DNSFilter MCP Server
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@DNSFilter MCP Servershow me recent threat reports for my network"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
DNSFilter MCP Server
MCP server for DNSFilter's DNS security/filtering API - organizations, networks (sites), filtering policies, content/application categories, custom block pages, and the full traffic/threat reporting surface, for AI assistants and the WYRE Conduit gateway.
Scope
This is a deliberately narrow, read-only v1 surface, hard-scoped to organizations, networks, policies, categories, block pages, and reporting. DNSFilter's REST API (api.dnsfilter.com) has 217 documented paths across a much broader surface - MSP/distributor management, billing, users, roaming-client agents, enterprise SSO connections, API key management, scheduled reports, and more. None of that is implemented here, by design, not by oversight. Every tool in this connector maps 1:1 to a real, documented GET operation in DNSFilter's own published OpenAPI spec (https://api.dnsfilter.com/docs.json) - there is no write, update, or delete tool anywhere in this codebase.
Hard-excluded (every write/mutation operation on every in-scope resource) - never implemented:
POST/PATCH/DELETE /v1/organizations*(create, bulk_update, promote_to_msp, update, cancel, destroy) - organization mutations.POST/PATCH/DELETE /v1/networks*(create, bulk_create/update/destroy, update, destroy, secret_key rotate/revoke/generate) - network mutations, including LAN IP and subnet writes.POST/PATCH/DELETE /v1/policies*(create, update, destroy, application_update, add/remove_allowed_application, add/remove_blacklist_category, add/remove_blacklist_domain, add/remove_blocked_application, add/remove_whitelist_domain, permissive_mode update) and all of/v1/policies/bulk/*(bulk allow/block-list add/remove) and/v1/policy_ipswrites - every policy-content mutation.POST/DELETE /v1/block_pages*(create, destroy) andPATCH /v1/block_pages/{id}(update) - block-page mutations.Every write endpoint on resources this connector doesn't otherwise touch at all: API keys (
create/destroy/revoke), users and organization users (create/update/destroy/resend_invite), billing/invoices, distributors (MSP/sub-org provisioning, SKUs, cancellation), enterprise SSO connections, scheduled policies/reports, roaming-client user-agents (bulk delete/update/cleanup, dequeue-uninstall), domain notes, IP/MAC address management, and trials.
They can be added as a follow-up if there's demand, after a deliberate scope decision - not by default.
Deferred (read-only, not implemented in this v1 - not a security exclusion): a handful of GET-only sub-resources and dashboard-adjacent endpoints exist under the same resource groups this connector covers, but aren't wired up yet: network subnets (GET /v1/networks/{id}/subnets*), network LAN IPs (GET /v1/networks/{id}/lan_ips*), policy IPs (GET /v1/policy_ips*), the unpaginated */all variants of every list endpoint (redundant with the paginated list tool), and administrative */counts endpoints. These can be added later without any scope-policy change, since they're already read-only.
Related MCP server: cf-mcp
Authentication
DNSFilter authenticates with a static API key, generated in the DNSFilter dashboard under Account Settings -> Security -> API Keys (an account supports up to 5 active keys at a time; see DNSFilter's own API Keys article). Unlike most sibling WYRE Conduit connectors, the key is sent as the raw header value - Authorization: <key>, with no Bearer prefix - per DNSFilter's own API docs: "Authentication is done by setting the Authorization request header. The header value is the API key itself. For example: Authorization: eyJ...".
Credential scope: two separate claims, at deliberately different confidence levels
Structurally verified (checked directly, stated with full confidence): this connector's own code makes zero mutating calls - every function in
client.tsis aGET, and noPOST/PUT/PATCH/DELETEcall exists anywhere insrc/(enforced bytool-scope.test.ts's forbidden-token check). Also structurally verified, directly against DNSFilter's own published OpenAPI spec (api.dnsfilter.com/docs.json, fetched directly): an API key is generated per user account (theApiKeyresource schema carries auser_idfield) and its own creation request (ApiKeyCreateSpec) accepts onlynameandexpiry- there is no scope/role/permission field chosen at key-creation time. A key's effective capability is therefore inherited from whatever role the DNSFilter user account it was generated under holds, not selected independently when the key itself is created. That same spec'sMembership/OrganizationUserrole enums explicitly include a"read_only"value alongside"administrator"(and, on the MSP/distributor membership shape, alongside"network_administrator"/"network_support"/"support") - so a genuinely restricted DNSFilter user role is a first-class, documented concept in the API itself, not just dashboard-UI copy.Vendor-documented, not independently verified (hedged deliberately): DNSFilter's own help center separately describes a dashboard-level Read Only user role ("Users with more restrictive roles like Read Only... have hidden dashboard tabs and panels"). Combined with the structural finding above, generating an API key under a dedicated Read-Only-role user account should yield a key whose calls DNSFilter's API server rejects for any write endpoint - but whether the API actually enforces that role server-side against write calls (versus the restriction being dashboard-UI-only) has not been tested by WYRE. Nobody sent a live write call against a Read-Only-role key to confirm, correctly: that would be a mutating test against a real account, not something to run without consent. Do not read this README as having established that a Read-Only-role API key cannot perform writes against DNSFilter's API - only that (a) DNSFilter's spec models a
read_onlyrole as a real, first-class concept, and (b) this connector's own code never attempts a write regardless of which key it's given.
In gateway mode the key arrives per-request via the X-DNSFilter-Api-Key header; in local/stdio mode it's read once from DNSFILTER_API_KEY.
Configuration
Env var | Description |
| DNSFilter API key, generated in the DNSFilter dashboard. |
|
|
|
|
| When set, the HTTP transport requires a valid |
|
|
Tools
57 read-only tools, one per documented DNSFilter GET operation across six resource groups.
Organizations
dnsfilter_list_organizations- list organizations visible to this API key.dnsfilter_get_organization- get one organization's basic information.dnsfilter_get_organization_settings- get organization-level settings.
Networks
dnsfilter_list_networks- list networks (sites/locations).dnsfilter_get_network- get one network's basic information.dnsfilter_lookup_network_by_ip- find the network associated with a source IP address.dnsfilter_get_networks_geo- get every network's geo/location metadata only.
Policies
dnsfilter_list_policies- list filtering policies.dnsfilter_get_policy- get one policy's full configuration (allow/block lists, categories, applications).dnsfilter_get_application_policies- get which policies allow/block a specific application.dnsfilter_get_policy_permissive_mode- get whether a policy has permissive (monitor-only) mode enabled.
Categories
dnsfilter_list_categories- list content-filtering categories.dnsfilter_get_category- get one content category's details and hierarchy.dnsfilter_list_application_categories- list application categories.dnsfilter_get_application_category- get one application category's details.
Block Pages
dnsfilter_list_block_pages- list custom block pages.dnsfilter_get_block_page- get one custom block page's configuration.
Metrics
dnsfilter_get_organization_usage- get organization usage (plan, users, total requests) over a date range.dnsfilter_get_organization_usage_detailed- get the detailed per-metric breakdown of organization usage.
Traffic Reports
DNSFilter's entire reporting surface is GET-only, so all 38 documented report operations are implemented with no curation:
dnsfilter_get_qps,dnsfilter_get_qps_active_agents,dnsfilter_get_qps_active_organizations- queries-per-second time series.dnsfilter_get_query_logs- raw DNS query log entries (domain, requester, category, allow/block result). The most granular, PII-bearing report this connector exposes.dnsfilter_get_top_agents,dnsfilter_get_top_application_categories,dnsfilter_get_top_categories,dnsfilter_get_top_collections,dnsfilter_get_top_domains,dnsfilter_get_top_networks,dnsfilter_get_top_organizations_requests,dnsfilter_get_top_users- "top N" breakdowns by traffic volume.dnsfilter_get_total_applications_agents_stats,dnsfilter_get_total_applications_collections_stats,dnsfilter_get_total_applications_networks_stats,dnsfilter_get_total_applications_stats,dnsfilter_get_total_applications_users_stats- application request-count totals, broken out by dimension.dnsfilter_get_total_categories,dnsfilter_get_total_categories_organizations,dnsfilter_get_total_category_stats- content-category request totals.dnsfilter_get_total_client_stats,dnsfilter_get_total_deployments,dnsfilter_get_total_roaming_clients- client/deployment counts.dnsfilter_get_total_domain_stats,dnsfilter_get_total_domains,dnsfilter_get_total_domains_organizations,dnsfilter_get_total_domains_users- domain request totals.dnsfilter_get_total_organizations_requests,dnsfilter_get_total_organizations_stats- organization-level request totals.dnsfilter_get_total_requests,dnsfilter_get_total_requests_agents,dnsfilter_get_total_requests_collections,dnsfilter_get_total_requests_geo,dnsfilter_get_total_requests_organizations,dnsfilter_get_total_requests_users- total request-count totals, broken out by dimension.dnsfilter_get_total_threats,dnsfilter_get_total_threats_organizations,dnsfilter_get_total_threats_users- blocked-threat totals.
Sensitivity
Every tool in this connector is classified isAdmin: true in the Conduit gateway (see result-cache.ts's VENDOR_TOOL_CONFIG entry for this vendor), a whole-connector decision rather than a per-tool one. DNSFilter's surface here is a DNS security product: policy configuration, block-page branding, and - especially - the traffic-report family carry per-device/per-user DNS query history and threat-detection data (dnsfilter_get_query_logs returns individual domains queried by individual requesters; several total_*/top_* reports break results out by local user or client/agent). That's PII- and security-posture-adjacent data even as a plain read, the same posture this WYRE Conduit wave has taken for other security-category connectors (Cork, CyberQP, Cisco Duo).
Development
npm install
npm run build
npm test
npm run lint # tsc --noEmitDocker
docker build -t dnsfilter-mcp .
docker run -p 8080:8080 -e DNSFILTER_API_KEY=... dnsfilter-mcpLicense
Apache-2.0
Available Tools
57 toolsdnsfilter_get_application_categoryB
Get one application category's details. Requires an application category ID from dnsfilter_list_application_categories.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Application category ID, from dnsfilter_list_application_categories. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations, so the description carries the full burden of disclosure. It only restates the read-style operation and the parameter source, without mentioning response format, error behavior, or any other operational side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short and front-loaded, immediately identifying what the tool does. The second sentence is somewhat redundant with the schema description, but it reinforces the required data-flow from the list endpoint.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter getter, the description is minimally sufficient to make the call. However, with no output schema and no annotations, it leaves return details and failure modes unstated, which an agent might need for robust invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the schema already describes the single 'id' parameter, including its source. The description repeats this information rather than adding new semantic detail, so it reaches the baseline but not beyond.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Get') and the resource ('one application category's details'), making the tool's purpose obvious. It also implies the singular nature of the operation, distinguishing it from listing tools, though it does not explicitly differentiate from siblings like dnsfilter_get_category.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a useful prerequisite: the application category ID must come from dnsfilter_list_application_categories. However, it gives no explicit guidance on when to choose this tool over alternatives or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_application_policiesA
Get which policies in an organization allow or block a specific application. Requires an application ID and organization ID.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Filter to policies whose name matches (or partially matches). | |
| policy_ids | No | Limit the search to these policy IDs. | |
| application_id | Yes | Application ID to look up. | |
| organization_id | Yes | Organization ID to scope the search to. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full behavioral disclosure burden. It explains the core read behavior and required IDs, but does not describe return shape, empty-result behavior, permissions, or other operational traits, leaving important gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no filler. Every word contributes to stating purpose and prerequisites.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is adequate for a simple read-style lookup with fully documented parameters, but it lacks return-value hints and explicit guidance on filtering behavior. Because there is no output schema, a little more context about the result would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds no parameter-specific detail beyond naming required IDs, relying on the schema to document name and policy_ids semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: it gets policies that allow or block a specific application, scoped to an organization. This clearly differentiates it from siblings like list_policies or get_policy by focusing on application-specific policy outcomes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use it—when you need policy actions for a specific application in an organization—and states required IDs. However, it does not explicitly contrast it with alternatives such as list_policies or get_policy, leaving some routing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_block_pageA
Get one custom block page's configuration: branding (org name, logo), contact email, and appearance settings. Requires a block page ID from dnsfilter_list_block_pages.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Block page ID, from dnsfilter_list_block_pages. | |
| include_relationships | No | Include related resources in the response. Defaults to true. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. 'Get' clearly signals a read-only operation, and the description specifies exactly what configuration data is returned. It does not mention auth or error behavior, but for a simple retrieval tool this is reasonably transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence conveys the operation, the resource scope, the return contents, and the key prerequisite. There is no filler or redundant phrasing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple getter with no output schema, the description is largely complete: it names the resource, the required ID source, and the main data fields returned. It could add a bit more about include_relationships behavior, but that is already fully documented in the input schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description mostly restates the ID source already documented in the schema and adds no new meaning for include_relationships. It does not need to compensate for schema gaps because there are none.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Get one custom block page's configuration' and enumerates the contents (branding, contact email, appearance settings). It clearly differentiates from sibling list/get tools by focusing on a single block page via an ID.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives an explicit prerequisite and source for the required parameter: 'Requires a block page ID from dnsfilter_list_block_pages.' This gives clear context for when to call the tool, though it does not explicitly discuss alternatives or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_categoryA
Get one content category's details and hierarchy (parent/child categories). Requires a category ID from dnsfilter_list_categories.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Category ID, from dnsfilter_list_categories. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It adds useful non-obvious context by revealing the tool returns hierarchy (parent/child relationships) and by grounding the ID's source. However, it does not state what happens for invalid IDs, whether the operation is strictly read-only, or what 'details' encompasses, so the disclosure is partial.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with zero filler. The primary action and scope are front-loaded in the first sentence, and the prerequisite occupies the second. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity tool (single required parameter, no enums, no nested objects), the description covers the essentials: what it does, what the return includes (details and hierarchy), and how to obtain the required id. Since no output schema exists, describing the hierarchy aspect partially fills that gap, though 'details' remains vague and error behavior is unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with the schema already documenting id as 'Category ID, from dnsfilter_list_categories.' The description largely echoes this same prerequisite ('Requires a category ID from dnsfilter_list_categories'), adding little semantic value beyond the schema. Baseline 3 applies since the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Get one content category's details and hierarchy.' The qualifiers 'one' and 'content category' clearly differentiate it from siblings like dnsfilter_list_categories (all categories) and dnsfilter_get_application_category (a different category type). The hierarchy detail further sharpens what the tool uniquely provides.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives an explicit prerequisite: 'Requires a category ID from dnsfilter_list_categories.' This tells the agent the correct call sequence. However, it stops short of naming alternatives or stating when not to use this tool versus related category tools, leaving some routing inference to the agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_networkA
Get one network's basic information. Requires a network ID from dnsfilter_list_networks.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Network ID, from dnsfilter_list_networks. | |
| count_network_ips | No | Include a count of associated IP addresses. Defaults to false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations, so the description must carry behavioral disclosure. It only states 'Get one network's basic information'; it does not disclose response shape, error/not-found behavior, authentication needs, or side effects. Beyond implying a read-only GET, it adds little behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the purpose and then the prerequisite. No filler or redundant detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-by-id tool the prerequisite is helpful and the schema covers parameters fully. But with no output schema, 'basic information' does not specify what fields or return value to expect, and no error or alternative context is provided.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already documents both parameters with 100% coverage, including the default for count_network_ips. The description's 'requires a network ID from dnsfilter_list_networks' largely repeats the id schema description and adds no new parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening phrase 'Get one network's basic information' names a specific verb, resource, and singular scope. The explicit requirement for a 'network ID from dnsfilter_list_networks' distinguishes it from IP-based lookup and plural network tools like dnsfilter_list_networks or dnsfilter_get_networks_geo.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a clear prerequisite: obtain the network ID via dnsfilter_list_networks before calling. It does not, however, state when to prefer this over dnsfilter_lookup_network_by_ip or other network retrieval tools, nor does it mention any exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_networks_geoA
Get every visible network's geo/location metadata only (name, lat/long, physical address) - a lighter-weight variant of dnsfilter_list_networks for mapping.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It is transparent about returning only geo/location fields and about the scope being 'every visible network', implying a read-only aggregation. However, it does not disclose response shape, pagination, authentication needs, or what 'visible' means, leaving some behavioral gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, tightly composed sentence that front-loads the action and resource, lists the exact fields in parentheses, and adds the sibling comparison in a short clause. Every word earns its place with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple no-parameter, no-output-schema tool, the description provides the essential context: what data is returned, for what purpose, and how it differs from the full network list. It could be more complete by defining 'visible' or describing the output format, but those are minor gaps for this low-complexity tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and the schema is an empty object, so there is no parameter semantics burden. The description correctly implies that no configuration is needed, which is consistent with the schema. Baseline 4 applies for a zero-parameter tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('get'), a clear resource ('every visible network's geo/location metadata'), and explicitly narrows the scope with 'only (name, lat/long, physical address)'. It also differentiates itself from the sibling dnsfilter_list_networks by calling itself a 'lighter-weight variant', so an agent can tell the two apart immediately.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'for mapping' gives a concrete intended use case, and naming dnsfilter_list_networks as the heavier alternative provides routing context. It lacks explicit 'when not to use' conditions, but the lighter-weight framing and mapping purpose are sufficient guidance for a no-parameter tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_organizationA
Get one organization's basic information. Requires an organization ID from dnsfilter_list_organizations.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Organization ID, from dnsfilter_list_organizations. | |
| include_current_mrr | No | Include current MRR (monthly recurring revenue) information. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. The 'Get' verb implies a read-only operation, and the prerequisite is disclosed, but the description does not explicitly state side-effect-free behavior, error handling, or authorization needs. It is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One concise sentence front-loads the action and resource, with the prerequisite following immediately. No wasted words; every part earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 2 parameters, no output schema, and a long list of sibling tools, the description is somewhat thin. It does not clarify what 'basic information' includes or how this tool differs from get_organization_settings or get_organization_usage. The prerequisite helps, but the description would benefit from explicit differentiation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds no parameter meaning beyond the schema: the id prerequisite duplicates the schema's own description, and include_current_mrr is not mentioned. The schema already covers both parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Get one organization's basic information.' This distinguishes it from list_organizations (getting all) and get_organization_settings (settings-specific), though 'basic information' is somewhat vague and could overlap with other organization-specific getters.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly states a prerequisite: 'Requires an organization ID from dnsfilter_list_organizations.' This tells the agent that list must be called first and the ID sourced from there. It does not explicitly mention alternatives, but the prerequisite gives solid usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_organization_settingsB
Get organization-level settings, optionally scoped to a specific organization or MSP.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Filter by organization name. | |
| msp_id | No | MSP ID to scope to. | |
| organization_id | No | Organization ID to scope to. | |
| organization_ids | No | Comma-separated organization IDs to scope to. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It states the operation is a read ('Get') but does not disclose behavior such as whether all settings are returned when no scoping is provided, whether filters are mutually exclusive, or what the response structure looks like. For a read tool with no annotations, this is a notable gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the main action and then mentions optional scoping. No wasted words, though it could add a bit more context without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read tool with 100% schema coverage and no output schema, the description is mostly adequate. However, it lacks guidance on parameter combinations and default behavior (e.g., what happens with no parameters), which an agent would need to call it correctly in ambiguous cases.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all four parameters. The description adds the concept of 'scoping' but does not explain parameter precedence or interaction (e.g., what happens if both organization_id and organization_ids are provided). Baseline 3 is appropriate since the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves organization-level settings and mentions optional scoping by organization or MSP. It distinguishes itself from sibling tools like dnsfilter_get_organization (which likely fetches a single organization's details) by focusing on settings, though it doesn't explicitly name the sibling it differs from.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context: use when you need organization-level settings, optionally scoped. It does not explicitly state when not to use it or name alternatives, but the optional scoping parameters give some guidance. Sibling names like dnsfilter_get_organization suggest a related but distinct purpose, yet no explicit routing is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_organization_usageA
Get usage information (plan, term, user/wifi counts, total requests, estimated users) for an organization over a date range. Maximum range is 365 days. Requires an organization ID from dnsfilter_list_organizations.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Organization ID, from dnsfilter_list_organizations. | |
| to | Yes | Range end date, ISO 8601 (e.g. "2026-09-01"). Maximum range is 365 days. | |
| from | Yes | Range start date, ISO 8601 (e.g. "2026-08-01"). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the responsibility for behavioral disclosure. It does state the date-range limit (365 days), the prerequisite for an organization ID, and what fields are returned. It does not explicitly mention read-only behavior, error cases, or response structure, but for a 'get usage' tool the disclosed constraints are materially useful.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, each adding relevant information: the action and content, the maximum range, and the prerequisite. The structure is front-loaded and efficient, though the range constraint is also present in the 'to' parameter description, making it slightly redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple 3-parameter tool with no output schema, the description provides a good picture: what data is returned (plan, term, counts, requests, estimated users), the required input (organization ID), and the key constraint (365-day max range). It does not mention the detailed sibling variant, but the description is sufficient for an agent to make a correct call in most cases.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the parameters (id, from, to) are already fully documented in the schema. The description adds slight value by restating the 365-day limit and the source of the organization ID, but does not introduce new parameter semantics beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Get') and clearly identifies the resource: usage information (plan, term, user/wifi counts, total requests, estimated users) for an organization over a date range. It does not explicitly differentiate from the sibling dnsfilter_get_organization_usage_detailed, but the listed fields and scope make the primary purpose clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides an explicit prerequisite: requires an organization ID from dnsfilter_list_organizations, which helps the agent understand the correct call sequence. However, it offers no guidance on when to choose this tool over similar siblings such as dnsfilter_get_organization_usage_detailed or the total_* family, leaving the decision to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_organization_usage_detailedA
Get the detailed (per-metric) breakdown of an organization's usage over a date range. Maximum range is 365 days. Requires an organization ID from dnsfilter_list_organizations.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Organization ID, from dnsfilter_list_organizations. | |
| to | Yes | Range end date, ISO 8601 (e.g. "2026-09-01"). Maximum range is 365 days. | |
| from | Yes | Range start date, ISO 8601 (e.g. "2026-08-01"). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses the 365-day maximum range and the ID dependency, which is helpful, but it does not describe response structure, timezone handling, or whether the request is read-only, though 'Get' implies it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler: the first states the purpose and the second captures the two most important constraints. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the core inputs and constraints needed to invoke the tool, but 'per-metric breakdown' is vague about which metrics are returned and there is no output schema to fill the gap. It could more clearly describe what the response contains.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the input schema already documents id, from, and to. The description only repeats the 365-day limit and the ID source already present in the schema, adding no substantially new parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the operation: retrieving a detailed per-metric usage breakdown for an organization over a date range. It distinguishes this from the simpler sibling tool dnsfilter_get_organization_usage by emphasizing 'per-metric', though it does not explicitly name that alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides a useful prerequisite: the organization ID must come from dnsfilter_list_organizations. However, it does not explain when to choose this detailed tool over dnsfilter_get_organization_usage or other usage-related siblings, leaving the agent to infer the distinction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_policyA
Get one policy's full configuration: allow/block domain lists, allow/block category rules, allowed/blocked applications, and which networks it's assigned to. Requires a policy ID from dnsfilter_list_policies.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Policy ID, from dnsfilter_list_policies. | |
| include_relationships | No | Include related resources (organization, networks) in the response. Defaults to true. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of disclosing behavior. It indicates the operation is a read (Get) and lists what the response contains, but it does not mention potential side effects, error handling, or performance considerations. This is adequate but not rich; the read-only nature is inferred from the name and wording rather than explicitly stated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence that front-loads the primary purpose and then details the response contents. It is concise with no fluff or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (two parameters, no output schema), the description covers the essential aspects: what it returns, the required input, and the source of that input. It does not discuss error cases or response format, but these are not critical for a get operation and the schema already covers parameter defaults.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%—both 'id' and 'include_relationships' have descriptions. The description adds context by specifying that the ID comes from dnsfilter_list_policies, which reinforces the schema's hint, but it does not introduce new semantics beyond that. This meets the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb (Get), a specific resource (one policy's full configuration), and enumerates what is included (allow/block domain lists, category rules, applications, and network assignments). It also distinguishes itself from dnsfilter_list_policies by indicating this tool retrieves a single policy's details.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly notes that a policy ID from dnsfilter_list_policies is required, giving a clear prerequisite and implying this tool is used after listing policies. It does not explicitly state when not to use it, but the single-policy vs list distinction is implicit and sufficient for most cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_policy_permissive_modeA
Get whether a policy currently has permissive (monitor-only, non-blocking) mode enabled. Requires a policy ID from dnsfilter_list_policies.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Policy ID, from dnsfilter_list_policies. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the behavioral burden. 'Get whether' clearly implies a read-only state check and indicates the returned information is a boolean-ish current-state value. It does not discuss errors or authentication, but for a single-parameter getter this is sufficiently transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One focused sentence that front-loads the tool's purpose and immediately follows with the prerequisite. No filler or redundant explanation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter getter with no output schema, the description fully explains what the tool returns ('whether ... enabled') and where the input comes from. There is no missing information needed to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%: the id parameter is already described as 'Policy ID, from dnsfilter_list_policies.' The description repeats this same information rather than adding new semantic detail, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Get whether'), a specific resource ('policy permissive mode'), and clarifies the meaning with 'monitor-only, non-blocking'. It is clearly distinct from sibling tools like dnsfilter_get_policy and dnsfilter_get_application_policies.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly requires a policy ID from dnsfilter_list_policies, giving clear context for how to obtain a valid input. It does not explicitly contrast with alternatives, but the prerequisite is strong enough guidance for this simple getter.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_qpsB
Queries-per-second time series - the closest thing to a live traffic pulse.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| type | No | Report type. Defaults to all. | |
| msp_id | No | MSP ID to scope the report to. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| nat_ips | No | Comma-separated NAT IP addresses to filter to. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| agent_types | No | Comma-separated agent/client types. | |
| bucket_size | No | Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| security_report | No | Threat-only report. 'all' returns both threats and non-threats. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. | |
| show_individual_networks | No | Group results by individual network ID. Defaults to false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It does communicate that the output is a time series rather than a single scalar and hints at near-real-time data via the 'live traffic pulse' phrasing. However, it does not disclose aggregation or bucket behavior, output shape, rate limits, or operational caveats beyond what the parameter schema already encodes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short and front-loaded with the core resource: 'Queries-per-second time series'. The second clause, 'the closest thing to a live traffic pulse', is evocative but not strictly informative, so it does not fully earn its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 20-parameter analytics endpoint with no output schema and more than 50 sibling tools, a one-sentence metaphor is not enough. An agent still lacks clarity about the returned shape, unit and bucketing behavior, and how this tool relates to query logs, totals, and other QPS-specific siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all 20 parameters are already documented with types, defaults, and filtering semantics. The description itself adds no parameter-level meaning, which places this at the baseline score of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the resource as a 'queries-per-second time series' and conveys the high-level purpose of reporting QPS over time, though it lacks an explicit verb like 'retrieves' or 'returns'. It is clear enough to separate from totals, tops, and query-log tools, but it does not explicitly distinguish itself from sibling QPS-specific tools such as dnsfilter_get_qps_active_agents or dnsfilter_get_qps_active_organizations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like dnsfilter_get_query_logs, dnsfilter_get_total_requests, or the other QPS endpoints. The 'live traffic pulse' metaphor weakly implies a monitoring use case, but there is no explicit when-to-use, when-not-to-use, or alternative routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_qps_active_agentsC
Queries-per-second broken out by active client/agent.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| type | No | Report type. Defaults to all. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| nat_ips | No | Comma-separated NAT IP addresses to filter to. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| agent_types | No | Comma-separated agent/client types. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| security_report | No | Threat-only report. 'all' returns both threats and non-threats. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It only states the output type (QPS broken out) without disclosing whether the operation is read-only, requires specific permissions, or has rate limits. For a data-retrieval tool, this is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, which is concise and front-loaded with the core purpose. However, it is under-specified for the tool's complexity; it lacks any structural breakdown or supplementary details, so it is concise but not appropriately informative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 17 parameters and no output schema, the description is grossly incomplete. It does not explain the return format, pagination, default behaviors, or how filters interact. The description provides almost no context beyond the name, making it inadequate for an agent to use effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all 17 parameters are already documented in the schema. The description adds no parameter-specific context beyond the general topic, so the baseline score of 3 is appropriate; it neither improves nor degrades the semantic clarity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (queries-per-second, implicitly 'get') and a clear resource breakdown: 'by active client/agent.' This distinguishes it from sibling tools like dnsfilter_get_qps (total QPS) and dnsfilter_get_qps_active_organizations (breakdown by org), making the tool's intent unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. The description only states what it does; it does not mention when not to use it or name sibling tools that serve different breakdowns. The usage context is entirely implied by the name and one-line description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_qps_active_organizationsC
Queries-per-second broken out by active organization.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| type | No | Report type. Defaults to all. | |
| msp_id | No | MSP ID to scope the report to. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| nat_ips | No | Comma-separated NAT IP addresses to filter to. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| agent_types | No | Comma-separated agent/client types. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| security_report | No | Threat-only report. 'all' returns both threats and non-threats. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With zero annotations, the description carries the full burden of behavioral disclosure, and it only states the grouping. It does not define what makes an organization 'active,' how QPS is aggregated, how the from/to time window applies, or what the response looks like. Not misleading, but minimal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single seven-word sentence with zero filler; the key elements (QPS and organization grouping) are front-loaded. It errs toward under-specification, but every word earns its place and the structure is clean.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 18-parameter tool with no annotations and no output schema, this definition is under-specified. It should define 'active,' describe report semantics, surface the organization_ids default and 403 behavior, and ideally point to sibling tools. The schema rescues parameter documentation, but the overall definition leaves too much to inference for correct tool selection.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema documents all 18 parameters including formats, enums, and defaults, which sets the baseline at 3. The description itself adds no parameter-level meaning, but no compensation is needed given full schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Queries-per-second broken out by active organization' states a clear resource (QPS metrics) and the grouping dimension (active organization), going beyond a bare restatement of the name. It is distinguishable from dnsfilter_get_qps and dnsfilter_get_qps_active_agents in principle, though it does not explicitly name those siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided about when to use this tool versus the closely related dnsfilter_get_qps, dnsfilter_get_qps_active_agents, or the dnsfilter_get_total_*_organizations variants. The agent receives no routing signal, no exclusions, and no mention of alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_query_logsB
Raw DNS query log entries - domain queried, requester, category, and allow/block result. The most granular, PII-bearing report this connector exposes.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| fqdn | No | Filter to a specific fully-qualified domain name. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| page | No | Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100). | |
| domain | No | Filter to a specific domain. | |
| result | No | Filter to a specific query result. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| nat_ips | No | Comma-separated NAT IP addresses to filter to. | |
| user_id | No | Comma-separated local user IDs. Defaults to all. | |
| agent_id | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| network_id | No | Comma-separated network (site) IDs. Defaults to all. | |
| policy_ids | No | Comma-separated policy IDs to filter to. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| category_ids | No | Comma-separated content-category IDs to filter to. | |
| collection_id | No | Comma-separated collection (roaming-client group) IDs. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| question_type | No | Filter to a specific DNS question (record) type, e.g. A, AAAA, CNAME. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| organization_id | No | Organization ID. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| security_report | No | Threat-only report. 'all' returns both threats and non-threats. | |
| exclude_category_ids | No | Comma-separated content-category IDs to exclude. | |
| application_category_ids | No | Comma-separated application category IDs to filter to. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions the data includes PII, which is a useful privacy warning, but it doesn't disclose pagination behavior, rate limits, potential large result sizes, or that this is a read-only operation. The description doesn't contradict any annotations (since none exist), but it leaves significant behavioral gaps for a tool with 28 parameters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that front-loads the core purpose and adds a distinguishing qualifier. It's efficient and doesn't waste words. However, it could have used the space to add a brief usage note without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 28 parameters, no annotations, and no output schema, the description is too thin. It doesn't explain the return format, pagination behavior, or how to handle the PII-bearing nature of the data. The schema covers parameters, but the description doesn't provide enough context for an agent to know what to expect or how to use the tool effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 28 parameters. The description adds minimal parameter-level meaning beyond noting the report contains domain, requester, category, and allow/block result. It doesn't explain how filters combine or which parameters are most important. Baseline 3 is appropriate since the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as returning raw DNS query log entries with specific fields (domain, requester, category, allow/block result). It distinguishes itself from sibling tools by noting it is 'the most granular, PII-bearing report this connector exposes', which helps differentiate it from aggregate/top-N reports like dnsfilter_get_top_domains or dnsfilter_get_total_requests. However, it doesn't explicitly name a sibling alternative, so it's not a perfect 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for granular, PII-bearing DNS query data, which suggests it's for raw log analysis rather than aggregate statistics. It doesn't explicitly state when to use this tool versus alternatives, nor does it mention any exclusions or prerequisites. The 'most granular, PII-bearing' phrasing gives some context but no direct comparison to specific siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_top_agentsC
Clients/agents generating the most traffic.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| name | No | Filter/search by name. | |
| page | No | Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100). | |
| type | No | Report type. Defaults to all. | |
| msp_id | No | MSP ID to scope the report to. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| nat_ips | No | Comma-separated NAT IP addresses to filter to. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| agent_types | No | Comma-separated agent/client types. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| security_report | No | Threat-only report. 'all' returns both threats and non-threats. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description must carry the full burden of behavioral disclosure. It only states the core purpose and provides no information about default time ranges, pagination behavior, filtering semantics, or output format. The agent has no hint about what the response contains or any side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, which is concise, but it lacks structure and front-loading of important information. It states only the purpose without any additional context that would be valuable before diving into the 20-parameter schema. It is under-specified for a tool of this complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 20 parameters, no output schema, and no annotations, the description is grossly inadequate. It provides no context on filtering, time ranges, pagination, or what the result looks like. An agent cannot determine correct usage or interpret the response without external knowledge.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides complete descriptions for all 20 parameters (100% coverage). The description itself adds no parameter-specific meaning. Per the baseline rule, a score of 3 is appropriate when the schema fully documents parameters, even though the description does not enhance them.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Clients/agents generating the most traffic.' clearly states the verb (generate), the resource (agents), and the outcome (most traffic). It is not a tautology and provides the essential purpose. However, it does not differentiate from sibling 'top_' tools (e.g., top_users, top_networks), so it lacks explicit scoping.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives such as dnsfilter_get_top_users or dnsfilter_get_top_networks. There is no mention of intended use cases, exclusions, or conditions that would select this tool over others.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_top_application_categoriesC
Application categories generating the most traffic.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| name | No | Filter/search by name. | |
| page | No | Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100). | |
| type | No | Report type. Defaults to all. | |
| msp_id | No | MSP ID to scope the report to. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| agent_types | No | Comma-separated agent/client types. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| security_report | No | Threat-only report. 'all' returns both threats and non-threats. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden for behavioral disclosure. 'Generating the most traffic' implies sorting by volume, but the description does not specify return shape, ordering direction, default time window, pagination, or access requirements. For a 19-parameter report endpoint, this is a substantial gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded phrase with no filler, which is efficient for an API where the schema carries parameter detail. It sacrifices some expressiveness by being a noun phrase rather than a complete sentence, but it is appropriately short.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description should explain enough for the agent to know what response to expect (e.g., a paginated list of categories with counts, filtered by time/type/source). The current phrase does not mention output structure, filtering options, defaults, or the report nature, making it incomplete for a tool with 19 parameters and many similar siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers all 19 parameters with descriptions, so the baseline is 3. The description adds only the high-level 'top by traffic' context and no parameter-specific meaning; it neither helps nor hurts beyond the already-complete schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies the resource (application categories) and the ranking criterion (most traffic), which clearly indicates the tool returns the top application categories by traffic. It is distinguishable from siblings like dnsfilter_list_application_categories and dnsfilter_get_top_categories through the focus on 'application' and 'most traffic', though it lacks an explicit verb such as 'Get' or 'List'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to call this tool instead of closely related report/list tools such as dnsfilter_get_top_categories, dnsfilter_list_application_categories, or dnsfilter_get_total_category_stats. No conditions, exclusions, or alternatives are mentioned, so the agent must infer usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_top_categoriesC
Content categories generating the most traffic.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| name | No | Filter/search by name. | |
| page | No | Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100). | |
| type | No | Report type. Defaults to all. | |
| msp_id | No | MSP ID to scope the report to. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| agent_types | No | Comma-separated agent/client types. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| security_report | No | Threat-only report. 'all' returns both threats and non-threats. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations were provided, so the description carries the full burden of behavioral disclosure, yet it only restates the ranking concept. It does not reveal that this is a read-only report, how 'top' is computed (request count vs. volume), whether results are paginated, or what the response structure looks like — especially important since there is no output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single six-word phrase with zero wasted words and the core subject front-loaded. It loses the fifth point because it is structurally a sentence fragment — the action verb is missing — which slightly reduces parseability for an agent scanning tool summaries.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 19 parameters, 56 siblings, no annotations, and no output schema, a six-word description is severely inadequate. It does not clarify what 'top' means as a metric, how this differs from dnsfilter_get_top_application_categories or dnsfilter_get_total_categories, what the response contains, or whether the operation is safe/read-only. An agent cannot reliably select and invoke this tool correctly from the provided context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline of 3 applies: all 19 parameters carry rich semantic detail in the schema itself, including date formats, defaults, enum meanings, and the 403 behavior for organization_ids. The tool description adds no parameter-level information, but the schema fully compensates, so no penalty is warranted.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the resource (content categories) and the ranking principle (most traffic), which distinguishes it at a glance from the seven other top_* siblings like dnsfilter_get_top_agents and dnsfilter_get_top_domains. However, it is a noun phrase without an explicit action verb (returns/lists/reports), and it does not differentiate itself from the closely related dnsfilter_get_top_application_categories.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides zero usage guidance. It never states when to prefer this tool over dnsfilter_get_top_application_categories, dnsfilter_get_total_categories, or dnsfilter_list_categories — a meaningful distinction given 56 siblings. No context, exclusions, or alternative routing is offered; the agent must infer intent from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_top_collectionsC
Collections (roaming-client groupings) generating the most traffic.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| name | No | Filter/search by name. | |
| page | No | Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100). | |
| type | No | Report type. Defaults to all. | |
| msp_id | No | MSP ID to scope the report to. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| nat_ips | No | Comma-separated NAT IP addresses to filter to. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| agent_types | No | Comma-separated agent/client types. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| security_report | No | Threat-only report. 'all' returns both threats and non-threats. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It only says collections generating the most traffic, but does not disclose whether the result is a ranked list, what fields are returned, whether counts or percentages are included, how time ranges affect the report, or what 'traffic' precisely means.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single clear sentence with no filler, and it front-loads the central concept. It is appropriately terse, though it omits a few useful qualifiers such as the request metric or time-bound behavior, which keeps it from a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a complex tool with 20 optional parameters, no output schema, and many closely related sibling tools. The description provides only the basic intent and leaves the agent without guidance on response structure, ranking semantics, pagination behavior, or how this report relates to similar collection-specific endpoints.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage with detailed descriptions and enums for every parameter, so the baseline of 3 applies. The description adds no additional parameter semantics, but also does not need to because the schema already documents each filter thoroughly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the resource (collections) and the metric (traffic) with a ranking implication, which distinguishes it from many analytics siblings. It does not explicitly state 'top' as a sort order or differentiate from dnsfilter_get_total_requests_collections, but the core purpose is understandable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus the many sibling reporting tools, such as dnsfilter_get_total_requests_collections or other top_* endpoints. There are no exclusions, alternatives, or conditions stated, so an agent must infer usage from the name and schema alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_top_domainsC
Domains queried most often.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| fqdn | No | Filter to a specific fully-qualified domain name. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| page | No | Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100). | |
| type | No | Report type. Defaults to all. | |
| domain | No | Filter to a specific domain. | |
| msp_id | No | MSP ID to scope the report to. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| agent_types | No | Comma-separated agent/client types. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| category_ids | No | Comma-separated content-category IDs to filter to. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| security_report | No | Threat-only report. 'all' returns both threats and non-threats. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden, but it only states the output concept ('domains queried most often'). It does not disclose pagination behavior, default time window, sorting semantics, filter interactions, or whether this is a read-only reporting operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The definition is extremely short, but this is under-specification rather than effective conciseness. It omits the report's time-window behavior, pagination, and the meaning of 'top' beyond the vague phrase, so the one sentence does not earn its place as a complete definition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a report tool with 21 parameters, no output schema, and no annotations, the description provides only the barest purpose. It does not explain that results are ranked by query count, that from/to default to the last day, that page size defaults to 10, or how the many filters combine.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all 21 parameters are already documented with meanings and defaults. The description adds no parameter-specific meaning, which is acceptable given the schema's completeness; baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description, 'Domains queried most often,' identifies the resource (domains) and the ranking metric (query frequency), which adds a bit beyond the tool name. However, it lacks an explicit verb/action and does not distinguish this tool from similar siblings like dnsfilter_get_total_domains or dnsfilter_get_top_categories.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus the many sibling report tools, no mention of alternatives, and no exclusions or preconditions. The usage context must be inferred entirely from the tool name and the generic 'top domains' phrasing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_top_networksC
Networks generating the most traffic.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| name | No | Filter/search by name. | |
| page | No | Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100). | |
| type | No | Report type. Defaults to all. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| nat_ips | No | Comma-separated NAT IP addresses to filter to. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| agent_types | No | Comma-separated agent/client types. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| security_report | No | Threat-only report. 'all' returns both threats and non-threats. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the full burden of behavioral disclosure. It only states that top networks are returned and does not mention read-only behavior, pagination, default time ranges, result ordering, or response structure. This is minimal, though not misleading.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single short sentence with no filler and is easy to scan. It is appropriately concise, though it is arguably too terse to fully inform an agent about a heavily parameterized report tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the agent is left without the output shape, metric definition, sort direction, pagination behavior, or default window semantics. A one-phrase description is completely inadequate for a 19-parameter report tool with many sibling alternatives.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides 100% description coverage for all 19 parameters, including defaults, enums, and formats. The description adds no parameter-level semantics, so the baseline score of 3 applies because the schema already does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies the resource (networks) and the ranking criterion (most traffic), so an agent can infer the outcome. It lacks an explicit verb and does not differentiate this report from sibling top_* tools, but it is not merely a restatement of the name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives such as dnsfilter_get_top_agents, dnsfilter_get_top_domains, or dnsfilter_get_total_requests. The only implication is that it is for ranking networks by traffic, but no exclusions or selection criteria are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_top_organizations_requestsC
Organizations generating the most request volume.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| page | No | Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100). | |
| msp_id | No | MSP ID to scope the report to. | |
| bucket_size | No | Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range. | |
| organization_id | No | Organization ID. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full disclosure burden. It only states that the output is ranked organizations by request volume and says nothing about pagination behavior, time-range handling, bucket selection, or response shape. This is minimal behavioral context with no contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded phrase with no wasted words. It is efficient, though thin; the lack of detail is more a completeness issue than a conciseness issue.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a six-parameter report with pagination, time-bucket options, no output schema, and no annotations, and it sits among many closely related sibling tools. A one-sentence description leaves the agent without guidance on parameter composition, return format, or when this report is the right choice. The definition is not complete enough for reliable selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with all six parameters individually documented including defaults, ranges, and formats. The description adds no parameter-level meaning, but the schema already carries that weight, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies the resource (organizations) and the ranking criterion (most request volume), making the tool's purpose reasonably clear. It lacks an explicit verb and does not contrast with closely named siblings such as dnsfilter_get_total_organizations_requests, so it is clear but not fully differentiating.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance about when to use this tool versus the many sibling report tools. The agent must infer usage solely from the name and one phrase, with no stated conditions, exclusions, or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_top_usersC
Local users generating the most traffic.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| name | No | Filter/search by name. | |
| page | No | Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100). | |
| type | No | Report type. Defaults to all. | |
| msp_id | No | MSP ID to scope the report to. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| nat_ips | No | Comma-separated NAT IP addresses to filter to. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| agent_types | No | Comma-separated agent/client types. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| security_report | No | Threat-only report. 'all' returns both threats and non-threats. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. The description is too brief to explain any behaviors beyond the static purpose. It does not mention what data is returned, whether results are sorted, how pagination interacts with ranking, or any side effects. The schema reveals many filters and defaults, but the description itself lacks this context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely brief (6 words), which is concise but might be under-specified. It does front-load the purpose, but it lacks even a single additional sentence to provide context. While over-verbosity is avoided, the brevity borders on under-specification for a tool with 20 parameters and many siblings.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the 20 parameters and no output schema, the description is incomplete. It does not clarify the purpose of each filter, how they combine, whether ranking is by total requests or data volume, or what the response structure looks like. The schema documents parameter syntax, but the description does not explain the tool's semantics or expected usage patterns.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter is documented, including defaults like 'from' defaulting to 1 day ago and 'page.size' max 100. The description adds minimal value beyond the schema; it only clarifies that the tool ranks users by traffic. This is a baseline 3 as the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the tool returns local users generating the most traffic, which identifies the resource (local users) and metric (traffic volume). However, it is very terse and does not distinguish it from many siblings like dnsfilter_get_total_requests_users or dnsfilter_get_top_agents, so an agent might confuse it with other reporting tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives. With over 50 sibling tools, the description should clarify, for example, that this ranks users by traffic volume, while dnsfilter_get_total_requests_users might aggregate totals differently, but no such context is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_total_applications_agents_statsC
Application request counts broken out by client/agent.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| name | No | Filter/search by name. | |
| type | No | Report type. Defaults to all. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| nat_ips | No | Comma-separated NAT IP addresses to filter to. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| agent_types | No | Comma-separated agent/client types. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| security_report | No | Threat-only report. 'all' returns both threats and non-threats. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. | |
| application_category_ids | No | Comma-separated application category IDs to filter to. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It only states the output shape ('counts broken out by client/agent') and says nothing about report time bounds, defaults, filtering semantics, pagination, or side effects. There is no annotation contradiction, but behavior beyond the one-line output is essentially undisclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler or redundancy. It is concise and readable, though its brevity comes at the cost of behavioral context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 19 parameters, no annotations, and no output schema, this description is too sparse. It doesn't mention default time ranges, what types of counts are included (e.g., allowed vs blocked), or the response breakdown, leaving the agent to rely on the tool name and schema parameters for nearly all context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline of 3 applies; all 19 parameters have descriptive text that explains formats, defaults, and enum semantics. The description adds little beyond the schema, though 'client/agent' does align conceptually with the agent_ids parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the result: application request counts broken out by client/agent, which matches the tool name and distinguishes it from sibling total_applications_{users,networks,collections}_stats tools. It lacks an explicit verb like 'get' and doesn't characterize the time window, but the resource and grouping are clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given for when to use this tool versus the many related get_total_applications_*, get_total_requests_*, or get_top_* tools. The only differentiator is the group-by dimension, which is implicit in the description; no alternatives, exclusions, or prerequisites are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_total_applications_collections_statsC
Application request counts broken out by collection.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| name | No | Filter/search by name. | |
| type | No | Report type. Defaults to all. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| nat_ips | No | Comma-separated NAT IP addresses to filter to. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| agent_types | No | Comma-separated agent/client types. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| security_report | No | Threat-only report. 'all' returns both threats and non-threats. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. | |
| application_category_ids | No | Comma-separated application category IDs to filter to. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure, yet it only states the output grouping. It does not indicate that this is a safe read-only query, what the response shape looks like (there is no output schema), whether the 19 filters combine additively, or that 'collection' means 'roaming-client group' (a term that appears only in the schema, not the description).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One six-word sentence with zero filler, front-loading the core semantics. It is efficient, though arguably terse to the point of under-specification given the tool's complexity and 50+ sibling tools.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 19-parameter statistics tool with no annotations and no output schema, a single noun-phrase description is inadequate. It leaves unstated what the counts actually represent (DNS requests? bytes?), what the response contains, and how this tool differs from dnsfilter_get_total_requests_collections. The well-documented schema helps an agent build a request, but it cannot confidently predict the result or select this tool over near-identical siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all 19 parameters are already thoroughly documented in the schema itself. The description adds no parameter-level meaning beyond naming 'collection' as the grouping dimension, which aligns with the collection_ids parameter. Baseline 3 is appropriate since the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the resource (application request counts) and the grouping dimension (by collection) clearly, which distinguishes it from sibling stats tools like dnsfilter_get_total_applications_users_stats (by user) and dnsfilter_get_total_applications_networks_stats (by network). It lacks an explicit imperative verb, but 'Application request counts broken out by collection' unambiguously conveys a query intent.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives zero guidance on when to use this tool versus its many near-identical siblings, such as dnsfilter_get_total_applications_stats (not broken out), dnsfilter_get_total_requests_collections (all requests by collection), or dnsfilter_get_top_collections. An agent must infer the selecting condition purely from the tool name and the word 'collection'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_total_applications_networks_statsB
Application request counts broken out by network.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| name | No | Filter/search by name. | |
| type | No | Report type. Defaults to all. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| nat_ips | No | Comma-separated NAT IP addresses to filter to. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| agent_types | No | Comma-separated agent/client types. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| security_report | No | Threat-only report. 'all' returns both threats and non-threats. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. | |
| application_category_ids | No | Comma-separated application category IDs to filter to. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are not provided, so the description carries the full burden. It describes the primary output (application request counts by network) but lacks details on response structure, pagination, or any potential side effects. Since this is a read-only reporting tool, no destructive behavior is expected, so not mentioning mutation is fine, but more context on what the response contains (e.g., fields like total requests, network name) would be useful. The score is adequate because it communicates the core purpose without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a short, single sentence that immediately states the core purpose (application request counts by network). It is front-loaded and free of fluff. While it could expand on usage context, the conciseness is appropriate for a tool that is part of a family of similar statistics endpoints, where the title and parameters provide additional context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (19 parameters all optional) and the absence of annotations or output schema, the description is minimal but adequate to understand the tool's purpose. It does not explain the output format, pagination, or how to interpret the counts, but the parameter schema provides comprehensive filtering guidance. For a reporting tool with no required parameters, the description might need to mention that it returns aggregated data, but given that it is named 'get_total_applications_networks_stats', it is fairly predictable. However, for optimal completeness, it could state that it returns per-network breakdowns and clarify whether the totals are across all applications or per application.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers 100% of parameters with descriptions and enums, so the baseline for this dimension is 3. The description adds no additional parameter semantics beyond what the schema provides—it does not summarize key filters like time range, type, or network_ids. Since the schema already describes each parameter, the description does not need to repeat them; however, it could highlight the most relevant parameters (e.g., network_ids, type) to guide usage, but this omission does not reduce the score below 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns application request counts broken out by network, which is a specific and unambiguous purpose. It distinguishes itself from siblings like dnsfilter_get_total_applications_agents_stats and dnsfilter_get_total_applications_users_stats by the network dimension implied in the name and description. However, it could be more explicit about the grouping or aggregation format.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies it is for network-level application statistics, which differentiates it from similar stats tools for agents, users, collections, or overall. However, it does not explicitly mention when to use this tool over alternatives (e.g., when you need per-network breakdown), nor does it exclude cases. Given the large sibling family with similar names, more explicit guidance would be beneficial.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_total_applications_statsC
Total application request counts.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| name | No | Filter/search by name. | |
| type | No | Report type. Defaults to all. | |
| msp_id | No | MSP ID to scope the report to. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| nat_ips | No | Comma-separated NAT IP addresses to filter to. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| agent_types | No | Comma-separated agent/client types. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| security_report | No | Threat-only report. 'all' returns both threats and non-threats. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. | |
| application_category_ids | No | Comma-separated application category IDs to filter to. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It only states 'Total application request counts' without explaining whether this is a read-only aggregate report, what the output shape is, how aggregation works, or how the many filters affect results. The 20-parameter schema implies complex behavior, but the description reveals none of it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
At five words, the description is extremely concise with no wasted words, but the brevity is a result of under-specification, not effective front-loading. It does not convey the tool's purpose or scope adequately, so while it is concise, it is not well-structured for an agent's understanding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 20 optional parameters, no output schema, and no annotations, the description is severely incomplete. It does not describe the return format, the meaning of 'total' or 'applications' in this context, how the many filters interact, or any expected output structure. An agent would be unable to predict what this tool returns or how to correctly invoke it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage, with every one of the 20 parameters individually documented. The description adds no parameter-level meaning beyond what the schema already provides, so it meets the baseline of 3 for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Total application request counts' is a noun phrase, not a sentence with a verb like 'retrieves' or 'returns.' It identifies the resource (application request counts) but does not clearly state the tool's action, and it does nothing to distinguish this tool from siblings such as dnsfilter_get_total_applications_agents_stats. The purpose is vague, though not a pure tautology.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It fails to mention that this is likely the aggregate application stats tool while siblings like *_agents_stats, *_networks_stats, and *_users_stats provide breakdowns, and it gives no context about filtering or time ranges. There is no when-to-use or when-not-to-use information.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_total_applications_users_statsC
Application request counts broken out by local user.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| name | No | Filter/search by name. | |
| type | No | Report type. Defaults to all. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| nat_ips | No | Comma-separated NAT IP addresses to filter to. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| agent_types | No | Comma-separated agent/client types. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| security_report | No | Threat-only report. 'all' returns both threats and non-threats. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. | |
| application_category_ids | No | Comma-separated application category IDs to filter to. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It only states the result shape ('counts broken out by local user') and does not disclose whether this is a read-only operation, what time-range defaults apply, how filters interact, whether pagination exists, or what the response structure looks like. The description adds little beyond the tool's name.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler words. It is appropriately brief for a straightforward reporting tool; however, it is so terse that it omits useful context, which slightly reduces the score from the top.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 19 parameters, no output schema, and no annotations, this one-line description is not sufficient. It does not explain what fields are returned, how the 'local user' breakdown is represented, whether the result is a single aggregate or a per-user series, or how time bounds and filters affect the output. An agent would need to infer significant behavior from the schema and tool name alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 19 parameters in detail. The description does not add extra meaning about parameter usage, but because coverage is complete, the baseline of 3 is appropriate. It does not mislead, but it also does not clarify relationships among filters like user_ids, application_ids, and type.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's output: application request counts grouped by local user. This distinguishes it from sibling tools like dnsfilter_get_total_applications_networks_stats and dnsfilter_get_total_applications_agents_stats, though it does not explicitly name them. It is a concise, specific resource-plus-dimension statement.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus the many similar reporting siblings. No mention of when it is preferable, what scenarios it fits, or how it differs from tools such as dnsfilter_get_total_applications_stats or dnsfilter_get_total_requests_users. The agent is left to infer usage from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_total_categoriesC
Total content-category request counts over time.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| type | No | Report type. Defaults to all. | |
| msp_id | No | MSP ID to scope the report to. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| agent_types | No | Comma-separated agent/client types. | |
| bucket_size | No | Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| security_report | No | Threat-only report. 'all' returns both threats and non-threats. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. | |
| show_individual_networks | No | Group results by individual network ID. Defaults to false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral disclosure burden. It communicates that counts are time-based, but it does not disclose aggregation granularity, result shape, default date window, filtering scope, or whether the operation is purely read-only. These are material gaps for a 19-parameter reporting tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single short sentence with no filler or repetition. It is front-loaded and easy to parse, though it is terse enough that it fails to carry necessary usage context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 19 optional parameters, no annotations, and no output schema, the description must explain what the returned report actually contains, such as whether results are grouped by category, whether they are a time series, and what the request counts represent. The one-sentence description only gives a high-level hint and leaves too much for the agent to infer.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema already explains every parameter including defaults, enums, and formats. The description adds no param-level detail, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific resource—total content-category request counts over time—so the agent can tell this is an aggregate reporting tool. It lacks an explicit verb like 'returns' or 'lists' and does not differentiate itself from close siblings such as dnsfilter_get_total_category_stats, so it does not earn a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance about when to use this tool versus alternatives like dnsfilter_get_total_category_stats, dnsfilter_get_top_categories, or dnsfilter_get_total_categories_organizations. An agent must infer usage solely from the name and one-line description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_total_categories_organizationsC
Total content-category request counts broken out by organization.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| type | No | Report type. Defaults to all. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| agent_types | No | Comma-separated agent/client types. | |
| bucket_size | No | Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| security_report | No | Threat-only report. 'all' returns both threats and non-threats. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. | |
| show_individual_organizations | No | Group results by individual organization ID. Defaults to false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure, yet it only restates the report's content in slightly different words from the name. It does not disclose grouping defaults (e.g., show_individual_organizations=false behavior), time-range defaults, or output shape; only the word 'counts' weakly implies a read-only aggregation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single eight-word sentence with zero filler; the core resource and the grouping dimension are front-loaded. Every word earns its place, though the terseness sacrifices completeness, which is assessed separately.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 18-parameter analytics tool with no output schema and no annotations, a one-phrase description is inadequate: it leaves unclear how results are grouped when show_individual_organizations is false, what the response series look like, and how this report differs from get_total_category_stats or get_total_requests_organizations. The fully-covered schema mitigates parameter confusion but cannot clarify report semantics or sibling selection.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline of 3 applies and the schema already documents all 18 parameters with defaults and formats. The description adds a single grouping hint ('broken out by organization') that maps to organization_ids and show_individual_organizations, but no additional syntax or default information beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific resource ('content-category request counts') and the breakdown dimension ('by organization'), which makes it clear this is an aggregate report rather than a single-object lookup. However, it closely mirrors the tool name and does not differentiate it from near-siblings like dnsfilter_get_total_category_stats or dnsfilter_get_total_requests_organizations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to choose this tool over the many adjacent report tools in the sibling list, such as get_total_categories, get_total_category_stats, get_total_requests_organizations, or get_top_organizations_requests. The agent must infer the use case purely from the name and one-line description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_total_category_statsC
Content-category request-count summary.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| msp_id | No | MSP ID to scope the report to. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| category_ids | No | Comma-separated content-category IDs to filter to. | |
| organization_id | No | Organization ID. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations, so the description carries the full burden of behavioral disclosure, but it only says 'Content-category request-count summary.' It does not explain whether results are aggregated per category, whether it returns a single total or a breakdown, what time-window behavior applies, or what the response structure looks like.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single compact noun phrase with no wasted words or redundant restatements of the tool name. It is maximally concise, though its brevity contributes to the lack of behavioral context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With six optional parameters, no annotations, no output schema, and a large set of sibling stat tools, this description is not complete enough. An agent has no information about the return shape, whether the result is grouped by category, or how this differs from the many similar sibling endpoints.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameter descriptions already document the time range, MSP scoping, network IDs, category IDs, and organization ID. The tool description adds no extra parameter semantics, but it does not need to because the schema carries that information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies the resource as content-category request counts and the operation as a summary, so an agent can infer the tool returns aggregated request-count data per content category. It does not explicitly name a sibling to distinguish itself from, but the wording is specific enough to separate it from category-listing or top-category tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to use this tool versus alternatives such as dnsfilter_get_total_categories, dnsfilter_get_top_categories, or dnsfilter_get_total_requests. The agent must infer the tool's niche solely from its name and the sibling list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_total_client_statsC
Client/agent count summary.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| msp_id | No | MSP ID to scope the report to. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| organization_id | No | Organization ID. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description only says 'Client/agent count summary,' which implies an aggregated read-only result but offers no detail about defaults, time-window semantics, scoping behavior, or return shape. With no annotations, the description carries the full burden, and it does not disclose enough behavioral traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short and contains no filler, but it is more under-specified than concisely structured. It is a noun phrase rather than a complete, scannable tool description, so it does not provide the front-loaded clarity expected of a helpful definition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the five optional parameters, no output schema, and no annotations, the description should explain what the returned summary contains and how the parameters affect it. It does not state whether the result is a single number, a per-client/per-agent breakdown, or a time-series, leaving important context missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameters are already well documented. The description adds no meaningful parameter context beyond what the input schema provides, which merits the baseline score of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies the resource as client/agent counts and the operation as a summary, which is clear enough to distinguish it from request- or threat-focused siblings. However, it does not explicitly contrast itself with similar tools like dnsfilter_get_total_roaming_clients, so sibling differentiation is only implicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to use this tool versus the many similar total-statistics siblings. There are no explicit alternatives, exclusions, or context signals such as 'use this when you need the total number of agents rather than per-network or per-user breakdowns.'
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_total_deploymentsC
Deployed client/network counts.
| Name | Required | Description | Default |
|---|---|---|---|
| msp_id | No | MSP ID to scope the report to. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| organization_id | No | Organization ID. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It only states the nominal output and does not disclose read-only behavior, aggregation semantics, whether authorization is required, or how results are structured.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with no filler, but it is a fragment rather than a complete sentence and delivers almost no structural guidance. It is brief but not appropriately informative for a tool with three optional scoping parameters.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description leaves important context undefined: what exactly counts as a deployment, how scoping parameters affect the result, and what the returned payload looks like. The phrase provides only a minimal high-level summary.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so each parameter's meaning is already documented. The description does not add parameter-level detail, which is acceptable given the high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies the resource ('deployed client/network') and the result type ('counts'), so an agent can infer this returns aggregate deployment totals. It is more specific than a tautology, though it lacks a verb and does not explicitly differentiate itself from the many sibling total_* tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternative count/stat tools, nor any exclusion criteria or suggested alternatives. The intended use case must be inferred entirely from the tool name and the brief phrase.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_total_domainsD
Total domain request counts over time.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| type | No | Report type. Defaults to all. | |
| domain | No | Filter to a specific domain. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| agent_types | No | Comma-separated agent/client types. | |
| bucket_size | No | Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| category_ids | No | Comma-separated content-category IDs to filter to. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| security_report | No | Threat-only report. 'all' returns both threats and non-threats. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. | |
| show_individual_networks | No | Group results by individual network ID. Defaults to false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are absent, so the description bears full responsibility for disclosing behavior. It does not explain what the response looks like (time series vs aggregate), whether results are grouped by domain, default time range behavior, or any other operational characteristics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely short but under-specified for a tool with 20 parameters. It is not a case of efficient conciseness; it omits critical information that would help an agent select and correctly invoke the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 20 optional parameters, no output schema, and no annotations, the description is far from sufficient. It does not explain return values, the meaning of 'over time', or how filters affect results, leaving agents to guess.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds no meaning beyond the schema—it does not clarify how parameters like bucket_size or type relate to 'over time' or the returned counts.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Total domain request counts over time' indicates the tool returns request counts related to domains, which is somewhat clear but lacks a specific verb and resource. It does not distinguish from siblings like dnsfilter_get_total_domain_stats or dnsfilter_get_top_domains, and 'over time' is ambiguous as to whether it returns a time series or aggregate totals.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives, no usage context, and no exclusions. With many sibling tools offering similar metrics, the agent is left without any routing information.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_total_domains_organizationsD
Total domain request counts broken out by organization.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| type | No | Report type. Defaults to all. | |
| domain | No | Filter to a specific domain. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| agent_types | No | Comma-separated agent/client types. | |
| bucket_size | No | Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| category_ids | No | Comma-separated content-category IDs to filter to. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| security_report | No | Threat-only report. 'all' returns both threats and non-threats. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. | |
| show_individual_organizations | No | Group results by individual organization ID. Defaults to false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure, but it is a single sentence that says nothing about output format, pagination, authentication, rate limits, or the effect of the many filtering and grouping parameters. It does not explain whether the result is a time series, a single aggregate, or a per-organization breakdown. The behavior is effectively opaque.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short, but that brevity is not a virtue here—it is under-specification. A single sentence that merely restates the name does not 'earn its place' for a tool with 20 parameters and complex filtering/grouping behavior. There is no structure or front-loading of critical information; it is simply too sparse to be considered appropriately concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (20 parameters, no output schema, no annotations), the description is grossly incomplete. It does not define the output shape, how the grouping flag changes the response, or which parameters are mutually exclusive. An agent cannot correctly invoke this tool or interpret its results based solely on the provided description. The description must be expanded significantly to cover even the most basic behaviors.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All 20 parameters are documented in the schema with 100% coverage, so the description does not need to repeat parameter details. The description adds no parameter-level information, and the baseline of 3 is appropriate because the schema already provides the necessary semantics. The description does not compensate for any gaps, but none exist in the schema itself.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Total domain request counts broken out by organization' is essentially a restatement of the name, offering little added specificity. It does not clarify that the grouping is optional via the show_individual_organizations parameter, nor does it distinguish this tool from similar siblings like dnsfilter_get_total_domains or dnsfilter_get_total_domains_users. The purpose is vague and lacks a clear verb or explicit resource scope beyond what the name already implies.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention the parameter that controls the output shape (show_individual_organizations), nor does it reference any sibling tools or exclusions. An agent would have to infer the intended use case from the name and schema alone, which is insufficient for a tool with this many related functions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_total_domain_statsA
Single-domain request-count summary - use with the domain/fqdn filter.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| fqdn | No | Filter to a specific fully-qualified domain name. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| domain | No | Filter to a specific domain. | |
| msp_id | No | MSP ID to scope the report to. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| organization_id | No | Organization ID. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the behavioral burden. It does convey that the tool returns an aggregate request-count summary rather than raw logs, but it does not describe response shape, whether the domain filter is required, or how the time bounds affect the summary.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one sentence with the most important facts front-loaded and no wasted words. It earns every word and is easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no annotations, no output schema, and seven optional parameters, this description is thin. It identifies the core purpose and main filter, but leaves the response structure and behavior around the other scoping parameters unstated, requiring the agent to infer or experiment.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters. The description adds a small extra signal by pointing to the domain/fqdn filter as the relevant one, but does not meaningfully go beyond what the schema states.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific resource and scope: a 'single-domain request-count summary'. 'Single-domain' distinguishes it from sibling tools like get_total_domains or get_total_requests, and 'use with the domain/fqdn filter' clarifies what it operates on.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The instruction to use it 'with the domain/fqdn filter' gives a clear usage context. It does not explicitly name alternative tools or exclusion criteria, but the context is enough to guide correct invocation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_total_domains_usersC
Total domain request counts broken out by local user.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| type | No | Report type. Defaults to all. | |
| domain | No | Filter to a specific domain. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| agent_types | No | Comma-separated agent/client types. | |
| bucket_size | No | Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| category_ids | No | Comma-separated content-category IDs to filter to. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| security_report | No | Threat-only report. 'all' returns both threats and non-threats. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. | |
| show_individual_users | No | Group results by individual local user ID. Defaults to false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the aggregation shape but does not disclose whether the result is grouped by default, how show_individual_users affects output, what the return representation is, or even that the call is read-only.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one front-loaded sentence with no filler or repetition. It states the primary purpose immediately and every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 20 filtering parameters and no output schema, yet the description is only eight words. It gives no sense of result shape, time-bucket behavior, or relationship to the dozens of sibling reports, so an agent could not confidently interpret the response or select this tool in context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds only general 'broken out by local user' context, which relates to show_individual_users but does not meaningfully compensate for or extend the schema's parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Total domain request counts broken out by local user' names a specific verb, resource, and aggregation dimension. It is clear on its own, but it does not explicitly distinguish itself from close siblings like get_total_domain_stats or get_total_requests_users.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance about when to use this tool versus the many sibling report tools. The sibling list contains several similar total/domains/users tools, and the description does not mention any alternative or exclusion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_total_organizations_requestsC
Total request counts broken out by organization.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| fqdn | No | Filter to a specific fully-qualified domain name. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| name | No | Filter/search by name. | |
| type | No | Report type. Defaults to all. | |
| domain | No | Filter to a specific domain. | |
| msp_id | No | MSP ID to scope the report to. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| agent_types | No | Comma-separated agent/client types. | |
| bucket_size | No | Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| category_ids | No | Comma-separated content-category IDs to filter to. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| organization_id | No | Organization ID. | |
| security_report | No | Threat-only report. 'all' returns both threats and non-threats. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It only states the basic function ('Total request counts broken out by organization') and doesn't mention output format, time range behavior, read-only nature, or any side effects. It adds little beyond what the tool name already implies, leaving agents uninformed about response structure or potential errors.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, succinct sentence that communicates the core purpose without fluff. It's efficiently written and front-loaded with the essential information. However, it's so brief that it sacrifices completeness, which prevents a perfect score.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a complex tool with 18 parameters, no output schema, and many sibling tools offering different breakdowns. The one-sentence description doesn't explain what the output looks like, when to use this over alternatives, or any important behavioral notes. An agent would need to rely heavily on the schema and infer context from the name and siblings, which is inadequate for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers all 18 parameters with detailed descriptions, so the baseline is 3. The tool description adds no parameter-specific context, such as how filters combine or that organization_ids defaults to the user's organization. Since the schema already handles parameter documentation, the description's silence is acceptable, but it doesn't enhance understanding beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool returns total request counts aggregated by organization, which is a specific resource and aggregation. It differentiates from siblings like get_total_requests (no breakdown) and get_total_requests_agents (breakdown by agents) based on the name and description. However, it doesn't explicitly contrast with alternatives or mention filtering options, so it's slightly below a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention that it's for per-organization breakdowns, nor does it contrast with other report tools. An agent would have to infer usage from the name and sibling list, which is insufficient for correct selection among the many total_* tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_total_organizations_statsC
Organization-level request-count summary.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| name | No | Filter/search by name. | |
| type | No | Report type. Defaults to all. | |
| msp_id | No | MSP ID to scope the report to. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| agent_types | No | Comma-separated agent/client types. | |
| bucket_size | No | Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| organization_id | No | Organization ID. | |
| security_report | No | Threat-only report. 'all' returns both threats and non-threats. | |
| application_category_ids | No | Comma-separated application category IDs to filter to. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. 'Summary' implies a read-only operation, but the description does not disclose time-range handling, aggregation behavior, output shape, or any other behavioral traits that would help an agent invoke it safely.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no filler words, making it easy to scan. It is concise, though arguably too terse for the tool's complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 13 parameters, no output schema, and no annotations, a noun-phrase description is insufficient. The agent cannot tell whether the result is a per-organization breakdown, a single aggregate, or how filters affect the summary.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema describes all 13 parameters with 100% coverage, so the structured data already documents each parameter. The description adds no parameter-level meaning, matching the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies a concrete resource and metric: an organization-level request-count summary. However, it does not differentiate this tool from closely related siblings like dnsfilter_get_total_organizations_requests or dnsfilter_get_total_requests_organizations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives. With more than fifty sibling tools, an agent receives no help choosing between this and other total_* stats tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_total_requestsC
Total DNS request counts over time.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| type | No | Report type. Defaults to all. | |
| msp_id | No | MSP ID to scope the report to. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| nat_ips | No | Comma-separated NAT IP addresses to filter to. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| agent_types | No | Comma-separated agent/client types. | |
| bucket_size | No | Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| security_report | No | Threat-only report. 'all' returns both threats and non-threats. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. | |
| show_individual_networks | No | Group results by individual network ID. Defaults to false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It only says 'Total DNS request counts over time,' which names the output but does not describe time-bucket behavior, defaults, grouping, filtering implications, or the response shape.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single short sentence with no filler and is front-loaded with the core result. It is slightly terse for a 20-parameter tool, but structurally it is concise and to the point.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 20 optional parameters, no output schema, no annotations, and many closely related sibling tools, a one-sentence description is insufficient. The rich parameter schema covers inputs, but the agent still lacks information about response structure, behavioral expectations, and when this base report should be chosen over its variants.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameters are already fully documented with formats, defaults, and enum values. The description adds no parameter-level detail, which is acceptable given the schema's completeness.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies a specific resource and result: total DNS request counts over time. It is clear at a high level, but it does not explicitly differentiate itself from sibling tools like dnsfilter_get_total_requests_geo or dnsfilter_get_total_requests_users, and it lacks an explicit verb.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus the many sibling variants, nor does it mention any exclusions or alternatives. An agent must infer from the tool name and schema that this is the base total-requests report.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_total_requests_agentsC
Total request counts broken out by client/agent.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| type | No | Report type. Defaults to all. | |
| msp_id | No | MSP ID to scope the report to. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| nat_ips | No | Comma-separated NAT IP addresses to filter to. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| agent_types | No | Comma-separated agent/client types. | |
| bucket_size | No | Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| security_report | No | Threat-only report. 'all' returns both threats and non-threats. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. | |
| show_individual_agents | No | Group results by individual client/agent ID. Defaults to false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It only states the high-level output without mentioning aggregation behavior, default grouping (e.g., show_individual_agents defaults to false), time-bucket defaults, or any side effects. The description adds no behavioral context beyond what the schema parameters already imply.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with zero wasted words. It front-loads the core purpose and is appropriately sized for a tool with a descriptive name. There is no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 20 parameters and no output schema, the description is far too sparse. It doesn't explain the response format, the meaning of 'client/agent' (e.g., agent vs client distinction), how grouping works, or the effect of parameters like show_individual_agents. An agent would have to rely entirely on the schema and name to understand behavior, which is insufficient for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all 20 parameters have individual descriptions in the schema. The tool description adds no extra parameter detail, but it doesn't need to. Baseline of 3 is appropriate since the schema does the heavy lifting and the description doesn't detract.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear purpose: 'Total request counts broken out by client/agent.' It identifies the resource (request counts) and the breakdown dimension (client/agent), which distinguishes it from sibling tools like geo and users. However, it doesn't elaborate on what 'client/agent' means or what counts are included (e.g., allowed/blocked), leaving some ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no explicit guidance on when to use this tool over the many sibling tools (e.g., dnsfilter_get_total_requests_users, dnsfilter_get_total_requests_geo). There is no mention of alternatives or conditions. Usage context is only implied by the tool name, which is not sufficient for an agent choosing among similar endpoints.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_total_requests_collectionsC
Total request counts broken out by collection.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| type | No | Report type. Defaults to all. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| nat_ips | No | Comma-separated NAT IP addresses to filter to. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| agent_types | No | Comma-separated agent/client types. | |
| bucket_size | No | Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| security_report | No | Threat-only report. 'all' returns both threats and non-threats. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. | |
| show_individual_collections | No | Group results by individual collection ID. Defaults to false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations, so the description carries the full burden of behavioral disclosure. It only states the output grouping and does not mention response shape, default behavior, potential 403s, time-bucketing effects, or how the show_individual_collections parameter interacts with the stated 'broken out by collection' behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no filler and the key grouping information is front-loaded. It is appropriately concise for what it attempts to convey.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a 19-parameter tool with no output schema and no annotations, yet the description only provides a one-line summary. It lacks guidance on response structure, relationships to sibling reporting tools, and behavioral caveats, making it insufficiently complete for an agent to confidently invoke it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with detailed parameter descriptions covering defaults, enums, formats, and filters. Since the schema already carries this weight, the description adds no parameter-level meaning but does not need to; baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear action and resource: total request counts grouped by collection. It is not a tautology because 'broken out by collection' adds the grouping dimension, but it does not explicitly differentiate itself from sibling tools like get_total_requests_users or get_total_requests_geo.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus any of the many similar total-request siblings. The description does not mention alternatives, exclusions, or conditions that would help an agent select this endpoint.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_total_requests_geoC
Total request counts broken out by geography.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| limit | Yes | Limit the number of results returned. | |
| msp_id | No | MSP ID to scope the report to. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the full burden of behavioral disclosure. It states only the aggregate output intent and does not mention grouping semantics, time-series behavior, result ordering, or any other operational detail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short sentence, with the key qualifier ('by geography') front-loaded. It is appropriately terse, though it may be too sparse in behavioral context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description should clarify what the response looks like (grouping, units, ordering), which it does not. The five parameters are documented in the schema, but the absence of usage or response context makes the tool harder for an agent to use correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3 even though the description itself adds no parameter detail. The description's geography mention doesn't map to any specific parameter; it only clarifies the report dimension.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the resource ('total request counts') and the specific breakdown dimension ('by geography'), which distinguishes it from sibling aggregate tools like dnsfilter_get_total_requests_users. It doesn't explicitly name alternatives, but the geo qualifier makes the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives such as dnsfilter_get_total_requests or dnsfilter_get_total_requests_agents. The only hint is the implicit geography dimension in the name and description, so the agent must infer usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_total_requests_organizationsB
Total request counts broken out by organization.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| type | No | Report type. Defaults to all. | |
| msp_id | No | MSP ID to scope the report to. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| nat_ips | No | Comma-separated NAT IP addresses to filter to. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| agent_types | No | Comma-separated agent/client types. | |
| bucket_size | No | Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| security_report | No | Threat-only report. 'all' returns both threats and non-threats. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. | |
| show_individual_organizations | No | Group results by individual organization ID. Defaults to false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure, but it only states the aggregated output at a high level. It does not describe what the response contains (e.g., per-org totals only vs time series), whether it is read-only, what defaults apply, or how the 'show_individual_organizations' behavior affects results beyond the schema note.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The single sentence is concise and front-loaded, but for a tool with 20 parameters and no output schema, it is under-specified rather than appropriately sized. It reads more like a title than a complete tool definition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity, the absence of an output schema, and the lack of annotations, the description is incomplete. An agent would not know the shape of the response, how time bucketing appears, or what additional grouping or filter behaviors affect the returned data.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 20 parameters with defaults and formats. The description adds no parameter-level meaning beyond that, placing it at the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the exact resource ('total request counts') and the grouping dimension ('by organization'), which clearly distinguishes it from sibling tools like get_total_requests_users and get_total_requests_geo. Even without an explicit verb like 'get' or 'return', the intent is unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus alternatives. It does not mention exclusions, prerequisites, or that a sibling like get_total_requests_users should be used instead when organization grouping is not needed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_total_requests_usersB
Total request counts broken out by local user.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| type | No | Report type. Defaults to all. | |
| msp_id | No | MSP ID to scope the report to. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| nat_ips | No | Comma-separated NAT IP addresses to filter to. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| agent_types | No | Comma-separated agent/client types. | |
| bucket_size | No | Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| security_report | No | Threat-only report. 'all' returns both threats and non-threats. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. | |
| show_individual_users | No | Group results by individual local user ID. Defaults to false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the behavioral disclosure burden. It only restates the result shape; it does not mention read-only behavior, response format, the default of show_individual_users, or how filters interact. The read-only nature is only implicit in the 'get' naming.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The single sentence is efficient, free of redundancy, and front-loads the core output. It is appropriately concise, though it is so brief that it also serves as the only source of behavioral context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 20 optional parameters, a large sibling family, no output schema, and no annotations, a one-sentence description is insufficient. It does not explain the response format, how filters combine, or the role of show_individual_users, leaving the agent to rely entirely on the schema and tool name.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema documents all 20 optional parameters, including formats, enums, and defaults. The description adds no meaningful parameter-level information beyond the 'local user' grouping, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states an explicit result: total request counts grouped by local user. This clearly distinguishes the tool from siblings like dnsfilter_get_total_requests_geo, dnsfilter_get_total_requests_agents, and dnsfilter_get_total_threats_users without needing to open the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to choose this tool versus the many sibling reporting tools. 'Broken out by local user' implies the use case, but alternatives, exclusions, and selection criteria are never stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_total_roaming_clientsB
Count of roaming (off-network) clients.
| Name | Required | Description | Default |
|---|---|---|---|
| msp_id | No | MSP ID to scope the report to. | |
| organization_id | No | Organization ID. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It only states what the tool counts, not whether it is a read-only operation, whether it requires specific permissions, what the response format looks like, or whether the count is scoped by default when no parameters are provided. Since all parameters are optional, the default behavior (e.g., global count vs. error) is unclear, which is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that is front-loaded with the core function. It is appropriately sized for a simple count tool, with no wasted words. However, it could have added a brief note about scoping behavior without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no annotations, no output schema, and two optional parameters, the description is incomplete. An agent cannot determine what the default scope is when no parameters are provided, what the response structure looks like, or whether this count overlaps with sibling tools like dnsfilter_get_total_client_stats. The description is adequate for a basic understanding but lacks critical operational details for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both parameters (msp_id and organization_id) with descriptions. The tool description adds no additional meaning about how these parameters affect the count, such as whether they are mutually exclusive or hierarchical. Baseline 3 is appropriate because the schema does the heavy lifting, but the description does not clarify the relationship between the two optional scoping parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Count of roaming (off-network) clients' clearly states the tool's function: it returns a count of roaming clients. The verb 'Count' and resource 'roaming clients' are specific, and the parenthetical clarifies the meaning of 'roaming' as off-network. It distinguishes itself from sibling tools that count requests, threats, or domains, though it doesn't explicitly name a sibling alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for retrieving a count of roaming clients, and the parameters suggest scoping by MSP or organization. However, it does not explicitly state when to use this tool versus alternatives like dnsfilter_get_total_client_stats or dnsfilter_get_total_requests. No exclusions or alternative routing are provided, so the agent must infer usage from the name and context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_total_threatsC
Total blocked-threat counts over time.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| type | No | Report type. Defaults to all. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| agent_types | No | Comma-separated agent/client types. | |
| bucket_size | No | Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. | |
| show_individual_networks | No | Group results by individual network ID. Defaults to false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It only states that counts are over time; it does not describe whether results are grouped into time buckets, how filters such as type or show_individual_networks affect the output, what aggregation occurs, or what the response shape looks like.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and contains no filler, but it is more of a label than a usage statement. For a tool with 17 parameters, eight words are not an appropriately sized description, and the lack of a verb and any structural breakdown makes it feel underspecified despite its brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a complex reporting tool with no output schema, so the description should explain at least the return shape, time-bucket behavior, and scope. 'Total blocked-threat counts over time' gives only a hint of temporal series data and leaves the agent without enough context to know what the tool will return or how to distinguish it from sibling threat-reporting tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema coverage is 100%, and each of the 17 parameters already has a meaningful description including defaults, so the description does not need to re-document them. However, the description adds no extra semantics about how the parameters shape the returned threat series, leaving it at the schema-driven baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The phrase 'Total blocked-threat counts over time' names the resource and the temporal dimension, and the get_ prefix in the tool name supplies the verb. It is clear at a high level, though it does not explicitly differentiate this aggregate from the sibling tools dnsfilter_get_total_threats_organizations and dnsfilter_get_total_threats_users.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance about when to use this tool versus the many sibling reporting tools. There is no mention of when to prefer this over dnsfilter_get_total_threats_organizations, dnsfilter_get_total_threats_users, dnsfilter_get_total_requests, or other alternatives, so an agent must infer scope from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_total_threats_organizationsC
Total blocked-threat counts broken out by organization.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| type | No | Report type. Defaults to all. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| agent_types | No | Comma-separated agent/client types. | |
| bucket_size | No | Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. | |
| show_individual_organizations | No | Group results by individual organization ID. Defaults to false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure, but it only restates the aggregate output ('counts broken out by organization') without explaining grouping behavior, defaults, error conditions, or output shape. It does not contradict annotations since none exist, but it adds almost no behavioral context beyond what the name implies.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with zero redundancy or filler. It is as concise as possible, though it borders on under-specification given the tool's 17-parameter complexity and the absence of an output schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given high complexity (17 parameters, no output schema, no annotations), the one-line description is not enough for an agent to call the tool correctly. It fails to clarify how the organization breakdown relates to the show_individual_organizations parameter, what the response structure looks like, or how filters interact with the grouping — significant gaps without an output schema to fill them.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 17 parameters, including defaults, formats, enums, and the 403 behavior for inaccessible organization IDs. The description itself adds no parameter-level meaning, which matches the baseline of 3; the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear function: returning total blocked-threat counts grouped by organization. The phrase 'broken out by organization' inherently distinguishes it from siblings like dnsfilter_get_total_threats and dnsfilter_get_total_threats_users, though no sibling is named explicitly. It is clear but relies on the tool name for part of the differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to choose this tool over the many similar sibling stat endpoints (e.g., get_total_threats, get_total_requests_organizations, get_total_categories_organizations). There are no usage conditions, exclusions, or references to alternatives, leaving the agent to infer selection solely from the name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_get_total_threats_usersC
Total blocked-threat counts broken out by local user.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| type | No | Report type. Defaults to all. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| agent_types | No | Comma-separated agent/client types. | |
| bucket_size | No | Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. | |
| show_individual_users | No | Group results by individual local user ID. Defaults to false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure, but it only restates the report's grouping. It does not reveal output shape, default time windows, whether results are truly per-user given show_individual_users defaults to false, or any other behavioral traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no filler or redundancy. 'Total blocked-threat counts broken out by local user' efficiently communicates the core subject and grouping.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a 17-parameter report tool with no output schema and no annotations, yet the description provides only a bare grouping statement. It lacks information about the returned record format, how filters and defaults affect the breakdown, and how this compares to the many sibling reporting tools, so an agent cannot fully anticipate the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 17 parameters. The description adds little beyond reinforcing 'local user' grouping and the threat-count focus, which maps roughly to type and show_individual_users but does not add detail beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear resource and grouping: 'Total blocked-threat counts broken out by local user.' The phrase 'blocked-threat' and 'local user' distinguish it from sibling tools like get_total_threats, get_total_threats_organizations, and get_total_requests_users, though it does not name them explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to choose this tool over its siblings. It does not mention alternatives such as get_total_threats for overall counts or get_total_threats_organizations for organization-level breakdowns, nor any exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_list_application_categoriesA
List application categories, used for the application allow/block surface of a policy (distinct from content categories). IDs from this response are required by dnsfilter_get_application_category and can filter traffic-report tools via application_category_ids.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden of behavioral disclosure. The verb 'List' implies a safe read operation, and the description adds meaningful behavioral context by noting that the response contains IDs that are required downstream. It does not describe response shape beyond IDs, but this is acceptable for a simple list operation with no side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler. The first sentence states the core purpose and key distinction; the second provides precise downstream dependency information. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity list tool with one optional pagination parameter and no required inputs, the description is quite complete. It names the purpose, distinguishes the category type, and notes the critical downstream use of returned IDs. A slight gap is the lack of detail about other response fields, but the description still gives an agent enough to select and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema fully documents the optional 'page' object, including defaults and max size. The description adds no parameter-specific information, but this is not needed because the schema already explains everything about the single parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with a specific verb and resource, 'List application categories,' and immediately distinguishes them from content categories. It also connects this tool to a specific sibling, dnsfilter_get_application_category, making the tool's role unambiguous among a large sibling list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when this tool is relevant: for the application allow/block surface of a policy, and clarifies it is distinct from content categories. It also describes downstream usage, telling the agent that IDs from this response are required by another tool and can be used to filter traffic-report tools, which is strong usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_list_block_pagesA
List the custom block pages configured for the current user/organization (shown to end users when a request is filtered). Block page IDs from this response are required by dnsfilter_get_block_page.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100). | |
| organization_id | No | Filter to block pages belonging to this organization. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the burden of behavioral disclosure. It clarifies that the tool lists custom, user/organization-scoped block pages and that the response contains IDs needed by another tool. While it doesn't detail pagination behavior or response shape, the read-only nature is implied by 'List' and the schema covers pagination.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no wasted words. It front-loads the core action and resource, then adds the most important downstream relationship. Every sentence contributes useful information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with no annotations and no output schema, the description covers the key operational context: what is listed, the scope, and how the result is used. It could be more explicit about the exact return structure, but 'Block page IDs from this response' gives an agent enough to proceed correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema itself already documents the 'page' object, 'size', 'number', and 'organization_id' parameters. The description does not add param-level detail beyond that, but the downstream dependency on block page IDs is useful context. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and resource ('custom block pages'), and clearly states the scope ('current user/organization') and purpose ('shown to end users when a request is filtered'). It also differentiates from the related sibling 'dnsfilter_get_block_page' by explaining this tool provides the IDs needed for that get operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear usage context by explaining that this tool lists block pages and that the IDs from its response are required by a sibling tool. It doesn't explicitly state when not to use it, but the cross-reference to dnsfilter_get_block_page effectively guides an agent toward the right tool for fetching a specific page.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_list_categoriesA
List DNSFilter's content-filtering categories (e.g. Malware, Gambling, Social Networking) used to build allow/block rules in a policy. Category IDs from this response are required by dnsfilter_get_category and can filter traffic-report tools via category_ids.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. The verb 'List' implies a safe, read-only operation, and it mentions that the response contains category IDs. However, it doesn't disclose pagination behavior, rate limits, or any other side effects beyond what the schema already states. The description adds some context but not rich behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with zero waste. The purpose and downstream usage are front-loaded, making it easy for an agent to scan and understand the tool's role without reading the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description should hint at the return value. It mentions 'Category IDs from this response', which conveys the key output. Combined with the pagination schema, the description is sufficient for a simple list tool. It could be more explicit about response structure, but the essentials are covered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the only parameter (page object), which fully documents pagination defaults and constraints. The description adds no additional parameter semantics beyond what the schema already provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource: 'List DNSFilter's content-filtering categories' with concrete examples. It clearly distinguishes from sibling list tools by naming the resource and its downstream use (build allow/block rules, required by dnsfilter_get_category).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use it: to obtain category IDs required by dnsfilter_get_category and to filter traffic-report tools via category_ids. It doesn't explicitly exclude alternatives or name when not to use it, but the context is clear enough for an agent to select it appropriately.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_list_networksA
List the networks (sites/locations) visible to this API key, with basic info and whether a filtering policy is assigned. Network IDs from this response are required by dnsfilter_get_network and can scope most traffic-report tools via network_ids.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100). | |
| search | No | Search by network name, hostname, IP address, etc. | |
| protected | No | Filter to networks with an assigned policy. | |
| basic_info | No | Return only the most basic network info. Defaults to false. | |
| unprotected | No | Filter to networks without an assigned policy. | |
| count_network_ips | No | Include a count of associated IP addresses. Defaults to false. | |
| force_truncate_ips | No | Omit IP address details from the response. Defaults to false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden. It discloses that this is a list operation, that results reflect what is visible to the API key, and that the response contains policy and basic info. It does not explicitly state it is read-only or describe rate limits, but the 'List' verb adequately implies a safe read operation and the schema covers pagination details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler: the first states the core purpose and output, the second explains downstream usage. The most important information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema or annotations, the description provides valuable context about return contents (basic info, policy assignment) and the role of Network IDs in other tools. It could be more explicit about the response shape, but the explanation is sufficient for an agent to call the tool and understand its result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameters are already fully documented. The description adds no extra meaning to parameters beyond referring to network IDs and policy filtering, which is not enough to raise the score above the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List'), names the resource ('networks'), and scopes it to those visible to the API key. It also states the output includes basic info and policy assignment, which clearly differentiates it from singular getters like dnsfilter_get_network and other network-specific tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives clear usage context: use this to list networks and obtain Network IDs needed by dnsfilter_get_network and applicable to traffic-report tools. It does not explicitly name alternate list/report tools to exclude, so it falls just short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_list_organizationsA
List the organizations visible to this API key, with basic info (name, type, MSP relationships). Organization IDs from this response are required by dnsfilter_get_organization, dnsfilter_list_networks/policies/block_pages (via organization_id), and every traffic-report tool.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Filter by organization name. | |
| page | No | Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100). | |
| type | No | Filter by organization type. | |
| basic_info | No | Return only the most basic organization info. Defaults to false. | |
| owned_msp_id | No | Filter to parent organizations owned by this MSP's ID. | |
| pii_grid_search | No | Filter by organization name or privacy mode. | |
| managed_by_msp_id | No | Filter to sub-organizations managed by this MSP's ID. | |
| exclude_inherit_privacy_mode | No | Exclude organizations that have inherit privacy mode. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses that the list is scoped to the API key ('visible to this API key') and that output is 'basic info (name, type, MSP relationships)'. However, it does not explain pagination behavior, ordering, error conditions, or response format beyond that basic info, leaving notable gaps for a read operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description consists of two tight sentences. The first immediately states the tool's purpose and output; the second explains its cross-tool importance. There is no filler or redundant content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 8-parameter tool with no output schema and no annotations, the description provides the core purpose and its role in the workflow, but leaves out important context such as how to handle pagination, the overall response structure (beyond a few fields), and any potential error/empty-list behaviors. It's adequate but not complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all 8 parameters are already documented. The description adds no parameter-level meaning beyond the schema, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List') and resource ('organizations visible to this API key'), plus the returned info (name, type, MSP relationships). It also differentiates from siblings by explaining that Organization IDs from this response are required by other tools like dnsfilter_get_organization and dnsfilter_list_networks/policies/block_pages, making the tool's role distinct among many list/get siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives clear context on when to use the tool: it is the required source of Organization IDs for several downstream tools. However, it does not explicitly mention when to use an alternative (e.g., dnsfilter_get_organization when an ID is already known), so the guidance is useful but not fully comprehensive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_list_policiesA
List filtering policies visible to this API key. Policy IDs from this response are required by dnsfilter_get_policy and dnsfilter_get_policy_permissive_mode.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | Pagination, e.g. { "number": 1, "size": 10 }. 'size' defaults to 10 (max 100). | |
| organization_id | No | Filter to policies belonging to this organization. | |
| include_global_policies | No | Include global (template) policies in the listing. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the disclosure burden. It usefully scopes results to the API key's visibility and highlights a downstream dependency, but it does not describe the response shape, pagination behavior, or explicitly confirm read-only semantics beyond the word 'List'.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler: the first states the purpose and scope, and the second provides actionable cross-tool context. The most important information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a list operation with fully documented optional parameters, this is mostly adequate. However, with no output schema and no annotations, the description could have said more about what the response contains or how pagination surfaces, though the 'Policy IDs' mention partially compensates.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so all three optional parameters are already well documented in structured form. The description adds no parameter-level meaning beyond stating the overall purpose, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource ('List filtering policies') and adds an access scope ('visible to this API key'), which distinguishes it from the many sibling list_* and get_* tools. It also states that returned policy IDs feed dnsfilter_get_policy and dnsfilter_get_policy_permissive_mode, reinforcing its role.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives clear usage context by telling the agent that this response supplies policy IDs required by two downstream getter tools, effectively indicating when to call this tool. It does not explicitly mention when not to use it or name alternative listing tools, so it stops short of full exclusion guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dnsfilter_lookup_network_by_ipA
Find the network associated with a given source IP address, along with that network's block-page branding.
| Name | Required | Description | Default |
|---|---|---|---|
| requesting_ip_address | Yes | IP address to look up. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full burden of behavioral disclosure. It only states what the tool finds and that block-page branding is included; it does not mention that the operation is read-only, any error conditions, input format support (IPv4/IPv6), rate limits, or response structure. For a tool with zero annotation support, this is a meaningful gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with the action verb first and no filler. It conveys the core operation and a key output detail in under 20 words, earning its place fully.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter lookup with no output schema, the description states the core operation and the notable output (block-page branding). However, it leaves the rest of the network object's fields undefined and does not clarify what 'block-page branding' means or how the response would be structured. This is adequate for a simple tool but leaves some context to inference.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description refers to 'source IP address', which is nearly identical to the schema's 'IP address to look up'. It adds no new semantic meaning about formats, validation, or special cases beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Find'), names the resource ('network'), and identifies the lookup criterion ('source IP address'), which is a distinctive operation among siblings like dnsfilter_get_network and dnsfilter_list_networks. It also mentions the notable output (block-page branding), leaving no ambiguity about the tool's purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implicitly conveys when to use it: when you have an IP address and need the associated network. However, it does not explicitly mention any alternatives, when not to use it, or how it differs from dnsfilter_get_network (likely by ID) or dnsfilter_list_networks. This is adequate implied usage but lacks direct routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
57 tool updates
v0.1.0- First observed
dnsfilter_get_application_category - First observed
dnsfilter_get_application_policies - First observed
dnsfilter_get_block_page - First observed
dnsfilter_get_category - First observed
dnsfilter_get_network - First observed
dnsfilter_get_networks_geo - First observed
dnsfilter_get_organization - First observed
dnsfilter_get_organization_settings - First observed
dnsfilter_get_organization_usage - First observed
dnsfilter_get_organization_usage_detailed - First observed
dnsfilter_get_policy - First observed
dnsfilter_get_policy_permissive_mode - First observed
dnsfilter_get_qps - First observed
dnsfilter_get_qps_active_agents - First observed
dnsfilter_get_qps_active_organizations - First observed
dnsfilter_get_query_logs - First observed
dnsfilter_get_top_agents - First observed
dnsfilter_get_top_application_categories - First observed
dnsfilter_get_top_categories - First observed
dnsfilter_get_top_collections - First observed
dnsfilter_get_top_domains - First observed
dnsfilter_get_top_networks - First observed
dnsfilter_get_top_organizations_requests - First observed
dnsfilter_get_top_users - First observed
dnsfilter_get_total_applications_agents_stats - First observed
dnsfilter_get_total_applications_collections_stats - First observed
dnsfilter_get_total_applications_networks_stats - First observed
dnsfilter_get_total_applications_stats - First observed
dnsfilter_get_total_applications_users_stats - First observed
dnsfilter_get_total_categories - First observed
dnsfilter_get_total_categories_organizations - First observed
dnsfilter_get_total_category_stats - First observed
dnsfilter_get_total_client_stats - First observed
dnsfilter_get_total_deployments - First observed
dnsfilter_get_total_domain_stats - First observed
dnsfilter_get_total_domains - First observed
dnsfilter_get_total_domains_organizations - First observed
dnsfilter_get_total_domains_users - First observed
dnsfilter_get_total_organizations_requests - First observed
dnsfilter_get_total_organizations_stats - First observed
dnsfilter_get_total_requests - First observed
dnsfilter_get_total_requests_agents - First observed
dnsfilter_get_total_requests_collections - First observed
dnsfilter_get_total_requests_geo - First observed
dnsfilter_get_total_requests_organizations - First observed
dnsfilter_get_total_requests_users - First observed
dnsfilter_get_total_roaming_clients - First observed
dnsfilter_get_total_threats - First observed
dnsfilter_get_total_threats_organizations - First observed
dnsfilter_get_total_threats_users - First observed
dnsfilter_list_application_categories - First observed
dnsfilter_list_block_pages - First observed
dnsfilter_list_categories - First observed
dnsfilter_list_networks - First observed
dnsfilter_list_organizations - First observed
dnsfilter_list_policies - First observed
dnsfilter_lookup_network_by_ip
TDQS
Scored across 57 tools
The entity getters are distinct, but the report tools overlap heavily: dnsfilter_get_top_*, dnsfilter_get_total_*, and dnsfilter_get_total_*_organizations/users/agents variants are easy to confuse. For example, dnsfilter_get_total_requests_organizations and dnsfilter_get_total_organizations_requests are nearly indistinguishable from their names alone.
Almost every tool follows a consistent dnsfilter_ + get/list/lookup + snake_case pattern, making the naming highly predictable. Minor inconsistencies exist, such as get_networks_geo being a plural/list-style operation and report names mixing top/total/qps without a strict semantic convention.
57 tools is far above the typical well-scoped MCP surface, and many are minor permutations of the same reporting concept broken out by organization, user, network, collection, or agent. A much smaller set of parameterized report tools could likely cover the same capabilities.
The tool surface is almost entirely read-only: it retrieves organizations, networks, policies, categories, block pages, and extensive traffic reports, but has no create, update, delete, assign, or configuration-management tools. Agents cannot act on DNSFilter settings, only observe them, which is a significant gap for a management-oriented server.
Maintenance
Related MCP Connectors
Signed internet telemetry, read-only: DNS, TLS, WHOIS, reachability. Every record Ed25519-signed.
Read-only access to your VortexIQ store data: audits, KPIs, alerts, Brand DNA, reports, Ask VIQ.
- InfrapageOAuthpage.infra
Read-only access to your Infrapage dashboards: pages, widgets, live values, weekly recaps.
Read-only access to your Nexly web analytics: traffic, pages, acquisition, events, and reports.
Related MCP Servers
- AlicenseBqualityDmaintenanceProvides read-only access to TikTok advertising data, including campaigns, ad groups, ads, and performance reports through the TikTok Business API.642MIT
- AlicenseBqualityDmaintenanceRead-only Cloudflare MCP server for SOC investigation, exposing Cloudflare services like WAF, bot management, analytics, and Zero Trust for querying and discovery.32MIT
- AlicenseAqualityCmaintenanceRead-only MCP server for the Action1 RMM REST API, enabling access to endpoints, missing updates, vulnerabilities, installed software, policies, automations, and reports.21Apache 2.0
- AlicenseAqualityCmaintenanceProvides read-only network diagnostics for a target host, including DNS, TLS, HTTP, and registry data.4MIT