Skip to main content
Glama
Knuckles-Team

CISO Assistant MCP Server

Api webhooks audit sinks create

ciso_assistant_api_webhooks_audit_sinks_create

Create an admin-managed audit-log forwarding destination (AUDIT_SINK) to send CISO Assistant audit events to an external sink.

Instructions

Admin-managed audit-log forwarding destinations (kind=AUDIT_SINK). Folder/IAM

Input Schema

NameRequiredDescriptionDefault
bodyNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv2.3.6

TDQS

C2.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false, idempotentHint=false and openWorldHint=true, so the write/external-effect profile is covered structurally. The description does add one genuinely useful behavioral fact not in the annotations: the resource is 'Admin-managed', implying elevated privileges are needed to create a forwarding destination. It says nothing about what a sink requires, whether creation triggers validation, or what happens on duplicate creation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is short, but the brevity is under-specification rather than concision: two fragments, the second ('Folder/IAM') being an unexplained tag that reads like leftover metadata. Nothing about the create action is front-loaded, and no sentence explains the payload or the effect.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

A create mutation with an opaque free-form body, no output schema, and no annotations covering permissions or side effects. The description supplies the resource identity and an admin hint, but leaves the agent unable to know what to put in the body or what a successful creation returns — a substantial gap for a write tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is one parameter, 'body', declared only as a free-form object (anyOf object/null) with 0% schema description coverage and no documented properties. The description does not enumerate or explain any body fields; the only hint is 'kind=AUDIT_SINK', which is not enough for an agent to construct a valid payload. With low coverage the description is expected to compensate, and it does not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the resource domain ('audit-log forwarding destinations') and an internal discriminator (kind=AUDIT_SINK), which does distinguish it from the sibling webhooks_endpoints family. However, it is a bare noun phrase with no verb: an agent cannot tell from the text alone that this is the create operation rather than list/retrieve/update, and it must fall back on the tool name. Purpose is inferable but not stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance, no prerequisite (e.g. that a sink must exist before events can be replayed), and no reference to the alternatives in the same family (audit_sinks_list, audit_sinks_update, audit_sinks_replay_create). The agent gets no routing signal beyond the resource noun.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools