Skip to main content
Glama

Find anomalous log lines

analyze_logs

Score log lines by severity and unusual wording to surface anomalies worst first, so you can focus on the few lines worth reading.

Instructions

Score a log file's lines by severity and how unusual their wording is, and return the anomalies, worst first. Deterministic — no model call, no API key. Call this when you have a log file and want the handful of lines worth reading rather than the whole file.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
logFileYesAbsolute path to the log file
thresholdNoAnomaly score cutoff, 0-1 (default 0.5)

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.8.2

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the burden. It usefully discloses that the tool is deterministic and requires no API key or model call, which addresses common LLM-tool concerns about cost, latency, and non-determinism. It does not disclose failure modes (e.g., unreadable file, encoding) or performance limits, which would push it higher.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, all useful. The key behavior (anomaly scoring and ordering) is front-loaded, followed by determinism note and a concrete usage trigger. No filler or repetition of the title.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers what the tool returns (anomalies, worst first), how it behaves (deterministic, no model call), and when to use it. Given there is no output schema and no annotations, a brief note on returned structure or error behavior would make it complete, but the current description is sufficient for an agent to decide to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents logFile (absolute path) and threshold (0-1, default 0.5) with descriptions. The description adds no parameter-specific semantics beyond what the schema provides, so a baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states what the tool does: score log lines by severity and wording unusualness, returning anomalies worst-first. This specific verb-resource pairing distinguishes it from siblings like analyze_file (generic file analysis) and predict_failures (prediction rather than anomaly extraction).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description says 'Call this when you have a log file and want the handful of lines worth reading rather than the whole file.' This gives a clear trigger condition. However, it doesn't explicitly contrast with siblings (e.g., when to choose analyze_file or scan_project instead), so it stops short of full when-not/alternative guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.