Skip to main content
Glama

Crear o fusionar entidad

osint_upsert_entity
Idempotent

Save or update an entity in an OSINT investigation case, normalizing its value and merging sources to return a deterministic entity_id for graph use.

Instructions

Guarda una entidad en un caso (lo crea si no existe). Normaliza el valor y devuelve su entity_id determinista. Reinsertar fusiona fuentes y propiedades. Úsala también para volcar al grafo datos de otros MCP (MISP, ATT&CK, TheHive...) con source=.

Input Schema

NameRequiredDescriptionDefault
notesNoNotas del analista.
valueYesValor de la entidad (ej.: example.com).
sourceNoOrigen del dato (manual, misp, attack...).manual
case_idYesId del caso: 2-63 caracteres a-z, 0-9, '-' o '_' (ej.: caso-2026-001).
confidenceNoConfianza 0-1 en el dato.
propertiesNoPropiedades adicionales "clave=valor".
entity_typeYesTipo Maltego (ver osint_list_entity_types), p. ej. maltego.Domain, propio (acme.Ticket) o "auto" para detectarlo por el valor (correo, URL, IP, rango, hash, AS, teléfono, dominio o frase).
response_formatNo"markdown" (por defecto, legible) o "json" (estructurado).markdown

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.2.0

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare idempotent=true and destructive=false, but the description earns credit by making idempotency concrete: reinsertion 'fusiona fuentes y propiedades' rather than failing or overwriting. It also discloses normalization and the deterministic entity_id return, adding real context beyond the structured hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three compact sentences, front-loaded with the core operation before secondary use cases and source guidance. Minimal waste, though the parenthetical and alternation of languages is slightly dense.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 8-param upsert tool with full schema coverage and no output schema, the description covers the operation, idempotent merge behavior, and the deterministic return (entity_id). Safety is covered by annotations; only explicit alternatives are missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so all eight parameters are already documented. The description only adds a passing reference to source=<origen>, which the schema already covers; baseline 3 is appropriate since the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific operation (upsert = save-or-create an entity in a case) plus the resource and side behaviors (normalization, deterministic entity_id). It is clearly distinguishable from read/search siblings like osint_get_entity or osint_search_entities, though it never explicitly names osint_manage_entity as the alternative for non-upsert operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides one concrete usage context: dumping graph data sourced from other MCPs (MISP, ATT&CK, TheHive) via source=<origen>, and notes that reinsertion merges. However, it gives no explicit exclusions and does not clarify when to choose this over osint_manage_entity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.