Skip to main content
Glama
F6 Threat Intelligence MCP Server

F6 Threat Intelligence MCP Server

Official
by F6-Security

ti_describe_collections

Read-onlyIdempotent

Describes available threat-intelligence collections, queryable fields, limits, and filtering rules so you can choose the right collection and build accurate queries before retrieval.

Instructions

Reference data from the API guides, answered locally with no API call and no rate-limit cost: for each collection its category, availability (общая vs индивидуальная), TTL, Admiralty code, severity, max records per request, which iteration methods it supports, whether apply_hunting_rules applies, and its response fields — which are also the attributes usable as q=field:value. Call this before ti_get_collection to pick the right collection and filter.

Input Schema

NameRequiredDescriptionDefault
categoryNoOptional: only collections in this category.
collectionNoOptional: describe just this one.
include_fieldsNoInclude the response-field lists. Default true for a single collection, false for a listing.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive, so the safety profile is covered. The description adds genuinely new behavioral context: this is served locally with no API call and no rate-limit cost, and it discloses the include_fields default (true for a single collection, false for a listing) beyond the schema's terse wording.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One dense sentence, front-loaded with the local/no-rate-limit benefit and then the field inventory. The long enumeration is long but each item is a distinct capability an agent needs, so little is wasted; a short bullet-style split would read better.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the return-value burden and does so by enumerating the metadata fields. It is nearly complete for a read-only reference tool, missing only how it relates to the overlapping ti_list_collections sibling.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds real meaning by explaining that the returned response fields are the attributes usable in q=field:value filters, which tells the agent why to inspect fields before querying. The category and collection parameters themselves are not elaborated beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific resource (collection reference metadata) and enumerates exactly what is returned: category, availability, TTL, Admiralty code, severity, max records, iteration methods, hunting-rule applicability, and response fields. It also distinguishes itself from the sibling ti_get_collection by being the pre-flight lookup.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a clear directive to call this before ti_get_collection to choose a collection and build filters, and notes it costs no API call or rate limit. It does not address the very similar sibling ti_list_collections, leaving an ambiguity about which listing tool to use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.