Skip to main content
Glama
Space-C0wboy

threatlocker-mcp

by Space-C0wboy

ThreatLocker MCP

PyPI version PyPI - Python Version License: MIT CI

threatlocker-mcp is a Model Context Protocol server that connects AI assistants such as Claude Desktop and Claude Code with the ThreatLocker Portal API. 44 tools — generated directly from the official OpenAPI 3.0 spec — give your AI assistant programmatic access to computers, approvals, action logs, tags, maintenance mode, reports, and more, across single-org and parent/child tenant setups.

IMPORTANT

Unofficial project. This is an independent, community-built MCP server developed against ThreatLocker's published API documentation. It is not an official ThreatLocker product and is not affiliated with, endorsed by, or supported by ThreatLocker, Inc. "ThreatLocker" is a trademark of ThreatLocker, Inc. For official support of the ThreatLocker platform itself, contact ThreatLocker directly.

WARNING

Beta software — not yet recommended for production environments. This project is under active development. The tool surface and individual tool body shapes may still change between minor versions, and not every endpoint has been exhaustively exercised against every tenant configuration. Use against a lab or non-production tenant until you're confident in the behavior for your use case.

This server can also perform destructive actions against your ThreatLocker environment. Tools can enable/disable endpoint protection, approve security requests, modify tag membership, end active maintenance windows, approve storage devices, and move computers between organizations. A hallucinated tool argument from your AI assistant could alter your ThreatLocker configuration in ways that affect endpoint security.

Recommended posture:

  • Try the server against a non-production or lab tenant first.

  • Use a ThreatLocker API key scoped to the minimum permissions your use case requires.

  • Review every destructive tool call before allowing execution. Claude Desktop requires tool-call approval by default — keep that enabled.

  • Treat the API key with the same care as portal admin credentials, because functionally it is one.

  • The HTTP transport binds to 127.0.0.1 by default. Do not expose it to the public internet without adding authentication.

Tools

Area

Count

Capabilities

Computers

9

Search, get/edit details, enable/disable protection, update maintenance mode, baseline rescan, move between orgs, finish active maintenance

Approval Requests

11

Search, get by ID, count pending, get permit details, approve, reject, ignore, take ownership, storage approval read/permit, file download details

Application

5

Get by ID, get matching list, list available apps for permit-into, list apps for maintenance mode, research details

Action Log

4

Search by parameters, get by ID, file history, file download details

Maintenance Mode

4

Get schedule by computer, insert, end by ID, reschedule end time

Tag

3

Get by ID, dropdown options by org, update

System Audit

2

Search by parameters, health center

Computer Groups

2

Get groups with computers, dropdown by org

Policy

1

Get by ID

Online Devices

1

Get by parameters

Reports

1

Get by organization

Organization

1

list_organizations — discover org GUIDs this API key can target

All request bodies are typed Pydantic models (63 generated from the spec), so the AI assistant receives full schema validation and autocomplete. The wire format preserves the original camelCase field names expected by the API.

Related MCP server: GHL MCP Server

Quick Start

Install

uv tool install threatlocker-mcp

Using pip

pip install threatlocker-mcp

Configure

Set the required environment variables (or place them in a .env file in the directory where you launch the server):

export THREATLOCKER_API_KEY="your-api-key"
export THREATLOCKER_ORG_ID="your-default-org-guid"
export THREATLOCKER_BASE_URL="https://portalapi.h.threatlocker.com"

Variable

Required

Default

Description

THREATLOCKER_API_KEY

API key from ThreatLocker Portal → Modules → API

THREATLOCKER_ORG_ID

Default organization GUID. Find it in the portal URL after switching into the target org.

THREATLOCKER_BASE_URL

Portal API base URL. Use the same subdomain letter shown in your portal (.h., .g., .e., etc.) — e.g. https://portalapi.h.threatlocker.com

THREATLOCKER_TIMEOUT

30

Per-request timeout in seconds

LOG_LEVEL

INFO

Logging verbosity: DEBUG / INFO / WARNING / ERROR

MCP_HTTP_HOST

127.0.0.1

Bind host for the HTTP transport

MCP_HTTP_PORT

8765

Bind port for the HTTP transport

Run

threatlocker-mcp

By default the server runs in stdio mode (the transport MCP clients like Claude Desktop expect). For HTTP transport:

threatlocker-mcp --transport http --port 8765

Editor Integration

Claude Desktop with uvx (recommended)

Add the following block to your Claude Desktop configuration file:

  • Windows: %APPDATA%\Claude\claude_desktop_config.json

  • macOS: ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "threatlocker": {
      "command": "uvx",
      "args": [
        "threatlocker-mcp"
      ],
      "env": {
        "THREATLOCKER_API_KEY": "your-api-key",
        "THREATLOCKER_ORG_ID": "your-default-org-guid",
        "THREATLOCKER_BASE_URL": "https://portalapi.h.threatlocker.com"
      }
    }
  }
}

Fully quit Claude Desktop (tray icon → Quit on Windows; ⌘Q on macOS), then reopen it. uvx resolves and caches the package on first launch; subsequent launches are nearly instant.

Pinning to a specific version

"args": ["threatlocker-mcp@0.2.1"]

Forcing a refresh

"args": ["--refresh", "threatlocker-mcp"]

Multi-Organization Usage

Every tool accepts two optional parameters for targeting specific organizations in a parent/child tenant hierarchy:

  • organization_id — overrides the ManagedOrganizationId request header. When omitted, THREATLOCKER_ORG_ID is used.

  • override_organization_id — sets the OverrideManagedOrganizationId header for scenarios that require both headers simultaneously.

Finding child org GUIDs: Call list_organizations first — optionally with search_text to filter by display name — to enumerate every org this API key can target. Org GUIDs can also be read from the portal URL while switched into each child org.

Example Prompts

Investigate denied activity:

"Search the action log for any denied executions on hostname SRV-DB-01 in the last 24 hours."

→ Calls action_log_get_by_parameters_v2 with an ActionLogParamsDto.

Review pending approvals:

"Show me all pending approval requests for the Cloud Services org."

→ Calls approval_request_get_by_parameters with organization_id=<cloud-svc-guid>.

Approve a request:

"Approve request abc-123 at computer scope with the note 'verified vendor'."

→ Calls approval_request_permit_application with a PermitApplicationDto.

Schedule maintenance:

"Put workstation WS-FINANCE-04 into maintenance mode for the next two hours."

→ Calls maintenance_mode_insert with a MaintenanceModeInsertDto.

Manage tags:

"Add corporate-vpn.example.com to the existing 'Corporate VPN' network tag."

→ Calls tag_get_dropdown_options_by_organization_id and tag_update.

License

MIT — see LICENSE.

Available Tools

44 tools
action_log_get_all_for_file_history_v2A

Get All File History by hostname and fullpath NOTE: spec marks every parameter optional, but the API returns 417 'Missing Parameters. Unable to load details.' unless fullPath plus one of (hostname, computerId) is supplied.

ParametersJSON Schema
NameRequiredDescriptionDefault
source_table_idNo
hostnameNo
full_pathNo
computer_idNo
page_numberNo
page_sizeNo
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behavior. It reveals that the API returns a 417 error if required parameters are missing, which is helpful. But it omits other behavioral traits like read-only nature, performance, or error handling beyond the 417 case.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with a critical note, front-loading essential information. No extraneous words, every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 8 parameters, no output schema, and no annotations, the description is incomplete. It addresses the required parameter combination but lacks details on return format, pagination, or what 'file history' entails, leaving significant ambiguity for an AI agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 25%, so the description should add meaning for the other parameters. It explains the relationship between full_path, hostname, and computerId, which is valuable. However, it does not clarify source_table_id, page_number, page_size, or the override parameters, leaving gaps.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves 'All File History by hostname and fullpath', specifying the verb (Get) and resource (File History) along with identifying keys. This distinguishes it from sibling tools like action_log_get_by_id_v2.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes a crucial note about parameter requirements (fullPath plus hostname or computerId), which guides usage. However, it does not specify when to use this tool versus alternatives or when not to use it, limiting guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

action_log_get_by_id_v2D

Action Log: Get By Id V2

ParametersJSON Schema
NameRequiredDescriptionDefault
e_action_log_idNo
source_table_idNo
add_to_applicationNo
get_all_parentsNo
opened_from_linkNo
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

D1/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations and description does not disclose any behavioral traits such as read-only nature, side effects, or error behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness1/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely brief but underspecified; lacks necessary information for tool usage, so not appropriately sized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 7 parameters and no output schema, description is severely lacking; does not explain return values or behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 7 parameters with only 2 having descriptions (29% coverage). Description adds no meaning to parameters beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose1/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description is 'Action Log: Get By Id V2', which is a tautology and does not specify what the tool does. It does not distinguish from siblings like action_log_get_by_parameters_v2.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines1/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. No context provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

action_log_get_by_parameters_v2A

Get Action Logs By Parameters. NOTE: this endpoint runs in two modes depending on the usenewsearch header. The MCP defaults to usenewsearch=true (the new search path the portal SPA uses), which is the only mode that returns data. Required: sourceTableId (1=ActionLog, 2=DenyActionLog, 3=BaselineActionLog, 4=EventLogActionLog), startDate, endDate, and paramsFieldsDto (the MCP defaults this to []; the server returns HTTP 500 when the field is absent under the new search path). Omitting sourceTableId returns HTTP 500; omitting both date forms returns 417 'Invalid Date Range'. Pass usenewsearch=null to opt out into the legacy path -- but note the legacy path returns an empty body even when data exists, so this is only useful for back-compat probing.

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyYesRequest body.
usenewsearchNoHeader: usenewsearchtrue
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the two-mode behavior, default values, error conditions, and that the legacy path returns empty. Missing info on rate limits, authentication, or side effects, but the coverage is still good.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with purpose and then details the two modes and errors. Every sentence adds value, though it is slightly verbose. It is well-structured and informative.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (many parameters, nested objects, no output schema), the description covers critical operational details like mode selection, required fields, and error responses. Missing some details on pagination (pageNumber, pageSize) and authentication, but overall it is sufficiently complete for an MCP tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions for each parameter. The description adds meaningful context beyond the schema: explains the usenewsearch default, required fields, and that paramsFieldsDto defaults to []. It also highlights specific error scenarios, which aids correct tool invocation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it gets action logs by parameters, and explains the two modes (usenewsearch). However, it does not explicitly differentiate from sibling action_log_* tools like action_log_get_by_id_v2 or action_log_get_all_for_file_history_v2.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit guidance: recommends usenewsearch=true for data, lists required fields (sourceTableId, startDate, endDate, paramsFieldsDto), warns about HTTP 500 and 417 errors, and explains when to use the legacy path (only for back-compat probing).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

action_log_get_file_download_details_by_idD

Action Log: Get File Download Details By Id

ParametersJSON Schema
NameRequiredDescriptionDefault
e_action_log_idNo
source_table_idNo
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

D1.7/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided and the description gives no behavioral context (read vs write, return structure, side effects). The agent knows nothing beyond the tool name.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely short but tautological. The single sentence adds no information beyond the tool name, wasting the opportunity to provide useful content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema, no annotations, and minimal description. The tool is under-defined; the agent cannot infer return format or behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only 2 of 4 parameters have schema descriptions; the description adds no additional meaning. Key parameters e_action_log_id and source_table_id remain undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose2/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Action Log: Get File Download Details By Id' merely restates the tool name without specifying the resource or action. It doesn't distinguish from sibling tools like action_log_get_by_id_v2.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. With many sibling action log tools, the agent needs context on prerequisites or use cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

application_get_by_idC

Get Application by Id.

ParametersJSON Schema
NameRequiredDescriptionDefault
application_idNo
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of disclosing behavioral traits. The simple 'Get' implies a read-only operation, but it does not confirm this, nor does it mention authentication needs, rate limits, or what happens if the ID is invalid. The minimal description fails to provide meaningful behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, short sentence that is front-loaded with the action. It is concise, though it arguably sacrifices completeness. Every word is functional, but the brevity leaves gaps in behavioral and contextual information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 3 parameters (none required) and no output schema, the description should explain what is returned (e.g., application details) or clarify the optional parameters' purpose. The current description is too sparse, providing only the basic action without addressing the tool's complexity or usage context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers 67% of parameters with descriptions (organization_id and override_organization_id). The description 'Get Application by Id.' adds no additional meaning beyond what the schema already provides. Since schema coverage is high (>80%? Actually 67%, but close to threshold), the baseline is 3, and the description does not improve it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Get Application by Id.' clearly states the verb 'Get' and the resource 'Application' with its identifier. It is specific and directly reflects the tool's name, distinguishing it from other get-by-id tools for different resources (e.g., action_log_get_by_id_v2). However, it does not differentiate itself from potential sibling tools like application_get_for_application_options beyond the resource name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus its siblings. It does not mention any prerequisites, alternatives, or exclusions. For example, it does not indicate that this tool returns a single application by ID, while application_get_matching_list might be more appropriate for searches.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

application_get_for_application_optionsA

Load Application List custom + built-in applications available to permit a file into. Use this when the permit_application flow needs useExistingApplication: true -- i.e., adding the requested file to an app discovered through means other than application_get_matching_list. Filter by osType (1=Windows, 2=MAC, 3=Linux, 5=Windows XP), optional searchText to narrow by name, and includeBuiltIn to include master-org BUILT-IN apps. (Renamed from the KB's ApplicationGetListForAddToApplication.)

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyYesRequest body.
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

A4.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. The word 'Load' implies a read operation, but there is no explicit statement about idempotency, side effects, or auth requirements. The description is adequate but lacks depth on behavioral traits beyond the operation type.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single paragraph that front-loads the main purpose, then details usage and filtering. It is efficient but slightly dense; a slight split could improve readability. Still, it earns its place without wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the three parameters in a nested body and no output schema, the description provides sufficient context for the tool's role in the permit_application flow. It covers when and how to use it, though it could optionally hint at the return structure.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, but the description adds value by explaining osType values (1=Windows, etc.), clarifying searchText narrows by name, and specifying includeBuiltIn includes master-org BUILT-IN apps. This goes beyond the schema descriptions, enhancing understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool loads custom + built-in applications for permitting a file into, specifies the exact use case (when permit_application flow needs useExistingApplication: true), and distinguishes itself from sibling application_get_matching_list by naming it and contrasting the context.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool (useExistingApplication: true) and provides an alternative (use application_get_matching_list for other cases). It also lists filtering parameters (osType, searchText, includeBuiltIn) with their meaning, giving clear guidance on how to invoke the tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

application_get_for_maintenance_modeA

Get Application Options for Maintenance Scheduling List applications eligible for use with a Maintenance Mode when processing an approval request. Filter by osType (1=Windows, 2=MAC, 3=Linux, 5=Windows XP). Maintenance Modes (Installation/Learning/Monitor) are selected on the permit_application body via policyConditions.ruleId (1/2/3 respectively).

ParametersJSON Schema
NameRequiredDescriptionDefault
os_typeNo
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It explains the output (list of applications eligible for maintenance mode) and provides mapping for osType and maintenance modes. However, it does not mention side effects, authentication, rate limits, or pagination. The description is adequate but not detailed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, efficiently front-loading the purpose and adding parameter details and context. It is appropriately sized with no obvious fluff, though the second sentence could be slightly clearer.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple nature of this list tool with no output schema, the description explains what it returns and how results relate to maintenance mode. However, it omits details like return format, sorting, pagination, or edge cases. It is adequate but not exhaustive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 67% with organization_id and override_organization_id described in schema. The description adds crucial meaning for os_type by providing its values (1=Windows, 2=MAC, 3=Linux, 5=Windows XP), which was missing from schema. This adds value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Get Application Options for Maintenance Scheduling List applications eligible for use with a Maintenance Mode', providing a specific verb and resource. It distinguishes from siblings like application_get_by_id and application_get_for_application_options by specifically mentioning maintenance mode and approval processing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage 'when processing an approval request' but does not explicitly state when to use this tool over alternatives or when not to use it. No exclusions or conditions are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

application_get_matching_listD

Get Matching Applications

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyYesRequest body.
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

D1.5/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations; description only repeats the name. No disclosure of behavioral traits like read-only, authentication needs, or return behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely concise but at the cost of informativeness. No structure, single phrase with no added value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given complex nested schema and no output schema, description is completely inadequate. No info on return type, pagination, or matching logic.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage signal says 100% but nested properties inside 'body' are undocumented. Description adds no meaning to parameters; just calls body 'Request body.'

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose2/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description 'Get Matching Applications' is vague; doesn't specify what 'matching' means or what criteria are used. Fails to differentiate from siblings like application_get_by_id.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines1/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs. alternatives. No exclusions or context provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

application_get_research_details_by_idA

Get Application Research Details by Id. Optional. Get ThreatLocker's research data (description, risks, mitigations) for an application before permitting it. Useful for decision support when the chosen matchingApplication or existingApplication is a sensitive built-in or unknown app.

ParametersJSON Schema
NameRequiredDescriptionDefault
application_idNo
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries burden. It discloses that the operation retrieves data (read-only implied) and lists return fields. However, it does not mention if the call can fail, rate limits, or that it is non-destructive. The fact that it's a 'get' suggests read-only, but more explicit transparency would be beneficial.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, directly conveying purpose and use case without extraneous information. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, description helpfully lists return fields (description, risks, mitigations). It covers the main use case. However, it does not explain error handling or what happens when no research exists. Considering low complexity, it is fairly complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 67%, with descriptions for organization_id and override_organization_id. The description adds no extra parameter-level info beyond schema. It implies application_id is the main identifier but does not elaborate on its usage. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Get Application Research Details by Id' and specifies that it retrieves ThreatLocker's research data (description, risks, mitigations). It distinguishes from sibling tools like application_get_by_id which returns general app info.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'Useful for decision support when the chosen matchingApplication or existingApplication is a sensitive built-in or unknown app.' It also marks the tool as 'Optional.' However, it does not explicitly state when not to use it or suggest alternatives among siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

approval_request_get_by_idA

Get Approval Request By ID NOTE: requestorReason is base64-encoded -- decode before display. approval_request_get_permit_application_by_id returns the same request with the reason already decoded under fileDetails.requestorReason, plus file/policy/ringfencing context.

ParametersJSON Schema
NameRequiredDescriptionDefault
approval_request_idNo
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses that requestorReason is base64-encoded and needs decoding, a key behavioral trait. It does not mention potential errors or authentication, but the disclosure is good for a simple get tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences with front-loaded key info. Every sentence adds value; no fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description could do more. It addresses the quirk and alternative but omits response structure, pagination, or rate limits. Adequate but not rich.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 67%, with approval_request_id lacking description. The description adds no parameter details beyond the schema. The primary parameter is not explained, and its optionality with default null is confusing.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the tool retrieves an approval request by ID, with a note about base64 encoding. It distinguishes itself from a sibling tool (approval_request_get_permit_application_by_id) that returns decoded data and more context.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear guidance on when to use this tool versus the alternative: use this for raw, base64-encoded requestorReason; use the sibling for decoded reason and additional context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

approval_request_get_by_parametersA

Approval Request: Get By Parameters NOTE: statusId is required (e.g. 1 for Pending). Calls without it return HTTP 500. Each result's requestorReason is base64-encoded -- decode before display. For the decoded reason plus richer file/policy context, follow up with approval_request_get_permit_application_by_id.

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyYesRequest body.
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses key behaviors: required statusId, error on missing, base64 encoding of requestorReason. Without annotations, description carries burden. Could mention pagination but core behaviors are covered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single dense paragraph, front-loaded with purpose and critical note. Every sentence adds value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, description explains return value format (base64) and error condition. Suggests follow-up for richer context. Missing details on pagination but schema covers parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage of top-level parameters is 100% but nested parameters lack descriptions. Description adds critical meaning for statusId (required, example for Pending) and base64 encoding, compensating for schema gaps.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states 'Approval Request: Get By Parameters' with specific verb and resource. It distinguishes from siblings by noting the required statusId and suggesting a follow-up tool for richer context.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states statusId is required, warns about HTTP 500 if omitted, explains base64 encoding, and recommends alternative tool for decoded reason and richer context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

approval_request_get_countC

Get Approval Request Pending Count

ParametersJSON Schema
NameRequiredDescriptionDefault
include_child_organizationsNo
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist. The description only states the purpose; it does not disclose behavioral traits such as what is counted, whether it scopes to a default organization, or any side effects. For a simple count tool, more transparency is needed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single short sentence, which is concise. However, it lacks structure (e.g., separate sections for parameters or behavior) but is still efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and no annotations, the description should explain what the count represents (e.g., pending approval requests across all organizations or a specific one). It does not mention return format or scoping nuances, making it incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 67%. Two parameters (organization_id, override_organization_id) have descriptions in the schema. The description does not add extra meaning for any parameter, leaving include_child_organizations undocumented. Baseline score is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description states 'Get Approval Request Pending Count', which clearly identifies the resource (approval request) and action (get count). It distinguishes from siblings like approval_request_get_by_id (single record) and approval_request_get_by_parameters (list of records). However, it does not explicitly contrast with these alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus siblings. The description does not mention context, prerequisites, or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

approval_request_get_file_download_details_by_idC

Get File Download Details By Approval Request Id

ParametersJSON Schema
NameRequiredDescriptionDefault
approval_request_idNo
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

C2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description carries full burden. The description provides zero behavioral disclosure—no mention of side effects, return format, rate limits, or required permissions. This is insufficient for a tool with no output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise (one sentence), but it achieves this by omitting critical details. It is underspecified rather than appropriately sized. Every sentence should earn its place; this one only restates the name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the absence of output schema, annotations, and the presence of three parameters, the description is far from complete. It does not explain what file download details are, what the return value looks like, or any prerequisites. The agent lacks sufficient context to correctly invoke the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds no meaning to any of the three parameters. The schema has 67% coverage (descriptions for two of three parameters), but the main parameter approval_request_id lacks description, and the description does not clarify it. The tool name implies its role, but the description fails to augment schema information.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose2/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Get File Download Details By Approval Request Id' is a human-readable restatement of the tool name, effectively a tautology. It does not add any new information or distinguish this tool from siblings beyond the name itself.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. With many sibling tools that retrieve file download details by different criteria, this omission leaves the agent without explicit usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

approval_request_get_permit_application_by_idC

Get Permit Application Details By Approval Request Id

ParametersJSON Schema
NameRequiredDescriptionDefault
approval_request_idNo
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description must carry the full burden of behavioral disclosure. It only states 'Get Permit Application Details' without any mention of side effects, authentication requirements, rate limits, or read-only nature. Minimal disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, which is concise but lacks structure. It is essentially a rephrasing of the tool name and misses an opportunity to front-load key information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of output schema and annotations, the description is insufficient. It does not describe what 'Permit Application Details' includes, the return format, or any prerequisites. Completeness is poor.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 67%, but the description adds no additional meaning beyond what is in the schema. It does not explain the relationship between approval_request_id and the permit application, nor does it clarify the two optional organization override parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the verb (Get) and resource (Permit Application Details) with a specific filter (by Approval Request Id). It distinguishes from sibling tools like approval_request_get_by_id which retrieves the approval request itself.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives such as approval_request_get_by_id or approval_request_get_storage_approval_by_id. The description implies the purpose but does not provide context for decision-making.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

approval_request_get_storage_approval_by_idC

Get Storage Approval Request By Id

ParametersJSON Schema
NameRequiredDescriptionDefault
approval_request_idNo
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

C2.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description should disclose behavioral traits like read-only nature, permissions required, or side effects. The description merely restates the tool name without any such details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely brief (one phrase), but it fails to provide useful information beyond the tool name. Conciseness without substance is not effective; the description does not earn its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has no output schema, three parameters, and no nested objects. The description explains nothing about return values, pagination, error handling, or any other contextual information. It is severely incomplete for a retrieval tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 67% description coverage (two of three parameters have descriptions). The tool description adds no additional parameter information beyond what the schema provides. Given the moderate coverage, a baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Get Storage Approval Request By Id' clearly indicates a retrieval operation on a specific resource type. However, it does not differentiate from sibling tools like 'approval_request_get_by_id' or 'approval_request_get_permit_application_by_id', leaving ambiguity about the exact scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives such as 'approval_request_get_by_id' or 'approval_request_get_by_parameters'. The description offers no context about prerequisites or typical use cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

approval_request_permit_applicationA

Approve Permit Application Request WORKFLOW: take_ownership -> get_permit_application_by_id -> application_get_matching_list -> permit_application. Start from the DTO returned by get_permit_application_by_id and modify the choices below. REQUIRED FIELDS (KB-documented, all must be present): approvalRequest.approvalRequestId; approvalRequest.json -- copy verbatim from get_permit_application_by_id (server uses it to reconstruct file/action context, omitting it causes silent failures); userinstance -- the portal shard ('h', 'g', etc.), parsed from the request's portalApiUrl subdomain; isFromApproval: true; hasOriginApprovalCenter: true; actionType (copy from request: 'elevate'/'execute'/'install'); osType (1=Windows, 2=Mac, 3=Linux, 5=WinXP); organizationId, computerId (copy from request); organizationIds -- list of parent org IDs above the request's org ([] for top-level); fileDetails.fullPath. APP SELECTION (set exactly ONE mode on matchingApplications): (a) PREFERRED -- use application_get_matching_list result. Prefer tenant-owned match (its organizationId equals the call's organizationId) over master-org/BUILT-IN (organizationName: "master"). Set useMatchingApplication: true, populate matchingApplication with the chosen result; set others false and their objects to null. The DTO's hasMatchingApplication flag is UNRELIABLE -- trust application_get_matching_list.hasMatching instead. *** CRITICAL -- BUILT-IN match REQUIRES entire-org scope. When the chosen match has organizationName: "master", you MUST set policyLevel.toEntireOrganization: true. Pairing a BUILT-IN with computer-scope returns HTTP 401 "Missing the '' permission" (misleading -- it's actually a body-shape error). Verified 2026-05-21. Tenant-owned matches and new apps use the default all-flags-false scope. (b) FALLBACK -- add to existing custom app (discover via application_get_for_application_options). Set useExistingApplication: true, populate existingApplication; others null. (c) LAST RESORT -- create new app. Set useNewApplication: true and newApplicationName to a non-null derived name (e.g. file stem title-cased: vlc.exe -> "VLC"). Null returns HTTP 417 'Must enter a name for a new application'. POLICY (policyConditions.ruleId): 0=manual rules, 1=Install Mode 1hr, 2=Learning Mode 1hr, 3=Monitor Mode 1hr. Set useExistingPolicy: true to reuse an existing policy (manualOptions then carries the rule criteria). SCOPE (policyLevel): default 'this computer' = ALL THREE flags false (toEntireOrganization/toComputerGroup/toComputer); scope is inferred from top-level computerId. Setting toComputer: true returns HTTP 417 'Provided applies to ID does not associate with a known OS type'. For computer group, set toComputerGroup: true and populate selectedComputerGroup (discover via computer_group_get_dropdown_by_organization_id). For entire-org, set toEntireOrganization: true. ACTION TYPE: for elevate set isElevationRequest: true and isExecutionRequest: false; for execute reverse. Both are spec-readOnly but MUST be sent matching the action. SHAPE: send null (not omit) for unused sub-objects -- matchingApplication, existingApplication, selectedComputerGroup, policyExpirationDate, elevationExpirationDate. Wrong shape = opaque HTTP 500. PERMISSIONS: API key user needs one of 'Approve for Entire Organization', 'Approve for Group', 'Approve for Single Computer', or 'Approve for Single Computer Application Only' in Administrators.

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyYesRequest body.
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description fully carries the burden. It discloses critical behaviors: the unreliable hasMatchingApplication flag, silent failures when omitting json, error mappings for wrong shape (HTTP 500), permission requirements, and the verified date for BUILT-IN scope requirement. This is exceptionally transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but well-organized with clear sections (workflow, required fields, app selection, policy, scope, shape, permissions). Every sentence provides actionable guidance. While verbose, the density is justified by the tool's complexity; minimal fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complex nested schema and no output schema, the description covers all necessary aspects: workflow prerequisites, field-level requirements, selection logic, error scenarios, permissions, and shape rules. It is self-contained and leaves no major gaps for a competent agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% for top-level params but the nested body object lacks descriptions. The description compensates fully by explaining required fields, exact values (e.g., osType mapping, actionType options), copy instructions, and complex logic for matchingApplications, policyConditions, policyLevel. It adds immense meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states 'Approve Permit Application Request' and specifies the workflow chain (take_ownership -> get_permit_application_by_id -> ...). It clearly distinguishes from sibling tools like approval_request_get_by_id or approval_request_update_for_reject by focusing on the approval action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides detailed usage guidance: the required workflow, three app selection modes with clear priority, policy and scope rules, and error conditions (401, 417, 500). It does not explicitly compare with all siblings but strongly implies when this tool is appropriate (after fetching the permit application).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

approval_request_permit_storage_approvalA

Approve Storage Request NOT YET LIVE-TESTED -- expect shape sensitivity similar to approval_request_permit_application. WORKFLOW: take_ownership -> get_storage_approval_by_id -> permit_storage_approval. Start from the DTO returned by approval_request_get_storage_approval_by_id and modify the choices below. LIKELY REQUIRED (by analogy with the application-permit flow): approvalRequest -- copy verbatim from get_storage_approval_by_id; json -- verbatim copy from the same response, used by the server to reconstruct the storage-request context. DEVICE / SCOPE FLAGS (set exactly one mode): addDeviceToExisting -- add the storage device to an existing storage policy (populate existingStoragePolicy); deviceExists -- the device is already known to ThreatLocker; allStorageDevices -- apply to all storage devices in scope; allFilePaths -- apply to all paths rather than just selectedPath; allUserGroups -- apply to all users/groups rather than the populated usersList/userGroups. Set unused companion objects (existingStoragePolicy, newStorageDevice) to null, not omitted. EXPIRATION: expirationDate is ISO 8601 UTC; null = permanent. RESPONSE: responseSubject and responseReason are shown to the requester; notifyOnResponse controls whether they're emailed. If the server returns HTTP 401 "Missing the '' permission" (empty interpolation), suspect body-shape rather than permissions -- same root cause as the application-permit flow.

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyYesRequest body.
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses important behavioral traits such as the tool being 'NOT YET LIVE-TESTED,' shape sensitivity, required fields to copy verbatim, how to handle nulls, expiration date format, and a note about HTTP 401. This provides substantial transparency, though it could mention side effects or success/failure behavior more explicitly.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is quite long but is structured into labeled sections (workflow, device/scope flags, expiration, response, troubleshooting). However, it contains some redundancy and could be more concise. Given the complexity of the tool, the structure aids readability, but there is room for tightening.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description thoroughly covers input parameters and usage prerequisites, including a workflow and troubleshooting tip. However, it lacks details about the tool's output—e.g., what the response object looks like or how to interpret success/failure. Since no output schema is given, this omission leaves a gap in contextual completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides only minimal descriptions for the top-level parameters (e.g., 'Request body.' for body). The description adds extensive semantic information: it explains which fields are likely required (approvalRequest, json), how to handle device/scope flags (set exactly one mode), and how to set expiration and response fields. This far exceeds the baseline expectation for 100% schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts by stating 'Approve Storage Request,' which clearly identifies the tool's purpose. It distinguishes itself from sibling tools by referencing the analog 'approval_request_permit_application' and by detailing the workflow involving get_storage_approval_by_id, making it unambiguous that this tool is for approving storage requests specifically.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly provides a workflow: 'WORKFLOW: take_ownership -> get_storage_approval_by_id -> permit_storage_approval.' It instructs the user to start from the DTO returned by the getter, thereby telling when to use this tool. Although it does not explicitly state when not to use it, the prerequisite steps are clear, which guides appropriate usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

approval_request_update_for_ignoreC

Ignore Approval Request

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyYesRequest body.
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

C2.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fails to disclose important behavioral details such as whether this is a destructive action, if it sends notifications, or what state changes occur. The single word 'Ignore' implies a mutation but offers no clarity.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely short and front-loaded, but it sacrifices substance for brevity. While concise, it fails to provide necessary context, making it only marginally effective.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (nested objects, many parameters, no output schema, no annotations), the description is far too minimal. It does not explain the tool's behavior, required fields, or typical use cases, leaving the agent underinformed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has descriptions for the top-level parameters, but the nested body fields lack descriptions. The description does not add meaning about which parameters are relevant for ignoring, so it does not enhance understanding beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Ignore Approval Request' provides a verb and resource, but it does not clarify what 'ignore' entails compared to similar tools like approval_request_update_for_reject. It is adequate but lacks differentiation from sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus alternatives such as approval_request_update_for_reject or approval_request_update_for_take_ownership. There are no prerequisites or when-not-to instructions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

approval_request_update_for_rejectC

Reject Approval Request

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyYesRequest body.
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

C2.4/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description fails to disclose any behavioral traits such as whether the rejection is permanent, what permissions are needed, or any side effects. The description 'Reject Approval Request' is purely functional and adds no behavioral insight.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

While the description is short (3 words), it is under-specified. Conciseness should provide necessary information without waste, but here it fails to earn its place by omitting critical details about parameters or usage. A single phrase is insufficient for a tool with a complex nested input.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (3 parameters, one required nested object with many subfields) and lack of output schema, the description is completely inadequate. It does not explain what fields in the body are needed for rejection, leaving the agent without key context to invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage: each parameter has a basic description (e.g., 'Request body.'). The tool description itself adds no additional meaning beyond what the schema already provides. With high schema coverage, a baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Reject Approval Request' clearly states the verb 'Reject' and the resource 'Approval Request', making the tool's purpose immediately understandable. However, it does not differentiate from sibling tools like 'approval_request_update_for_ignore', which also update approval requests but with different actions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives such as ignoring or taking ownership of an approval request. No prerequisites, context, or exclusions are given, leaving the agent without decision-support information.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

approval_request_update_for_take_ownershipC

Take Ownership of Approval Request

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyYesRequest body.
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

C2.2/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It fails to mention any effects (e.g., changes ownership, permissions required, reversibility), leaving the agent uninformed about the tool's impact.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely short (two words), but conciseness should not sacrifice completeness. It lacks necessary detail and is better described as under-specified rather than concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the absence of annotations, output schema, and the complexity of the input schema (nested object with many fields), the description is completely inadequate. It provides no information about return values or side effects.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although top-level parameters have schema descriptions, the complex body object with many nested properties is not explained in the tool description. The description adds no meaning beyond the schema; it does not clarify which fields are relevant for taking ownership, leaving the agent to guess.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Take Ownership of Approval Request' conveys the action (take ownership) and resource (approval request) clearly. However, it does not distinguish this tool from sibling tools like approval_request_update_for_ignore or approval_request_update_for_reject, which have similar names but different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No usage guidelines are provided. There is no indication of when to use this tool versus alternatives, nor any prerequisites or context for taking ownership. The description lacks any guidance on use cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

computer_disable_protectionC

Disable Computer Protection

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyYesRequest body.
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

C2/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations and only a four-word description, the tool's behavioral traits (e.g., destructiveness, permissions required, reversibility) are not disclosed. This is insufficient for an AI agent to understand the impact of invoking the tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise at four words but is under-specified given the complex nested input schema. It loses necessary detail for brevity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complex input schema, no output schema, and no annotations, the description is severely incomplete. It fails to explain what 'protection' is, what the outcome is, or any prerequisites or side effects.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds no meaning beyond the input schema. While schema coverage is 100%, the schema descriptions are minimal (e.g., 'Request body.') and the nested object's sub-properties lack descriptions. The tool's description does not compensate for this.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Disable Computer Protection' clearly states the action and resource, distinguishing it from the sibling 'computer_enable_protection'. However, it does not clarify what 'protection' refers to, leaving some ambiguity about the specific functionality.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives like 'computer_enable_protection' or maintenance mode tools. The description lacks context for appropriate usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

computer_enable_protectionD

Computer Enable Protection

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyYesRequest body.
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

D1.6/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description gives no information about behavioral traits. It does not state what enabling protection entails, whether it is safe, destructive, or requires permissions. The tool is a black box.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one word, which is extreme under-specification. It lacks structure and fails to provide any useful information while being too short.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of nested parameters and related sibling tools, the description is completely inadequate. It does not explain what 'protection' means, nor does it cover return values or usage semantics. The tool is not understandable from the description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with basic descriptions for parameters. However, the tool description adds no extra meaning beyond the schema. For complex nested objects like body.computerDetailDtos, more context would be beneficial. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose1/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description is simply the tool's name, repeating 'Computer Enable Protection' without any verb or resource. It is a tautology and fails to specify what enabling protection does or how it differs from other tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No description text provides context on when to use this tool versus alternatives like computer_disable_protection. The absence of guidance means no explicit when-to-use, but it's not misleading.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

computer_get_by_all_parametersC

Load Computers By All Parameters

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyYesRequest body.
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must disclose behavioral traits. It does not mention that the tool is read-only, supports pagination, or returns a list of computers. The description is too brief to inform about parameters like 'pageSize', 'orderBy', or whether it filters by organization. Behavioral transparency is lacking.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise (5 words) but at the expense of substance. It is a single phrase without structure or front-loading of key information. It could be expanded to include essential details without becoming lengthy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (15 body properties, optional headers, no output schema) the description is severely incomplete. It fails to explain pagination parameters, search functionality, ordering, output format, or when to use this tool compared to get-for-edit. The agent needs more context to use this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage, so the schema already documents all parameters adequately. The description adds no additional meaning beyond the tool's name. Baseline score of 3 applies since the description does not enhance parameter understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Load Computers By All Parameters' clearly states the verb 'Load' and resource 'Computers', indicating it retrieves computer data based on multiple parameters. However, it doesn't distinguish from sibling tools like 'computer_get_for_edit_by_id' which also loads computers but for editing. The purpose is clear but lacks differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternative computer retrieval tools (e.g., 'computer_get_for_edit_by_id'). There is no mention of use cases, prerequisites, or conditions where this tool is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

computer_get_for_edit_by_idC

Get Computer Information By Id.

ParametersJSON Schema
NameRequiredDescriptionDefault
computer_idNo
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

C2/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations and a one-sentence description, there is no disclosure of behavioral traits such as whether the tool acquires a lock, requires permissions, or has side effects. The name 'for_edit' suggests mutation, but the description only says 'Get', creating ambiguity.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely short but under-specified. It does not earn its place by providing substantive information beyond the name, making it a case of under-specification rather than effective conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given three parameters, no output schema, no annotations, and a complex domain (implied by sibling tools), the description is grossly incomplete. It fails to explain the 'for edit' functionality, return values, or parameter usage, rendering the tool largely opaque to an AI agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds no meaning to the parameters. While the schema covers two out of three parameters with descriptions, the primary parameter 'computer_id' is left undocumented, and the description does not explain it. Schema coverage is 67%, but the description fails to compensate for the gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Get Computer Information By Id' restates the tool's name without clarifying the 'for edit' aspect, which suggests a locking or editing context. It is clear as a basic get operation but misses the nuance implied by the name, making it only marginally better than a tautology.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus siblings like 'computer_get_by_all_parameters' or 'computer_update_for_edit'. There is no mention of prerequisites, alternatives, or context for edit-related usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

computer_group_get_dropdown_by_organization_idC

Get Computer Groups by OrganizationId

ParametersJSON Schema
NameRequiredDescriptionDefault
computer_group_o_s_type_idNo
computer_o_s_typeNo
hide_globalsNo
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

C2.2/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description adds no behavioral details such as whether the tool requires authentication, returns a limited set, or has side effects. The description is insufficient for safe invocation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely brief, which is concise but at the expense of informativeness. It could be expanded with key details without becoming verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the number of parameters (5) and the lack of an output schema, the description does not explain what the tool returns or how the parameters affect results. Sibling tools suggest a variety of group-related operations, but this tool's specific output is unclear.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 40%, with only organization_id and override_organization_id having descriptions. The main description adds no additional meaning beyond the tool name; it does not explain parameters like computer_group_o_s_type_id, computer_o_s_type, or hide_globals.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states the verb 'Get' and resource 'Computer Groups' with a filter 'by OrganizationId', but does not clarify what 'dropdown' means in the context, leaving ambiguity about the return format (e.g., a list for a UI dropdown). Among siblings, some also fetch groups, but this tool is moderately distinct.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus siblings like computer_group_get_group_and_computer or tag_get_dropdown_options_by_organization_id. No context about prerequisites or alternatives, leaving the agent to infer usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

computer_group_get_group_and_computerA

Get Groups and Computer NOTE: this endpoint can return very large payloads (>100KB for a single populated group) when called without scoping. Pass a specific computerGroupId and set only the include_* flags you actually need; unscoped calls may exceed downstream output limits.

ParametersJSON Schema
NameRequiredDescriptionDefault
computer_group_idNo
o_s_typeNo
include_globalNo
include_all_policiesNo
include_organizationsNo
include_all_computersNo
include_parent_groupsNo
include_logged_in_objectsNo
include_dns_serversNo
include_ingestorsNo
portal_module_type_idNo
include_access_devicesNo
include_removed_computersNo
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, description carries full burden. It discloses that the endpoint can return very large payloads (>100KB) and recommends scoping. This is critical behavioral information for an agent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence with a note. Front-loaded with purpose, then critical caveat. No superfluous text. Could break into two sentences for clarity but overall efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 15 parameters, no output schema, and no annotations, the description provides essential context about payload size and scoping but lacks details on return structure or parameter semantics beyond the general advice.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has only 13% description coverage. Description adds meaning by mentioning computerGroupId and include_* flags, but doesn't detail each flag. Compensates partially for low schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description states 'Get Groups and Computer' which is specific enough, but could clarify whether it returns a group with its computers or multiple groups. The warning about large payloads hints at scope but the core resource is clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly advises when to use (with scoping) and warns against unscoped calls due to large payloads. Does not mention alternative tools, but the guidance is actionable and context-aware.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

computer_move_to_other_organizationD

Move Computer

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyYesRequest body.
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

D1.7/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description contains no behavioral information. It does not disclose what happens during the move (e.g., whether it is destructive, requires specific permissions, or is reversible). With no annotations present, the description carries the full burden, which it fails to meet.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise at two words, but this brevity sacrifices clarity and completeness. While it avoids verbosity, it is not appropriately sized for a tool with nested objects and multiple parameters; it lacks front-loaded key information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of moving a computer between organizations (nested objects, multiple IDs), the description is incomplete. It does not explain what 'move' means operationally, nor does it provide any context about return values or side effects. The rich schema partially compensates, but overall completeness is low.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage, with each parameter individually described (e.g., 'Override the default organization'). The tool description itself adds no parameter information, but since the schema already provides adequate semantic details, a baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose1/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Move Computer' is essentially a tautology of the tool name 'computer_move_to_other_organization'. It restates the name without adding any specificity—e.g., moving a computer to a different organization—which is already implied by the name. It fails to clarify the scope or distinguish it from other computer-related tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No usage guidelines are provided. The description does not indicate when to use this tool versus alternatives like 'computer_update_for_edit' or 'computer_disable_protection'. There is no mention of prerequisites, context, or when this operation is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

computer_update_baseline_rescanD

Update Baseline Rescan Computer

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyYesRequest body.
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

D1.9/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behavioral traits. It only says 'Update' without explaining side effects, prerequisites, or what triggers a rescan, leaving the agent uninformed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is too short to be informative; it is under-specified rather than concise. Every word should add value, but here the phrase merely echoes the tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (nested objects, no output schema, numerous siblings), the description is severely inadequate. It omits essential details about effects, return values, and usage context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents parameters. The description adds no additional meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose2/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description is a near-tautology, restating the tool name without clarifying what 'Baseline Rescan' means or distinguishing it from sibling update tools like computer_update_for_edit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives (e.g., computer_update_for_edit). The description provides zero context for decision-making.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

computer_update_for_editC

Update Computer

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyYesRequest body.
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

C2.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so the description must disclose all behavioral traits. It only states 'Update Computer' without explaining side effects, prerequisites, or whether the operation is reversible. The vague verb provides minimal transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely terse at just two words. While concise, it fails to convey sufficient information for agent decision-making, making it under-specified rather than appropriately concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the nested input schema, lack of output schema, and many sibling tools, the description is incomplete. It does not explain return values, required fields beyond 'body', or constraints, leaving significant gaps for the agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with all parameters having descriptions in the input schema (e.g., 'Request body.'). The description adds no additional meaning beyond what the schema already provides, meeting the baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Update Computer' states a verb and resource, but is vague and does not differentiate from sibling tools like computer_update_maintenance_mode or computer_update_baseline_rescan. It lacks specificity on the type of update (e.g., general settings vs. maintenance).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. Sibling tools have distinct purposes (e.g., enabling protection, moving to organization), but the description does not help the agent decide which to invoke.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

computer_update_maintenance_modeC

Updates a device's maintenance mode settings.

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyYesRequest body.
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must fully disclose behavioral traits. It only says 'updates', which is vague. No mention of side effects, required permissions, or what 'maintenance mode settings' entails, leaving the agent underinformed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence with no wasted words. However, it could benefit from slightly more structure, e.g., separating purpose from behavior.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (3 parameters, nested objects, no output schema, no annotations), the description is too brief. It does not explain return values, error conditions, or how settings are updated, leaving significant gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage for top-level parameters, but the tool description adds no additional meaning beyond the schema. The complex nested 'body' object is not explained in the description, but schema descriptions partially compensate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Updates a device's maintenance mode settings' is clear and specific about the verb and resource, but does not differentiate from sibling maintenance mode tools like 'maintenance_mode_end_by_id' or 'maintenance_mode_update_end_date_time_for_specific_date'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives, such as other maintenance mode operations. The description lacks context about prerequisites or use cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

computer_update_to_finish_maintenance_modeA

End Maintenance Mode Ends ACTIVE maintenance mode on a specific computer immediately. Distinct from maintenance_mode_end_by_id, which ends a SCHEDULED maintenance window (in progress or not) identified by maintenanceModeId. Use this when you have a computerId and want enforcement re-enabled now. WARNING: may break in-progress installs.

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyYesRequest body.
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses that the tool ends active maintenance mode immediately and warns of breaking in-progress installs. While it could mention permissions or reversibility, the warning is a strong behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short and focused, but the opening 'End Maintenance Mode Ends' is slightly redundant. It is front-loaded with the action and the warning is valuable. Overall efficient, but a minor wordiness prevents a perfect score.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple mutation tool with no output schema, the description covers the core purpose, usage context, and a warning. It does not explain every parameter, but the schema covers them. The warning about breaking installs adds completeness. A brief note on what happens after ending (e.g., enforcement re-enabled) is present.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description does not explicate the parameters but references `computerId` implicitly. Since the schema has 100% coverage (all parameters have descriptions per context), the description adds value by linking the key parameter to the use case, justifying a score above baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool ends active maintenance mode on a computer immediately, using the verb 'Ends' and specifying the resource. It also distinguishes itself from the sibling tool `maintenance_mode_end_by_id`, which ends a scheduled window, making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly tells when to use this tool ('when you have a `computerId` and want enforcement re-enabled now') and differentiates it from `maintenance_mode_end_by_id`. It also provides a warning about potential breakage of in-progress installs, offering clear usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_organizationsA

Get Organizations For Move Computers Returns the organizations the current API key can target. Use this FIRST to discover org GUIDs to pass as organization_id to other tools. Despite the path name (the endpoint also feeds the portal's 'move computers' org picker), the result is the canonical list of accessible orgs for this key. searchText filters by display name; pass an empty string for the full list.

ParametersJSON Schema
NameRequiredDescriptionDefault
search_textNo
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden. It discloses that the result is the canonical list of accessible orgs, describes filtering behavior, and mentions optional override parameters. It does not detail rate limits or auth failure behavior, but is adequately transparent for a list endpoint.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is relatively concise at three sentences, front-loading the main purpose. It could be slightly more structured but overall efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and no annotations, the description could be more complete. It does not specify the return format (e.g., list of org GUIDs and names) or pagination behavior. It covers essential user guidance but lacks some detail expected for a discovery tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 67% (two parameters have descriptions). The tool description adds meaning for search_text by specifying it filters by display name and that an empty string returns the full list, going beyond what the schema provides. The other parameters are already well-described in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns the organizations the current API key can target, explicitly noting it's the canonical list and advising to use it first to discover org GUIDs. It also addresses the potentially confusing path name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Use this FIRST to discover org GUIDs to pass as organization_id to other tools' and explains the search_text parameter usage. However, it does not provide explicit when-not-to-use guidance or enumerate alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

maintenance_mode_end_by_idC

End Maintenance Schedule

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyYesRequest body.
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

C2.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description 'End Maintenance Schedule' does not disclose behavioral traits like whether it deletes the schedule, sets an end date, or has irreversible effects. Minimal transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise at three words, but this brevity sacrifices clarity. It front-loads the action but lacks necessary detail, making it only adequately sized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with a complex nested body parameter, no output schema, and no annotations, the three-word description is incomplete. It fails to explain what the body contains, the effect of the operation, or any prerequisites.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds no further meaning beyond the schema definitions; parameters are explained in the schema but not summarized or contextualized here.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'End Maintenance Schedule' is a verb+resource but vague; it does not specify what object or scope the schedule applies to. It is better than a tautology but lacks specificity to distinguish from sibling tools like 'maintenance_mode_update_end_date_time_for_specific_date'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives such as 'computer_update_to_finish_maintenance_mode' or 'maintenance_mode_update_end_date_time_for_specific_date'. The description provides no context for selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

maintenance_mode_get_by_computer_idC

Get Maintenance Schedule By Computer Id

ParametersJSON Schema
NameRequiredDescriptionDefault
computer_idNo
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

C2.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It states 'Get' implying a read operation, but does not disclose authorization requirements, behavior when computer_id is null or not found, or any side effects. The minimal description leaves significant ambiguity.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no waste, but it is so concise that it omits essential context. It could benefit from a slightly longer structure that adds value without verbosity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema is provided, and the description does not hint at the return format or structure. With three parameters (none required), the agent lacks guidance on required inputs (computer_id likely needed) and expected output. Incomplete for effective tool invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers 67% with descriptions for organization_id and override_organization_id, but the description adds nothing beyond the parameter names. The key parameter computer_id lacks schema description and the tool description does not clarify its role, default, or whether it is required.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Get Maintenance Schedule By Computer Id', specifying the verb (get) and resource (maintenance schedule by computer ID). However, it does not distinguish from potential sibling retrieval tools, but given the sibling list, this is the only get tool for maintenance mode by computer ID, so it is sufficiently clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. Sibling tools include computer_update_maintenance_mode, maintenance_mode_end_by_id, maintenance_mode_insert, etc., but the description does not indicate that this is the read-only retrieval tool or provide any context on prerequisites or typical use cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

maintenance_mode_insertC

Add to Maintenance Schedule

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyYesRequest body.
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

C2.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden for behavioral disclosure. It does not mention side effects (e.g., creation of a schedule, potential conflicts), required permissions, or idempotency. The tool likely creates a new maintenance entry, but this is not explicitly stated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, which is concise, but it is too minimal for a tool with a complex nested schema. It could benefit from additional context without being verbose. The structure is adequate but not optimized for quick understanding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complex input schema (nested body with many fields) and no output schema, the description is incomplete. It does not explain what the tool returns, required fields, or the impact of parameters. The description needs to be more informative to be contextually complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the input schema already documents all parameters. The description adds no additional meaning beyond what the schema provides. Baseline 3 is appropriate as the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Add to Maintenance Schedule' indicates the tool creates a maintenance schedule entry, but it is vague and does not differentiate from related tools like 'maintenance_mode_end_by_id' or 'computer_update_maintenance_mode'. The verb 'add' is clear, but lacks specificity about what exactly is being added.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No usage guidelines are provided. The description does not specify when to use this tool versus alternatives or any prerequisites. Sibling tools include various maintenance mode operations, but no comparisons are made.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

maintenance_mode_update_end_date_time_for_specific_dateA

Updated Maintenance Mode End Date Time. Reschedules the end time of an existing maintenance window for a specific computer without terminating it. Pass the new maintenanceEndDate (ISO 8601 UTC). To END maintenance immediately use computer_update_to_finish_maintenance_mode (by computer) or maintenance_mode_end_by_id (by maintenance schedule).

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyYesRequest body.
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full responsibility. It mentions the key behavior (reschedule without terminating) and the format of maintenanceEndDate, but does not disclose prerequisites, authorization needs, error states, or what happens to other fields in the body. The response is also not described, which is critical given no output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is brief (three sentences) and front-loaded with the core purpose. The first sentence is slightly redundant ('Updated Maintenance Mode End Date Time'), but the rest is efficient and directs to the critical parameter.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description fails to explain how to specify the 'specific computer' (e.g., via computerId in the body) or which other body fields are required/ignored. With a complex nested schema and no output schema, significant gaps remain for an agent to use this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents each parameter. The description adds the ISO 8601 format hint for maintenanceEndDate, but does not clarify the role of other body fields (e.g., computerId, computerName) despite the tool being for a specific computer. This is minimally helpful beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool reschedules the end time of an existing maintenance window for a specific computer without terminating it. It contrasts with sibling tools that end maintenance immediately, providing a specific verb and resource.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly tells when to use this tool (to reschedule end time) and when to use alternatives (computer_update_to_finish_maintenance_mode or maintenance_mode_end_by_id for immediate termination). Provides clear context for selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

online_devices_get_by_parametersC

View Online Devices

ParametersJSON Schema
NameRequiredDescriptionDefault
page_numberNo
page_sizeNo
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

C2.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided. Description only says 'View Online Devices', omitting any behavioral traits such as read-only nature, pagination behavior, authentication needs, or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence 'View Online Devices' is under-specified, not concise. It lacks essential information and fails to justify its brevity with completeness elsewhere.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 4 parameters, no output schema, and no annotations, the description is highly incomplete. It does not explain pagination, filtering, or the meaning of 'online devices', making it inadequate for agent use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50% (two parameters have descriptions in schema). Tool description adds no additional meaning to any parameter. It does not compensate for the parameters lacking schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description states 'View Online Devices' which gives a verb and resource, but is vague about what constitutes an 'online device'. It distinguishes from siblings by name but lacks specificity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like other get_by_parameters tools. No context on prerequisites or typical use cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

policy_get_by_idC

Get Policy by Id.

ParametersJSON Schema
NameRequiredDescriptionDefault
policy_idNo
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. 'Get Policy by Id' implies a read operation, but it does not explicitly state read-only behavior, auth requirements, rate limits, or error handling (e.g., if policy not found). The minimal description is insufficient for transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise at 4 words and front-loaded with the core purpose. Every word is necessary, but it could be slightly more informative without being verbose. It earns its place but borders on under-specification.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and simple parameters, the description lacks completeness. It does not explain what is returned, behavior on missing policy_id (all parameters optional), or prerequisites. For a tool with many siblings, more context is needed for correct usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 67% description coverage (organization_id and override_organization_id have descriptions), but the tool description adds no parameter semantics. It does not mention that policy_id is optional or clarify the relationship between parameters, so no added value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Get' and the resource 'Policy by Id', distinguishing it from sibling tools that target different entities (e.g., application_get_by_id, tag_get_by_id). However, it is minimal and does not clarify what 'Policy' refers to, limiting full clarity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like similar get_by_id tools for other resources or get_by_parameters tools. There is no mention of when-not-to-use or specific context, leaving the agent without decision support.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

report_get_by_organization_idB

Get report(s) by organization id.

ParametersJSON Schema
NameRequiredDescriptionDefault
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

B3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, but it only states the basic action. It omits behavioral traits such as authentication requirements, error handling, whether the operation is destructive, or what happens when organization_id is null.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, making it concise, but it lacks structure and important details. It is not front-loaded with critical information for an agent.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 2 optional parameters, no output schema, and no annotations, the description is insufficient for an agent to understand return values, default behavior, or error conditions. It needs additional context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%; both parameters have descriptions in the schema. The tool description adds no additional meaning beyond the schema, so a baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Get report(s) by organization id.' clearly states the verb (get), resource (reports), and filtering criterion (organization id). It distinguishes the tool from siblings, as no other sibling explicitly retrieves reports.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. The description does not mention prerequisites, constraints, or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_audit_get_by_parametersC

Retrieves System Audit records based on specified parameters.

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyYesRequest body.
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description must cover behavior. It only states retrieval without mentioning pagination, sorting, authentication, or read-only nature. The schema indicates pagination parameters (pageSize, pageNumber) but description omits them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, no redundancy. Efficiently communicates core purpose without any fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Description is too minimal given the tool's complexity (many sub-parameters, paging options). It lacks details on filtering, pagination behavior, and what is returned. No output schema exists to compensate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for top-level parameters (body, organization_id, override_organization_id) with individual descriptions. The tool description adds no additional meaning beyond specifying that parameters are used for retrieval.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves System Audit records based on parameters. The name reinforces this. It implicitly distinguishes from 'system_audit_get_for_health_center' which is more specific.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus siblings. No when-not-to-use or alternative suggestions. The description only states it retrieves records based on parameters.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_audit_get_for_health_centerB

Retrieves System Audit data for the Health Center, specifically focused on login attempts.

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyYesRequest body.
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries the burden. It only mentions retrieving login attempts, but doesn't disclose pagination, filtering behavior, or any side effects. Parameter details like 'afterKeys' for pagination are not addressed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, front-loaded, no fluff. However, it could add a bit more context without becoming verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description should hint at the response structure or common fields. It doesn't. Parameters like 'pageSize' and 'afterKeys' imply paginated results, but description omits this. Incomplete for a tool with nested parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions for all parameters. The tool description adds no additional meaning beyond the schema, so baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves System Audit data for the Health Center, specifically login attempts. The verb 'Retrieves' and the specific focus distinguish it from the sibling 'system_audit_get_by_parameters'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like 'system_audit_get_by_parameters'. The description does not mention prerequisites or context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tag_get_by_idC

Get Tag by Id.

ParametersJSON Schema
NameRequiredDescriptionDefault
tag_idNo
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

C2.3/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, and the description does not disclose behavioral traits such as read-only nature, permission requirements, or effects of null parameters. The tool's behavior is entirely opaque.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no extraneous words, but it is too terse. It meets the minimum requirement for conciseness but sacrifices necessary detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 3 parameters, no output schema, no annotations, and a one-sentence description, the tool is inadequately documented. Critical information about return values, required inputs, and operational behavior is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 67% (2 of 3 parameters have descriptions), but the tool description adds no additional meaning. The 'tag_id' parameter lacks a description in both schema and description, leaving its purpose unclear.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Get Tag by Id' clearly states the verb and resource. It distinguishes from sibling tools like tag_get_dropdown_options_by_organization_id and tag_update, which serve different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like tag_get_dropdown_options_by_organization_id. The description lacks context about prerequisites or preferred usage scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tag_get_dropdown_options_by_organization_idC

Get Tag Dropdown Options.

ParametersJSON Schema
NameRequiredDescriptionDefault
include_built_insYes
tag_typeYes
include_network_tag_in_masterYes
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

C2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, and the description does not disclose behavioral traits such as read-only nature, side effects, or authorization requirements. The name implies reading, but no explicit confirmation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely brief but under-specified. One sentence that provides no meaningful information beyond the tool name; fails to use the space effectively.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 5 parameters, no output schema, and many sibling tools, the description is wholly inadequate. Lacks return value description, scope, or any operational context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is low (40%), with only two parameters described. The description adds no insight into the three required parameters (include_built_ins, tag_type, include_network_tag_in_master) which remain unexplained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose2/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description is a tautology: 'Get Tag Dropdown Options' simply restates the name without clarifying what dropdown options are or how they differ from other tag-related tools. No distinction from siblings like tag_get_by_id.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs alternatives. Does not mention prerequisites, context, or when to prefer other tools like tag_get_by_id.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tag_updateA

Update Tag. Updates an existing tag. tagId (spec-nullable) must be a valid existing tag GUID; passing an empty or omitted tagId may cause the server to interpret the request as a new-tag creation. Use tag_get_dropdown_options_by_organization_id to discover existing tag GUIDs first. tagType enum (verify against tenant): 1=Computer tag, 2=Application tag, 3=Network tag. Sending one of tagItemsText / tagItemsIPv4 / tagItemsIPv6 replaces (not merges) that list for the tag. NOT YET LIVE-TESTED -- verify behaviour against the dev tenant before relying on it.

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyYesRequest body.
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, description carries full burden. Discloses critical behaviors: nil tagId may create new tag, tagItems replaces lists, tagType values, and that it is not yet live-tested. Could mention permissions or response, but overall strong.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Concise single paragraph, no wasted words. Each sentence serves a purpose – purpose, prerequisite, enum values, replacement behavior, reliability warning. Front-loaded with purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given complexity (nested objects, no output schema, no annotations), description covers essential points: how to get tagId, tagType meaning, tagItems behavior, and testing caveat. Could mention optional organization_id and allTagItems parameter, but overall sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, baseline 3. Description adds significant meaning: tagId must be valid GUID, tagType enum values, tagItems replacement behavior. Does not add much for name, active, or organizationId, but the added info for key parameters is valuable.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States 'Update Tag. Updates an existing tag' – clear verb and resource. Distinguishes from sibling tools like tag_get_by_id by focusing on update. However, could be more specific about which fields are updatable beyond items.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly recommends using tag_get_dropdown_options_by_organization_id to discover tag GUIDs first. Warns about nil tagId causing creation. Lacks explicit exclusions or when to use alternatives, but provides solid context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 44 tool updatesv0.2.1
    • First observedaction_log_get_all_for_file_history_v2
    • First observedaction_log_get_by_id_v2
    • First observedaction_log_get_by_parameters_v2
    • First observedaction_log_get_file_download_details_by_id
    • First observedapplication_get_by_id
    • First observedapplication_get_for_application_options
    • First observedapplication_get_for_maintenance_mode
    • First observedapplication_get_matching_list
    • First observedapplication_get_research_details_by_id
    • First observedapproval_request_get_by_id
    • First observedapproval_request_get_by_parameters
    • First observedapproval_request_get_count
    • First observedapproval_request_get_file_download_details_by_id
    • First observedapproval_request_get_permit_application_by_id
    • First observedapproval_request_get_storage_approval_by_id
    • First observedapproval_request_permit_application
    • First observedapproval_request_permit_storage_approval
    • First observedapproval_request_update_for_ignore
    • First observedapproval_request_update_for_reject
    • First observedapproval_request_update_for_take_ownership
    • First observedcomputer_disable_protection
    • First observedcomputer_enable_protection
    • First observedcomputer_get_by_all_parameters
    • First observedcomputer_get_for_edit_by_id
    • First observedcomputer_group_get_dropdown_by_organization_id
    • First observedcomputer_group_get_group_and_computer
    • First observedcomputer_move_to_other_organization
    • First observedcomputer_update_baseline_rescan
    • First observedcomputer_update_for_edit
    • First observedcomputer_update_maintenance_mode
    • First observedcomputer_update_to_finish_maintenance_mode
    • First observedlist_organizations
    • First observedmaintenance_mode_end_by_id
    • First observedmaintenance_mode_get_by_computer_id
    • First observedmaintenance_mode_insert
    • First observedmaintenance_mode_update_end_date_time_for_specific_date
    • First observedonline_devices_get_by_parameters
    • First observedpolicy_get_by_id
    • First observedreport_get_by_organization_id
    • First observedsystem_audit_get_by_parameters
    • First observedsystem_audit_get_for_health_center
    • First observedtag_get_by_id
    • First observedtag_get_dropdown_options_by_organization_id
    • First observedtag_update

TDQS

C2.5/5.0
Disambiguation4/5

Most tools target distinct resources and actions, though a few overlap (e.g., two maintenance-ending tools). Descriptions generally clarify differences.

Naming Consistency4/5

Tool names follow a consistent verb_noun snake_case pattern with occasional version suffixes. Minor deviations in length but pattern is predictable.

Tool Count3/5

44 tools is on the high side, likely justified by the breadth of ThreatLocker's features, but still borders on overwhelming without clear organization.

Completeness3/5

Covers many domains (logs, approvals, computers, maintenance) but lacks CRUD operations for policies, organizations, or deletions, leaving notable gaps.

Maintenance

ActivityStale
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • F
    license
    A
    quality
    C
    maintenance
    An MCP server that connects AI assistants to the NinjaOne remote monitoring and management platform via the REST API v2. It provides tools for device inventory, organization management, alert handling, maintenance scheduling, and automated job execution.
    22
    1
    -
  • A
    license
    B
    quality
    D
    maintenance
    A comprehensive MCP server that connects AI assistants to GoHighLevel CRM, enabling management of contacts, conversations, calendars, pipelines, payments, and more through 60+ tools.
    64
    39
    1
    MIT
  • A
    license
    A
    quality
    A
    maintenance
    MCP server for interacting with the ThreatLocker Portal API, enabling querying of computers, applications, policies, audit logs, and more through AI assistants.
    18
    1
    GPL 3.0

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Space-C0wboy/ThreatLocker-MCP'

If you have feedback or need assistance with the MCP directory API, please join our Discord server