Skip to main content
Glama
MadameFabulous

Chainsaw MCP Server

Chainsaw: assess results with Jev

chainsaw_jev_triage

Send selected Windows EVTX result rows to TypeSafe Jev for advisory classification and priority scoring, returning probabilities and confidence for triage.

Instructions

Send selected result rows to TypeSafe Jev for advisory classification and priority.

EXTERNAL DATA TRANSFER: sends the selected evidence fields to api.typesafe.ai. Requires CHAINSAW_JEV_ENABLED=true and credentials. One bounded API request per call, no retries. Returns source row indexes, probabilities and confidence; invalid answers fail only their source row, with both scores null and a named error; invalid response containers reject the batch. Each assessment lists all uncertain_reasons: insufficient_context, low_classification_confidence, low_priority_confidence or validation_failed. uncertain is true when reasons exist. Scores are model judgments, not confirmed findings. Review the original evidence before acting. Evidence and stored results are unchanged.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum rows sent to Jev.
fieldsNoDotted paths or result-field shorthand to send. Omit to send whole selected rows, including their evidence file path. Use chainsaw_result_page with these fields to preview exactly what would be disclosed.
handleYesSource JSONL result handle to assess.
offsetNoFirst source row index.
min_confidenceNoBelow this confidence, flag uncertainty.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds a lot beyond annotations: names the external destination (api.typesafe.ai), discloses the data-transfer implication, one bounded request per call with no retries, exact failure semantics (invalid answers null both scores with a named error; invalid containers reject the batch), enumerates uncertain_reasons, and cautions that scores are model judgments not confirmed findings. This is unusually thorough for a mutating/external-call tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the core action, then the external-transfer warning, then the return/failure semantics. Dense but each sentence carries distinct operational information; the only cost is length from the enumerated uncertainty reasons.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, yet the description compensates fully by describing the return shape (source row indexes, probabilities, confidence, uncertain flags and reasons) and per-row failure behavior. An agent has everything needed to invoke and interpret results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents limit, fields, handle, offset and min_confidence. The description reinforces the disclosure angle of 'fields' but adds no syntax or format detail beyond the schema, which is the expected baseline-3 outcome when structured data carries the load.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb and resource: 'Send selected result rows to TypeSafe Jev for advisory classification and priority.' It also implicitly differentiates from siblings by pointing at chainsaw_result_page for previewing disclosure, so an agent can tell what this tool does versus the result-inspection family.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

States the enabling condition (CHAINSAW_JEV_ENABLED=true plus credentials) and the correct precursor ('Use chainsaw_result_page with these fields to preview exactly what would be disclosed'). No explicit when-not-to-use or comparison against other analysis tools, but the operational context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.