Skip to main content
Glama

list_audit_logs

Investigate Cloudflare account changes by listing audit log entries with timestamps, actors, actions, and affected resources to answer who changed what and when.

Instructions

List audit log entries for a Cloudflare account. Returns operation history including timestamps, actors, actions, and affected resources. Useful for investigating who changed what and when.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
pageNoPage number of paginated results (default: 1)
sinceNoFilter by start date in ISO 8601 format (e.g. 2026-05-01T00:00:00Z)
beforeNoFilter by end date in ISO 8601 format
actor_ipNoFilter by the IP address of the actor
per_pageNoNumber of entries per page (default: 25, max: 1000)
directionNoSort direction: asc or desc (default: desc)
account_idYesrequired,The ID of the Cloudflare account
actor_emailNoFilter by the email of the actor

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the tool 'Returns' data, implying a read-only operation, and describes the content of the results. However, it does not disclose pagination behavior (despite page/per_page parameters), potential side effects, authentication requirements, or what happens when filters are applied. The description gives a general sense of the operation but lacks depth expected for a query tool without annotation support.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences with no redundant information. The action is front-loaded ('List audit log entries'), followed by a brief explanation of the returned data and a clear use case. Every sentence earns its place, and there is no fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (8 parameters, no output schema), the description provides a good high-level overview of the returned data and purpose. It does not explicitly mention pagination or the shape of the response, but the schema covers parameters and the description gives enough context for an agent to understand what the tool does. The lack of an output schema is partially mitigated by the description of the returned fields. Minor gaps include not mentioning pagination or sorting defaults, but the description is adequate for most use cases.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with each of the 8 parameters having a description in the schema. The tool description itself does not add any parameter-specific information beyond what the schema already provides. Since the schema fully documents the parameters, the description does not need to compensate, and the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists audit log entries for a Cloudflare account and specifies the data returned (timestamps, actors, actions, affected resources). It differentiates itself from siblings like list_received_logs or query_security_events by focusing on audit log investigation, though it does not explicitly name any alternatives. The verb 'List' and resource 'audit log entries' make the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a clear use case ('investigating who changed what and when') but does not explicitly state when to use this tool versus similar siblings such as query_security_events or list_received_logs. There is no mention of exclusions or alternatives. The usage context is implied but not made explicit enough to guide an agent to the right tool among closely related options.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.