::Bucket'.
resource_id (str): the resource's ARN or ID.
start_time (str): ISO timestamp, e.g. '2025-04-01T00:00:00Z'.
end_time (str): ISO timestamp.
limit (int): Maximum number of configuration items to return.
Returns:
JSON list of ConfigurationItem objects.
| Name | Required | Description | Default |
|---|---|---|---|
| aws_region | Yes | ||
| resource_type | Yes | ||
| resource_id | Yes | ||
| start_time | Yes | ||
| end_time | Yes | ||
| limit | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the action ('Fetch') and return type ('JSON list of ConfigurationItem objects'), but lacks critical details: it does not mention authentication requirements, rate limits, error conditions, pagination behavior (beyond the 'limit' parameter), or whether this is a read-only operation. For a tool with 6 parameters and no annotation coverage, this is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is efficiently structured with a clear purpose statement followed by parameter explanations and return information. Every sentence earns its place: the first sentence defines the tool's core function, and subsequent lines provide essential parameter details without redundancy. It is appropriately sized for a tool with multiple parameters.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (6 parameters, no annotations, but with an output schema), the description is partially complete. It excels in parameter semantics and purpose clarity but lacks behavioral context (e.g., authentication, errors) and usage guidelines. The output schema likely covers return values, so the description's mention of 'JSON list of ConfigurationItem objects' is adequate but not detailed. Overall, it meets minimum viability with clear gaps in guidance and transparency.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds substantial meaning beyond the input schema, which has 0% description coverage. It explains each parameter's purpose: 'aws_region' with a default value hint, 'resource_type' with an example, 'resource_id' clarification, timestamp formats, and 'limit' function. This fully compensates for the schema's lack of descriptions, providing clear semantic context for all parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Fetch') and resource ('configuration snapshots for a resource'), specifying the temporal scope ('between two ISO timestamps'). It distinguishes itself from sibling tools like 'config_describe_compliance_by_resource' by focusing on historical configuration data rather than compliance or current status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention prerequisites, such as needing AWS Config enabled, or compare it to similar tools like 'config_describe_config_rules' or 'config_list_discovered_resources'. Usage context is implied only through parameter requirements.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
config_list_discovered_resourcesA
List resource identifiers that AWS Config has discovered.
Parameters:
aws_region (str): The AWS region - use 'us-east-1' if not specified.
resource_type (str): e.g. 'AWS::EC2::Instance'.
Returns:
JSON list of resourceIdentifier objects.
| Name | Required | Description | Default |
|---|---|---|---|
| aws_region | Yes | ||
| resource_type | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that the tool lists resources and returns JSON, but lacks details on permissions required, rate limits, pagination behavior, or error conditions. It adds basic behavioral context but misses important operational traits for an AWS API tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections for purpose, parameters, and returns. Each sentence earns its place by providing essential information without redundancy. It is front-loaded with the core purpose and efficiently details parameters and output.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 2 parameters with 0% schema coverage and an output schema present, the description is largely complete. It explains parameters thoroughly and notes the return format, though it could benefit from more behavioral context like authentication or error handling. The output schema reduces the need to detail return values, making this reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It fully documents both parameters: 'aws_region' with a default value example and 'resource_type' with an example. This adds significant meaning beyond the bare schema, effectively explaining what each parameter does and how to use them.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'List' and the resource 'resource identifiers that AWS Config has discovered', specifying the AWS service context. It distinguishes itself from sibling tools like 'config_describe_compliance_by_resource' or 'config_get_resource_config_history' by focusing on discovered resources rather than compliance or configuration history.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when needing to list discovered AWS Config resources, but does not explicitly state when to use this tool versus alternatives like 'config_describe_config_rules' or other AWS Config tools. No exclusions or prerequisites are mentioned, leaving usage context somewhat implied rather than clearly defined.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ec2_describe_flow_logsA
Describe one or more VPC Flow Logs.
If no filter is provided, returns all Flow Logs in the region.
Parameters:
aws_region (str): The AWS region - use 'us-east-1' if not specified.
flow_log_ids (list[str], optional): List of Flow Log IDs to describe.
resource_ids (list[str], optional): List of resource IDs to filter by.
resource_type (str, optional): Type of resource to filter by (e.g. 'VPC', 'NetworkInterface', 'Subnet').
max_results (int, optional): Maximum number of results to return.
Returns:
str: JSON-formatted list of Flow Logs.
| Name | Required | Description | Default |
|---|---|---|---|
| aws_region | Yes | ||
| flow_log_ids | No | ||
| resource_ids | No | ||
| resource_type | No | ||
| max_results | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions the default behavior when no filter is given and the return format, but fails to cover critical aspects like authentication needs, rate limits, error handling, or whether this is a read-only operation. This is inadequate for a tool with multiple parameters and no annotation support.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and appropriately sized, with a clear opening sentence, parameter explanations in a bullet-like format, and a returns section. Every sentence adds value without redundancy, making it easy to scan and understand quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (5 parameters, 1 required) and the presence of an output schema (which handles return values), the description is mostly complete. It covers purpose, parameters, and basic usage, but lacks behavioral details like authentication or error handling, which are important given the absence of annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds significant value beyond the input schema, which has 0% description coverage. It explains each parameter's purpose, provides a default value for 'aws_region', and clarifies optional vs. required usage. This compensates well for the schema's lack of descriptions, though it could benefit from more detail on parameter formats or constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with the verb 'Describe' and resource 'VPC Flow Logs', making it easy to understand what the tool does. However, it doesn't explicitly differentiate from sibling tools like 'cloudtrail_describe_trails' or 'cloudwatch_describe_log_groups', which prevents a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides some implied usage guidance by stating 'If no filter is provided, returns all Flow Logs in the region,' which suggests when to use filters. However, it lacks explicit when-to-use vs. alternatives, prerequisites, or comparisons with sibling tools, leaving gaps in comprehensive guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
guardduty_get_findingsA
Get detailed information for the specified GuardDuty findings.
Parameters:
aws_region (str): The AWS region - use 'us-east-1' if not specified.
detector_id (str): The GuardDuty detector ID.
finding_ids (list): A list of finding IDs for which to retrieve details.
<IMPORTANT>
The server may crash when the response is too large. To avoid this, pass only max 2 finding IDs at a time.
The finding_ids list should contain a maximum of 2 IDs.
If guardduty_list_findings returns more than 2 IDs, you should call this tool max 5 times.
Then, proceed with your analysis, but remember to notify the user that there may be additional findings not retrieved.
</IMPORTANT>
Returns:
str: JSON-formatted details of the findings.
| Name | Required | Description | Default |
|---|---|---|---|
| aws_region | Yes | ||
| detector_id | Yes | ||
| finding_ids | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It effectively describes critical behavioral traits: the tool may cause server crashes if too many IDs are passed (a risk), specifies a maximum batch size (2 IDs), provides workarounds for larger datasets (call up to 5 times), and mentions the need to notify users about potential data limitations. This goes beyond basic functionality to include operational constraints and error handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and appropriately sized, with a clear purpose statement, parameter explanations, and a critical usage section. Every sentence adds value, but the <IMPORTANT> block is somewhat lengthy, though necessary for clarity. It's front-loaded with the core purpose, making it efficient for quick understanding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (3 parameters, no annotations, 0% schema coverage, but with an output schema), the description is highly complete. It covers the tool's purpose, parameter semantics, critical behavioral constraints, usage guidelines, and references to sibling tools. The output schema handles return value details, so the description doesn't need to explain the JSON format, making it fully adequate for the context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds significant meaning beyond the input schema, which has 0% description coverage. It explains each parameter's purpose: 'aws_region' with a default value suggestion, 'detector_id' as the GuardDuty detector ID, and 'finding_ids' as a list of IDs to retrieve details for. However, it doesn't fully specify the format or constraints of 'finding_ids' (e.g., ID structure), leaving some ambiguity, so it doesn't reach a perfect score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Get detailed information for the specified GuardDuty findings.' It specifies the verb ('Get detailed information') and resource ('GuardDuty findings'), but doesn't explicitly differentiate it from sibling tools like 'guardduty_list_findings' or 'guardduty_get_finding_statistics', which is why it doesn't earn a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit usage guidelines in the <IMPORTANT> section, including when to use this tool (after 'guardduty_list_findings' returns IDs), how to use it (max 2 IDs at a time, call up to 5 times), and what to do if there are more findings (notify the user). It also implicitly contrasts with sibling tools by referencing 'guardduty_list_findings'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
guardduty_get_finding_statisticsB
Get summary statistics for GuardDuty findings for a given detector.
Parameters:
aws_region (str): The AWS region - use 'us-east-1' if not specified.
detector_id (str): The GuardDuty detector ID.
Returns:
str: JSON-formatted statistics about the findings.
| Name | Required | Description | Default |
|---|---|---|---|
| aws_region | Yes | ||
| detector_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool retrieves statistics but doesn't cover aspects like authentication requirements, rate limits, error handling, or whether it's a read-only operation. This leaves significant gaps for an agent to understand its behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and concise, with clear sections for parameters and returns. Each sentence adds value without redundancy, making it easy to scan and understand quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (2 parameters), no annotations, and the presence of an output schema (which handles return values), the description is reasonably complete. It covers the purpose, parameters, and return format, though it could improve by adding more behavioral context or usage guidelines.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaningful context for parameters: it specifies that 'aws_region' defaults to 'us-east-1' if not provided and clarifies that 'detector_id' is for a GuardDuty detector. Since schema description coverage is 0%, this compensates somewhat, but it doesn't fully detail parameter constraints or examples beyond the defaults.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Get summary statistics') and resource ('GuardDuty findings for a given detector'), making the purpose evident. However, it doesn't explicitly differentiate from sibling tools like 'guardduty_get_findings' or 'guardduty_list_findings', which might retrieve detailed findings rather than statistics.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives, such as the sibling tools 'guardduty_get_findings' or 'guardduty_list_findings'. It mentions the detector context but lacks explicit usage scenarios or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
guardduty_list_detectorsB
List all GuardDuty detector IDs in the specified AWS region.
Parameters:
aws_region (str): The AWS region - use 'us-east-1' if not specified.
Returns:
str: JSON-formatted list of detector IDs.
| Name | Required | Description | Default |
|---|---|---|---|
| aws_region | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden but only states it lists IDs and returns JSON. It lacks critical behavioral details such as whether this is a read-only operation, if it requires specific permissions, rate limits, pagination behavior, or error handling for invalid regions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is efficiently structured with a clear purpose statement followed by parameter and return sections. Every sentence adds value without redundancy, making it easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (1 parameter) and the presence of an output schema (which covers return values), the description is minimally adequate. However, it lacks behavioral context and usage guidelines, which are important for an AWS tool with siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description adds meaningful context by specifying the parameter's purpose and a default value ('us-east-1'). This partially compensates for the schema gap, though it doesn't detail format constraints or validation rules.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('List') and resource ('all GuardDuty detector IDs'), making the purpose unambiguous. However, it doesn't explicitly differentiate from sibling tools like 'guardduty_list_findings' or other list operations, which would require a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'guardduty_get_findings' or other AWS listing tools. It mentions a default region but offers no context about prerequisites, dependencies, or typical use cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
guardduty_list_findingsA
List GuardDuty finding IDs for a given detector.
Optionally, you can supply a list of finding IDs to retrieve specific findings or a minimum severity threshold to filter findings.
Parameters:
aws_region (str): The AWS region - use 'us-east-1' if not specified.
detector_id (str): The GuardDuty detector ID.
finding_ids (list, optional): Specific finding IDs to query.
severity_threshold (float, optional): If provided, returns only findings with severity greater than this value.
<IMPORTANT>
After calling this tool, you should call guardduty_get_findings multiple times with the finding_ids returned by this tool.
</IMPORTANT>
Returns:
str: JSON-formatted list of finding IDs.
| Name | Required | Description | Default |
|---|---|---|---|
| aws_region | Yes | ||
| detector_id | Yes | ||
| finding_ids | No | ||
| severity_threshold | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden and does well: it explains the tool's behavior (returns JSON-formatted list of IDs), mentions optional filtering by severity, and provides important workflow context about calling 'guardduty_get_findings' afterward. It doesn't cover rate limits or authentication needs, but provides substantial behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is efficiently structured with clear sections: purpose statement, optional capabilities, parameter explanations, and important workflow note. Every sentence earns its place, and the <IMPORTANT> tags effectively highlight critical information without unnecessary verbosity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (4 parameters, no annotations, but has output schema), the description is complete: it explains purpose, parameters, return format, and critical workflow context. The output schema existence means the description doesn't need to detail return values, and it provides all necessary context for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description compensates well by explaining all 4 parameters: it clarifies that 'aws_region' defaults to 'us-east-1', explains what 'detector_id' is, and describes the optional 'finding_ids' and 'severity_threshold' parameters with their purposes. It adds meaningful context beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with specific verb ('List') and resource ('GuardDuty finding IDs for a given detector'), and distinguishes it from its sibling 'guardduty_get_findings' by explaining this tool returns IDs while the sibling retrieves full finding details. The title being null doesn't affect this clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use this tool versus alternatives: it specifies that after calling this tool, 'guardduty_get_findings' should be called multiple times with the returned IDs, clearly indicating the workflow relationship. It also mentions optional filtering capabilities.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
networkinsights_get_findingsB
Retrieve all findings for a given analysis.
Parameters:
aws_region (str): The AWS region - use 'us-east-1' if not specified.
analysis_id (str): The ID of the analysis to retrieve findings for.
max_results (int): Maximum number of findings to return.
Returns:
JSON list of NetworkInsightsAccessScopeAnalysisFinding objects.
| Name | Required | Description | Default |
|---|---|---|---|
| aws_region | Yes | ||
| analysis_id | Yes | ||
| max_results | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden for behavioral disclosure. It states the tool retrieves findings but doesn't mention authentication requirements, rate limits, pagination behavior (despite 'max_results' parameter), error conditions, or whether this is a read-only operation. The description is minimal and lacks critical behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is efficiently structured with clear sections for purpose, parameters, and returns. Each sentence earns its place by providing essential information without redundancy. The parameter explanations are brief but informative, and the return value is clearly stated.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 3 parameters with no schema descriptions and no annotations, the description does a decent job explaining parameters and the return format. However, it lacks context about the tool's behavior (e.g., pagination, errors), usage relative to siblings, and AWS-specific considerations. The presence of an output schema helps, but more operational context is needed for a complex AWS tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds significant value beyond the input schema, which has 0% description coverage. It explains all three parameters: 'aws_region' (with a default value hint), 'analysis_id' (what it represents), and 'max_results' (its purpose). This compensates well for the schema's lack of descriptions, though it could provide more detail about parameter formats or constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'retrieve' and resource 'findings for a given analysis', making the purpose specific. However, it doesn't distinguish this tool from similar sibling tools like 'guardduty_get_findings' or 'accessanalyzer_get_finding', which also retrieve findings but for different AWS services.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites (e.g., needing an existing analysis), exclusions, or how it differs from sibling tools like 'networkinsights_list_analyses' or 'guardduty_get_findings', leaving the agent with no contextual usage information.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
networkinsights_list_analysesB
Describe analyses for one or more scopes.
Parameters:
aws_region (str): The AWS region - use 'us-east-1' if not specified.
scope_id (str): The ID of the access scope to filter by.
analysis_ids (list[str]): List of analysis IDs to filter by.
Returns:
JSON list of NetworkInsightsAccessScopeAnalysis objects.
| Name | Required | Description | Default |
|---|---|---|---|
| aws_region | Yes | ||
| scope_id | No | ||
| analysis_ids | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions the return type ('JSON list of NetworkInsightsAccessScopeAnalysis objects') but fails to cover critical aspects like whether this is a read-only operation, potential rate limits, authentication needs, or pagination behavior. This leaves significant gaps for a tool with three parameters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is efficiently structured with a clear purpose statement followed by parameter and return sections. Every sentence adds value without redundancy, making it easy to parse and understand quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (3 parameters, no annotations), the description is partially complete. It covers parameters and return values adequately, but lacks behavioral context (e.g., safety, performance). The presence of an output schema helps, but more guidance on usage and limitations is needed for full completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaningful context beyond the schema, which has 0% description coverage. It explains that 'aws_region' defaults to 'us-east-1' if unspecified, clarifies that 'scope_id' and 'analysis_ids' are filters, and specifies their data types. This compensates well for the schema's lack of descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Describe') and resource ('analyses for one or more scopes'), making the purpose evident. However, it doesn't explicitly differentiate from sibling tools like 'networkinsights_get_findings' or 'networkinsights_list_scopes', which prevents a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like 'networkinsights_get_findings' or 'networkinsights_list_scopes'. The description lacks context about use cases, prerequisites, or exclusions, offering only basic parameter information.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
networkinsights_list_scopesB
Describe all Network Access Scopes in the region.
Parameters:
aws_region (str): The AWS region - use 'us-east-1' if not specified.
Returns:
JSON list of NetworkInsightsAccessScope objects.
| Name | Required | Description | Default |
|---|---|---|---|
| aws_region | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the action ('Describe') but lacks details on permissions, rate limits, pagination, or error handling. This is inadequate for a tool that likely interacts with AWS services.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and front-loaded with the core purpose, followed by parameter and return details. Every sentence adds necessary information without redundancy, making it efficient and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (1 parameter) and the presence of an output schema (which covers return values), the description is somewhat complete. However, it lacks behavioral context and usage guidelines, which are important for AWS-related operations, keeping it at an adequate but minimal level.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds value by specifying the parameter 'aws_region' and providing a default value ('use 'us-east-1' if not specified'), which isn't in the input schema (0% coverage). However, it doesn't fully explain the parameter's significance or constraints, keeping it at a baseline level.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Describe') and resource ('all Network Access Scopes in the region'), making the purpose specific and understandable. However, it doesn't explicitly differentiate from sibling tools like 'networkinsights_list_analyses' or 'networkinsights_get_findings', which prevents a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention sibling tools, prerequisites, or specific use cases, leaving the agent with minimal context for selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
networkinsights_start_analysisA
Start a Network Access Scope analysis.
Parameters:
aws_region (str): AWS region - use 'us-east-1' if not specified.
scope_id (str): The NetworkInsightsAccessScopeId to analyze.
dry_run (bool): If True, checks permissions without starting.
tag_specifications (list): TagSpecification dicts for annotating the analysis.
client_token (str): Idempotency token for the request.
Returns:
str: JSON representation of the NetworkInsightsAccessScopeAnalysis object.
| Name | Required | Description | Default |
|---|---|---|---|
| aws_region | Yes | ||
| scope_id | Yes | ||
| dry_run | No | ||
| tag_specifications | No | ||
| client_token | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden for behavioral disclosure. It mentions that the tool 'starts' an analysis and returns a JSON representation, but doesn't cover important aspects like whether this is a long-running operation, what permissions are required, potential costs, rate limits, or what happens to existing analyses. The dry_run parameter hint about permission checking is useful but insufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and efficiently organized. It begins with the core purpose, then provides a clear parameter section with bullet-point explanations, and ends with return value information. Every sentence adds value with no redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (5 parameters, no annotations, but with output schema), the description does well. The parameter explanations are thorough, and the return value is documented. However, for a tool that 'starts' an analysis (implying potential mutation and operational impact), more behavioral context about what 'starting' entails would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description provides excellent parameter semantics despite 0% schema description coverage. Each parameter is clearly explained with purpose and usage guidance: default values ('use us-east-1 if not specified'), idempotency context for client_token, permission checking for dry_run, and annotation purpose for tag_specifications. This fully compensates for the lack of schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Start a Network Access Scope analysis') with the specific resource type, which is helpful. However, it doesn't differentiate this tool from sibling tools like 'networkinsights_list_analyses' or 'networkinsights_get_findings', which would require more specificity about what makes this 'start' operation unique.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'networkinsights_list_analyses' or 'networkinsights_get_findings'. It mentions a 'dry_run' parameter for permission checking, but doesn't explain broader usage context, prerequisites, or typical workflows for starting an analysis.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
25 tool updates
- First observed
accessanalyzer_get_analyzer - First observed
accessanalyzer_get_finding - First observed
accessanalyzer_list_analyzers - First observed
accessanalyzer_list_findings - First observed
athena_create_cloudtrail_table - First observed
athena_query_events - First observed
cloudtrail_describe_trails - First observed
cloudtrail_lookup_events - First observed
cloudwatch_describe_log_groups - First observed
cloudwatch_filter_log_events - First observed
cloudwatch_list_log_streams - First observed
config_describe_compliance_by_resource - First observed
config_describe_config_rules - First observed
config_describe_recorder_status - First observed
config_get_resource_config_history - First observed
config_list_discovered_resources - First observed
ec2_describe_flow_logs - First observed
guardduty_get_finding_statistics - First observed
guardduty_get_findings - First observed
guardduty_list_detectors - First observed
guardduty_list_findings - First observed
networkinsights_get_findings - First observed
networkinsights_list_analyses - First observed
networkinsights_list_scopes - First observed
networkinsights_start_analysis
TDQS
Scored across 25 tools
Most tools are clearly distinct by AWS service and operation, but there is some overlap between cloudtrail_lookup_events and athena_query_events, as both query CloudTrail logs with different capabilities. The descriptions help clarify when to use each, but an agent might initially be confused about which tool to select for certain log queries.
All tool names follow a consistent pattern of service_verb_noun (e.g., accessanalyzer_get_analyzer, cloudtrail_describe_trails). This makes it easy to understand the service and action at a glance, with no deviations in naming conventions across the set.
With 25 tools, the count feels heavy for a single server, but it covers multiple AWS security and monitoring services (Access Analyzer, CloudTrail, Athena, CloudWatch, Config, EC2, GuardDuty, Network Insights). While comprehensive, it may overwhelm agents with its breadth, bordering on too many for a cohesive set.
The tool set provides good coverage for security analysis across AWS services, with CRUD-like operations for each service (e.g., list, get, describe, query). Minor gaps exist, such as missing update or delete operations for some resources, but agents can perform core workflows without major dead ends.
Maintenance
Related MCP Connectors
Hosted MCP server for AWS cloud spend: service breakdowns, anomalies, savings and forecasts.
MCP Server for an Agent Task Marketplace
Related MCP Servers
- AlicenseNot gradedqualityNot gradedmaintenanceMCP server for Huntress API integration1MIT
- MIT
- MIT
- AlicenseAqualityBmaintenanceMCP server for automated AWS security scanning — 19 modules, risk scoring, zero write operations.3516MIT