maltego-mcp
Enables checking email addresses for known data breaches as part of Maltego investigations.
Enables virus and threat intelligence lookups (e.g., domain, IP, hash analysis) as part of Maltego investigations.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@maltego-mcpInvestigate the domain example.com"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
๐ต๏ธ maltego-mcp
An AI-assisted Maltego CE investigation copilot. Build, expand, analyze, and report on OSINT investigation graphs through natural language โ exported as native Maltego
.mtgxfiles.
An MCP server that turns an LLM into a Maltego CE investigation copilot โ an AI-assisted OSINT platform built on Maltego Community Edition's native graph format.
Contents
Related MCP server: CutterMCP-plus
How it works
Maltego CE has no live external API. Instead of trying to remote-control the
desktop UI, this server uses Maltego's native .mtgx graph file (a ZIP
archive of GraphML XML) as the integration surface:
The LLM builds / reads / edits an investigation graph held in memory.
Transforms โ and high-level investigation workflows / machines โ expand the graph (e.g. a domain โ its IP addresses โ open ports).
The LLM analyzes the graph (summaries, pivots, next steps), lays it out, and generates a shareable report.
The graph is saved as a
.mtgxfile that you open (or refresh) in Maltego CE.
A pluggable transform-provider layer keeps the design extensible: the
built-in local provider needs no API keys, and external OSINT providers
(VirusTotal, Shodan, SecurityTrails, Censys, Hunter.io, HaveIBeenPwned) activate
automatically when their API keys are present โ all without changing the graph
core or the MCP tools.
Capabilities at a glance
Area | What you get |
Build graphs | Create/edit entities & links; save/open native |
High-level workflows |
|
Unified entry point |
|
Investigation Memory | Procedural memory: records why/how each step ran; queryable; travels in the |
Next Best Action | Deterministic, explainable, memory-aware ranking of the most valuable next move. |
Risk & confidence | Per-entity confidence, source reliability, linkage, priority, novelty scores. |
Real-time mode | Optional event stream (entity_discovered, transform_*, report_generated, โฆ). |
Investigation machines | Reusable templates (Passive Domain, Email, Infrastructure Mapping). |
OSINT providers | VirusTotal, Shodan, SecurityTrails, Censys, Hunter.io, HIBP (env-var keys). |
AI analysis | Summarize, explain entity, identify pivots, suggest next steps. |
Layout | Deterministic hierarchical / radial / force-directed layouts. |
CSV import | Bulk-build graphs from |
Reporting | Deterministic Markdown / HTML investigation reports (now incl. quality scores). |
Continuation | Load or merge existing |
Install as an MCP server (recommended)
This is a standalone MCP server. The server is launched with
uv via uvx, which auto-installs the Python dependencies in an
isolated environment โ no manual pip install needed. Install uv once if you don't have it:
# Windows (PowerShell)
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"
# macOS / Linux
curl -LsSf https://astral.sh/uv/install.sh | shAdd it to Claude Code
Register the server straight from GitHub (available in every project โ user scope):
claude mcp add maltego --scope user -- uvx --from git+https://github.com/SulimanAbdulrazzaq/maltego-mcp.git maltego-mcpOr run from a local clone (reflects your local edits โ best for development):
git clone https://github.com/SulimanAbdulrazzaq/maltego-mcp.git
claude mcp add maltego --scope user -- uvx --from ./maltego-mcp maltego-mcpOn Windows PowerShell, the
--separator can be swallowed by the shell. Ifclaude mcp adderrors withunknown option '--from', add the server by editing your config instead: open~/.claude.jsonand add amaltegoentry under the top-level"mcpServers"object:"maltego": { "type": "stdio", "command": "uvx", "args": ["--from", "git+https://github.com/SulimanAbdulrazzaq/maltego-mcp.git", "maltego-mcp"] }
The repo also ships a committed .mcp.json, so if you simply open a clone of this
repo in Claude Code the maltego server is offered automatically (project scope, launched with
uvx --from .).
Verify it connected:
claude mcp list # โ maltego: uvx ... - โ ConnectedAfter it connects, the maltego_* tools are available in Claude. Set OSINT keys (optional) in
your shell before starting Claude Code to enable those providers (see
Transforms by provider).
Prefer not to use
uv? See Manual / pip install and point the MCP command at the venv'smaltego-mcpexecutable instead.
Windows troubleshooting (first launch)
On Windows, the very first launch occasionally fails with
failed to rename ... Access is denied (os error 5) while unpacking pywin32 (a transitive
dependency of mcp). This is Windows Defender briefly locking the files during real-time
scanning โ not a bug in the server. Fixes:
Just retry โ restart Claude Code; it succeeds once Defender finishes scanning and the dependency is cached (verified: it works on the second attempt).
Or pre-warm the cache once from a terminal:
uvx --from <path-to-this-repo> maltego-mcp(Ctrl-C after it prints nothing โ it's a stdio server), then retry in Claude Code.Or add an exclusion for
%LOCALAPPDATA%\uv\cachein Windows Security โ Virus & threat protection โ Exclusions.
Manual / pip install
cd maltego-mcp
python -m venv .venv
.venv/Scripts/activate # Windows
# source .venv/bin/activate # macOS/Linux
pip install -e .Then register the stdio server with any MCP client, e.g.:
{
"mcpServers": {
"maltego": { "command": ".../.venv/Scripts/maltego-mcp.exe" }
}
}Running
The server speaks MCP over stdio (ideal for local desktop integration):
maltego-mcp
# or
python -m maltego_mcp.serverRegister with an MCP client
Example mcp.json / client config entry:
{
"mcpServers": {
"maltego": {
"command": "C:/Users/you/Desktop/maltego_mcp/.venv/Scripts/maltego-mcp.exe"
}
}
}(Use the .venv Python on macOS/Linux: "command": ".../.venv/bin/maltego-mcp".)
Test with the MCP Inspector
npx @modelcontextprotocol/inspector maltego-mcpTools
52 tools. The tables below group them by area. For the complete reference with every
argument, type, and default, see TOOLS.md (auto-generated from the live tool
schemas โ the file an AI agent should read to learn the exact interface).
Graph management
Tool | Description |
| Create a new empty in-memory graph (becomes active). |
| Load an existing |
| Write a graph to a |
| List open graphs and show the active one. |
| Switch the active graph. |
Entities & links
Tool | Description |
| Add a node (domain, IP, person, email, โฆ). |
| Add a directed link between two entities. |
| List/filter/paginate entities on the active graph. |
| Full details for one entity. |
| Update value/properties/notes/weight. |
| Delete an entity and its links. |
| Discover supported Maltego entity types. |
Transforms
Tool | Description |
| List available transforms (optionally by input type; shows availability). |
| Run a single transform on an entity and add the results. |
High-level investigation workflows
Tool | Description |
| Seed a domain and auto-run all applicable/available transforms. |
| Seed an email and auto-investigate (domain, breaches, footprint). |
| Seed an IP and auto-investigate (reverse DNS, ports, services). |
| List investigation machines (workflow templates). |
| Run a machine (e.g. |
Unified entry point (primary interface for agents)
Tool | Description |
| One call does it all: detect type โ build/expand graph โ layout โ summarize โ rank โ next-best-actions โ inline report, returned as one finished briefing. Supports |
| Run all applicable transforms on one entity (pivot from a specific node). |
| Shortest relationship path between two entities. |
| Returns the server's usage guidance (workflow + tool map) on demand. |
The AI is told how to use these tools via the server's MCP instructions (auto-injected
into the model's context โ this is how the assistant knows to run an investigation to completion
instead of asking after each step). You can also invoke the bundled command
/maltego-mcp:investigate <target> or the investigate / triage / report prompts.
AI-oriented analysis (the "copilot")
Tool | Description |
| Deterministic overview: counts, type breakdown, key/isolated entities. |
| Explain one entity: data, neighbours, applicable transforms. |
| Rank the most-connected pivot entities. |
| Simple heuristic suggestions (retained for compatibility). |
| Decision engine: deterministic, explainable, memory-aware ranking of the best next move. |
Investigation Memory (procedural memory)
Tool | Description |
| List recorded steps (what ran, why, outcome, importance). |
| Trace an entity's provenance โ which transform/step discovered it and why. |
| Full detail of one recorded transform execution (by execution id). |
| Chronological narrative of the whole investigation. |
Risk & confidence scoring
Tool | Description |
| Confidence, source reliability, linkage strength, priority, novelty for one entity. |
| Rank all entities by investigation priority. |
| Scores plus a deterministic rationale for one entity. |
Real-time mode (optional)
Tool | Description |
| Enable live event mode; returns a subscription id. |
| Poll recent events (supports |
Layout, CSV, import/export, link & graph management
Tool | Description |
| Assign positions ( |
| Build entities/links from a CSV file or inline CSV text. |
| Export entities to CSV (round-trips with import). |
| Export the full graph + memory + scores as JSON. |
| List or delete individual links. |
| Rename or drop an open graph. |
| List OSINT providers and whether their API keys are configured. |
| Markdown/HTML report inline or to a file. |
| Open a |
Outcome-based learning (opt-in)
Tool | Description |
| View cross-investigation transform success/yield history. |
| Clear the learning store. |
Learning is off by default (keeps results deterministic). Enable with
MALTEGO_MCP_LEARNING=1 (or MALTEGO_MCP_LEARNING_PATH=/path/to/learning.json). When on, the
server records per-transform outcomes across investigations and lets that history nudge
maltego_next_best_actions.
Transforms by provider
No API key required โ work out of the box:
dns.domain_to_ipโ domain/DNS name โ IPv4 addresses (DNS A record) [network]dns.ip_to_hostโ IPv4 address โ hostname (reverse DNS / PTR) [network]parse.url_to_domain/parse.email_to_domain/parse.domain_to_website(offline)crtsh.domain_to_subdomainsโ subdomains from Certificate Transparency (crt.sh) [network]rdap.domain_infoโ registrar, dates, nameservers, contacts (RDAP/WHOIS) [network]rdap.ip_infoโ netblock + owning org/ASN for an IP (RDAP) [network]
External OSINT providers โ activate when their env-var key is set (see
maltego_list_providers). Transforms are always listed but only run when
configured; a missing key yields an actionable message rather than an error.
Provider | Env var(s) | Example transforms |
VirusTotal |
|
|
Shodan |
|
|
SecurityTrails |
|
|
Censys |
|
|
Hunter.io |
|
|
Have I Been Pwned |
|
|
Configure keys via environment variables (in your MCP client's env block or
the shell), then restart the server. Example client config:
{
"mcpServers": {
"maltego": {
"command": ".../.venv/Scripts/maltego-mcp.exe",
"env": { "VIRUSTOTAL_API_KEY": "...", "SHODAN_API_KEY": "..." }
}
}
}Example workflows
Manual (low-level):
maltego_create_graph(name="acme-recon")
maltego_add_entity(type="maltego.Domain", value="example.com") # -> n0
maltego_run_transform(transform_name="dns.domain_to_ip", entity_id="n0")
maltego_apply_layout(algorithm="hierarchical")
maltego_save_graph(path="C:/Users/you/Desktop/acme-recon.mtgx")One-call copilot (recommended for agents):
maltego_investigate(query="bob@example.com") # detect โ build โ expand โ analyze โ recommend
maltego_explain_why(entity_id="n1") # why is this entity here?
maltego_next_best_actions() # explainable, memory-aware ranking
maltego_rank_entities() # focus on the highest-priority findings
maltego_get_investigation_timeline() # the reasoning trace
maltego_generate_report(format="html")
maltego_save_graph(path="C:/cases/example.mtgx") # memory travels inside the .mtgxAI-assisted (step-by-step):
maltego_investigate_domain(value="example.com") # auto-runs transforms
maltego_identify_pivots() # find key nodes
maltego_next_best_actions() # what to do next (decision engine)
maltego_apply_layout(algorithm="radial")
maltego_generate_report(format="markdown") # shareable report
maltego_save_graph(path="C:/Users/you/Desktop/example.mtgx")Continue a previous investigation:
maltego_load_graph(path="C:/cases/old.mtgx") # reopen
maltego_run_machine(machine_name="infrastructure_mapping", seed_value="example.com")
maltego_import_graph(path="C:/cases/related.mtgx") # merge in another caseBulk import from CSV:
maltego_import_csv(content="type,value,link_to\nDomain,example.com,\nIPv4Address,1.2.3.4,example.com\n")Extending
Add a new OSINT provider
Create a module under
src/maltego_mcp/transforms/osint/.Write pure parser functions (
dict -> list[ResultEntity]) and asyncrunfunctions that read the API key from an env var viarequire_keys(...).Register a
ProviderInfowithproviders.register(...)and yourTransform(...)objects (withapi_key_env=...) viaregistry.register(...).Import the module from
transforms/osint/__init__.py.
No changes to the graph core, orchestration, machines, or MCP tools are needed โ
new transforms automatically participate in investigate_*, machines, analysis,
and suggestions.
Add an investigation machine
from maltego_mcp.machines import Machine, register_machine
register_machine(Machine(
name="my_workflow", display_name="My Workflow", description="...",
seed_type="maltego.Domain",
transform_names=["dns.domain_to_ip", "vt.domain_to_subdomains"],
allow_network=True, max_rounds=2,
))Architecture
src/maltego_mcp/
โโโ server.py # FastMCP server (with MCP instructions) + 52 tools + prompts
โโโ models.py # Pydantic input models
โโโ entities.py # Maltego entity-type catalog
โโโ formatting.py # markdown/JSON response helpers + error mapping
โโโ detect.py # query -> entity type/value/machine (for maltego_investigate)
โโโ orchestration.py # breadth-first engine + run_and_record (memory+events choke-point)
โโโ machines.py # reusable workflow templates + registry
โโโ analysis.py # deterministic summarize/explain/pivots/next-steps
โโโ recommendation.py # Next Best Action decision engine (memory-aware, explainable)
โโโ scoring.py # Risk & confidence engine (deterministic per-entity metrics)
โโโ memory.py # Investigation Memory (procedural memory; storage + queries)
โโโ learning.py # opt-in cross-investigation outcome learning (feeds NBA)
โโโ events.py # architecture-agnostic event bus (real-time mode)
โโโ layout.py # hierarchical / radial / force-directed layouts
โโโ csv_import.py # CSV -> entities/links (type aliases, dedupe)
โโโ reporting.py # deterministic Markdown / HTML reports (incl. quality scores)
โโโ graph/
โ โโโ graph_store.py # in-memory Graph (+ .memory, merge, analysis helpers)
โ โโโ mtgx_writer.py # Graph -> .mtgx (GraphML + positions + memory sidecar + zip)
โ โโโ mtgx_reader.py # .mtgx -> Graph (recovers positions + memory sidecar)
โโโ transforms/
โโโ base.py # Transform/registry + ProviderInfo/ProviderRegistry (+ reliability)
โโโ local.py # built-in no-auth transforms
โโโ osint/ # providers
โโโ base_http.py
โโโ keyless.py # NO-key: crt.sh (cert transparency), RDAP (domain + IP)
โโโ virustotal.py, shodan.py, securitytrails.py, censys.py, hunterio.py, hibp.pyInvestigation Memory & determinism
Procedural memory (
memory.py) records every transform execution โ the trigger entity, the chosen transform, why it was chosen, what it discovered, status, importance, and whether to reconsider it. It is stored onGraph.memory, kept separate from the graph structure, and serialized to a sidecar member (maltego_mcp/investigation_memory.json) inside the.mtgxโ so it travels with the investigation but never affects Maltego CE compatibility (Maltego ignores unknown archive members).orchestration.run_and_recordis the single choke-point through which the engine and the manualmaltego_run_transformtool execute transforms, so memory and events are captured consistently everywhere.Scores (
scoring.py) are computed deterministically from the graph + memory and provider reliability (ProviderInfo.reliability), so the same investigation always yields the same scores, recommendations, and reports.
Verifying a graph opens in Maltego CE
The .mtgx format is validated by our reader/writer round-trip and by checking entity
property field names against Maltego's real definitions (e.g. Domain/Website โ fqdn,
Company/Organization โ title, IPv4Address โ ipv4-address). To confirm end-to-end in
the actual app:
Install Maltego CE (free; requires a download + account at maltego.com).
Generate a sample:
maltego_investigate("example.com")(or add a few entities) thenmaltego_save_graph(path="โฆ/sample.mtgx"). A ready-madesample-verification.mtgxis produced on the Desktop by the test fixtures.In Maltego CE: File โ Import โ Import Graph (or File โ Open) and select the
.mtgx.Confirm entities render with their values populated, correct types, and links with labels. If a given type's value is blank, its
main_propertyinsrc/maltego_mcp/entities.pyneeds correcting against Maltego's field id for that entity.
Status: the common entity types (Domain, IP, Email, Website, Person, Company, โฆ) have had their field names verified against a reference; opening in a real Maltego CE install is the final confirmation step and is left to the user (no Maltego install was available here).
Notes & limitations
Targets Maltego CE's file format; it does not remote-control the running desktop app. Re-open or refresh the
.mtgxin Maltego after saving.The entity-type catalog is a curated subset; custom
maltego.*types are accepted and saved as-is.Graphs live in process memory until saved; restarting the server clears unsaved graphs.
Layout positions are written into the
.mtgxas yFiles node graphics. Maltego CE may re-run its own layout on import; positions are always available via the tools regardless.OSINT provider transforms call third-party APIs โ respect each provider's terms of service and rate limits. Without a key, those transforms are listed but skip with a clear "missing credential" message.
Reports, layouts, scores, and recommendations are deterministic: the same graph + memory always yields the same output, so results are reproducible and shareable. (Timestamps in memory/events are the only non-deterministic field.)
Investigation Memory is stored as a sidecar JSON member inside the
.mtgxand is recovered on load โ it survives save/load and merges, and is ignored by Maltego CE. Manually-added/CSV entities are "analyst-provided" (no discovering step) and scored with full source reliability.Real-time mode is optional: the event bus always buffers cheaply, and
maltego_subscribe_eventsenables live callbacks. Over MCP stdio you retrieve events by pollingmaltego_get_recent_events(usesince_seqfor increments).
License
MIT
Available Tools
52 toolsmaltego_add_entityA
Add an entity (node) to the active graph.
Use this to place domains, IPs, people, emails, etc. on the investigation
graph. By default duplicate entities (same type + value) are merged rather
than re-created. Unknown maltego.* types are accepted so investigations
are never blocked by a missing catalog entry.
Args: params (AddEntityInput): - type (str): Maltego entity type id (e.g. 'maltego.Domain'). - value (str): Primary value (e.g. 'example.com'). - properties (Optional[Dict[str,str]]): Extra properties. - notes (Optional[str]): Free-text notes. - dedupe (bool): Reuse existing identical entity (default True).
Returns: str: Confirmation including the new (or existing) entity id, plus a hint if the entity type is not in the known catalog.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate the tool is not read-only and not destructive. The description adds value by disclosing merging behavior for duplicates and acceptance of unknown types, which are beyond the annotations. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a summary line, then detailed Args and Returns sections. It is somewhat verbose but each sentence adds information. Could be slightly more concise without losing clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, clear purpose), the description fully covers purpose, parameters, behavior (deduplication, unknown types), and return value. It is complete for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides detailed descriptions for each parameter. The description's Args section largely replicates this, adding minimal new information (e.g., acceptance of unknown types). Schema coverage is effectively high despite the 0% metric, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Add' and the resource 'entity (node) to the active graph', with examples of entity types. It distinguishes from sibling tools like delete_entity or update_entity by specifying addition.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear guidance on when to use the tool (e.g., placing domains, IPs, people on the investigation graph) and explains default deduplication behavior. However, it lacks explicit exclusions or references to alternative tools (e.g., maltego_import_csv for bulk adds).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_add_linkA
Add a directed link (edge) between two existing entities on the active graph.
Args: params (AddLinkInput): - source_id (str): Source entity id (e.g. 'n0'). - target_id (str): Target entity id (e.g. 'n1'). - label (Optional[str]): Label drawn on the link.
Returns: str: Confirmation including the new link id, or an actionable error if an endpoint id does not exist.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate the tool is not read-only and not destructive, and the description adds behavioral details: it mutates by adding a directed link, returns a confirmation with link id, and raises an actionable error if an endpoint id does not exist. This goes beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured: a one-line summary followed by a bullet list of parameters and return value. No unnecessary words; every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers all essential aspects for a simple add-link tool: purpose, prerequisites (existing entities), parameters, return value (confirmation/error). No output schema needed as return type is simple. Complete for an agent to use correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite the 0% schema description coverage metric, the description adds meaning by listing each parameter with examples (e.g., 'n0', 'n1') and clarifying optionality of label, beyond what the schema provides (which already has minLength and descriptions). The schema itself is well-documented, so the description enhances usability.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Add', the resource 'directed link (edge) between two existing entities', and the scope 'on the active graph', distinguishing it from siblings like maltego_add_entity (adds entity) and maltego_delete_link (removes link).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description specifies the prerequisite that source and target entities must exist ('between two existing entities'), providing essential context for when to use this tool. However, it does not explicitly state when not to use it or mention alternatives, but the context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_apply_layoutAIdempotent
Compute and assign (x, y) layout positions to entities on the active graph.
Positions are stored on the graph and persisted into the .mtgx on save. Re-run after adding entities to refresh the layout. Layouts are deterministic.
Args: params (ApplyLayoutInput): - algorithm (str): 'hierarchical', 'radial', or 'force'.
Returns: str: Confirmation with the number of entities positioned.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate idempotency and non-destructiveness. The description adds behavioral details (positions stored and persisted, deterministic) that go beyond annotations, providing useful context about side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is succinct and well-structured, with an initial action statement followed by key details, then Args and Returns sections. Every sentence adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, no nested objects), the description covers all necessary aspects: action, effect, persistence, re-run guidance, algorithm options, and return type. It is fully complete for an agent to select and invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The sole parameter 'algorithm' is fully described in the input schema with enum values, so the description adds no new meaning beyond the schema. The return type is noted, but parameter semantics are not enhanced.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool computes and assigns (x, y) layout positions to entities on the active graph. This is a specific verb-resource combination, and no sibling tool performs layout, so it distinguishes well.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description guides users to re-run after adding entities to refresh the layout and notes that layouts are deterministic. While it doesn't explicitly state when not to use, the context is clear and sufficient for the tool's simplicity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_create_graphA
Create a new, empty in-memory Maltego graph and make it active.
The graph lives in server memory until you save it with maltego_save_graph, which writes a .mtgx file that opens in Maltego CE. Subsequent entity/link operations target the active graph.
Args: params (CreateGraphInput): - name (str): Unique name for the new graph.
Returns: str: Confirmation message including the graph name.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond annotations (which are minimal), the description adds important behavioral info: the graph is in-memory, becomes active, and requires explicit saving. This helps the agent understand side effects and lifecycle.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise: three sentences for behavior, then Args/Returns sections. No redundant or misleading content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (single param, no output schema), the description covers creation, active state, memory persistence, and saving relation. It is fully adequate for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With schema description coverage at 0%, the description adds the uniqueness constraint ('Unique name') not in the schema. However, it does not mention the max length (120) from the schema, leaving some information gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Create a new, empty in-memory Maltego graph and make it active.' This is a specific verb+resource+outcome, distinguished from sibling tools like load_graph or open_graph.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides workflow context: 'Subsequent entity/link operations target the active graph' and mentions saving with maltego_save_graph. It does not explicitly exclude alternatives but guides usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_delete_entityADestructiveIdempotent
Delete an entity and all links touching it from the active graph.
Args: params (DeleteEntityInput): - entity_id (str): Entity to delete.
Returns: str: Confirmation including how many links were removed, or an error.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond annotations (destructiveHint, idempotentHint), description adds that it removes all links touching the entity and returns confirmation including number of links removed or an error. This provides clear behavioral context for a destructive operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with one sentence for the action and a structured Args/Returns block. It avoids unnecessary words, though the Args format could be integrated more naturally. Efficient overall.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a deletion tool with an output schema (return value described), the description covers the main effect, return type, and error condition. It does not specify what happens if the entity doesn't exist, but that is acceptable for a simple destructive tool. Sufficient for use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already describes entity_id with 'Id of the entity to delete (its links are removed too).' The description repeats this information without adding new meaning. With schema description coverage effectively 100% (the single parameter is described), the additional description is redundant but not harmful.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'Delete an entity and all links touching it from the active graph.' This specifies the verb (delete), resource (entity and its links), and scope (active graph). It distinguishes from sibling tools like maltego_delete_link (only links) and maltego_delete_graph (entire graph).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Lacks explicit guidance on when to use this tool vs alternatives such as maltego_delete_link. Does not mention prerequisites (e.g., entity must exist) or when not to use it. The phrase 'from the active graph' implicitly indicates the context but does not fully guide selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_delete_graphADestructiveIdempotent
Remove an open graph from the server's memory.
This does NOT delete any saved .mtgx file on disk โ only the in-memory copy.
If the active graph is removed, another open graph becomes active (if any).
Args: params (DeleteGraphInput): - name (str): Name of the open graph to remove.
Returns: str: Confirmation, or an actionable error if the name is unknown.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds behavioral context beyond annotations: notes that if the active graph is removed, another graph becomes active. Annotations indicate destructiveHint=true and idempotentHint=true, and the description aligns without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise: two short paragraphs plus Args/Returns. Key information is front-loaded. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the operation and the presence of output schema (though not shown), the description provides complete context: what it does, what it doesn't do, and what returns. No gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already describes the 'name' parameter clearly. The description's Args section adds no new information beyond the schema, so minimal added value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states 'Remove an open graph from the server's memory.' Differentiates from file operations by explicitly stating it does not delete .mtgx files. Distinguishes itself from sibling tools like maltego_create_graph and maltego_save_graph.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use (to remove an open graph from memory) and what it does not do (does not delete saved .mtgx file). Clear context on use, but does not name an alternative tool for file deletion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_delete_linkADestructiveIdempotent
Delete a single link (edge) from the active graph by id.
Args: params (DeleteLinkInput): - link_id (str): Link id (e.g. 'e0'; see maltego_list_links).
Returns: str: Confirmation, or a note if the link id was not found.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses the return behavior: confirmation string or a note if the link ID is not found, adding context beyond the annotations. The annotations already indicate destructiveHint=true and idempotentHint=true, and the description is consistent with these. No contradictions detected.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise and well-structured, with a short summary followed by clear args and returns sections. Every sentence adds value with no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description adequately covers the tool's purpose, parameter, and return behavior, including the not-found case. It assumes the graph is active (implied by 'active graph') but doesn't explicitly state prerequisites like graph must be loaded or active, which is a minor gap. The presence of an output schema further reduces the need for detailed return documentation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds a cross-reference to maltego_list_links for obtaining the link_id, which is helpful beyond the schema's basic description. Although the schema already describes the parameter, the extra usage context enhances clarity for the AI agent.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states 'Delete a single link (edge) from the active graph by id.' It clearly identifies the action (delete), resource (link/edge), and simplifies by referencing the source for the ID. This distinguishes it from sibling tools like maltego_add_link or maltego_delete_entity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains the tool's intent and references maltego_list_links to obtain the link ID, providing guidance on how to prepare. However, it does not explicitly state when not to use this tool or compare it to other deletion alternatives, which would further clarify usage boundaries.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_expand_entityA
Run ALL applicable, available transforms on ONE entity to pivot from it.
Use when: you want to dig into a specific node (e.g. a pivot from maltego_identify_pivots) rather than re-running a whole investigation. Records Investigation Memory and links results back to the entity.
Args: params (ExpandEntityInput): - entity_id (str): Entity to expand (e.g. 'n0'). - allow_network (bool): Run network transforms (default True). - max_rounds (int): Expansion rounds from this entity (1-4, default 1).
Returns: str: Summary of what the expansion discovered.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate readOnlyHint=false (mutating) and openWorldHint=true (potentially broad scope). The description adds that it 'Records Investigation Memory and links results back to the entity,' which goes beyond annotations. It does not contradict annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured: front-loaded purpose, usage guidance, and behavior. The Args block is redundant with the schema but not excessive. Two sentences plus a parameter list is concise enough.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool that runs all transforms on one entity, the description covers purpose, use case, parameters, and return type (summary string). It lacks details on potential performance impact or result volume, but with openWorldHint and output schema present, it's reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has descriptions for all parameters (entity_id, max_rounds, allow_network) with high coverage. The description's 'Args' block merely repeats these descriptions verbatim, adding no extra meaning. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Run ALL applicable, available transforms on ONE entity to pivot from it.' This specifies the action (run) and resource (entity transforms), and the scope (ALL transforms) differentiates it from sibling like 'maltego_run_transform' which runs a single transform.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit usage context: 'Use when: you want to dig into a specific node (e.g. a pivot from maltego_identify_pivots) rather than re-running a whole investigation.' It contrasts with broader investigations and mentions recording memory, but does not explicitly name alternatives or when not to use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_explain_entityARead-onlyIdempotent
Explain one entity: its data, neighbours, and how it can be expanded.
Deterministic context for a single node: properties, notes, degree, incoming and outgoing neighbours (with link labels), and which transforms apply to it (and whether each is currently available).
Args: params (ExplainEntityInput): - entity_id (str): Entity id (e.g. 'n0'). - response_format (ResponseFormat): 'markdown' (default) or 'json'.
Returns: str: Detailed explanation, or an error if the id is unknown.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses deterministic behavior, the type of information returned (properties, notes, degree, neighbours, transforms), and error handling. This adds value beyond annotations (readOnlyHint, idempotentHint) by detailing the exact output components and scope. No contradictions detected.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded: the first sentence captures the core purpose. Subsequent lines elaborate efficiently without redundancy. It is appropriately sized for the tool's simplicity, though some minor repetition with the schema exists.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool is non-destructive, deterministic, and has an output schema (as indicated), the description covers the essential aspects: input parameters, output content, and error condition. It is complete for an explain tool, though it could mention the return format (markdown vs JSON) as part of the behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides clear descriptions for both parameters (entity_id and response_format). The description's Args section restates these but does not add new semantic meaning. With schema coverage effectively 100% (both parameters have descriptions), the baseline is 3, and no additional insight is provided.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it explains a single entity including its data, neighbours, and expansion possibilities. The verb 'Explain' combined with 'one entity' distinguishes it from sibling explain tools like explain_scores or explain_transform, which focus on other aspects. The first sentence is specific and actionable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implicitly indicates this tool is for explaining a single entity, but it does not explicitly state when to use it over alternatives like maltego_explain_scores or maltego_explain_transform. There is no 'when-not' or explicit alternative mention, leaving the agent to infer the context from the tool name and sibling list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_explain_scoresARead-onlyIdempotent
Explain how an entity's intelligence-quality scores were derived.
Returns the scores plus a deterministic, human-readable rationale (sources, connectivity, type rarity, enriching properties).
Args: params (ScoreEntityInput): - entity_id (str): Entity id (e.g. 'n0').
Returns: str: Markdown explanation with the scores and contributing factors.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint, idempotentHint, and destructiveHint. The description adds behavioral detail: returns deterministic, human-readable rationale with specific factors (sources, connectivity, type rarity, enriching properties). It does not contradict annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences plus clear args list, no redundancy. Efficient structure with key information front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given single parameter and simple output (Markdown), the description covers purpose, parameters, and return value. Missing edge cases (e.g., invalid entity ID) but complete for typical use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the input schema's parameter description is minimal ('Entity id to score (e.g. 'n0').'). The tool description repeats this and adds no additional meaning or examples. Baseline is adequate but not enhanced.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool explains how intelligence-quality scores were derived, using specific verbs and resource ('Explain how an entity's intelligence-quality scores were derived'). It distinguishes from sibling explain tools like 'maltego_explain_entity' and 'maltego_explain_transform' by focusing specifically on scores.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for understanding score derivation but does not explicitly state when to use this tool over alternatives like 'maltego_explain_why' or 'maltego_score_entity'. No guidance on when not to use or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_explain_transformARead-onlyIdempotent
Explain one recorded transform execution by its execution id.
Args: params (ExplainTransformInput): - transform_execution_id (str): e.g. 'x0' (see maltego_list_investigation_steps). - response_format (ResponseFormat): 'markdown' (default) or 'json'.
Returns: str: Full step detail, or an error if the execution id is unknown.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds that it returns 'Full step detail, or an error if the execution id is unknown', disclosing potential error behavior. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is reasonably concise, with a clear front-loaded purpose and structured details. The 'Args:' section is slightly redundant with the schema but not overly verbose. Could be trimmed slightly, but overall effective.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema and annotations, the description covers the tool's purpose, required parameter, optional format, return value, and error case. It references the prerequisite tool. Adequate for the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already includes descriptions for both parameters (transform_execution_id and response_format). The description merely repeats these, adding minimal new meaning beyond the schema. Baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'explain' and resource 'recorded transform execution', and specifies the identifier (execution id). It distinguishes from sibling tools like maltego_explain_entity or maltego_explain_scores, which address different resources.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides context by referencing maltego_list_investigation_steps for obtaining execution ids. It does not explicitly exclude alternatives or state when not to use, but the purpose is clear enough for an agent to infer usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_explain_whyARead-onlyIdempotent
Explain why an entity is on the graph: which step/transform discovered it.
Uses Investigation Memory to trace an entity's provenance โ the transform that produced it, the entity that triggered that transform, and the recorded reason. Seed entities (added manually or via CSV) report as analyst-provided.
Args: params (ExplainWhyInput): - entity_id (str): Entity id (e.g. 'n3'). - response_format (ResponseFormat): 'markdown' (default) or 'json'.
Returns: str: Provenance explanation, or an error if the id is unknown.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the description's role is reduced. The description confirms the read-only nature and adds context (uses Investigation Memory, returns error for unknown id), but does not disclose additional behavioral traits beyond what annotations cover.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured. It starts with a one-sentence purpose, explains the mechanism, then lists parameters and return value. Every sentence is informative without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity and the existence of an output schema, the description is fairly complete. It covers purpose, parameters, return value, and error handling. Could be improved by detailing the output format further, but it is sufficient for an agent to use correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already describes both parameters (entity_id and response_format) with clear descriptions. The tool description essentially repeats this information, adding no new meaning. With schema coverage high, the baseline is 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: to explain why an entity is on the graph by tracing its provenance. It specifies the mechanism (Investigation Memory) and the return value (transform, triggering entity, reason). This differentiates it from siblings like maltego_explain_entity or maltego_explain_transform.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context on when to use the tool (to trace provenance) and notes that seed entities are identified as analyst-provided. However, it does not explicitly state when not to use it or contrast with alternative explain tools among siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_export_csvADestructiveIdempotent
Export the active graph's entities to a CSV file (round-trips with import).
Writes the same type,value,notes,link_to schema that maltego_import_csv
reads, so an exported CSV can be re-imported to reconstruct entities and their
relationships.
Args: params (ExportPathInput): - path (str): Destination CSV file path.
Returns: str: Confirmation including the path and entity count.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses the output format and round-trip behavior, adding value beyond annotations. It also mentions the return value (confirmation with path and entity count). Annotations (idempotentHint=true, destructiveHint=true) are consistent with the description's implied behavior (exporting overwrites file, but is idempotent if graph unchanged).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, with two clear paragraphs and structured Args/Returns sections. Every sentence serves a purpose, with the main action front-loaded. No redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (exporting to CSV), the description fully covers the purpose, format, parameter, and return value. The round-trip context and lack of output schema are adequately addressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description repeats the parameter 'path' from the input schema without adding new semantic detail. The schema itself already provides a description ('Destination file path for the export'). Therefore, the description does not significantly enhance parameter understanding beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly specifies 'Export the active graph's entities to a CSV file', identifying the action (export), resource (active graph's entities), and format (CSV). It also mentions round-trip compatibility with import, distinguishing it from sibling export tools like maltego_export_json.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states that the exported CSV can be re-imported using maltego_import_csv, providing clear context for when to use this tool. However, it does not explicitly state when not to use it or mention alternatives like maltego_export_json.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_export_jsonADestructiveIdempotent
Export the full active graph (entities, links, memory, scores) as JSON.
A complete, programmatic snapshot โ a superset of the .mtgx sidecars โ
useful for downstream tooling that doesn't read Maltego files.
Args: params (ExportPathInput): - path (str): Destination JSON file path.
Returns: str: Confirmation including the path.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate destructiveHint=true, but description describes it as a non-destructive export. This contradiction confuses the agent about potential side effects. No mention of file overwriting or other destructive behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two-sentence overview plus a concise Args section. Every sentence provides necessary information without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers purpose and usage adequately for a simple tool, but the annotation contradiction introduces uncertainty. Output schema not shown but mentioned as existing; description confirms return value.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Description restates the parameter name and purpose, but the schema already includes a nearly identical description. Minimal added value; baseline score appropriate given high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states action (export), resource (full active graph), and output format (JSON). Distinguishes from sibling export tools (CSV, report) and mentions it's a superset of .mtgx sidecars.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
States it's useful for downstream tooling that doesn't read Maltego files, implying when to use. Lacks explicit alternatives or when-not-to-use but context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_export_reportADestructiveIdempotent
Write a deterministic investigation report for the active graph to a file.
Same content as maltego_generate_report, written to path. Use a .md path
for markdown or .html for HTML.
Args: params (ExportReportInput): - path (str): Destination file path. - format (ReportFormat): 'markdown' (default) or 'html'.
Returns: str: Confirmation including the path written.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate idempotentHint=true and destructiveHint=true. The description adds that the tool writes to a file and is deterministic, but does not elaborate on overwrite behavior or other side effects beyond what annotations imply.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, front-loaded with the core purpose, and efficiently organized with parameter details in a clear list. Every sentence adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description, together with annotations and output schema, provides a thorough understanding of the tool's behavior. It could mention overwrite semantics explicitly, but overall it is sufficiently complete for effective usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds value beyond the input schema by explaining the path-format convention (.md for markdown, .html for HTML) and linking to the sibling tool's content. This compensates for any lack of schema description coverage (0% stated, though schema has descriptions).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool writes a deterministic investigation report to a file, and explicitly distinguishes it from the sibling tool maltego_generate_report by specifying that this one writes the same content to a path.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear guidance on when to use this tool (when you need to write the report to a file) and compares it to maltego_generate_report, which does not write to a file. It also explains the path extension convention for format selection, but does not explicitly state when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_find_pathARead-onlyIdempotent
Find the shortest relationship path between two entities (undirected BFS).
Use when: you want to know how two findings are connected (e.g. does this email relate to that IP, and through what?).
Args: params (FindPathInput): - source_id (str): Start entity id. - target_id (str): End entity id.
Returns: str: The shortest path as a chain of entities (with link labels), or a note if no path exists.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description reveals the algorithm ('undirected BFS'), the output format ('shortest path as a chain of entities with link labels, or a note if no path exists'), and safety implications are already covered by annotations (readOnlyHint=true). No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, well-structured with clear sections (purpose, use case, args, returns). Every sentence is necessary and efficient, avoiding redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the core functionality, use case, and return format. With an output schema present, return value details are not needed. It does not mention performance constraints or graph scope, but for a simple path-finding tool, it is adequately complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, meaning the description should add value beyond the schema. However, it merely restates the parameter names and types ('Start entity id', 'End entity id') without providing additional context like acceptable id formats or entity types. This adds little to no new information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Find the shortest relationship path between two entities (undirected BFS).' It provides a concrete example ('does this email relate to that IP, and through what?') and is distinct from sibling tools, which mainly deal with single entities or lists.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly tells when to use the tool ('Use when: you want to know how two findings are connected') and gives an illustrative example. However, it does not mention when not to use it or contrast with alternative tools (e.g., maltego_explain_entity), missing some guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_generate_reportARead-onlyIdempotent
Generate a deterministic investigation report for the active graph.
The report includes an executive summary, key findings (pivots), an entity inventory by type, relationship highlights, and suggested next steps. Returns the report text inline (use maltego_export_report to write it to a file).
Args: params (GenerateReportInput): - format (ReportFormat): 'markdown' (default) or 'html'.
Returns: str: The full report as Markdown or HTML text.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false. The description adds that the report is deterministic and lists the report content, which aligns with annotations. No contradictions, and it provides additional behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a clear opening sentence, bullet-like list of report contents, and a separate Args section. It is concise, front-loaded, and every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema (not shown but mentioned), the description still explains the return type ('str: The full report as Markdown or HTML text'). The single parameter is fully documented. The tool is simple and the description leaves no gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% (per context), but the description includes an Args section explaining the 'format' parameter with default and enum values (markdown or html). This adds meaningful interpretation beyond the schema's property type.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it generates a deterministic investigation report for the active graph, listing components like executive summary and key findings. It distinguishes from sibling tool maltego_export_report by noting that this tool returns the report inline while the sibling writes to a file.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly mentions an alternative (maltego_export_report) for writing to a file, providing usage context. It does not explicitly state when not to use this tool, but the context of report generation vs. file export is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_get_entityARead-onlyIdempotent
Fetch full details of one entity on the active graph by id.
Args: params (GetEntityInput): - entity_id (str): Entity id (e.g. 'n0'). - response_format (ResponseFormat): 'markdown' (default) or 'json'.
Returns: str: Entity detail. JSON form is {id, type, value, properties, notes, weight}; markdown form is a readable block. Error if the id is unknown.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations provide readOnly and idempotent hints. Description adds that it returns JSON or markdown, includes error handling for unknown id, and outlines the return structure, which goes beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is clear and front-loaded, though it uses a Python docstring format that is slightly longer than necessary. Every sentence adds value, but it could be more concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 2 parameters, annotations, and no output schema shown, the description adequately explains return format and error behavior. It could mention the active graph context explicitly, but it is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 0% description coverage. The description explains both parameters: entity_id with an example, and response_format with enum values, fully compensating for the lack of schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool fetches detailed entity data by id, distinguishing it from list-oriented and mutation siblings like maltego_list_entities and maltego_update_entity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when you have a specific entity id but does not explicitly state when to prefer this over listing or explain tools. No when-not or alternative guidance is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_get_investigation_timelineARead-onlyIdempotent
Return the chronological timeline of the active investigation.
A compact, ordered narrative of every transform execution recorded in Investigation Memory โ useful for review, audit, and explaining the path the investigation took.
Returns: str: Markdown timeline (one line per step in execution order).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, destructiveHint, so the description adds value by specifying the Markdown format and one-line-per-step structure. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Very conciseโfive sentences total, front-loaded with purpose, no wasted words. Clear structure with returns section.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an existing output schema, the description sufficiently covers the return type (Markdown timeline) and purpose. Full context provided given zero parameters and simple behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters; schema coverage is 100%. Description does not need to explain parameters, and the baseline of 4 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it returns the chronological timeline of the active investigation, specified as a compact ordered narrative of transform executions. This distinguishes it from sibling tools like maltego_get_recent_events or maltego_list_investigation_steps.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states usefulness for review, audit, and explaining the investigation path. Lacks explicit when-not or alternatives, but the context is clear enough for an agent to infer appropriate usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_get_recent_eventsARead-onlyIdempotent
Return recent investigation events (entity_discovered, transform_*, etc.).
Reads from the event bus's bounded buffer. Use since_seq to fetch only
events newer than a sequence number you've already seen (incremental polling).
Args: params (GetEventsInput): - limit (int): Max events (default 50). - since_seq (Optional[int]): Only events with seq greater than this. - response_format (ResponseFormat): 'json' (default) or 'markdown'.
Returns: str: JSON form is {count, next_seq, events:[{seq,type,timestamp,data}]}; markdown is a readable list.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and idempotentHint. The description adds context about reading from the event bus's bounded buffer and describes the return format, which is beyond what annotations provide. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, well-structured with Args and Returns sections, and every sentence adds value. No unnecessary text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only polling tool, the description covers purpose, parameter usage, and return format. It lacks details on buffer capacity or error handling, but the overall completeness is adequate given the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description repeats schema parameter descriptions but adds usage context for `since_seq` and explains the return format (JSON vs markdown). Since schema coverage is 0%, the tool description compensates somewhat, but the additional value is incremental.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns recent investigation events and lists example event types. It does not explicitly differentiate from sibling tools like maltego_subscribe_events, but the purpose is specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains incremental polling with `since_seq`, providing clear usage guidance. It does not specify when not to use or mention alternatives, but the context is sufficient for typical use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_guideARead-onlyIdempotent
Return how to use this server: the autonomous workflow and the tool map.
Use when: you are unsure which tool to call or how the investigation flow
works. This is the same guidance the server provides as MCP instructions โ
call it to pull the workflow into context. Next: usually maltego_investigate.
Returns: str: The full usage guidance (workflow, tool map, conventions).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate read-only, idempotent, non-destructive. Description adds that it returns a string of guidance, same as MCP instructions, and is safe to call anytime.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Very concise: three short paragraphs. Front-loaded with purpose, then usage, then return type. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no parameters and a simple string output, the description is complete: explains why, when, what it returns, and what to do next.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters; schema coverage is 100%. Description doesn't need to add parameter info. Baseline 4 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it returns guidance on using the server (autonomous workflow and tool map). It distinguishes itself from sibling tools as a meta-orientation tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit usage condition: 'Use when: you are unsure which tool to call or how the investigation flow works.' Also provides a recommended next step: 'Next: usually `maltego_investigate`.'
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_identify_pivotsARead-onlyIdempotent
Identify the most promising pivot entities in the active graph.
Deterministically ranks entities that connect many others (degree >= 2), which are typically the best points to pivot an investigation (shared IPs, central emails, etc.).
Args: params (AnalysisLimitInput): - limit (int): Max pivots to return (1-50, default 10). - response_format (ResponseFormat): 'markdown' (default) or 'json'.
Returns: str: Ranked pivots with id, value, type, degree, and a reason.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and idempotentHint, meaning the tool is safe and idempotent. The description adds algorithmic detail: it deterministically ranks entities with degree >= 2 and returns specific fields (id, value, type, degree, reason). This fully explains the behavior beyond what annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a clear header sentence, an explanatory sentence, and a structured Args/Returns section. It is concise, front-loaded, and every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (two parameters, no nested objects, output schema present), the description covers all necessary aspects: input parameters, algorithmic behavior, and output format. The annotations handle safety, and the description adds sufficient context for an agent to use the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already contains descriptions for the limit and response_format parameters (including defaults, min, max, and enum values). The description's 'Args' section essentially repeats this information without adding new meaning beyond what the schema provides. Baseline is 3 since schema_coverage is effectively high despite the context signal indicating 0% (likely a data issue).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool identifies the most promising pivot entities in the active graph, which are entities with degree >= 2. This is a specific verb+resource combination, and it is easily distinguished from sibling tools like maltego_expand_entity or maltego_rank_entities.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains that the tool finds pivots that connect many others, making them good points to pivot an investigation. It gives examples (shared IPs, central emails), which helps an agent understand when to use it. However, it does not explicitly state when not to use it or compare to alternatives, but the context is sufficient for a typical use case.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_import_csvA
Build entities (and optional links) on the active graph from CSV.
Accepts a CSV file path or raw CSV text with a 'type,value' header (optional 'notes' and 'link_to' columns). The 'type' column accepts friendly aliases ('Domain', 'Email', 'IP') or full Maltego type ids. Entities are deduplicated; rows with unknown types are skipped and reported.
Args: params (ImportCsvInput): - path (Optional[str]): Path to a CSV file, OR - content (Optional[str]): Raw CSV text.
Returns: str: Counts of entities added/reused, links added, rows skipped, and any per-row warnings.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses mutation (builds on active graph), deduplication, and handling of unknown types. Annotations confirm readOnlyHint=false, no contradiction. Missing detail on what happens if no active graph exists, but overall good transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Concise, well-structured description: first sentence states purpose, then format, behavior, args, returns. No fluff or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers input format, dedup, unknown types, and return value. Minor gap: does not explain how 'link_to' column works to create links. Output schema exists, so return description is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema already describes path and content parameters with good detail. Description adds context about CSV format (type,value header, optional columns) and dedup behavior, but does not significantly enhance per-parameter meaning beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool builds entities (and optional links) on the active graph from CSV. This is a specific verb-resource pair and distinguishes from sibling tools like maltego_add_entity (single entity) and maltego_import_graph (graph file).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Describes input format and behavior (dedup, skip unknown types) well, but does not explicitly say when to use this tool over alternatives like maltego_add_entity for single entries or maltego_import_graph for graph files. Implicit usage context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_import_graphA
Merge a .mtgx file's contents into the ACTIVE graph (combine investigations).
Unlike maltego_load_graph (which opens a separate graph), this merges another
graph's entities and links into the current active graph, remapping ids and
de-duplicating by (type, value) when dedupe is true.
Args: params (ImportGraphInput): - path (str): Path to the .mtgx file to merge in. - dedupe (bool): Reuse matching entities instead of duplicating.
Returns: str: Counts of entities/links added and reused, or an actionable error.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate a mutable, potentially destructive operation (readOnlyHint=false, destructiveHint=false). The description adds that the tool merges data into the active graph and remaps ids, but does not detail permission requirements or error scenarios beyond mentioning an actionable error.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is efficient and well-structured: it first states the core action and distinction, then details parameters and return value. Every sentence adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema and annotations, the description provides all necessary context: what the tool does, how it differs from siblings, parameter explanations, and return format. No gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% according to context, so the description fully explains both parameters: path (path to .mtgx file) and dedupe (deduplication logic). It also describes the return value, compensating for the lack of schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool merges a .mtgx file into the active graph, contrasting with maltego_load_graph. It specifies the action (merge), resource (graph), and unique behavior (remapping ids, deduplication).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly directs when to use this tool versus maltego_load_graph, and explains the dedupe parameter's role. The description provides clear context for the tool's appropriate use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_investigateA
PRIMARY entry point โ run a COMPLETE investigation in one call.
Use when the user wants to investigate anything (domain, email, IPv4/IPv6, or URL, or a bare value). This is the default for "investigate X". It auto-detects the type, builds/expands the graph via the right machine (recording Investigation Memory), lays it out, summarizes, scores/ranks entities, computes next-best-actions, and includes an inline report โ and returns ONE finished briefing. Present it directly; do not call summarize/ list/suggest afterwards. Next: offer to maltego_save_graph or maltego_export_report (do not write files unless asked).
Args: params (InvestigateQueryInput): - query (str): What to investigate (type auto-detected). - allow_network (bool): Run network transforms (default True). - depth (str): 'quick' | 'standard' (default) | 'deep'. 'deep' runs ALL applicable available transforms over more rounds (thorough, slower); use it when the user asks to "go deep"/"dig further". - max_rounds (Optional[int]): Explicit rounds override (else set by depth). - layout (str): 'hierarchical' | 'radial' | 'force'. - include_report (bool): Append the full inline report (default True). - include_next_actions (bool): Include NBA recommendations (default True).
Returns: str: One complete briefing โ detection + run stats, important discoveries, recommended next actions, and (by default) a full inline report. No files are written.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations show readOnlyHint=false, openWorldHint=true, destructiveHint=false. The description adds that it updates Investigation Memory, auto-detects type, builds graph, and returns a briefing without writing files. No contradiction with annotations, and it provides meaningful behavioral context beyond the structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the primary purpose, uses bullet points for arguments, and avoids redundancy. It is slightly lengthy but every sentence adds value for a complex tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex tool with 7 parameters and an output schema (not shown), the description covers all key aspects: entity types, parameter details, behavioral effects (graph memory), and return value (briefing string). It is sufficiently complete for an agent to use correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% per context, but the schema itself contains detailed parameter descriptions (e.g., depth explains quick/standard/deep). The description adds minor extra context (e.g., 'deep' for 'go deep' requests) but does not significantly surpass what the schema already provides. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'PRIMARY entry point โ run a COMPLETE investigation in one call' and specifies supported entity types (domain, email, IPv4/IPv6, URL, bare value). It distinguishes itself from sibling tools like maltego_investigate_domain by being a unified entry point.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'Use when the user wants to investigate anything' and 'This is the default for "investigate X"'. It instructs not to call summarize/list/suggest afterwards and suggests next steps (maltego_save_graph or maltego_export_report), providing clear when/not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_investigate_domainA
Automatically investigate a domain by adding it and running transforms.
A one-call workflow: ensures an active graph (creating one if needed), adds a Domain entity, then expands the graph by running every applicable + available transform (DNS, plus any configured OSINT providers) for a few rounds, de-duplicating results. Use this instead of chaining transforms manually.
Args: params (InvestigateInput): - value (str): The domain to investigate (e.g. 'example.com'). - allow_network (bool): Run network transforms (default True). - max_rounds (int): Expansion depth 1-4 (default 2).
Returns: str: Summary of how many transforms ran and what was discovered, plus a note of any transforms skipped for missing API keys.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses significant behavioral traits beyond annotations: it ensures an active graph, adds entities, runs transforms with deduplication, allows network/offline modes, sets expansion depth limits, and notes skipped transforms for missing API keys. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a clear opening, bullet-like argument list, and return value section. Every sentence adds value, and it is appropriately sized for the tool's complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the orchestration nature and output schema, the description covers input, behavior, output summary, and limitations (missing API keys). It is complete without needing to explain return values due to output schema existence.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although the input schema already describes parameters, the description adds context (e.g., 'breadth-first' for max_rounds, 'offline/passive parse-only run' for allow_network) that enhances understanding beyond schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's action ('Automatically investigate a domain') and resource (domain), distinguishing it from sibling tools like maltego_investigate_email and maltego_investigate_ip. It specifies the one-call workflow of adding a domain entity and running transforms.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly recommends this tool 'instead of chaining transforms manually', providing clear usage context. It implies when to use for automated investigation versus fine-grained control, though it does not explicitly list all alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_investigate_emailA
Automatically investigate an email address (domain, breaches, footprint).
Adds an Email Address entity and expands the graph: derives the domain, checks breach exposure (if a HaveIBeenPwned key is configured), and expands the related domain's basic footprint. See maltego_investigate_domain for the shared behaviour and return shape.
Args: params (InvestigateInput): - value (str): The email to investigate (e.g. 'bob@example.com'). - allow_network (bool): Run network transforms (default True). - max_rounds (int): Expansion depth 1-4 (default 2).
Returns: str: Summary of what was discovered.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses that it adds an entity, expands the graph, and performs network-dependent checks, aligning with annotations (readOnlyHint=false, openWorldHint=true). It references shared behavior in another tool for full details, which slightly reduces transparency but still provides solid insight into behavior beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with an overview sentence, an Args section, and a Returns line. It is concise (about 6 sentences) and front-loaded with the core purpose. Every part adds value, including the cross-reference to the domain tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (orchestration tool with multiple steps) and the presence of an output schema (return string), the description covers inputs, behavior, and what to expect. It wisely defers to maltego_investigate_domain for detailed shared behavior, which is acceptable but leaves some details indirect.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite the 0% schema coverage signal, the description includes an Args section explaining each parameter (value, allow_network, max_rounds) with clear, contextual explanations that add value beyond the schema's own descriptions. For example, it clarifies network transforms and expansion depth.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it investigates an email address, deriving domain, checking breaches, and expanding footprint. It references maltego_investigate_domain for shared behavior, distinguishing its specific focus from sibling tools like maltego_investigate_domain and maltego_investigate_ip.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description indicates its specific purpose for email investigation and directs to the domain tool for shared behavior, but does not explicitly state when not to use it or compare to alternatives like the general maltego_investigate. Implicit guidance is clear but not fully explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_investigate_ipA
Automatically investigate an IPv4 address (reverse DNS, ports, services).
Adds an IPv4 Address entity and expands the graph using reverse DNS plus any configured host-intelligence providers (Shodan, Censys). See maltego_investigate_domain for the shared behaviour and return shape.
Args: params (InvestigateInput): - value (str): The IPv4 address (e.g. '8.8.8.8'). - allow_network (bool): Run network transforms (default True). - max_rounds (int): Expansion depth 1-4 (default 2).
Returns: str: Summary of what was discovered.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate non-readOnly, openWorld, not idempotent, not destructive. The description adds context: it makes network calls via reverse DNS and host-intelligence providers (Shodan, Censys), and provides an 'allow_network' parameter to control network behavior. This goes beyond annotations without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with two sentences of purpose, structured args list, and return mention. It front-loads the key action. Some redundancy with schema info but overall efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a moderately complex tool that expands the graph, the description covers inputs, actions, and references sibling for shared behavior. An output schema exists, so not detailing returns is acceptable. It could mention side effects like adding entities to the active graph, but overall sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already has detailed descriptions for all parameters (value, max_rounds, allow_network). The description in the text repeats the schema info and adds an example IP and clarifies max_rounds bounds. Since schema coverage is high, the description adds marginal value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool investigates an IPv4 address by performing reverse DNS, port, and service discovery. It adds an IPv4 Address entity and expands the graph. It references the sibling tool 'maltego_investigate_domain' for shared behavior, distinguishing its focus on IP addresses.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains it investigates IP addresses and points to a sibling for shared behavior, but does not explicitly state when to use this tool versus alternatives or when not to use it. No exclusions or alternative conditions are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_learning_statsARead-onlyIdempotent
Show cross-investigation learning stats used by the Next Best Action engine.
Learning is opt-in: enable it by setting the env var MALTEGO_MCP_LEARNING=1 (or MALTEGO_MCP_LEARNING_PATH=/path/to/file.json). When enabled, the engine records per-transform outcomes across investigations (runs, successes, average yield) and lets that history nudge recommendations.
Returns: str: JSON of per-transform stats, or a note if learning is disabled.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate read-only, idempotent, non-destructive. The description adds value by explaining the opt-in mechanism, the data recorded (runs, successes, yield), and return format, without contradicting annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences front-load the purpose, followed by necessary details in a second paragraph. No extraneous information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no parameters, rich annotations, and output schema present, the description covers return type and opt-in prerequisite. Lacks exact note wording when learning is disabled, but otherwise complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so schema coverage is 100%. The description compensates by explaining the return value and opt-in behavior, meeting the baseline for 0 params.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Show' and the resource 'cross-investigation learning stats', and distinguishes this tool from siblings like maltego_next_best_actions by specifying it focuses on statistics, not actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains when to use (to view learning stats) and prerequisites (opt-in via env vars), but does not explicitly exclude alternatives or provide when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_list_entitiesARead-onlyIdempotent
List entities on the active graph, with optional filtering and pagination.
Args: params (ListEntitiesInput): - type_filter (Optional[str]): Restrict to a Maltego type. - value_contains (Optional[str]): Case-insensitive substring filter. - limit (int): Max results (1-500, default 50). - offset (int): Results to skip (default 0). - response_format (ResponseFormat): 'markdown' (default) or 'json'.
Returns: str: In JSON form, an object: { "total": int, # entities matching filters "count": int, # entities in this page "offset": int, "has_more": bool, "next_offset": int | None, "entities": [ {id, type, value, properties, notes, weight}, ... ] } In markdown form, a readable bullet list.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds value by detailing the return formats (markdown and JSON), pagination behavior (offset, limit, has_more, next_offset), and that it operates on the active graph. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with clear sections (Args, Returns) and front-loads the main purpose. Every sentence adds value without repetition. The structure is easy to parse for an AI agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 5 parameters and an output schema, the description fully covers the input and output. It explains pagination, filtering, and both response formats. No missing information; the tool is complete for a list operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite schema description coverage being 0%, the description thoroughly documents all parameters with additional context: type_filter (Maltego type), value_contains (case-insensitive substring), limit (range 1-500, default 50), offset, and response_format (enum with defaults). This adds significant meaning beyond the schema's property descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'List entities on the active graph' with specific verb and resource. It distinguishes from sibling tools like maltego_get_entity (single entity) and maltego_list_links by focusing on entities with optional filtering and pagination.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly documents parameters and their defaults, making it clear how to use the tool. However, it does not explicitly state when not to use it or compare to alternatives like maltego_get_entity. The context is implied but not explicitly stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_list_entity_typesARead-onlyIdempotent
List supported Maltego entity types from the built-in catalog.
Use this to discover valid type ids for maltego_add_entity. The catalog
is a curated subset of Maltego's built-in types; custom types also work.
Args: params (ListEntityTypesInput): - category (Optional[str]): Filter to one category (e.g. 'infrastructure', 'personal', 'social', 'organization', 'location').
Returns: str: Markdown grouped by category, listing each type id and its main property.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations provide readOnlyHint, idempotentHint, destructiveHint. Description adds that the catalog is a 'curated subset' and that custom types also work, which provides extra context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is well-structured with a purpose, usage, and parameter description. No redundant sentences; front-loaded with the most important information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one optional parameter, the description covers what it does, how to use it, and what it returns (Markdown). The presence of an output schema and annotations further reduces the need for more detail.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so description carries the burden. The description explains the 'category' parameter with example values (infrastructure, personal, social, organization, location) and confirms it is optional, adding meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool lists supported Maltego entity types from the built-in catalog, and explicitly connects it to discovering type IDs for maltego_add_entity. This distinguishes it from sibling tools like maltego_list_entities.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Description instructs to use this to discover valid type ids for maltego_add_entity. It notes the catalog is a curated subset and that custom types work, but does not explicitly specify when not to use it, though the context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_list_graphsARead-onlyIdempotent
List all graphs currently open in the server and mark the active one.
Returns: str: Markdown bullet list of open graphs with entity/link counts, or a note if none are open.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnly, idempotent, and non-destructive hints. The description adds that it returns a Markdown bullet list with entity/link counts and marks the active graph, which is useful behavioral detail beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two sentences covering purpose and return value. Every sentence adds value with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters, full annotations, and an output schema, the description provides all necessary context: what it does, what it returns, and a behavioral note. Nothing is missing for a simple list operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, and the schema description coverage is 100%. The description is not required to add parameter meaning, so a baseline score of 4 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists all open graphs and marks the active one. This distinguishes it from sibling tools that create, delete, or rename graphs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explicitly state when to use this tool versus alternatives. While the purpose is clear, there is no guidance on when to prefer this over other graph listing or info tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_list_investigation_stepsARead-onlyIdempotent
List recorded investigation steps (procedural memory) for the active graph.
Each step records a transform execution: what ran, why, the trigger entity, what it discovered, status, and importance. This is the investigation's reasoning trace, not just its data.
Args: params (ListStepsInput): - limit/offset (int): Pagination. - status (Optional[str]): Filter by 'success', 'empty', or 'error'. - response_format (ResponseFormat): 'markdown' (default) or 'json'.
Returns: str: JSON form is {total, count, offset, steps:[...]}; markdown is a list.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond annotations (readOnlyHint, idempotentHint), the description adds valuable context that the tool returns the investigation's reasoning trace, not just graph data. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured, front-loading the purpose, then detailing parameters and returns in a clear, bullet-like format. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (nested object parameter, no schema descriptions), the description fully covers parameter details and return format, with no obvious gaps. Output schema exists, so return details are sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite 0% schema description coverage, the description thoroughly explains each parameter (limit/offset for pagination, status filter, response_format) and the return format, adding significant meaning beyond the raw schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it lists recorded investigation steps (procedural memory) for the active graph, explaining what each step records (transform execution details). This differentiates it from sibling tools like maltego_list_transforms or maltego_list_entities.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage is for the active graph's reasoning trace, but it does not explicitly state when to use this tool over alternatives or provide exclusions. The context is clear enough for basic use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_list_linksARead-onlyIdempotent
List links (edges) on the active graph, with pagination.
Args: params (ListLinksInput): - limit/offset (int): Pagination. - response_format (ResponseFormat): 'markdown' (default) or 'json'.
Returns: str: JSON form is {total, count, offset, links:[{id,source,target,label}]}; markdown shows source โ target with labels and entity values.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true and destructiveHint=false. Description adds pagination details and response format behavior, going beyond annotations without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is front-loaded with purpose and includes structured Args/Returns sections. It is fairly concise but could be slightly shorter by omitting obvious parameter repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers pagination and response format. Output schema exists, reducing need to explain return values. Lacks context about requiring the active graph to exist, but otherwise complete for a read-only list tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has descriptions for all subproperties (limit, offset, response_format). The description mainly repeats schema info ('limit/offset for pagination', 'response_format: markdown or json') without adding new meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'List links (edges) on the active graph, with pagination', specifying the verb 'list' and resource 'links on the active graph'. This distinguishes from sibling tools like maltego_add_link and maltego_delete_link.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. Usage is implied for viewing edges, but no exclusions or when-not conditions are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_list_machinesARead-onlyIdempotent
List available investigation machines (reusable workflow templates).
Machines run a curated set of transforms over several rounds (e.g. 'Passive Domain Investigation'). Run one with maltego_run_machine.
Returns: str: Markdown list of machines with their seed type and description.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint, idempotentHint, destructiveHint. The description adds that the tool returns a Markdown list and explains what machines do, complementing the safety profile without contradicting it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is four sentences, front-loads the purpose, and contains no unnecessary words. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With zero parameters, complete annotations, and an output schema, the description fully covers the tool's purpose and behavior. No gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, and schema coverage is 100%. The description does not need to add parameter details, so baseline 4 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists available investigation machines, defines them as reusable workflow templates, and gives an example. It distinguishes from siblings like maltego_run_machine and maltego_list_transforms.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains what machines are and explicitly mentions maltego_run_machine as the tool to run one, providing a clear alternative. It gives enough context for when to use this tool, though it doesn't explicitly exclude other cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_list_providersARead-onlyIdempotent
List OSINT transform providers and whether each is configured.
Shows the built-in 'local' provider plus external providers (VirusTotal, Shodan, SecurityTrails, Censys, Hunter.io, HaveIBeenPwned), the environment variable(s) each needs, and whether those are currently set.
Returns: str: Markdown list grouped by tier with configuration status and the env vars required to enable each provider.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false. The description adds value by specifying the return format (Markdown list), grouping by tier, and including configuration status and env vars.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences plus a return line, concise and front-loaded. Every sentence provides necessary information without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no parameters, comprehensive annotations, and an existing output schema, the description fully explains the tool's behavior and return value (Markdown list with configuration details).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, so the baseline per rules is 4. The description correctly focuses on the tool's output without needing to elaborate on inputs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the tool lists OSINT transform providers and their configuration status. It clearly distinguishes from sibling list tools (e.g., list_transforms) by focusing on providers and their env-var requirements.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for checking provider configuration but does not explicitly state when to use it versus alternatives or mention when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_list_transformsARead-onlyIdempotent
List available transforms, optionally filtered by accepted input type.
Transforms expand an entity into related entities (e.g. a domain into its IP addresses). The built-in 'local' provider needs no API keys; more providers (a Maltego API, OSINT services) can be added without changing these tools.
Args: params (ListTransformsInput): - input_type (Optional[str]): Only transforms accepting this type.
Returns: str: Markdown list of transforms with name, accepted input types, output types, provider, and whether they require network access.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and idempotentHint. The description adds context about the local provider needing no API keys and the return format, which is useful beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a clear main sentence, a brief explanation of transforms, and an Args/Returns section. It is concise yet informative, with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (one optional parameter, read-only, idempotent), the description provides all necessary context: what it does, what it returns, and the provider nuance. No gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description explains the only parameter (input_type) in the Args section, but the schema also includes a description for that field. The description adds value by contextualizing the purpose and return format.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists available transforms with optional filtering. It distinguishes from sibling tools like maltego_run_transform and maltego_explain_transform by focusing on listing. The explanation of what transforms are adds clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions the purpose and optional filtering, but does not explicitly state when to use this tool versus alternatives like maltego_run_transform. However, the context is clear enough for an agent to decide.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_load_graphA
Load an existing .mtgx file as a new active graph (continue an investigation).
Equivalent to maltego_open_graph: parses all entities, links, properties, and any stored layout positions so you can continue editing and re-save (full round-trip).
Args: params (LoadGraphInput): - path (str): Path to the .mtgx file.
Returns: str: Summary of the loaded graph, or an actionable error.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds detail beyond annotations: mentions that entities, links, properties, and layout positions are parsed, and full round-trip editing is supported. Annotations (readOnlyHint=false, destructiveHint=false) are consistent with loading behavior. No contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the main purpose in the first sentence, followed by an explanation of equivalence and parameter details. Some redundancy with the schema's parameter description, but overall concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Provides a good overview of what the tool does, what it loads, and that it returns a summary or error. However, it does not mention potential error conditions (e.g., file not found) or permissions needed, leaving minor gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is high (the single 'path' parameter is described in the schema as 'Path to an existing .mtgx file to load.'). The tool description repeats this information without adding new semantic details, so no additional value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states that the tool loads an existing .mtgx file as a new active graph for continuing investigations. However, the claim of equivalence to maltego_open_graph may cause confusion between two seemingly identical sibling tools, reducing differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies usage for continuing investigations by loading an existing file, but provides no explicit guidance on when to use this tool versus alternatives like maltego_open_graph or maltego_import_graph. No when-not-to-use or selection criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_next_best_actionsARead-onlyIdempotent
Recommend the most valuable next moves (decision engine). Use when deciding what to do next.
A deterministic, explainable ranking that weighs entity importance, expected information gain, confidence, provider availability, and โ crucially โ the Investigation Memory (so it never re-suggests a transform already attempted on an entity). Supersedes maltego_suggest_next_steps with richer reasoning.
Args: params (AnalysisLimitInput): - limit (int): Max recommendations (1-50, default 10). - response_format (ResponseFormat): 'markdown' (default) or 'json'.
Returns: str: Ranked recommendations, each with transform, target entity, a deterministic score, expected gain, and a plain-English reason.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds significant behavioral context beyond annotations: it explains the ranking factors (entity importance, information gain, etc.), mentions Investigation Memory to avoid re-suggestions, and states it is deterministic and explainable. Annotations already indicate readOnlyHint and idempotentHint, which align with the description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and concise: a clear purpose statement, explanation of ranking logic, explicit supersession, then args and returns. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter), the description covers the input, output format, and decision logic. The expected return structure is described, and the output schema exists for further detail. No gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description details the params object with limit (1-50, default 10) and response_format (markdown or json, default markdown), adding meaning beyond the schema which only provides brief descriptions. However, the schema already includes defaults and constraints, so the description adds moderate value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool recommends the most valuable next moves, acting as a decision engine. It uses specific verb 'recommend' and resource 'next best actions', and explicitly distinguishes from sibling maltego_suggest_next_steps by stating it supersedes it with richer reasoning.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Use when deciding what to do next' and 'Supersedes maltego_suggest_next_steps with richer reasoning', providing clear context and an alternative to avoid.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_open_graphA
Open an existing Maltego .mtgx file into memory and make it active.
Parses the GraphML inside the archive into entities and links so they can be inspected and edited. The graph remembers its source path so maltego_save_graph can re-save in place.
Args: params (OpenGraphInput): - path (str): Path to an existing .mtgx file.
Returns: str: Summary of the loaded graph (entity/link counts) or an error.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are silent (no readOnly, destructive, idempotent hints set), but description adds useful context: parses GraphML, creates entities/links, remembers source path for re-save, and returns summary. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three paragraphs, well-structured with main action first, then details, then args/returns. Minimal waste, though some redundancy with schema description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple file-open tool, description includes all necessary context: how it processes the file, what it returns, and integration with save. Output schema exists but description already explains return value.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so description fully covers the single required param 'path' with clear meaning and context (path to .mtgx file). Also notes remembered path behavior beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses specific verb 'Open' and resource 'existing Maltego .mtgx file', clearly distinguishing from siblings like create or import. Includes details about parsing GraphML and remembering source path for save.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies usage for opening existing files only, but does not explicitly state when to use this vs alternatives like load_graph or import_graph. No exclusion criteria or sibling comparisons.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_rank_entitiesARead-onlyIdempotent
Rank entities by investigation priority (deterministic).
Scores every entity and returns them ordered by investigation_priority, so an analyst can focus on the most meaningful findings first.
Args: params (RankEntitiesInput): - limit (int): Max entities (1-200, default 20). - response_format (ResponseFormat): 'markdown' (default) or 'json'.
Returns: str: Ranked entities with their scores.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already show readOnlyHint and idempotentHint; description adds 'deterministic' and explains scoring and ordering behavior beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short paragraphs with clear structure: purpose, behavior, args, returns. No fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers purpose, behavior, and parameters. Could clarify which entities are ranked (e.g., current graph), but overall sufficient given annotations and output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has descriptions for both parameters (limit and response_format), so baseline is 3. Description restates defaults and ranges but adds no new meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the tool ranks entities by investigation priority, deterministic. Distinguishes from siblings like maltego_score_entity and maltego_list_entities.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies usage when prioritized list is needed, but does not explicitly state when not to use or provide alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_rename_graphA
Rename an open graph (defaults to the active graph).
Args: params (RenameGraphInput): - new_name (str): New name. - graph_name (Optional[str]): Graph to rename; defaults to active.
Returns: str: Confirmation, or an actionable error (unknown/duplicate name).
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With annotations already indicating non-read-only and non-destructive, the description adds that the return value includes actionable errors for unknown or duplicate names. This provides additional behavioral context beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise: a single sentence for the purpose, followed by a bullet list of arguments and the return value. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple rename tool with one required parameter and an output schema, the description fully covers inputs and outputs. It is sufficiently complete given the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description lists the parameters and their types, but the schema also provides similar descriptions. Given the context indicates 0% schema description coverage, the description compensates somewhat, but it largely repeats the schema information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Rename an open graph', which is a specific verb+resource combination. It distinguishes from sibling tools like maltego_create_graph and maltego_delete_graph.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains that it defaults to the active graph and that graph_name is optional. It also describes the return value. However, it does not explicitly state when not to use this tool or provide alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_reset_learningADestructiveIdempotent
Clear the cross-investigation learning store (in-memory and on disk).
No-op when learning is disabled.
Returns: str: Confirmation.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds behavioral context beyond annotations: it clarifies that both in-memory and on-disk stores are cleared, and that the operation is a no-op when learning is disabled. Annotations already indicate destructiveness and idempotence, so the description complements them well.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise, consisting of three short sentences. It is front-loaded with the main action, followed by edge-case behavior and a return type. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no parameters and an output schema that indicates a simple confirmation string, the description is complete. It covers the main purpose, edge case, and return type, leaving no ambiguity for a simple reset action.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, so schema coverage is 100%. The description provides no parameter information, which is appropriate as there are none. Baseline 4 is suitable.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool clears the cross-investigation learning store, both in-memory and on disk, and is a no-op when learning is disabled. This is a specific verb-resource combination that distinguishes it from siblings like maltego_learning_stats.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions when it's a no-op (learning disabled) but does not provide explicit guidance on when to use it vs. alternatives, such as when learning stats are unnecessary or when a reset is needed. Usage context is implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_run_machineA
Run an investigation machine against a seed value on the active graph.
Ensures an active graph (creating one if needed), seeds the machine's entity
type with seed_value, and expands the graph per the machine's recipe.
Missing/unavailable transforms are skipped gracefully.
Args: params (RunMachineInput): - machine_name (str): e.g. 'passive_domain' (see maltego_list_machines). - seed_value (str): Seed value (domain/email/ip). - allow_network (Optional[bool]): Override the machine's network setting. - max_rounds (Optional[int]): Override expansion depth.
Returns: str: Summary of what the machine discovered, or an actionable error.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds behavioral details beyond annotations: ensures active graph, seeds entity, expands per recipe, skips missing transforms gracefully, and returns a summary. Annotations declare openWorldHint and non-destructive; description aligns and extends.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise yet thorough: a clear purpose statement, followed by structured Args and Returns sections. No redundant information, and front-loaded with essential details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (running a machine with overrides), the description covers all necessary aspects: prerequisites, process, parameter details, and return format. It also mentions error handling, making it complete for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description includes an Args section that explains the purpose of each parameter (e.g., 'e.g. passive_domain' for machine_name), adding value over the schema descriptions. Schema coverage is 0%, but the description compensates well.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool runs an investigation machine, explains the process (ensuring graph, seeding, expanding), and distinguishes it from similar tools like run_transform (single transform) and investigate_* (higher-level).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides guidance to use maltego_list_machines for available machines, and describes the behavior (skips missing transforms). However, it does not explicitly state when not to use this tool (e.g., for single transforms use maltego_run_transform), but the context with siblings provides differentiation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_run_transformA
Run a transform on an entity in the active graph to discover related entities.
Looks up the named transform, runs it against the given input entity, and (by default) adds the resulting entities to the active graph with links back to the input entity. Results are de-duplicated against existing entities.
Args: params (RunTransformInput): - transform_name (str): Transform to run (see maltego_list_transforms). - entity_id (str): Input entity id in the active graph. - add_to_graph (bool): Add results to the graph (default True).
Returns: str: Summary of discovered entities (and the ids created when added), or an actionable error (unknown transform, type mismatch, no results).
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations provide basic read/write hints, while the description adds key behavioral details: results are added to the graph by default, de-duplication occurs, and it returns a summary or error. This goes beyond annotations by explaining mutation and dedup behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a clear first sentence, followed by a bullet list of arguments and a return value section. It is concise without excess, though the bullet list could be integrated into prose. Overall, efficient and front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (running a transform, modifying the graph) and the presence of an output schema, the description adequately explains behavior, results, and error handling. It covers de-duplication, graph modification, and return format, leaving few gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides detailed descriptions for each parameter, so the description's docstring-style listing adds minimal new meaning. Schema description coverage appears high despite context stating 0%, but the description does not significantly enhance parameter understanding beyond what the schema offers.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('run a transform'), the resource ('entity in the active graph'), and the purpose ('discover related entities'). It distinguishes this tool from siblings like maltego_list_transforms and maltego_expand_entity by specifying the exact operation and its outcome.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool (to run a transform on an entity) but does not explicitly exclude alternatives or provide when-not-to-use scenarios. It references maltego_list_transforms for discovering transforms, which aids usage, but no explicit guidance on comparing with similar tools like maltego_run_machine.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_save_graphADestructiveIdempotent
Save a graph to a Maltego .mtgx file that opens in Maltego CE.
Writes the active graph (or the named graph) as a .mtgx archive. If no path is supplied, re-saves to the path the graph was opened from. Open the resulting file in Maltego CE via File > Open, or refresh it if already open.
Args: params (SaveGraphInput): - path (Optional[str]): Destination .mtgx path. Defaults to the graph's original source path. - graph_name (Optional[str]): Graph to save; defaults to active graph.
Returns: str: The absolute path written, or an actionable error.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate idempotent and destructive hints. The description adds context about default path behavior (re-saves to original path) and mentions opening the file in Maltego CE, going beyond annotations without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, front-loaded with the main purpose, and structured with a headline, body, and Args list. Every sentence adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple write tool with annotations and an output schema, the description covers the purpose, parameters, behavior (default path), and return value (absolute path or error). No major gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description compensates with an Args section explaining both parameters: path (defaults to original source) and graph_name (defaults to active). This adds meaning beyond parameter names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it saves a graph to a .mtgx file, distinguishing it from export tools like maltego_export_csv or maltego_export_json. It specifies verb (save), resource (graph), and format (.mtgx), with details about active vs named graph.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the format specification and mention of opening in Maltego CE, but no explicit guidance on when to use this vs alternatives (e.g., export functions) or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_score_entityARead-onlyIdempotent
Compute intelligence-quality scores for one entity (deterministic).
Returns confidence, source_reliability, linkage_strength, investigation_priority, and novelty in [0, 1], derived from the graph structure and Investigation Memory (which providers found the entity).
Args: params (ScoreEntityInput): - entity_id (str): Entity id (e.g. 'n0').
Returns: str: JSON object {entity, scores:{confidence, source_reliability, linkage_strength, investigation_priority, novelty}}.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnly, idempotent, and non-destructive nature. The description adds that the computation is deterministic and provides the exact output structure. No contradictions; the description adds value beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, front-loaded with purpose, and every sentence adds essential information: the scores returned, the derivation, the parameter, and the return format. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description fully covers the tool's behavior for a single parameter tool. It explains the output structure in detail, compensating for the lack of an explicit output schema in the provided data. It also mentions the derivation source (graph structure and Investigation Memory), which is sufficient for an agent to understand the tool's effect.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema includes a description for entity_id, so the description adds no new semantic value. It only repeats the parameter meaning. With schema description coverage at 0% (possibly misreported), the description does not compensate but also does not harm. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it computes intelligence-quality scores for one entity deterministically, specifying the five scores returned. This distinguishes it from siblings like maltego_rank_entities (multiple entities) and maltego_explain_scores (explanation). The title 'Score Entity' reinforces this.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly limits scoring to a single entity ('for one entity') and mentions deterministic behavior. It does not explicitly state when to avoid using it or point to alternatives, but the context of one entity vs. many is clear enough for an agent to infer.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_set_active_graphAIdempotent
Make a previously-opened graph the active target for entity/link operations.
Args: params (SetActiveGraphInput): - name (str): Name of an open graph (see maltego_list_graphs).
Returns: str: Confirmation or an actionable error.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate idempotentHint true, readOnlyHint false, destructiveHint false. The description aligns: it confirms making a graph active returns confirmation/error. It adds no new behavioral traits beyond confirming the action is on an already-open graph, which is already implied. Minimal added value over annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: one sentence for purpose, then a bullet for Args and Returns. No fluff, front-loaded with actionable verb. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter, the description covers the action, required input, and expected output (confirmation/error). There is no missing information given the low complexity. The output schema is not shown but described sufficiently.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already describes the required 'name' parameter as 'Name of an already-open graph to make active.' The tool description repeats this info (name as string) but adds a reference to malteco_list_graphs. Since schema coverage is effectively 100% with its own description, the tool description adds little new semantic value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Make a previously-opened graph the active target for entity/link operations.' It specifies the verb ('Make active'), resource (graph), and distinguishes from sibling tools like malteco_create_graph or malteco_open_graph by emphasizing 'previously-opened'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage after opening a graph and references malteco_list_graphs. It provides clear context but does not explicitly state when not to use it or mention alternatives beyond the list_graphs hint. A stronger exclusion could improve it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_subscribe_eventsA
Enable real-time investigation mode and return a subscription id.
Turns on the event bus's live mode and buffering. Because MCP stdio cannot push to the caller, retrieve emitted events by polling maltego_get_recent_events (events are also buffered before subscribing). Real-time mode is optional and does not change any .mtgx behaviour.
Returns: str: The subscription id and current buffer/sequence state.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare the tool is not read-only, not destructive, not idempotent. The description adds key behavioral details: it turns on live mode and buffering, returns a subscription id, and clarifies that MCP stdio cannot push events, so polling is required. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is four sentences. It front-loads the main purpose, then explains implications, optionality, and return value. Every sentence earns its place with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no parameters and an existing output schema, the description fully covers the tool's purpose, mechanism, and context. It explains the need for polling and the optional nature of real-time mode, which is complete for a subscribe tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, so the description does not need to add parameter meaning. Schema coverage is 100% trivially. Baseline for 0 params is 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool enables real-time investigation mode and returns a subscription ID. It distinguishes itself from sibling tools by explaining that events must be polled via maltego_get_recent_events because MCP stdio cannot push.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains when to use this tool (to enable real-time mode) and that polling is required. It notes that real-time mode is optional and does not change .mtgx behavior, implying it can be skipped if not needed. It references the alternative poll tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_suggest_next_stepsARead-onlyIdempotent
Legacy simple heuristic for next transforms โ prefer maltego_next_best_actions.
Use when: you want the basic heuristic list. For real recommendations use maltego_next_best_actions (memory-aware, ranked, explainable). Kept for backward compatibility.
Deterministically recommends transforms to advance the investigation, prioritising the most-connected entities and available transforms first. Unavailable (missing-key) transforms are still listed but flagged.
Args: params (AnalysisLimitInput): - limit (int): Max suggestions (1-50, default 10). - response_format (ResponseFormat): 'markdown' (default) or 'json'.
Returns: str: Suggestions of (transform, target entity, expected output types).
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint, idempotentHint, and non-destructive hint. The description adds behavioral details: deterministic, prioritization of most-connected entities, and flagging of unavailable transforms. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with clear sections and front-loaded key message. Somewhat verbose with legacy note and rationale, but each sentence adds value. Could be slightly tighter but overall efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter and an output schema (mentioned but not shown), the description covers purpose, usage, behavioral traits, and parameter details adequately. No gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description repeats parameter info already present in schema (limit, response_format with defaults). Schema has high coverage (properties have descriptions), so baseline is 3. Description adds minimal new meaning beyond restating schema details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it is a 'legacy simple heuristic for next transforms' and specifies what it does: deterministically recommends transforms, prioritizing most-connected entities. It explicitly distinguishes from sibling tool maltego_next_best_actions by calling that the preferred alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly advises to 'prefer maltego_next_best_actions' for real recommendations and states that this tool is for basic heuristic lists. It provides clear when-to-use and alternatives guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_summarize_graphARead-onlyIdempotent
Summarize the active investigation graph (composition + key entities).
Deterministic overview: entity/link totals, a breakdown by entity type, the most-connected entities, and any isolated entities. Ideal for presenting an investigation's state to a user.
Args: params (SummarizeGraphInput): - response_format (ResponseFormat): 'markdown' (default) or 'json'.
Returns: str: JSON form matches analysis.summarize_graph (name, entity_count, link_count, type_breakdown, most_connected, isolated_count, isolated); markdown form is a readable brief.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds that it provides a 'Deterministic overview' and lists included elements (totals, breakdown, most-connected, isolated entities), enhancing transparency without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is reasonably concise at about 100 words, with clear structure: a summary sentence followed by bullet-point-like details. It includes parameter and return info without extraneous text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter and comprehensive annotations, the description covers everything needed: what it does, what the output contains, and the two response formats. An output schema exists, so return values are fully specified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has only one parameter (response_format) with a description in the schema. The tool description repeats this information and adds details about the return format, but adds little new meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool summarizes the active investigation graph, specifying composition and key entities. It distinguishes from siblings like maltego_explain_entity or maltego_list_entities by focusing on a holistic overview.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description indicates it is 'Ideal for presenting an investigation's state to a user,' which conveys appropriate use. However, it does not explicitly state when not to use it or mention alternative tools for similar purposes.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
maltego_update_entityAIdempotent
Update an entity's value, properties, notes, or weight on the active graph.
Only the supplied fields change; properties are merged (not replaced).
Args: params (UpdateEntityInput): - entity_id (str): Entity to update. - value (Optional[str]): New primary value. - properties (Optional[Dict[str,str]]): Properties to set/merge. - notes (Optional[str]): Replacement notes. - weight (Optional[int]): Node weight (0-100).
Returns: str: Confirmation or an actionable error.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate idempotentHint=true and non-destructive, but the description adds critical detail: 'properties are merged (not replaced)' and only supplied fields change. This informs the agent of exact mutation behavior, which is beyond what annotations provide. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences and a bullet list, immediately stating purpose, then key behavioral note, then parameter details. No redundant content; every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutating update tool with idempotent hint, the description covers what changes (specific fields), how they change (merge, partial), and return type (confirmation/error). This is sufficient for an agent to understand side effects and usage context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite 0% schema description coverage, the description lists all parameters with clear roles: entity_id (required), value (optional new primary), properties (merged), notes (replacement), weight (0-100). It adds the merge behavior and weight range, compensating for schema gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'Update an entity's value, properties, notes, or weight on the active graph.' This identifies the specific verb and resource, and distinguishes from sibling tools like add, delete, or get by focusing on modification of an existing entity's attributes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description emphasizes that 'Only the supplied fields change; properties are merged (not replaced),' which guides usage for partial updates. However, it lacks explicit when-not-to-use guidance or comparison to alternatives like add_entity or delete_entity, leaving context clear but not fully comprehensive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
52 tool updates
v0.5.0- First observed
maltego_add_entity - First observed
maltego_add_link - First observed
maltego_apply_layout - First observed
maltego_create_graph - First observed
maltego_delete_entity - First observed
maltego_delete_graph - First observed
maltego_delete_link - First observed
maltego_expand_entity - First observed
maltego_explain_entity - First observed
maltego_explain_scores - First observed
maltego_explain_transform - First observed
maltego_explain_why - First observed
maltego_export_csv - First observed
maltego_export_json - First observed
maltego_export_report - First observed
maltego_find_path - First observed
maltego_generate_report - First observed
maltego_get_entity - First observed
maltego_get_investigation_timeline - First observed
maltego_get_recent_events - First observed
maltego_guide - First observed
maltego_identify_pivots - First observed
maltego_import_csv - First observed
maltego_import_graph - First observed
maltego_investigate - First observed
maltego_investigate_domain - First observed
maltego_investigate_email - First observed
maltego_investigate_ip - First observed
maltego_learning_stats - First observed
maltego_list_entities - First observed
maltego_list_entity_types - First observed
maltego_list_graphs - First observed
maltego_list_investigation_steps - First observed
maltego_list_links - First observed
maltego_list_machines - First observed
maltego_list_providers - First observed
maltego_list_transforms - First observed
maltego_load_graph - First observed
maltego_next_best_actions - First observed
maltego_open_graph - First observed
maltego_rank_entities - First observed
maltego_rename_graph - First observed
maltego_reset_learning - First observed
maltego_run_machine - First observed
maltego_run_transform - First observed
maltego_save_graph - First observed
maltego_score_entity - First observed
maltego_set_active_graph - First observed
maltego_subscribe_events - First observed
maltego_suggest_next_steps - First observed
maltego_summarize_graph - First observed
maltego_update_entity
TDQS
Most tools have clearly distinct purposes, especially with detailed descriptions. However, there is some overlap between the generic 'maltego_investigate' and the type-specific 'maltego_investigate_domain', 'maltego_investigate_email', 'maltego_investigate_ip', and between 'maltego_suggest_next_steps' and 'maltego_next_best_actions', which could cause confusion.
All tools follow a consistent 'maltego_' prefix with snake_case naming. Verbs are uniform and descriptive (e.g., list_*, create_*, delete_*), and compound names like 'investigate_domain' follow a predictable pattern.
52 tools is a large number for an MCP server, bordering on excessive. While the domain is complex, many tools (e.g., type-specific investigates, legacy 'suggest_next_steps') could be consolidated, making the surface feel heavy.
The tool set covers the full investigation lifecycle: graph management, entity/link CRUD, transforms, analysis, scoring, reporting, and learning. Minor gaps exist (e.g., no tool to clear all entities), but overall it is comprehensive.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
Hyperion โ MCP tool marketplace for AI agents: web, OSINT, security, research via one key.
Code intelligence for LLMs. Analyze, search, and retrieve code from any public git repository.
Code intelligence platform for AI agents. 20 tools for architecture, security & impact analysis.
Related MCP Servers
- AlicenseAqualityDmaintenanceConnects LLMs to BloodHound Enterprise for natural language attack path analysis, Cypher queries, and exploration of Active Directory, Azure/Entra ID, and OpenGraph environments.20GPL 3.0
- AlicenseNot gradedqualityCmaintenanceEnables LLMs to automate reverse engineering tasks using Cutter, including function analysis, decompilation, disassembly, and more.55GPL 3.0
- AlicenseAqualityDmaintenanceEnables AI-native access to the MITRE ATT\&CK framework, allowing LLMs and agents to query techniques, threat groups, software, and generate ATT\&CK Navigator layers for threat intelligence and security workflows.65765Apache 2.0

Ontolocy MCP Serverofficial
AlicenseNot gradedqualityDmaintenanceAugments an LLM with Ontolocy cyber graph capabilities, enabling natural language queries against a Neo4j graph database populated with MITRE ATT\&CK data.1MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/SulimanAbdulrazzaq/maltego-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server