Skip to main content
Glama
F6 XDR MCP Server

F6 XDR MCP Server

Official
by F6-Security

xdr_get_artifact_structure

Read-only

Lists files and folders inside a collected artifact one level at a time with sizes, helping identify specific parts to download instead of fetching the whole artifact.

Instructions

List the files and folders inside a collected artifact, one level at a time, with their sizes. Takes the artifact's numeric 'id' from xdr_list_artifacts and an optional folder inside it (e.g. /var/log). Use it to find the part worth downloading rather than fetching a whole artifact.

Input Schema

NameRequiredDescriptionDefault
pathNoFolder inside the artifact; omit for the top
report_idYesNumeric artifact id ('id' in xdr_list_artifacts)

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv1.3.0

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=true, so safety is covered; the description instead contributes the non-obvious behavior that listing is non-recursive ('one level at a time') and that sizes are returned. It does not say what happens with an invalid path or whether there is a result cap, but the key calling behavior is disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with what the tool does, followed by the prerequisite and the intended use. No filler or restatement of structured fields beyond what is needed for context.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter read tool with no output schema, the description covers the source of the required id, the meaning and default of the path, the granularity of results, and the return contents (names and sizes). Nothing an agent needs in order to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and both parameters are already documented there, including the 'id in xdr_list_artifacts' cross-reference. The description repeats that mapping and adds only a '/var/log' example, so it adds little beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List the files and folders inside a collected artifact') and immediately bounds the scope with 'one level at a time, with their sizes'. It also names the sibling that produces the required id, so an agent can distinguish it from xdr_list_artifacts without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a concrete decision rule: use it to 'find the part worth downloading rather than fetching a whole artifact', which frames it as a cheaper precursor to a download step, and tells the agent the id must come from xdr_list_artifacts. It does not state an explicit when-not-to-use case or a sibling alternative for other browsing needs.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.