Skip to main content
Glama
Sign In
EyalSec MCP Server

EyalSec MCP Server

Official
by EyalSec
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

Activity log

list_activity
Read-onlyIdempotent

Retrieve an account's 30-day audit trail, newest first, filter security events by action or outcome, and review sign-ins, machine changes, key generation and API calls.

Instructions

The account's audit trail, newest first, 50 per page, kept for 30 days: sign-ins, machine changes, key generation and API calls.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "list_activity"
  }
}

Input Schema

NameRequiredDescriptionDefault
actionNoOne exact action name, such as 'machine.create' or 'auth.login'.
outcomeNoKeep only this outcome.
before_idNoNext page: the 'id' of the last entry received.
before_tsNoNext page: the 'time' of the last entry received.

Output Schema

NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover safety (readOnly, idempotent, non-destructive), yet the description adds three genuinely useful behavioral facts: newest-first ordering, a 50-per-page page size, and a 30-day retention window. Cursor pagination via before_id/before_ts is implied by "50 per page" but never explained, and auth/rate-limit behavior is unstated, so it is not a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence packs resource, scope, ordering, page size, retention and content types with zero filler, and the identifying information (audit trail) is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return values need no explanation, and the description supplies the retention window, ordering and page size an agent needs to page correctly. It is only incomplete in sibling routing — nothing tells the agent when to prefer search_events or event_stats over this tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so action, outcome, before_id and before_ts are all already documented with examples and enum values. The description adds no syntax or usage detail about those filters, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific resource — "the account's audit trail" — and enumerates the event kinds it covers (sign-ins, machine changes, key generation, API calls), which makes it distinguishable from generic event tools. It never states the verb explicitly (it is a listing tool), and it does not name the sibling (search_events) it is closest to, so it stops short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use or when-not-to-use guidance, no prerequisites, and no routing to alternatives such as search_events or event_stats despite 18 siblings. The content enumeration only faintly implies the use case, which is weaker than the 'implied usage' a 3 requires.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools