Skip to main content
Glama
FouadHELLAL7

Datto EDR MCP Server

by FouadHELLAL7

datto_edr_agents_list

Read-only

List and search Datto EDR endpoint agents by hostname, IP, active/authorized status, and last heartbeat, with paging and custom filters for auditing or triage.

Instructions

List or search Datto EDR endpoint agents (GET /api/Agents). Filter by hostname, IP, active/authorized state and last heartbeat; add any other property (OS, version, isolation state...) through "where" after checking field names with datto_edr_api_models {"model":"Agents"}. Paged with limit/skip.

Input Schema

NameRequiredDescriptionDefault
ipNoExact IP address (ipstring)
skipNoNumber of results to skip (use nextSkip from the previous page)
limitNoMax results per page (1-1000, default 50)
orderNoLoopBack order, e.g. "createdOn DESC" or "hostname ASC"
whereNoExtra LoopBack where filter, combined with AND, e.g. {"hostname":{"ilike":"%sql%"}}. Operators: eq, neq, gt, gte, lt, lte, between, inq, nin, like, ilike, and, or. Use datto_edr_api_models to see a model's properties.
activeNotrue = agent currently active/online
fieldsNoOnly return these properties (keeps responses small)
hostnameNoExact hostname
authorizedNotrue = agent approved/authorized
last_seen_afterNoOnly agents with a heartbeat at or after this ISO date/time
last_seen_beforeNoOnly agents whose last heartbeat is at or before this ISO date/time (stale agents)
hostname_containsNoCase-insensitive hostname substring (LoopBack ilike)

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.0.0

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and openWorldHint, so the safety profile is covered. The description adds real behavioral context beyond them: results are paged via limit/skip, and 'where' filters are AND-combined with the first-class filters. It does not describe default page size or total-count behavior, but that is minor given the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences, front-loaded with the verb/resource before the filtering strategy and pagination note. Slight redundancy in re-listing filter dimensions already present in the schema, but nothing wasteful.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 12-parameter, nested-filter list tool with no output schema and existing annotations, the description covers the essentials: what is searched, how to filter beyond the fixed set, and how pagination works. It stops short of noting response shape or that 'fields' keeps payloads small (the schema covers that), which is acceptable here.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3; the description earns above that by explaining the intended layering of the 12 params (dedicated filters vs. the 'where' escape hatch) and by naming example properties (OS, version, isolation state) that are not in the schema. Pagination semantics of limit/skip are also tied together conceptually.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List or search Datto EDR endpoint agents') and even names the underlying endpoint (GET /api/Agents). It is clearly a collection-level read, distinguishable in spirit from datto_edr_agents_get, though it never names that sibling explicitly to make the split airtight.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete routing guidance for filtering: use the first-class filters for hostname/IP/state/heartbeat, and fall back to 'where' for other properties after verifying field names via datto_edr_api_models {"model":"Agents"}. It does not state when to prefer datto_edr_agents_get or datto_edr_agents_count over this tool, leaving that to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.