Skip to main content
Glama

Ejecutar un transform

osint_run_transform

Run integrated, provider, or custom Maltego transforms on an entity and save results and relationships to a case graph for persistent OSINT analysis.

Instructions

Ejecuta un transform (integrado, de proveedor o de tus servidores TRX/iTDS) sobre una entidad. Con save=true guarda entidad, resultados, relaciones y el paso en la memoria del caso.

Input Schema

NameRequiredDescriptionDefault
saveNoGuardar en el grafo del caso.
valueYesValor de la entidad de entrada.
reasonNoPor qué se hace (queda en la memoria del caso).
case_idNoCaso donde guardar (obligatorio si save=true).
transformYesNombre del transform (ver osint_list_transforms).
propertiesNoPropiedades adicionales "clave=valor".
soft_limitNoMáximo de resultados por transform.
entity_typeYesTipo Maltego (ver osint_list_entity_types), p. ej. maltego.Domain, propio (acme.Ticket) o "auto" para detectarlo por el valor (correo, URL, IP, rango, hash, AS, teléfono, dominio o frase).
response_formatNo"markdown" (por defecto, legible) o "json" (estructurado).markdown

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.2.0

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare a non-read-only, open-world, non-idempotent, non-destructive operation; the description adds the important consequence that save=true writes entity, results, relations AND the step into case memory — a side effect not captured by the hints. It omits what happens when save=false (results returned but not persisted) and whether the transform hits external servers/slow paths.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences, front-loaded with what the tool does and followed by the persistence behavior. No filler or repetition of parameter names already in the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 9-parameter, open-world tool with no output schema, the description is thin: it never describes what is returned (result set shape, truncation via soft_limit, when save=false) or that external/TRX servers may be contacted and could fail or be slow. The schema carries most of the load, leaving behavioral completeness adequate but not full.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so every parameter is already documented, including case_id being mandatory when save=true and the enum for response_format. The description only reinforces the save semantics; it adds no syntax or interaction detail (e.g., how properties interacts with the transform, or what soft_limit truncation means) beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ("Ejecuta") and resource ("transform") plus the three transform origins (integrado, proveedor, TRX/iTDS servers) applied to an entity. It does not explicitly differentiate from the close sibling osint_run_machine, which chains transforms, so the verb/resource is clear but sibling framing is left implicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied: run a single transform on an entity, with save=true persisting to the case. There is no explicit when-to-use/when-not guidance versus osint_run_machine (single transform vs machine) or osint_expand_entity, and no stated prerequisite to first call osint_list_transforms beyond what the schema itself says.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.