EyalSec MCP Server

Official

by EyalSec

Overview Schema Source Related Servers Discussions Admin

Python

Remote

Event counts

event_counts

Read-onlyIdempotent

Count an account's security events per product, split by live or suppressed status, and show progress toward the monthly event quota.

Instructions

How many events the account has: per product list, live versus suppressed, and the count toward the monthly event quota (pass view for the number one product's list is capped by).

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "event_counts"
  }
}

Input Schema

Name	Required	Description	Default
`view`	No	Which product's events: 'python' (es-python) or 'browser' (es-chromium). Omit for every product on the account.
`bucket`	No	'live' (default: events not suppressed), 'suppressed', or 'all'.

Output Schema

Name	Required	Description	Default
No arguments

Schema Changelog

Changes observed during successful MCP inspections.

First observedv0.1.0Oct 15, 2026

TDQS

C2.7/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, openWorldHint, and destructiveHint=false, so the safety profile is covered. The description adds useful domain context by distinguishing live vs suppressed buckets and mentioning the monthly quota count, but it omits anything about result shape, defaults, or account-level scope beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is a single run-on sentence whose trailing parenthetical is grammatically broken and hard to parse. The core countable dimensions should be front-loaded as a clean list, but instead they are tangled with the quota clause.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be restated, and annotations cover safety. Still, for a tool sitting among many event-related siblings, the description lacks the routing guidance and clarity an agent needs to pick it over event_stats or search_events, and the ambiguous quota clause leaves the tool's exact scope uncertain.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the schema already explains that view maps to 'python'/'browser' and bucket to live/suppressed/all. The description echoes these concepts loosely ("per product list, live versus suppressed") without adding format or default details beyond the schema, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description indicates a counting/aggregation tool ("How many events the account has") and names the dimensions: per product, live vs suppressed, and quota usage. However, it never clearly distinguishes itself from siblings like event_stats or get_event_uniqueness, and the final parenthetical ("pass view for the number one product's list is capped by") is nearly unintelligible, blurring rather than sharpening the purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to use this tool versus event_stats, search_events, or list_event_names, and no note about prerequisites. The only implicit guidance is "pass view" for a per-product count, which is embedded in a garbled clause rather than framed as a decision rule.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.