Skip to main content
Glama
CoveoSec
by CoveoSec

scripts_run_script

Run a script from the library on up to 1000 endpoints by providing endpoint IDs and script parameters. Execute actions across multiple endpoints for security investigation or remediation.

Instructions

Run Script

Initiate a new endpoint script execution action using a script from the script library. The script can be run on up to 1000 endpoints.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/scripts/run_script] · Script execution

Example request body:

{
  "request_data": {
    "filters": [
      {
        "field": "endpoint_id_list",
        "operator": "in",
        "value": [
          "<endpoint ID>"
        ]
      }
    ],
    "script_uid": "<unique ID>",
    "parameters_values": {
      "x": "param input as returned in Get Script Metadata",
      "y": 4
    }
  }
}

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
request_dataYesA dictionary containing the API request fields.
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description carries the full burden. It does disclose the required license, the 1000-endpoint limit, and the exact POST endpoint. However, it does not explain that this likely initiates an asynchronous action requiring subsequent status polling, nor does it describe the response shape, which is critical for an action endpoint.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well front-loaded: title, capability, license, endpoint, then a detailed example. Every section serves a purpose, and there is no filler, though the length is justified by the nested API format it needs to clarify.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema, the description lacks critical operational context: it does not state whether the tool is synchronous or asynchronous, what the response contains, or how to retrieve execution status. The input schema covers request parameters well, but the post-invocation lifecycle is left unclear, which is especially important given the sibling status and results tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, providing a baseline of 3. The example request body adds practical meaning by illustrating how filters, script_uid, and parameters_values interrelate, and it references Get Script Metadata for parameter keys, going beyond the schema's static descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool 'Run Script' initiates a new endpoint script execution action using a script from the script library, and adds a specific scope (up to 1000 endpoints). This distinguishes it from sibling scripts_run_snippet_code_script, which runs snippet code rather than a library script.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage requires an existing script_uid from the Get Scripts API, and the example shows how to structure a request. However, it does not explicitly say when to prefer this over scripts_run_snippet_code_script or mention that execution status should be checked via scripts_get_script_execution_status, so guidance is more implied than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/CoveoSec/xsiam-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server