Skip to main content
Glama

Investigar en una llamada

osint_investigate

Detects an indicator's type, runs the matching OSINT machine, scores entities, and returns an inline report with proposed next steps.

Instructions

Punto de entrada: detecta el tipo del valor, crea el caso (o usa case_id), ejecuta la Machine adecuada (o expand_entity), puntúa entidades, propone los siguientes pasos y devuelve un informe en línea.

Input Schema

NameRequiredDescriptionDefault
valueYesDato inicial: dominio, IP, correo, URL, alias...
reasonNoPor qué se hace (queda en la memoria del caso).
case_idNoCaso; vacío = se crea inv-<valor>-<fecha>.
machineNoForzar Machine; vacío = automática por tipo.
max_roundsNoRondas de expansión.
entity_typeNoTipo Maltego (ver osint_list_entity_types), p. ej. maltego.Domain, propio (acme.Ticket) o "auto" para detectarlo por el valor (correo, URL, IP, rango, hash, AS, teléfono, dominio o frase).auto
response_formatNo"markdown" (por defecto, legible) o "json" (estructurado).markdown
max_total_entitiesNoPresupuesto de entidades.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.2.0

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already flag a non-read-only, open-world, non-idempotent operation, and the description usefully adds that it creates a case and returns an inline report. It still omits cost, latency, failure behavior when a Machine is unavailable, and what 'puntúa entidades' produces — relevant given the openWorldHint.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One front-loaded sentence with the key qualifier ('Punto de entrada') first and no filler. It is a dense run-on list of clauses, but each clause names a real behavior rather than restating the name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 8-parameter, open-world orchestration tool with no output schema, the description does state the end product ('informe en línea'), which is the most important missing piece. It still leaves unclear what the report contains, how the case persists, and what happens across max_rounds > 1.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all eight parameters including case_id defaults, machine override and max_rounds. The description only reinforces the value/machine/case_id relationship, adding little syntax or constraint detail beyond the schema — baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Declares itself the entry point ('Punto de entrada') and enumerates the concrete pipeline: type detection, case creation, Machine execution, entity scoring, next-step proposal and inline report. This makes it clearly distinguishable from orchestrated siblings like osint_run_machine and osint_suggest_next_steps, though it never explicitly contrasts itself with them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Punto de entrada' implies this is the first tool to reach for, and the mention of case_id hints at continuing an existing case. However, there is no explicit guidance on when to use osint_run_machine or osint_expand_entity instead, nor on when not to use this one (e.g., cheap single-transform lookups).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.