taegis-magic-mcp

Server Quality Checklist

Profile completionA complete profile improves this server's visibility in search results.

Latest release: v0.1.0
Disambiguation5/5
Each tool targets a distinct resource type (alerts, events, investigations, tenants, threat intel) with clear search/list semantics. The escape hatch command is explicitly for arbitrary CLI calls, so there's no overlap with the dedicated tools.
Naming Consistency5/5
All tool names follow a consistent verb_noun snake_case pattern (search_alerts, list_tenants, run_taegis_command). The pattern is uniform across the set with no mixed conventions.
Tool Count5/5
Six tools is well within the ideal 3-15 range. The server covers the core Taegis search use cases without redundancy, and the escape hatch avoids the need for many narrow wrappers.
Completeness4/5
The dedicated tools cover the most common read/search operations for a security platform. Minor gaps exist (e.g., no dedicated get-by-id tools or investigation management), but the run_taegis_command escape hatch fills any missing functionality, making the surface effectively complete.
Average 4.1/5 across 6 of 6 tools scored. Lowest: 3.5/5.
See the Tool Scores section below for per-tool breakdowns.
- No community issues in the last 6 months
- 2 commits in the last 12 weeks
- No stable releases found
- No critical vulnerability alerts
- No high-severity vulnerability alerts
- No code scanning findings
- CI status not available
This repository is licensed under MIT License.
This repository includes a README.md file.
No tool usage detected in the last 30 days. Usage tracking helps demonstrate server value.
Tip: use the "Try in Browser" feature on the server page to seed initial usage.
Add a glama.json file to provide metadata about your server.
If you are the author, simply .
If the server belongs to an organization, first add glama.json to the root of your repository:
```
{
  "$schema": "https://glama.ai/mcp/schemas/server.json",
  "maintainers": [
    "your-github-username"
  ]
}
```
Then . Browse examples.
Add related servers to improve discoverability.

How to sync the server with GitHub?

Servers are automatically synced at least once per day, but you can also sync manually at any time to instantly update the server profile.

To manually sync the server, click the "Sync Server" button in the MCP server admin interface.

How is the quality score calculated?

The overall quality score combines two components: Tool Definition Quality (70%) and Server Coherence (30%).

Tool Definition Quality measures how well each tool describes itself to AI agents. Every tool is scored 1–5 across six dimensions: Purpose Clarity (25%), Usage Guidelines (20%), Behavioral Transparency (20%), Parameter Semantics (15%), Conciseness & Structure (10%), and Contextual Completeness (10%). The server-level definition quality score is calculated as 60% mean TDQS + 40% minimum TDQS, so a single poorly described tool pulls the score down.

Server Coherence evaluates how well the tools work together as a set, scoring four dimensions equally: Disambiguation (can agents tell tools apart?), Naming Consistency, Tool Count Appropriateness, and Completeness (are there gaps in the tool surface?).

Tiers are derived from the overall score: A (≥3.5), B (≥3.0), C (≥2.0), D (≥1.0), F (<1.0). B and above is considered passing.

Tool Scores

Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the burden of behavioral disclosure. It adds useful context by explaining the default region derived from TAEGIS_ENVIRONMENT, the default limit, and the return format as a JSON array. However, it does not disclose potential side effects, error behavior, or rate limits, which are common for search tools.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a compact docstring with a one-line purpose, a short Args section, and a Returns line. It is front-loaded and concise, with no filler or redundant prose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple search tool with an output schema, the description covers the essential purpose, parameters, and return type. However, it lacks usage guidance (when to choose this over sibling tools) and does not elaborate on query syntax, which prevents it from being fully contextually complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description is the sole source of parameter meaning. It explains 'query' as an event query string, 'region' as the Taegis environment with a default, and 'limit' as the maximum result count. While this adds value beyond the schema, 'query' lacks syntax or example details, leaving some ambiguity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a clear verb and resource: 'Search Taegis security events.' This directly states the tool's function and distinguishes it from sibling tools like search_alerts, search_investigations, and search_threat_intel, which target different data types.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus alternatives like search_alerts or search_investigations. The description only covers mechanics (query, region, limit) and does not mention exclusions, prerequisites, or a decision framework.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description must carry the full burden. It discloses the 'open' filter, default values, and return type, but omits details on permissions, side effects, or pagination. Adequate but not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured, with a one-sentence purpose, an Args section, and a Returns section. Every sentence contributes directly to tool usage.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple search tool with two optional parameters and an output schema, the description covers the core scope, parameters, and return format. It could mention pagination or tenant context, but the essentials are complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaning beyond the input schema: 'region' is explained as the Taegis environment with a fallback to an environment variable, and 'limit' is defined as the maximum number of results. This enriches the schema's minimal default-value definitions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'List and search open security investigations in Taegis.' The verb+resource combination is specific and distinguishes it from sibling tools like search_alerts and search_events.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines3/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this tool is for investigation data, but it does not explicitly state when to use it over alternatives or provide any exclusions. Usage context is clear but not contrasted with siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior4/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the read-only nature via 'List', scoping via 'visible to the authenticated user', and return format via 'JSON array of tenant objects.' It does not mention pagination or errors, but for a simple listing tool this is adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences: one for the action and one for the return format. It is front-loaded with the verb and includes no unnecessary words, earning maximum conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with zero parameters and an output schema, the description is complete: it states the primary function and the return type. The presence of an output schema means the description does not need to detail return fields beyond the summary provided.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, so no parameter semantics are needed. The baseline for 0-parameter tools is 4, and the description correctly implies no parameters are required.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'List' with a clear resource 'Taegis tenants' and scope 'visible to the authenticated user.' It clearly distinguishes itself from the sibling search tools (search_alerts, search_events, etc.) which are query-based rather than a simple listing operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention use cases such as retrieving tenant IDs before running searches, nor does it exclude any scenarios. The usage is implied but not explicitly stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior4/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description bears the full burden of behavioral disclosure. It provides useful context: OCSF query syntax, default region fallback to TAEGIS_ENVIRONMENT and then 'charlie', a maximum limit of 10,000, and a return format of a JSON array. It does not mention rate limits or pagination, but for a read-only search tool this is largely sufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a purpose sentence, an Args section, and a Returns section. It is slightly longer than necessary but every sentence adds value—example query, default behavior, and result format. Front-loading the core purpose makes it easy to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 3 parameters (1 required) and an output schema, so the description doesn't need to detail return fields. It covers input syntax, defaults, limits, and return type. It could mention whether the search spans all tenants, but for an alert search tool this is adequate and contextually aligned with its sibling search tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters5/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must fully explain parameters. It does so exceptionally: query is described with a concrete OCSF example, region lists example values (charlie, delta, us1, us2, eu) and default resolution, and limit specifies default (100) and max (10,000). This far exceeds the schema's minimal titles.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Search Taegis alerts using OCSF query syntax' clearly specifies the verb (search), resource (Taegis alerts), and query syntax (OCSF). This distinguishes it from sibling tools like search_events and search_investigations, which target other data types.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines3/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage by stating 'Search Taegis alerts' but does not explicitly mention when to use this tool versus alternatives or provide exclusions. It lacks the explicit alternative guidance seen in high-scoring examples, but the context is clear enough for an agent to infer.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully disclose behavior. It states that it runs arbitrary commands and returns raw JSON, which is transparent about the action and output. However, it gives no warning about potential side effects or errors, which would be valuable for an arbitrary-command tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections (overview, Args, Returns). It is front-loaded with the main purpose and every sentence adds value, with no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an escape-hatch tool, the description covers what it does, how to invoke it, and expected output. It does not mention authentication or error handling, but these are less critical for a generic wrapper and the sibling tools handle specific contexts.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters5/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description thoroughly explains the 'args' parameter: space-separated CLI arguments after the binary, with a concrete example. Even though schema coverage is 0%, the description fully compensates for this single parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it runs an arbitrary taegis CLI command and returns JSON output. It explicitly identifies itself as an escape hatch, which distinguishes it from sibling tools that wrap specific searches.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description says to use it for commands not yet wrapped as dedicated tools, which implies when to use it. It does not explicitly say 'use dedicated tools when available' as an exclusion, but the escape hatch framing provides clear context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior4/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden for behavioral disclosure. It adds value by specifying the return type ('JSON array of threat intelligence objects') and the region default behavior ('Defaults to TAEGIS_ENVIRONMENT or "charlie"'). While it doesn't discuss pagination or rate limits, this is a simple search tool and the described behavior is adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and well-structured, with a single-purpose opening sentence and organized Args/Returns sections. Every sentence earns its place; there is no redundant or extraneous information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter search tool, the description covers the essential context: what it searches, how parameters behave, and what is returned. The presence of an output schema means the description needn't list fields. It lacks explicit mention of potential pagination or permissions, but these are not critical for basic usage, making it nearly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters5/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has zero description coverage (only titles), so the description fully compensates. The Args section explains that 'query' is an 'indicator value or free-text search' and 'region' is 'Taegis environment/region' with an explicit default. This adds meaningful semantics beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Search Taegis threat intelligence (IOCs, hashes, IPs, domains …)', which clearly states the tool's specific verb and resource. This also distinguishes it from sibling tools like search_alerts and search_events by focusing on threat intelligence rather than alerts or investigations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage by naming the types of indicators (IOCs, hashes, IPs, domains) and the platform (Taegis), which gives clear context for when this tool is appropriate. However, it does not explicitly mention alternatives or exclusions, such as 'for security events use search_events', so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

GitHub Badge

Glama performs regular codebase and documentation scans to:

Confirm that the MCP server is working as expected.
Confirm that there are no obvious security issues.
Evaluate tool definition quality.

Our badge communicates server capabilities, safety, and installation instructions.

Card Badge

Copy to your README.md:

[![taegis-magic-mcp MCP server](https://glama.ai/mcp/servers/DarkLicornor/taegis-magic-mcp/badges/card.svg)](https://glama.ai/mcp/servers/DarkLicornor/taegis-magic-mcp)

Score Badge

Copy to your README.md:

[![taegis-magic-mcp MCP server](https://glama.ai/mcp/servers/DarkLicornor/taegis-magic-mcp/badges/score.svg)](https://glama.ai/mcp/servers/DarkLicornor/taegis-magic-mcp)

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/DarkLicornor/taegis-magic-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server