Skip to main content
Glama

watch_logs

Read-only

Watch a profile's DNS queries live for 5-120 seconds, then list each with time, status, domain, device, and reason, plus blocked count. Use while opening apps; logs must be on.

Instructions

Watch a profile's DNS queries live for 5 to 120 seconds, for example while the user opens an app ("open TikTok now"), then list what came in, one line each with time, status, domain, device and reason, and how many were blocked. Use logs for past queries and analytics for totals. Changes nothing, but the call waits the whole time; logs must be on for the profile, or nothing comes in.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
rawNotrue: every query. false (default): only the useful ones (A, AAAA and HTTPS, without repeats).
deviceNoOnly this device: a device ID from the devices report, or __UNIDENTIFIED__.
searchNoPart of a domain to look for: facebook matches facebook.com, fbcdn.net and others.
statusNoOnly queries with this result: blocked, allowed, default or error.
profileNoThe profile's ID or name. Leave empty for the only profile, or the default one.
secondsNoHow long to watch, 5 to 120 seconds.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
resultYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed6 schema fields changed
    • addedInput schema / properties / device / description
      Added value: +"Only this device: a device ID from the devices report, or __UNIDENTIFIED__."
    • addedInput schema / properties / profile / description
      Added value: +"The profile's ID or name. Leave empty for the only profile, or the default one."
    • addedInput schema / properties / raw / description
      Added value: +"true: every query. false (default): only the useful ones (A, AAAA and HTTPS, without repeats)."
    • addedInput schema / properties / search / description
      Added value: +"Part of a domain to look for: facebook matches facebook.com, fbcdn.net and others."
    • addedInput schema / properties / seconds / description
      Added value: +"How long to watch, 5 to 120 seconds."
    • addedInput schema / properties / status / description
      Added value: +"Only queries with this result: blocked, allowed, default or error."
  2. First observedv0.8.1

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so safety is covered; the description adds the non-obvious cost that 'the call waits the whole time' up to 120 seconds, which materially affects agent behavior. It also discloses the dependency on profile logging. What it does not add is whether results are streamed or returned at the end, but the latency disclosure is the important one.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense paragraph with no filler sentences, and the core action plus time bounds are front-loaded. It is slightly overloaded with the output-format enumeration, which is redundant given the output schema exists.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given an output schema exists, the return values need not be re-explained, yet the description still previews them. With safety covered by annotations, the description supplies the two things an agent most needs: the blocking latency and the logging prerequisite. Nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and each parameter (raw, device, search, status, profile, seconds) is documented in the schema itself. The description adds only an illustrative example ('open TikTok now') rather than format or syntax guidance. Baseline 3 is appropriate when the schema carries the parameter burden.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb (watch live) plus the resource (a profile's DNS queries) and even the time bounds (5 to 120 seconds). It explicitly distinguishes itself from the two closest siblings by naming logs and analytics, so an agent can route correctly without reading any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states when to use this tool versus alternatives ('Use logs for past queries and analytics for totals') and gives a concrete trigger scenario ('while the user opens an app'). It also states a hard precondition: logs must be enabled for the profile or nothing comes in.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.