Skip to main content
Glama

logs

Read-only

Search a profile's DNS query history to see what a device looked up or why a domain was blocked earlier. Returns one line per query with time, status, domain, device, and block reason.

Instructions

Search a profile's query log: single DNS queries, newest first, one line each with time (UTC), status, domain, device and block reason. Use it to see what a device looked up or why something was blocked earlier; use watch_logs for queries happening now, analytics for totals and check_domain to test one domain. Changes nothing. Returns a cursor line when there is more, or a private link to download the whole log with download_link; empty when logs are off for the profile.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
rawNotrue: every query. false (default): only the useful ones (A, AAAA and HTTPS, without repeats).
limitNoHow many queries, 10 to 1000.
cursorNoThe cursor from the last answer, to get the next page.
deviceNoOnly this device: a device ID from the devices report, or __UNIDENTIFIED__.
searchNoPart of a domain to look for: facebook matches facebook.com, fbcdn.net and others.
statusNoOnly queries with this result: blocked, allowed, default or error.
profileNoThe profile's ID or name. Leave empty for the only profile, or the default one.
to_dateNoWhere to stop, not included: an ISO date, Unix time or relative like -1h. Empty means now.
from_dateNoWhere to start, included: an ISO date, Unix time or relative like -6h, -7d or -1M.
oldest_firstNotrue: oldest first instead of newest first.
download_linkNotrue: give a link to download the whole log instead of showing it.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
resultYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed11 schema fields changed
    • addedInput schema / properties / cursor / description
      Added value: +"The cursor from the last answer, to get the next page."
    • addedInput schema / properties / device / description
      Added value: +"Only this device: a device ID from the devices report, or __UNIDENTIFIED__."
    • addedInput schema / properties / download_link / description
      Added value: +"true: give a link to download the whole log instead of showing it."
    • addedInput schema / properties / from_date / description
      Added value: +"Where to start, included: an ISO date, Unix time or relative like -6h, -7d or -1M."
    • addedInput schema / properties / limit / description
      Added value: +"How many queries, 10 to 1000."
    • addedInput schema / properties / oldest_first / description
      Added value: +"true: oldest first instead of newest first."
    • addedInput schema / properties / profile / description
      Added value: +"The profile's ID or name. Leave empty for the only profile, or the default one."
    • addedInput schema / properties / raw / description
      Added value: +"true: every query. false (default): only the useful ones (A, AAAA and HTTPS, without repeats)."
    • addedInput schema / properties / search / description
      Added value: +"Part of a domain to look for: facebook matches facebook.com, fbcdn.net and others."
    • addedInput schema / properties / status / description
      Added value: +"Only queries with this result: blocked, allowed, default or error."
    • addedInput schema / properties / to_date / description
      Added value: +"Where to stop, not included: an ISO date, Unix time or relative like -1h. Empty means now."
  2. First observedv0.8.1

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered; the description reinforces it with 'Changes nothing.' Beyond that it discloses pagination behavior (cursor line when there is more), the private download link option, and the empty result when logging is disabled for the profile. It stops short of stating rate limits or retention, but the edge cases it does cover are the ones an agent would otherwise guess wrong.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four sentences, front-loaded with what the tool returns, then routing guidance, then behavior. Every sentence does work, though the final sentence on cursor/download/empty state is dense and partly overlaps the output schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 11-parameter, all-optional search tool with a full output schema and read-only annotations, the description supplies exactly the missing pieces: scope, sibling routing, pagination and empty-state behavior. An agent has everything needed to call it correctly without further context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% across all 11 parameters, including defaults, ranges and enum-like values, so the schema already carries the parameter burden. The description only restates output fields (time, status, domain, device, block reason) and adds no syntax or format detail beyond the schema, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Search a profile's query log') and immediately specifies the return shape: one DNS query per line with time (UTC), status, domain, device and block reason, newest first. It also names the sibling tools it is not (watch_logs, analytics, check_domain), so an agent can route without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit use cases ('see what a device looked up or why something was blocked earlier') and three named alternatives with the condition that selects each: watch_logs for live queries, analytics for totals, check_domain for a single domain test. Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.