Skip to main content
Glama
Knuckles-Team

CISO Assistant MCP Server

Api webhooks audit sinks replay create

ciso_assistant_api_webhooks_audit_sinks_replay_create

Replays historical audit events to a webhook audit sink over a specified time range, enabling recovery or re-delivery of missed audit data.

Instructions

Re-emit historical audit events to this sink. Body: {since, until?} (ISO

Input Schema

NameRequiredDescriptionDefault
idYes
bodyNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv2.3.6

TDQS

C2.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false, idempotentHint=false and openWorldHint=true, so the safety profile is structured. The description's 're-emit ... to this sink' adds the meaningful fact that this dispatches historical events outward to an external endpoint and is repeatable/non-idempotent, but it stops there — no mention of volume limits, whether delivery is synchronous, or what happens on sink failure, and the text is cut off mid-sentence.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two lines is appropriately short, but the definition is under-specified rather than concise: the parenthetical format hint is truncated mid-token ('(ISO'), which reads as a broken tool definition and leaves an unclosed bracket.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an externally-facing, non-idempotent replay action with a fully opaque request body and no output schema, the description should carry much more: accepted timestamp format, defaults for 'since', and the effect on the target sink. Annotations cover only the safety hints; the operational contract is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the body is an opaque anyOf object, so the description is the only source of field names — {since, until?} is genuinely additive. However the format hint is truncated at '(ISO' so the agent can't tell date-only from datetime, and the required 'id' parameter is never explained beyond the vague 'this sink'.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: re-emitting historical audit events to a named sink. This is clearly distinguishable from the sibling CRUD tools (audit_sinks_create/list/retrieve/destroy) and from batch_action. It loses a point only because the truncated text never clarifies what 'sink' identifier is required or what a 'replay' produces.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No statement of when to use this versus the sink CRUD or batch_action siblings, and no prerequisites (sink must exist, must be enabled, required permissions). Nothing tells the agent when replay is inappropriate, e.g. re-driving a live production endpoint.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools