Skip to main content
Glama
WYRE-AI
by WYRE-AI

Cisco Umbrella MCP Server

MCP server for Cisco Umbrella's NextGen REST API - deployment inventory, admin, policy, reporting, and investigate visibility - for AI assistants and the WYRE Conduit gateway.

Authentication

Create an API Key in the Umbrella admin console (Admin > API Keys, or Console Settings > API Keys on a Multi-org/MSP console) to receive an API Key and API Secret pair.

The secret is shown only once at creation time and cannot be retrieved later - store it somewhere safe immediately.

This server exchanges that pair for a short-lived (1-hour) Bearer access token via POST /auth/v2/token (grant_type=client_credentials, HTTP Basic auth), and handles the exchange and its refresh on expiry internally. Callers only ever need to supply the long-lived API Key/Secret below.

A note on a real discrepancy in Cisco's own documentation: Cisco's published Postman collection (CiscoDevNet/cloud-security, Umbrella/PostmanExamples/umbrella-external-postman-collection.json) encodes the token request as a bare GET with no body, while Cisco's DevNet "Getting Started" and "Quickstart" prose docs both independently specify POST with a grant_type=client_credentials form body. This server follows the prose docs (POST), since two independent doc pages agree and it matches the standard OAuth2 client_credentials flow Cisco names explicitly - but this was not verified against a live credential pair. If token exchange 401s against a real account, try a bare GET with no body before assuming the credentials are bad.

Related MCP server: ThousandEyes MCP

Configuration

Env var

Description

CISCOUMBRELLA_API_KEY

API Key from the Umbrella admin console.

CISCOUMBRELLA_API_SECRET

API Secret paired with the API Key. Shown only once at creation.

MCP_TRANSPORT

stdio (default) or http.

AUTH_MODE

env (default, reads the vars above) or gateway (credentials arrive per-request via X-CiscoUmbrella-* headers, injected by the Conduit gateway).

CONDUIT_S2S_SECRET

When set, the HTTP transport requires a valid X-Gateway-S2S header (Conduit sidecar auth) on every /mcp request.

LOG_LEVEL

debug | info (default) | warn | error.

Tools

Deployments

  • umbrella_list_networks - list registered public-IP network identities.

  • umbrella_list_internal_networks - list internal (RFC1918) network identities.

  • umbrella_list_sites - list Umbrella sites.

  • umbrella_list_virtual_appliances - list virtual appliances and their status.

  • umbrella_list_roaming_computers - list roaming-client-enrolled computers.

  • umbrella_get_internal_domains - get all internal domains configured to bypass Umbrella DNS.

Admin

  • umbrella_list_roles - list administrative roles.

  • umbrella_list_users - list admin console users.

  • umbrella_get_user - get a specific admin console user.

  • umbrella_list_api_keys - list configured API keys.

Policies

  • umbrella_list_destination_lists - list destination (allow/block) lists.

  • umbrella_list_destinations - list destinations within a specific destination list.

Reports

  • umbrella_top_destinations - most-requested destinations, optionally by traffic type (dns/proxy/firewall).

  • umbrella_total_requests - total request counts, optionally by traffic type.

  • umbrella_top_categories - most-requested content/security categories.

  • umbrella_activity - raw activity log, optionally by traffic type.

  • umbrella_identities - identities (roaming/network/mobile/AD users) with traffic summaries.

  • umbrella_appdiscovery_applications - discovered cloud applications.

  • umbrella_appdiscovery_app_identities - identities observed using a discovered application.

  • umbrella_appdiscovery_app_risk - risk details for a discovered application.

  • umbrella_api_usage_summary / umbrella_api_usage_requests / umbrella_api_usage_responses / umbrella_api_usage_keys - API usage reporting.

Investigate

  • umbrella_domain_categorization - content/security categorization for a domain.

  • umbrella_domain_risk_score - Cisco's risk score for a domain.

  • umbrella_domain_security_score - detailed security scoring signals for a domain.

  • umbrella_top_most_seen_domains - the top million most globally-popular domains.

  • umbrella_get_samples - malware/file samples for a domain, IP, or URL.

  • umbrella_domain_volume - DNS query volume over time for a domain.

  • umbrella_domain_resource_records - passive DNS resource records for a domain.

Every Reports/Investigate/Deployments/Admin/Policies list tool that Cisco's docs don't fully enumerate the filter set for accepts an optional additionalParams object, passed through verbatim as extra query-string parameters (e.g. categories, identityids, verdict, domains on Reports endpoints) - documented Cisco filters this client doesn't model as first-class arguments.

Scope

This is a v1, read-only surface: this server only implements GET endpoints across Deployments, Admin, Policies, Reports, and Investigate. Explicitly deferred, all real endpoints in Cisco's own Postman collection, out of scope for now:

  • Add/remove internal domains (POST/DELETE /deployments/v2/internaldomains)

  • Add/remove tunnels (POST/DELETE /deployments/v2/tunnels)

  • Add tags and tag/untag devices (POST /deployments/v2/tags*)

  • Create/delete users (POST/DELETE /admin/v2/users)

  • Create API keys (POST /admin/v2/apiKeys)

  • Add/remove destinations on a destination list (POST/DELETE /policies/v2/destinationlists/{id}/destinations)

  • Update an App Discovery application's label (PATCH /reports/v2/appDiscovery/applications/{id})

These are provisioning/mutation actions, out of scope for a read-only monitoring connector - consistent with how other connectors in this wave (Printix, WatchGuard Cloud) deferred provisioning-heavy writes. They can be added as a follow-up if a write-capable v2 is ever needed.

Also explicitly out of scope: the Legacy Umbrella Reporting v1/v2 APIs (different auth, different host - investigate.api.umbrella.com / management.api.umbrella.com) and any Multi-org/MSP child-organization switching via the X-Umbrella-OrgId header - real, documented Cisco behavior, but not covered in enough concrete request/response detail (whether it applies to the token request, every subsequent request, or both) to implement with confidence without a live credential pair to verify against.

Development

npm install
npm run build
npm test
npm run lint   # tsc --noEmit

Docker

docker build -t cisco-umbrella-mcp .
docker run -p 8080:8080 \
  -e CISCOUMBRELLA_API_KEY=... \
  -e CISCOUMBRELLA_API_SECRET=... \
  cisco-umbrella-mcp

Available Tools

31 tools
umbrella_activityC

Raw activity (request-level) log over a time range, optionally broken down by traffic type.

ParametersJSON Schema
NameRequiredDescriptionDefault
toYesRange end, epoch milliseconds.
fromYesRange start, epoch milliseconds.
limitNoMaximum number of records to return.
offsetNoNumber of records to skip, for paging.
trafficTypeNoOptional traffic-type breakdown. Omit for the all-traffic-types view.
additionalParamsNoEscape hatch for any documented Cisco Reports/Investigate query parameter not modeled explicitly above (e.g. categories, identityids, verdict, domains), passed through verbatim as query string key/value pairs.

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full responsibility for behavioral disclosure, but it only states that this is a raw activity log. It does not mention pagination behavior, default limits, potential result size, ordering, or authorization requirements. This is a meaningful gap for a tool that likely returns large log datasets.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, focused sentence with no filler. It front-loads the core meaning (raw request-level activity) and then specifies the two main axes: time range and traffic type. Every word contributes to comprehension.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and no annotations, this description is not complete enough for safe invocation. An agent would not know what fields are returned, how pagination behaves, whether a limit is required, or what the default result size is. Additional context about the raw log's shape and volume is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all parameters, including additionalParams and trafficType. The description adds only high-level context about time range and traffic-type breakdown, which is adequate but not substantial beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies this as a raw, request-level activity log over a time range with an optional traffic-type breakdown. This distinguishes it from aggregate sibling tools like umbrella_total_requests, though it does not explicitly name any sibling. The phrasing could use a verb, but the resource and scope are clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no explicit guidance about when to use this tool versus alternatives such as umbrella_total_requests, umbrella_api_usage_requests, or umbrella_domain_volume. The word "raw" implies it is for request-level logs rather than summaries, but no when-to-use or when-not-to-use guidance is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_api_usage_keysB

API usage broken down by API key over a date range.

ParametersJSON Schema
NameRequiredDescriptionDefault
toYesRange end, YYYY-MM-DD.
fromYesRange start, YYYY-MM-DD.

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

There are no annotations, so the description carries the burden of explaining behavior. It does communicate the main behavior—returning usage broken down by API key—but it does not clarify response shape, read-only semantics, pagination, aggregation, or whether 'usage' means requests, responses, or something else.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is brief and front-loaded with the key differentiator ('broken down by API key'). It wastes few words, though 'over a date range' somewhat repeats what the schema already communicates.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter reporting tool, the description conveys the core grouping dimension and required date range. However, with no output schema and no annotations, it leaves ambiguity about the exact usage metric and return format, which matters given the many similar umbrella usage siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the from/to date parameters are already well documented. The description only rephrases 'date range' and adds no new parameter-level meaning such as date behavior, inclusivity, or timezone handling.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool reports API usage grouped by API key over a date range, which distinguishes it from siblings like umbrella_api_usage_summary or umbrella_api_usage_requests. However, it lacks an explicit action verb such as 'List' or 'Get,' so it reads more like a noun phrase than a full instruction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given about when to prefer this tool over its siblings. It does not mention alternatives like umbrella_api_usage_summary, umbrella_api_usage_requests, or umbrella_api_usage_responses, nor does it state conditions such as 'use when you need per-key breakdowns.'

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_api_usage_requestsC

Detailed API request log over a date range.

ParametersJSON Schema
NameRequiredDescriptionDefault
toYesRange end, YYYY-MM-DD.
fromYesRange start, YYYY-MM-DD.

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral disclosure burden. It only states that the output is a detailed log over a date range; it does not mention pagination, ordering, limits, output shape, or whether this is a read-only operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, short sentence with no filler, and it front-loads the key resource and date-range scope. However, its brevity leaves little room for context that would help an agent distinguish it from similar siblings.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no annotations and no output schema, the agent has only this sentence plus the parameter schema. The description does not explain what the detailed log contains, how it differs from related API usage tools, or what the caller should expect in the response, making it incomplete for confident invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already documents both 'from' and 'to' as date range endpoints with YYYY-MM-DD format, so the description adds no additional meaning. With 100% schema coverage, the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States that the tool returns a detailed API request log over a date range, clearly identifying the resource and the required date parameters. It does not use an explicit verb and does not directly contrast with siblings like umbrella_api_usage_summary or umbrella_api_usage_responses, though 'detailed' hints at differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided about when to use this tool versus umbrella_api_usage_summary, umbrella_api_usage_responses, or umbrella_api_usage_keys. The agent must infer selection solely from the tool name and the single-sentence description, with no exclusions or alternatives mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_api_usage_responsesC

Detailed API response log over a date range.

ParametersJSON Schema
NameRequiredDescriptionDefault
toYesRange end, YYYY-MM-DD.
fromYesRange start, YYYY-MM-DD.

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of disclosure. It only states that it is a 'detailed' log over a date range, but does not mention pagination, sorting, field names, response format, or any limitations. This is insufficient for an un-annotated tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence with no redundant words. It is efficient and front-loaded with the core resource type and scope, though it could arguably provide more detail without sacrificing brevity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter tool with no output schema, the description gives minimal information about what the response log contains, whether results are paginated, or how it differs from similar API usage logs. An agent is left without enough context to know what to expect or how to choose this over siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already fully describes both parameters (from and to) with format details (YYYY-MM-DD). The description's 'over a date range' adds no new meaning beyond what the schema provides, so it remains at the baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific resource, 'Detailed API response log', and the scope 'over a date range', making it clear that this tool returns a log of API responses. This distinguishes it from request logs and summary tools, though it does not explicitly name any sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus alternatives like umbrella_api_usage_requests or umbrella_api_usage_summary. No context, exclusions, or selection criteria are given, leaving the agent to infer usage. With several closely related sibling tools, this is a notable gap.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_api_usage_summaryC

Summary of this organization's Umbrella API usage over a date range.

ParametersJSON Schema
NameRequiredDescriptionDefault
toYesRange end, YYYY-MM-DD.
fromYesRange start, YYYY-MM-DD.

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. 'Summary' implies a read-only aggregate, but the description does not explain what data is included, whether it covers all API activity, whether results are paginated, or what the response shape looks like.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence that is clear and front-loaded, with no filler or redundant phrasing. It packs the essential resource and scope into minimal text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple with two fully documented parameters, but the environment has several closely related siblings and no output schema. The description does not clarify what the summary returns or how it differs from the more specific API-usage siblings, leaving an agent under-informed for correct selection.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%: both 'from' and 'to' are documented as YYYY-MM-DD range bounds. The description only restates this concept ('over a date range') and adds no new meaning, so it stays at the baseline for fully covered schemas.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear resource ('Umbrella API usage') and a date range, so an agent can infer the tool summarizes usage data. However, it does not specify what 'usage' counts—requests, responses, keys, or total volume—and there are several usage-oriented siblings (umbrella_api_usage_requests, umbrella_api_usage_responses, umbrella_api_usage_keys, umbrella_total_requests) that it fails to differentiate from.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus the many sibling tools. It does not state what kind of summary it provides, what scenarios it fits, or which alternatives to prefer for more granular usage data.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_appdiscovery_app_identitiesB

List the identities (users/devices) observed using a specific discovered application.

ParametersJSON Schema
NameRequiredDescriptionDefault
appIdYesDiscovered application ID.
limitNoMaximum number of records to return.
offsetNoNumber of records to skip, for paging.
additionalParamsNoEscape hatch for any documented Cisco Reports/Investigate query parameter not modeled explicitly above (e.g. categories, identityids, verdict, domains), passed through verbatim as query string key/value pairs.

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure, but 'List the identities observed' only conveys that this is a read-style operation. It does not disclose pagination defaults, behavior for an invalid/unknown appId, data freshness, or whether results are complete or sampled. No contradiction exists (no annotations), but the behavioral surface is largely undisclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single 13-word sentence that front-loads the verb and object and adds a parenthetical clarifying the identity concept. Every word earns its place; there is no filler, restatement of the tool name, or redundant schema repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a relatively simple list tool the description is adequate, and the schema fully documents all four parameters including the additionalParams escape hatch. However, with no output schema and no annotations, the description leaves gaps an agent would need to fill by trial: the response shape, default/effective pagination, and the operational context linking this to the app-discovery workflow.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds only marginal meaning beyond the schema: 'specific discovered application' reinforces that appId refers to an app-discovery record, which the schema already states as 'Discovered application ID.' It does not illuminate limit/offset behavior or how additionalParams is meant to be used, but the schema already documents those adequately.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (List), a resource (identities, clarified as users/devices), and a precise scope (observed using a specific discovered application). This differentiates it from siblings like umbrella_appdiscovery_applications (lists apps, not identities) and umbrella_identities (would list identities generally, not per-app).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given about when to use this tool versus alternatives. It does not name any sibling, state a prerequisite (e.g., that appId must come from a prior app-discovery lookup), or explain when this would be preferred over umbrella_identities or umbrella_appdiscovery_applications. The usage context is only implied by the tool name and description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_appdiscovery_applicationsC

List cloud applications discovered in this organization's traffic (App Discovery).

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of records to return.
offsetNoNumber of records to skip, for paging.
additionalParamsNoEscape hatch for any documented Cisco Reports/Investigate query parameter not modeled explicitly above (e.g. categories, identityids, verdict, domains), passed through verbatim as query string key/value pairs.

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It only states that the tool lists discovered applications, implying a read operation, but does not mention pagination behavior, authentication requirements, rate limits, or what the response structure looks like. The existence of the additionalParams escape hatch is not hinted at in the description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with zero wasted words. It communicates the core action and scope efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has no output schema and no annotations, so the description must provide enough context for correct invocation. It fails to explain what fields the returned applications include, how to use limit/offset for paging (though schema covers them), how the additionalParams escape hatch works, or how this tool relates to the sibling app discovery tools. An agent is left guessing at the output format and filtering capabilities.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all three parameters (limit, offset, additionalParams). The description adds no parameter-specific information beyond the schema. Per the rubric, a baseline of 3 is appropriate when the schema carries the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear verb (List), resource (cloud applications), and scope (in this organization's traffic). It is specific enough to distinguish from most sibling tools, though it does not explicitly differentiate from the other app discovery tools (app_identities, app_risk). The name reinforces the purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus the other app discovery tools or any alternatives. There is no mention of filtering options, output usage, or conditions that would make this tool preferable. An agent has to infer usage solely from the name and description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_appdiscovery_app_riskA

Get risk details for a specific discovered application. Cisco's own Postman collection lists this endpoint under both "App Details" and "App Risk Details" - they are the same URL.

ParametersJSON Schema
NameRequiredDescriptionDefault
appIdYesDiscovered application ID.

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It only says 'Get risk details' and mentions the Postman alias; it does not describe the response shape, whether this is read-only beyond the verb, authentication needs, or any edge-case behavior. The alias note is useful but not behavioral transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences, front-loading the core purpose and then adding the valuable Postman alias disambiguation. There is no redundancy or irrelevant detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read-only tool, the description provides sufficient intent and the alias clarification is helpful. The only minor gap is that no output schema exists and the description does not summarize typical return fields, but this is acceptable given the simplicity of the endpoint.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already fully documents the only parameter, appId, with a clear description. The tool description adds no additional semantic meaning about the parameter, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Get') and resource ('risk details for a specific discovered application'), making the tool's scope immediately clear. It also disambiguates the endpoint from similar sibling tools by emphasizing it operates on a single discovered application rather than a list or identities.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the correct use case: when you have a specific discovered application ID and need its risk details. However, it does not explicitly contrast this with sibling tools like umbrella_appdiscovery_applications or umbrella_appdiscovery_app_identities, nor does it state when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_domain_categorizationC

Get the content/security categorization for a domain.

ParametersJSON Schema
NameRequiredDescriptionDefault
domainYes

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure, but it only states 'Get,' implying a read operation. It does not mention authentication requirements, rate limits, output format, or what the categorization data includes, leaving significant behavioral gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one concise sentence with a clear verb and object, front-loaded and free of filler. Every word contributes to the meaning, making it highly efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter lookup with no output schema and no annotations, the description is minimal. It leaves important details unaddressed, such as the domain format, the structure of the returned categorization, and any tool-specific limitations. This is barely adequate for an agent to call the tool confidently.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has one required string parameter 'domain' with zero description coverage, but the tool description does not explain the expected format (e.g., bare domain, URL, with or without scheme). The description merely repeats the word 'domain' without adding any semantic value, failing to compensate for the schema's lack of detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action 'Get' and the targeted resource: 'content/security categorization for a domain.' It provides a specific purpose that is distinct from sibling tools like domain_volume or resource records, but it does not explicitly contrast itself with similarly named tools such as umbrella_domain_risk_score or umbrella_domain_security_score, leaving some differentiation to inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus alternatives like domain_risk_score or domain_security_score. There is no mention of scenarios, prerequisites, or exclusions, so an agent has no documented basis for selecting this tool over its siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_domain_resource_recordsB

Get passive DNS resource records (historical DNS resolutions) for a domain.

ParametersJSON Schema
NameRequiredDescriptionDefault
domainYes

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of disclosing behavioral traits. It mentions the operation is a 'Get' (implying read-only) and specifies the resource type, but it does not disclose return format, pagination, authentication requirements, rate limits, or any side effects. The description is too sparse to inform an agent about operational nuances.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that is front-loaded with the core action and resource. It contains no filler and is appropriately sized for the tool's simplicity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (one parameter, no output schema, no annotations), the description should explain return values and operational context. It does not mention what the response looks like (e.g., a list of records), nor does it provide any usage context. The description is adequate only for a trivial understanding of the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. It does mention 'for a domain', clarifying that the 'domain' parameter is the domain being queried. However, it lacks details such as expected format (e.g., bare domain vs. protocol), any constraints, or examples. Since there is only one simple parameter, the minimal clarification is acceptable but not comprehensive.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific action (Get) on a specific resource (passive DNS resource records) with a clear context (historical DNS resolutions for a domain). This distinguishes it from sibling tools like umbrella_domain_categorization or umbrella_domain_risk_score, which serve different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It does not mention exclusions, prerequisites, or scenarios where another tool would be more appropriate. Usage is only implied by the tool's name and description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_domain_risk_scoreC

Get Cisco's risk score for a domain (higher = riskier).

ParametersJSON Schema
NameRequiredDescriptionDefault
domainYes

TDQS

C2.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behavior, but it mostly restates the operation and adds a score-direction cue. It does not mention read-only status, authentication requirements, failure behavior, or score generation, so the burden is not met.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence with no filler. The useful interpretative cue ('higher = riskier') is included without bloating the text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema and no annotations, the definition leaves key context implicit: the output shape/range, parameter constraints, and the relationship to umbrella_domain_security_score are all absent. It is enough to guess the tool's basic function but not to use it with confidence among siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description does not compensate. It says 'for a domain' but gives no format, normalization, or eligibility criteria; the schema already labels the property 'domain', so no extra parameter meaning is added.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Get') and identifies the resource: Cisco's risk score for a domain. It also clarifies the score's direction ('higher = riskier'), but does not distinguish this tool from the similarly named sibling umbrella_domain_security_score.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to choose this tool over alternatives. The sibling list includes umbrella_domain_security_score and umbrella_domain_categorization, and the description provides no conditions, exclusions, or comparisons to help an agent route between them.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_domain_security_scoreB

Get detailed security scoring signals for a domain (DGA score, perplexity, entropy, Secure Rank, etc).

ParametersJSON Schema
NameRequiredDescriptionDefault
domainYes

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. 'Get' signals a read-only operation and the listed signals indicate the kind of data returned, but the description does not address response shape, error cases, or any special behavior. This is adequate for a simple lookup but not richly transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence that names the action, resource, and representative output signals without wasted words. The parenthetical examples and 'etc.' efficiently convey the scope of returned data.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with only one required parameter and no output schema, the description is minimally viable: an agent can infer what to pass and generally what to expect. However, it lacks output structure details and does not help an agent choose between this tool and the similarly named domain_risk_score sibling, leaving meaningful context gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for the undocumented domain parameter. It only restates that the tool works 'for a domain', adding little beyond the property name. It does not specify expected format, such as whether a full URL, bare domain, or subdomain is acceptable.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear action ('Get') and resource ('detailed security scoring signals for a domain'), with concrete examples such as DGA score, perplexity, entropy, and Secure Rank. It does not explicitly distinguish itself from the closely named sibling tool umbrella_domain_risk_score, so it stops short of full differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The metric examples imply this tool is for domain security scoring use cases, but the description does not explicitly say when to use it instead of related siblings like umbrella_domain_risk_score or umbrella_domain_categorization. There is no 'when not to use' or alternative-routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_domain_volumeB

Get DNS query volume over time for a domain.

ParametersJSON Schema
NameRequiredDescriptionDefault
domainYes

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden for behavioral disclosure. It states that the tool gets query volume over time, but it does not disclose time range behavior, aggregation granularity, pagination, rate limits, or whether any implicit default time window applies. For a data-query tool, these are material gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one short, front-loaded sentence with no filler. It states the action and object immediately. It is concise rather than under-specified to the point of being a pure label, though it could still carry more useful detail without becoming bloated.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read-style tool, the description is minimally viable: it names the input and the kind of output. However, with no annotations and no output schema, it omits details like what time range is covered, what units or series format are returned, and whether the domain must be an exact FQDN. These gaps prevent it from being fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, but it only repeats the concept of 'domain' without adding format guidance, examples, or constraints. It does clarify that the domain is the object whose volume is queried, but it adds little beyond what the input schema already shows.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb-resource pairing: 'Get DNS query volume over time for a domain.' This clearly conveys what the tool does and distinguishes it from siblings like umbrella_total_requests (which suggests aggregate counts) and umbrella_domain_categorization (which is metadata classification).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no guidance on when to use this tool instead of the many related sibling tools. There are no stated alternatives, exclusions, or context cues such as 'use this for per-domain trends' versus 'use umbrella_total_requests for overall counts.' The agent must infer usage entirely from the name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_get_internal_domainsA

Get all internal domains configured to bypass Umbrella DNS resolution.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of records to return.
offsetNoNumber of records to skip, for paging.
additionalParamsNoEscape hatch for any documented Cisco Reports/Investigate query parameter not modeled explicitly above (e.g. categories, identityids, verdict, domains), passed through verbatim as query string key/value pairs.

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the behavioral burden. 'Get' implies a read-only operation and the scope is stated, which is useful. But the description does not disclose auth requirements, pagination semantics, or output format; for a list tool with limit/offset parameters, that would add value.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, compact sentence with no filler. It front-loads the action, resource, and the key qualifying condition. Every word contributes to the agent's understanding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a straightforward GET/list tool with optional paging parameters and 100% schema coverage, the description is adequately complete. It identifies the resource and selection criteria. It does not describe the return shape, but no output schema exists and the resource name makes the expected result reasonably clear.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and each parameter already has a descriptive schema entry. The tool description adds no parameter-level meaning, but at full schema coverage the baseline of 3 is appropriate. The additionalParams escape hatch is also documented in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Get'), the resource ('internal domains'), and the specific condition ('configured to bypass Umbrella DNS resolution'). This distinguishes it from siblings like umbrella_list_internal_networks by resource type. It is specific and not a tautology.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The purpose implies when to use the tool — when an agent needs the list of internal domains that bypass Umbrella DNS resolution. However, it gives no explicit guidance about when not to use it or which sibling tool would be a better alternative, such as umbrella_list_internal_networks or umbrella_list_destinations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_get_samplesA

Get malware/file samples associated with a domain, IP, or URL.

ParametersJSON Schema
NameRequiredDescriptionDefault
domainIpOrUrlYes

TDQS

A3.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. 'Get' implies a read-only operation, but the description does not explain what the samples contain, whether results are paginated, rate limits, authentication needs, or what the response looks like.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence with no filler. Every word contributes to the meaning, and the description is appropriately sized for the tool's simplicity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter getter, the description is largely complete: it identifies the input and the conceptual output. Minor gaps include lack of detail on response format, result limits, or sample types, but these do not prevent a competent agent from invoking the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description compensates by explaining that domainIpOrUrl accepts a domain, IP, or URL. This directly conveys the accepted value type, which is meaningful beyond the bare schema property name.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Get') and resource ('malware/file samples'), and clearly scopes the operation to a domain, IP, or URL. This distinguishes it from sibling tools like umbrella_get_internal_domains or umbrella_domain_categorization without ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool: whenever malware/file samples for a domain, IP, or URL are needed. However, it does not explicitly contrast it with alternatives or state when not to use it, leaving selection guidance to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_get_userB

Get a specific Umbrella admin console user by user ID.

ParametersJSON Schema
NameRequiredDescriptionDefault
userIdYesUmbrella user ID.

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description must carry the burden of behavioral disclosure. It only says 'Get', implying a read operation, but does not mention response format, error handling, permissions, or any side effects. The description adds no behavioral detail beyond the implicit read.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, clear sentence with no redundant words. It is appropriately brief for a simple get-by-ID operation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple get with one parameter and no output schema, the description is minimally sufficient. However, it does not mention what the response contains (e.g., user details) or any potential error states. Given the simplicity, this is acceptable but not comprehensive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers 100% of the parameter (userId) with a description 'Umbrella user ID.' The tool description adds the phrase 'admin console' which provides context that this is an admin console user, not a general user. This is a slight addition, meeting the baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (Get), the resource (specific Umbrella admin console user), and the selection criterion (by user ID). It implicitly distinguishes from the sibling umbrella_list_users, which lists users, but does not explicitly name the alternative.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives like umbrella_list_users. The description does not state prerequisites, such as having a valid user ID, nor does it mention when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_identitiesA

List identities (roaming computers, networks, mobile devices, AD users) with traffic summaries, filtered by one or more identity types.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of records to return.
offsetNoNumber of records to skip, for paging.
identityTypesYesIdentity type(s) to filter by, e.g. ['roaming'], ['network'], ['mobile_device','android'], ['directory_user'] - per Cisco's documented identitytypes values.
additionalParamsNoEscape hatch for any documented Cisco Reports/Investigate query parameter not modeled explicitly above (e.g. categories, identityids, verdict, domains), passed through verbatim as query string key/value pairs.

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses that results include traffic summaries and that filtering occurs, which are useful behavioral details. However, it does not mention the additionalParams escape hatch, any side effects (none likely), or potential response size concerns. It also does not clarify that this is a read-only operation beyond the verb 'List'. Overall, it adds some behavioral context but is not thorough.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that front-loads the core purpose and enumerates the identity types in parentheses. Every word contributes, with no fluff or repetition. It is concise and easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has a required array parameter, an escape hatch (additionalParams) that allows arbitrary query parameters, and no output schema. The description does not mention additionalParams at all, which is a significant capability an agent would need to know about. It also does not explain how this tool relates to the many sibling list tools, leaving the agent to infer when to use it. For a tool with this complexity and competition, the description is insufficiently complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all parameters including the required identityTypes and the purpose of limit/offset. The description only mentions 'filtered by one or more identity types', which aligns with the schema's identityTypes description but adds no new semantics. It does not elaborate on additionalParams, but since the schema covers it, the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists identities with traffic summaries and filters by identity type. It enumerates the specific identity types (roaming computers, networks, mobile devices, AD users), which directly distinguishes it from sibling tools like umbrella_list_roaming_computers or umbrella_list_networks that focus on a single type.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies a flexible, type-filtered listing but does not explicitly say when to choose this over the dedicated sibling tools. It mentions filtering by one or more types, which suggests a use case for mixed or multiple types, but there is no explicit guidance such as 'use this instead of umbrella_list_roaming_computers for combined queries'. The context is implied, not stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_list_api_keysB

List all API keys configured for this Umbrella organization.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

B3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It only states 'list', which implies a read-only operation, but does not disclose any other behavioral traits such as pagination, sorting, or limitations. This is minimal and insufficient for a tool with zero annotation coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that front-loads the action and resource. It contains no filler or redundant information, making it appropriately sized and structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list-all tool with no parameters and no output schema, the description is mostly adequate, but it does not describe the output format or any additional details an agent might need, such as whether it returns just keys or full metadata. Given the lack of annotations and output schema, this gap is notable but not critical for a basic listing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the schema is trivially complete (100% coverage). The description adds context by specifying the scope 'configured for this Umbrella organization', which provides meaning beyond the empty schema. This meets the baseline for a zero-parameter tool and adds a useful qualifier.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'List' and the resource 'API keys configured for this Umbrella organization', which is specific and unambiguous. It does not explicitly differentiate from sibling tools like umbrella_api_usage_keys, but the purpose is clear enough for an agent to identify what it does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines1/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It does not mention any conditions, exclusions, or mention of sibling tools that might be more appropriate for related queries, leaving the agent without decision support.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_list_destination_listsA

List all destination lists (allow/block lists) configured for this Umbrella organization.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of records to return.
offsetNoNumber of records to skip, for paging.
additionalParamsNoEscape hatch for any documented Cisco Reports/Investigate query parameter not modeled explicitly above (e.g. categories, identityids, verdict, domains), passed through verbatim as query string key/value pairs.

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the behavioral disclosure burden. It does state the operation is a list and defines the scope ('configured for this Umbrella organization'), but it does not mention pagination behavior, return format, or any access requirements. This is adequate for a simple read-only list operation but not rich in detail.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no filler or redundancy. It states exactly what the tool does in as few words as possible.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is sufficient for basic understanding, but there is no output schema and no mention of pagination semantics or how additionalParams affect the call. Since the tool is simple and the schema covers parameters, the gaps are not severe, but they prevent full contextual completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides 100% coverage for limit, offset, and additionalParams, each with descriptions. The tool description adds no extra parameter-level meaning beyond the schema, so the baseline score of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'List all destination lists (allow/block lists) configured for this Umbrella organization.' It clearly identifies the object and scope, distinguishing it from the similarly named sibling 'umbrella_list_destinations' by referring to the lists themselves rather than the destinations within them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The intended use is implied: use this tool when you need to enumerate destination lists for the organization. However, there is no explicit comparison to alternatives such as umbrella_list_destinations or any guidance on when not to use this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_list_destinationsA

List the destinations (domains/URLs/IPs) contained in a specific destination list.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of records to return.
offsetNoNumber of records to skip, for paging.
additionalParamsNoEscape hatch for any documented Cisco Reports/Investigate query parameter not modeled explicitly above (e.g. categories, identityids, verdict, domains), passed through verbatim as query string key/value pairs.
destinationListIdYesID of the destination list.

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full responsibility for behavioral disclosure. It adds little beyond the tool name: there is no mention of pagination, default limits, response shape, authorization requirements, or whether the list is ordered or filtered. For a read tool this is a modest gap, but still leaves the agent guessing about behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence contains only the essential information: the verb, the resource, the scope, and the type of data returned. There is no filler or repetition of the tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list operation, the description covers the core intent, and the schema handles parameter details. However, with no output schema and no annotations, the agent is left unaware of the response format, pagination behavior, or any defaults for limit/offset. It is adequate but not complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3 even without additional parameter guidance in the description. The description does not add parameter semantics, but the schema fully documents destinationListId, limit, offset, and the additionalParams escape hatch, so no compensation is needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List') with a clear resource ('destinations... contained in a specific destination list') and explicitly enumerates what counts as a destination (domains/URLs/IPs). It distinguishes itself from sibling umbrella_list_destination_lists by emphasizing 'specific destination list' rather than listing the lists themselves.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'in a specific destination list' provides clear context: use this when you already have a destination list ID and need its members. It does not explicitly name alternatives or exclusions, but the context is enough to avoid confusing it with listing networks, users, or destination lists as a whole.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_list_internal_networksA

List internal (RFC1918) networks registered for internal-network identities.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of records to return.
offsetNoNumber of records to skip, for paging.
additionalParamsNoEscape hatch for any documented Cisco Reports/Investigate query parameter not modeled explicitly above (e.g. categories, identityids, verdict, domains), passed through verbatim as query string key/value pairs.

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the behavioral burden. 'List' clearly implies a read-only operation, and the target scope is stated. It does not disclose pagination behavior, authorization needs, or result format, but for a non-mutating list tool this is adequate though not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence with no filler or redundancy. It front-loads the action and resource, and every word contributes meaningful scoping.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a list tool, the description plus the fully documented parameter schema is mostly sufficient, and no output schema means return values need not be described. The main gap is the missing explicit differentiation from sibling list tools, particularly umbrella_list_networks.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers all three parameters (limit, offset, additionalParams) with descriptions, so the 100% coverage baseline applies. The tool description adds no parameter-specific meaning beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List') and identifies the resource: internal (RFC1918) networks registered for internal-network identities. The parenthetical 'RFC1918' adds precision and helps separate this from a generic network-list tool. It does not explicitly reference sibling umbrella_list_networks, so full differentiation is left partly to the tool name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The scoping qualifiers 'internal (RFC1918)' and 'registered for internal-network identities' imply when this tool is appropriate. However, the description does not explicitly mention alternatives such as umbrella_list_networks or state conditions for choosing one over the other.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_list_networksA

List Cisco Umbrella networks (public IP identities) registered to this organization.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of records to return.
offsetNoNumber of records to skip, for paging.
additionalParamsNoEscape hatch for any documented Cisco Reports/Investigate query parameter not modeled explicitly above (e.g. categories, identityids, verdict, domains), passed through verbatim as query string key/value pairs.

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It clearly conveys a read-only listing operation and scopes results to the organization, which is adequate for a simple list call. However, it does not disclose pagination defaults, response shape, or any API-specific behavior such as rate limits or required auth, so transparency is only partial.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The entire description is one tight, front-loaded sentence. Every phrase earns its place: the action, the resource, the disambiguating parenthetical, and the scope. There is no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only list tool with fully documented parameters, the description is largely complete. It gives the agent enough to call it correctly with no parameters or with pagination params. The main gap is the lack of explicit sibling differentiation and any note about response format, but those are minor given the simplicity and the clarity of the current description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%: limit, offset, and additionalParams are all already well-documented in the input schema. The description adds no parameter-specific detail, and none is needed, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List'), names the exact resource ('Cisco Umbrella networks'), and adds scope ('registered to this organization') plus a clarifying parenthetical ('public IP identities'). The parenthetical also implicitly distinguishes it from the sibling umbrella_list_internal_networks, making the tool's identity clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states the organizational scope and clarifies that these are public IP identities, giving an agent clear context for choosing this tool over the similar-sounding umbrella_list_internal_networks. However, it does not explicitly say 'use this for public networks, use the other for internal networks,' so it stops short of fully explicit routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_list_roaming_computersA

List all roaming computers enrolled via the Umbrella roaming client.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of records to return.
offsetNoNumber of records to skip, for paging.
additionalParamsNoEscape hatch for any documented Cisco Reports/Investigate query parameter not modeled explicitly above (e.g. categories, identityids, verdict, domains), passed through verbatim as query string key/value pairs.

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry behavioral context; 'List' signals a read-only operation, and 'enrolled via the Umbrella roaming client' defines the population. It does not mention response format, ordering, pagination semantics, or any API-specific quirks, but for a simple list this is a moderate rather than severe gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence with no filler or repeated schema information. It earns its place by identifying the resource and the enrollment scope immediately.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has no annotations and no output schema, and the description is minimal. It is sufficient for basic invocation with the well-documented optional parameters, but it leaves return values and any list-specific behavior unstated; for a low-complexity list tool this is acceptable but not thorough.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema coverage is 100%, so limit, offset, and additionalParams are already fully documented and the description does not need to repeat them. The description adds no parameter-specific meaning beyond the schema, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List') and a precise resource ('roaming computers enrolled via the Umbrella roaming client'), which clearly differentiates it from sibling list tools such as umbrella_list_networks and umbrella_list_internal_networks. It is more than a restatement of the tool name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Intended usage is implied by the resource scope: an agent that needs enrolled roaming computers can select this tool. However, there is no explicit guidance about when to prefer it over sibling list_* tools or what conditions would make it inappropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_list_rolesA

List all administrative roles available in this Umbrella organization.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description makes the core behavior clear: a read-only enumeration of all available roles in the organization. However, with no annotations provided, it does not disclose potential details such as pagination, authentication requirements, or response shape. This is a minor gap for a simple zero-parameter list operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence with no filler. The action and resource are front-loaded, making it immediately scannable for an agent.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no input parameters, no output schema, and minimal side effects, the description is sufficiently complete for correct invocation. It identifies both what is returned and the organizational scope. Additional return-field details would be useful but are not necessary for basic selection and use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are no parameters and the schema coverage is 100%, so there is no parameter-level ambiguity to resolve. The phrase 'all administrative roles' appropriately reinforces that no filters or inputs are needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific action ('List') and a distinct resource ('administrative roles'), scoped to the Umbrella organization. It clearly differentiates this tool from sibling list tools such as umbrella_list_networks and umbrella_list_users.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The intended use is clear and unambiguous: retrieve the complete set of administrative roles for the organization. It does not explicitly mention alternatives or exclusions, but the unique resource type and zero-parameter signature provide sufficient contextual guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_list_sitesB

List Umbrella sites (logical groupings of virtual appliances/internal networks).

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of records to return.
offsetNoNumber of records to skip, for paging.
additionalParamsNoEscape hatch for any documented Cisco Reports/Investigate query parameter not modeled explicitly above (e.g. categories, identityids, verdict, domains), passed through verbatim as query string key/value pairs.

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses that sites are logical groupings, which adds context, but it doesn't mention pagination behavior, response shape, or any filtering semantics. For a read-only list tool, the lack of behavioral detail beyond the resource definition is a gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that front-loads the verb and resource, then adds a clarifying parenthetical. It is concise and every word earns its place, though it could have added a usage pointer without becoming bloated.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with zero required parameters and full schema coverage, the description is mostly adequate. However, with no annotations and no output schema, it would benefit from a note about what a 'site' record contains or how paging works. The sibling context helps disambiguate, but the description alone leaves some context gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents limit, offset, and additionalParams. The description adds no parameter-specific meaning beyond the schema, which is acceptable given full coverage. The additionalParams escape hatch is well-documented in the schema itself.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('List') and resource ('Umbrella sites') and clarifies what sites are ('logical groupings of virtual appliances/internal networks'). This distinguishes it from siblings like umbrella_list_networks and umbrella_list_virtual_appliances, though it doesn't explicitly name them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this is for listing site groupings, and the sibling list shows related list tools, but there is no explicit when-to-use guidance or exclusions. An agent can infer usage from the resource definition, but the description doesn't state when to prefer this over umbrella_list_networks or umbrella_list_virtual_appliances.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_list_usersB

List all admin console users for this Umbrella organization.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of records to return.
offsetNoNumber of records to skip, for paging.
additionalParamsNoEscape hatch for any documented Cisco Reports/Investigate query parameter not modeled explicitly above (e.g. categories, identityids, verdict, domains), passed through verbatim as query string key/value pairs.

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry behavioral disclosure. It signals a read operation via 'List' but says 'all' while the schema includes limit/offset pagination, and it never explains paging behavior, default page size, or response shape. This is a meaningful gap for a no-annotation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence with no filler. It gets the core message across efficiently, though it sacrifices context for brevity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a low-complexity, zero-required-parameter list tool the description conveys the core operation, but without annotations or an output schema it leaves pagination semantics and the meaning of 'all' underspecified. Additional guidance on paging would make it complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the parameters are already fully documented. The description adds no parameter-level detail, which is acceptable; baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific action ('List') and a distinct resource ('admin console users for this Umbrella organization'). This plainly separates it from sibling list tools focused on networks, sites, roles, or a single user via umbrella_get_user.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to prefer this over umbrella_get_user or other list tools, and no mention of filters or context. The agent is left to infer usage from the name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_list_virtual_appliancesA

List all Umbrella virtual appliances (on-prem DNS forwarders) and their status.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of records to return.
offsetNoNumber of records to skip, for paging.
additionalParamsNoEscape hatch for any documented Cisco Reports/Investigate query parameter not modeled explicitly above (e.g. categories, identityids, verdict, domains), passed through verbatim as query string key/value pairs.

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Since annotations are absent, the description carries the full burden. It discloses that it returns status (useful context) and implies a read-only operation, but does not mention pagination behavior or any side effects. However, for a listing tool, the absence of caveats is acceptable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence with no fluff, front-loading the resource type and action. It could have elaborated on the output, but the sentence is efficient and direct.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (read-only list, no output schema, all parameters optional and well-documented in the schema), the description covers the core purpose and status. It might have mentioned that it returns a list of objects, but that's implicit from the tool name and phrasing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides descriptions for all three parameters (limit, offset, additionalParams), including the escape hatch semantics. The description adds no additional parameter-level meaning, so a baseline of 3 is suitable given full schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns a list of virtual appliances with their status, using a specific verb and resource. However, it does not explicitly distinguish it from sibling tools that also list entities (e.g., umbrella_list_sites), though the resource name is sufficiently unique among the siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies it is for listing virtual appliances, which is a read operation, but it provides no explicit when-to-use guidance or exclusions. There are no alternative tools for the same resource, though stand-alone advice is minimal.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_top_categoriesC

Report of the most-requested content/security categories over a time range.

ParametersJSON Schema
NameRequiredDescriptionDefault
toYesRange end, epoch milliseconds.
fromYesRange start, epoch milliseconds.
limitNoMaximum number of records to return.
offsetNoNumber of records to skip, for paging.
additionalParamsNoEscape hatch for any documented Cisco Reports/Investigate query parameter not modeled explicitly above (e.g. categories, identityids, verdict, domains), passed through verbatim as query string key/value pairs.

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and only indicates a non-mutating 'report'. It does not disclose sorting semantics, timezone/inclusivity of the range, pagination behavior, whether results are blocked vs allowed categories, or what the response shape is.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no wasted words and puts the core intent up front. It is concise, though it leaves space for more useful detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a report tool with 5 parameters, no output schema, and no annotations, the description is too thin: it doesn't explain paging, the additionalParams escape hatch, or the return structure. An agent would have to infer how limit/offset interact and what 'top' means.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the input schema already explains from, to, limit, offset, and additionalParams. The description adds no parameter-level detail beyond the phrase 'over a time range', which matches the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states the resource (content/security categories) and the aggregation intent (most-requested over a time range), which distinguishes it from sibling top-destination or top-domain report tools. However, it is phrased as a noun phrase rather than an actionable verb, and it doesn't explicitly differentiate by name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given about when to choose this tool over sibling reporting tools such as umbrella_top_destinations or umbrella_top_most_seen_domains. The time-range mention is a factual scope, not a usage rule.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_top_destinationsB

Report of the most-requested destinations (domains) over a time range, optionally broken down by traffic type.

ParametersJSON Schema
NameRequiredDescriptionDefault
toYesRange end, epoch milliseconds.
fromYesRange start, epoch milliseconds.
limitNoMaximum number of records to return.
offsetNoNumber of records to skip, for paging.
trafficTypeNoOptional traffic-type breakdown. Omit for the all-traffic-types view.
additionalParamsNoEscape hatch for any documented Cisco Reports/Investigate query parameter not modeled explicitly above (e.g. categories, identityids, verdict, domains), passed through verbatim as query string key/value pairs.

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full behavioral burden. It does convey that this is a read-only report, that results are ranked by request volume, and that an optional traffic-type breakdown exists. However, it does not disclose response shape, pagination defaults, or how 'most-requested' is calculated beyond the basic implication.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence with no filler. It communicates the core purpose, the time-range context, and the optional breakdown efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has six parameters, a nested object, and no output schema, yet the description is only one sentence. It does not describe what the returned report contains, how pagination behaves, or what typical use cases look like, leaving an agent without enough context to reliably parse or interpret the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all parameters well. The description adds little beyond restating the time range and traffic-type breakdown, which are already present in the schema. This is the appropriate baseline since the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the resource (destinations/domains), the time-range scoping, and the optional traffic-type breakdown. It is specific enough to distinguish from most sibling tools, though it does not explicitly differentiate itself from the similarly named umbrella_top_most_seen_domains.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states what the tool does but provides no guidance on when to use it over alternatives such as umbrella_top_most_seen_domains or umbrella_top_categories. There are no usage conditions, exclusions, or preferred scenarios described.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_top_most_seen_domainsA

Get Cisco's list of the top million most globally-popular domains.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

There are no annotations, so the description must carry the behavioral burden. It only says 'Get', which implies a read operation, but it does not disclose whether the list is static or dynamic, how recent it is, what ranking methodology is used, or what response shape to expect.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded, information-dense sentence. Every word contributes to identifying the tool's purpose, with no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a no-parameter list retrieval, this is nearly complete: the data source, scope, and approximate size are stated. A small note about return format, ordering, or update cadence would make it fully complete, but nothing critical blocks invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and an empty schema, so parameter semantics are fully covered by the schema itself. The description appropriately does not fabricate parameter details; the baseline for zero-parameter tools applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Get') and a specific resource ('Cisco's list of the top million most globally-popular domains'). It clearly distinguishes this from sibling organization-specific list tools like umbrella_top_destinations by emphasizing the global, Cisco-provided nature of the data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use or when-not-to-use guidance is provided, and no alternative tools are mentioned. An agent must infer that this is for global popularity data rather than org-specific analytics, but there is no explicit routing or exclusion signal.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

umbrella_total_requestsA

Total DNS/proxy/firewall request counts over a time range, optionally broken down by traffic type.

ParametersJSON Schema
NameRequiredDescriptionDefault
toYesRange end, epoch milliseconds.
fromYesRange start, epoch milliseconds.
limitNoMaximum number of records to return.
offsetNoNumber of records to skip, for paging.
trafficTypeNoOptional traffic-type breakdown. Omit for the all-traffic-types view.
additionalParamsNoEscape hatch for any documented Cisco Reports/Investigate query parameter not modeled explicitly above (e.g. categories, identityids, verdict, domains), passed through verbatim as query string key/value pairs.

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description carries the behavioral burden. It discloses the core read-only aggregation behavior and optional breakdown, but it does not mention response shape, pagination behavior, or any caveats around the additionalParams escape hatch. For a reporting tool this is minimally adequate, but not richly transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that states the core purpose first and adds the optional breakdown without wasted words. Every part earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The schema is rich enough for parameter usage, but with no output schema and no annotations the description leaves the response shape and paging behavior unstated. It is barely sufficient for a simple count query, but an agent would benefit from knowing what the returned totals look like and how limit/offset apply.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the schema already explains from, to, limit, offset, trafficType, and additionalParams in reasonable detail. The description only restates the time-range and traffic-type grouping, so it adds no real semantic value beyond the input schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the resource (DNS/proxy/firewall request counts), the operation (totaling over a time range), and an optional grouping dimension (traffic type). It is much more specific than most sibling tool names, though it lacks an explicit verb and does not directly distinguish itself from similar-looking tools like umbrella_api_usage_requests.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for aggregate request-volume reporting and mentions the time-range and optional traffic-type breakdown. However, it gives no explicit when-to-use or when-not-to-use guidance, and it does not point to alternatives such as umbrella_activity for raw events or umbrella_api_usage_requests for API-specific usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 31 tool updatesv0.1.0
    • First observedumbrella_activity
    • First observedumbrella_api_usage_keys
    • First observedumbrella_api_usage_requests
    • First observedumbrella_api_usage_responses
    • First observedumbrella_api_usage_summary
    • First observedumbrella_appdiscovery_app_identities
    • First observedumbrella_appdiscovery_app_risk
    • First observedumbrella_appdiscovery_applications
    • First observedumbrella_domain_categorization
    • First observedumbrella_domain_resource_records
    • First observedumbrella_domain_risk_score
    • First observedumbrella_domain_security_score
    • First observedumbrella_domain_volume
    • First observedumbrella_get_internal_domains
    • First observedumbrella_get_samples
    • First observedumbrella_get_user
    • First observedumbrella_identities
    • First observedumbrella_list_api_keys
    • First observedumbrella_list_destination_lists
    • First observedumbrella_list_destinations
    • First observedumbrella_list_internal_networks
    • First observedumbrella_list_networks
    • First observedumbrella_list_roaming_computers
    • First observedumbrella_list_roles
    • First observedumbrella_list_sites
    • First observedumbrella_list_users
    • First observedumbrella_list_virtual_appliances
    • First observedumbrella_top_categories
    • First observedumbrella_top_destinations
    • First observedumbrella_top_most_seen_domains
    • First observedumbrella_total_requests

TDQS

B3.1/5.0

Scored across 31 tools

Disambiguation3/5

Most tools are tied to distinct Umbrella entities, but several clusters overlap: umbrella_identities overlaps with the individual network/roaming-computer listers, the four api_usage_* tools are near-variants of the same log, and the domain risk/security/categorization lookups can be confused. Descriptions disambiguate most cases, but an agent will need to read carefully.

Naming Consistency4/5

All tools share the umbrella_ prefix and consistent snake_case, with recognizable list_/get_/top_ verbs in most entries. The domain_* and appdiscovery_* names are noun-style rather than verb-first, but the resource grouping is predictable.

Tool Count2/5

31 tools is over the 25-tool comfort threshold and will bloat the tool picker even though they are grouped logically. Several families (api_usage_*, appdiscovery_*, domain_*) could be consolidated into fewer parameterized tools.

Completeness3/5

Read-only coverage is broad: networks, identities, appliances, reports, app discovery, API usage, and domain intelligence are all represented. However, the entire surface is list/get/report-oriented; there are no create/update/delete operations for destination lists, users, networks, or sites, so management workflows dead-end.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • F
    license
    Not graded
    quality
    C
    maintenance
    Provides read-only access to Umbrella Cost finops platform, enabling natural language querying of multi-cloud cost data, optimization recommendations, anomaly detection, and budget tracking across AWS, Azure, and GCP.
    -
  • A
    license
    Not graded
    quality
    F
    maintenance
    Enables AI assistants to query Cisco ThousandEyes v7 API for network monitoring data including tests, agents, alerts, dashboards, and test results (network, page-load, web-transactions, path visualization) for faster troubleshooting through natural language.
    2
    Apache 2.0
  • A
    license
    B
    quality
    D
    maintenance
    Enables AI assistants to manage and monitor UniFi Network Controllers through natural language. Provides 25 read-only tools for discovering devices and clients, viewing security configurations, analyzing network statistics, and exporting configuration data.
    41
    MIT