Teramind MCP Server
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Teramind MCP Servershow me alerts from the last 24 hours"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Teramind MCP Server
MCP server for Teramind's insider-threat/employee-monitoring API - computer inventory, agent (user) inventory, departments, alerts, anomaly-rule and behavior-policy configuration, and monitoring-profile metadata - for AI assistants and the WYRE Conduit gateway.
This connector is PII-dense by construction (insider-threat/employee-monitoring product) and requires security review before merge - see Scope and Credential scope below.
Authentication
Teramind authenticates with a JWT Access Token, self-generated per-account in the Teramind dashboard (User menu -> Access Tokens), sent as the x-access-token header. There is no OAuth flow.
Teramind's API is per-customer-instance (cloud or on-premise/private-cloud) - there is no shared multi-tenant base URL like most other connectors in this catalog. Every credential set also carries the customer's own instance URL (e.g. https://yourcompany.teramind.co). In gateway mode both arrive per-request via the X-Teramind-Access-Token / X-Teramind-Instance-Url headers; in local/stdio mode they're read once from TERAMIND_ACCESS_TOKEN / TERAMIND_INSTANCE_URL.
Related MCP server: trmm-exec-mcp
Configuration
Env var | Description |
| JWT access token issued by the Teramind dashboard's Access Tokens menu. |
| The customer's Teramind instance base URL, e.g. |
|
|
|
|
| When set, the HTTP transport requires a valid |
|
|
Tools
Computers
teramind_list_computers- list monitored computers (hostname, FQDN, MAC/IP, OS, monitoring status).teramind_get_computer- get full detail for a single computer.
Agents (users)
teramind_list_agents- list monitored agents (Teramind's term for a monitored employee/user identity): id, name, email, avatar, online status.teramind_get_agent- get full detail for a single agent.
Departments
teramind_list_departments- list departments (org-structure metadata).teramind_get_department- get full detail for a single department.
Alerts
teramind_list_alerts- list fired rule-violation events in a time window, optionally filtered by agent/computer/department.
Anomaly rules
teramind_list_anomaly_rules- list configured ML-based anomaly-detection rules (type, risk quotient, trigger conditions).teramind_get_anomaly_rule- get full detail for a single anomaly rule.teramind_list_anomaly_rule_tags- list the tags available to categorize anomaly rules.
Behavior policies
teramind_list_behavior_policies- list behavior policies (what activity type each policy watches and its match conditions).teramind_get_behavior_policy- get full detail for a single behavior policy.teramind_list_behavior_policy_groups- list behavior policy groups (the containers that organize behavior policies).teramind_get_behavior_policy_group- get full detail for a single behavior policy group.
Monitoring
teramind_list_monitoring_profiles- list monitoring profiles (which data types are configured to be captured, and for whom).
Account
teramind_get_account- get the authenticated account's own settings (credential sanity check).
Scope
This is a deliberately narrow, read-only v1 surface, scoped MORE conservatively than this catalog's usual bar given the sensitivity of an insider-threat/employee-monitoring product. Teramind's documented API (fetched directly from its published Postman collection, apidoc.dev.teramind.co) has 239 operations across dozens of product areas (monitoring, BI reporting, time tracking, scheduling, productivity classification, LDAP, task management, scheduling). This connector implements 16: literal HTTP GET reads covering only computer/user/session inventory, department metadata, and rule/alert configuration. Every tool is classified isAdmin: true in the Conduit gateway regardless of verb, given the sensitivity of employee-monitoring data.
No literal GET endpoint exists for session inventory. Teramind's session data (Sessions report, Login session BI grid) is only reachable through POST query/grid-style endpoints, not a plain resource GET - documented here as a finding, not fabricated as a tool. Session data is out of this connector's v1 scope as a consequence, not a separate exclusion decision.
Hard-excluded: anything that returns actual monitored content, or mints/reveals a credential - by name, even where the verb is GET
Per this connector's scope boundary, the distinction is: metadata about monitoring (who is monitored, when, what rule fired) is in scope; the actual captured content of what was monitored, or a mechanism to obtain a live credential, is not, regardless of read/write verb.
Endpoint | Rationale |
| Returns the agent's avatar/headshot image - biometric-adjacent photo content. |
| Email-activity metadata (participants/subject) - content-adjacent; excluded alongside its two siblings below rather than judged separately. |
| Returns the full captured email body as rendered HTML. Raw captured content. |
| Returns the full captured email body. Raw captured content. |
| Session-recording player/playback settings for a specific agent+computer. |
| Annotations/bookmarks tied to recorded-session timelines. |
| Timeline tags for a specific agent/computer's recorded sessions over a period. |
| Status of a screen-recording video export job. |
| Enumerates which recorded video segments exist for a computer/period - an inventory of available screen recordings. |
| Generic report-export download - the export could be of ANY report type this API supports, including keystrokes, emails, instant messages, or video, so it is excluded as a class rather than judged per export. |
| Status of a report-export job - same generic content-bearing concern as the download endpoint above. |
| Mints a new short-lived, live access token. Credential issuance, not content - held to the same bar as a credential-return endpoint in every other connector in this catalog. |
| Lists the account's active JWT token IDs - credential/session-management data. |
No GET endpoint anywhere in Teramind's documented API returns raw keystroke logs, chat/IM content, printed-document content, or social-media activity content - those are exclusively reachable through the POST /tm-api/report/*/grid and POST /tm-api/wip/tma-query (BI) families, which this connector excludes as a category below. This connector's GET-only scope therefore rules out keystroke/screenshot/chat-content exposure by construction, not merely by the per-endpoint judgment calls above - see Credential scope for what this claim does and does not cover.
Excluded by category (out of the named scope: computer/user/session inventory + rule/alert data)
Category | Why excluded |
Activities (aggregated activity) | Activity/productivity data, not inventory or rule/alert metadata. |
BI / BI Filter (37 ops) | All |
Reports / Report settings / Reports batch (~55 ops) | All |
Video export (remaining 2 ops) |
|
Time Tracking Reports, Time tracker tasks, Tasks, Schedule | Employee clock-in/task/shift-scheduling features, unrelated to monitoring inventory or rule/alert data. |
LDAP | Directory-service connection config - out of scope, and a plausible vector for exposing bind-account details even as a plain read. |
SMTP, Ingestion | Single |
Shared lists | Rule-input datasets (e.g. keyword/URL watchlists referenced by rules) of ambiguous sensitivity - excluded as a judgment call rather than included by default. |
Productivity Profile, | Productivity-classification taxonomy - arguably rule-adjacent, but not named in this connector's scope; excluded to stay tight rather than included as a stretch. |
| Generic utility/status endpoints, none of which fit computer/user/session inventory or rule/alert data. |
Every | Write, provisioning, enable/disable-monitoring, or account-mutation operations. Never implemented, regardless of verb. |
Anomaly-rule / behavior-policy templates, tags-and-misc bundle, demo policy | Catalogs for AUTHORING new rules, not this org's actual configured monitoring - out of scope for a read-only inventory connector ( |
They can be added as a follow-up if there's demand, after a deliberate scope decision - not by default.
Field-level restriction, not just endpoint-level
GET /tm-api/v1/agents[/:id] supports an optional fields query parameter that can return salary_type and default_wage (compensation data) and ldap_attrs (raw directory attributes) - HR/PII data well beyond "who is monitored." This connector's client.ts never passes that parameter, so only the default identity fields (agent_id, name, email_address, avatar, online) are ever returned, regardless of what a caller requests through the tool's input schema (there is no fields parameter exposed on teramind_list_agents / teramind_get_agent at all).
Judgment call flagged for reviewer attention: alert content
teramind_list_alerts is squarely in this connector's named scope ("rule/alert data"), and its response shape is documented by Teramind to include description/caption/values fields describing why a rule fired. Depending on the rule type, those fields may carry a short excerpt of the triggering context (e.g. a matched keyword, or a visited URL) rather than pure metadata - this is passed through as Teramind returns it, unmodified. This was judged in-scope because alerts are explicitly named in this connector's scope and the excerpt (if present) is bounded to what a human already configured a rule to flag, not raw unfiltered activity capture - but it is flagged here explicitly, per this task's instruction, rather than decided unilaterally as a closed question.
Credential scope (read this before connecting a real account)
This is the single most important finding in this README. Two claims, deliberately kept at different confidence levels:
(1) STRUCTURALLY VERIFIED - this connector's own code never calls a content-capture, credential-issuance, or write endpoint. Confirmed against client.ts: exactly 16 functions exist, one per tool, each a literal GET against one of the endpoints listed in the Tools section above; there is no wildcard/passthrough/generic-request function anywhere in src/. This connector is read-only and non-content-capturing by construction.
(2) VENDOR-DOCUMENTED, NOT INDEPENDENTLY VERIFIED - whether the underlying access token itself can be restricted to a metadata-only scope is a separate question from what this connector's code calls, and the answer is more nuanced than a clean yes/no:
Per Teramind's own Knowledge Base ("User Menu"; "How to change a user's access level" - both fetched directly, 2026-09-20), an access token inherits the full permissions of whichever account created it, fixed at creation time. Teramind does not offer a token-scoping mechanism independent of account role.
The default case - a single full "Administrator" account, which is what a fresh self-serve cloud trial signup produces - has NO restrictions. A token created there can reach every one of Teramind's 239 documented operations, including screen recordings, keystroke logs, and email/chat content capture. This connector's code never calls those endpoints, but the credential itself is not restricted unless the customer takes deliberate, manual, vendor-side action beyond anything this connector or Conduit controls or verifies.
Teramind does document a reduced role, "Operational Administrator," that CAN create its own access tokens and is explicitly documented as unable to "browse any recordings or view monitoring data" and unable to see "Alerts" (per Teramind's "How to change a user's access level" article, quoted directly). This is the closest documented approximation to a metadata-only token - but (a) it is a manual account-configuration choice the customer must make, not anything this connector or the Conduit connect flow enforces or checks at connect time; (b) Teramind's documentation describes this as menu/UI-level access, and no independent test was performed sending a request with an Operational-Administrator-scoped token against one of this connector's excluded endpoints to confirm a real server-side 403 versus a UI-only restriction; and (c) that role is explicitly documented as also blocking Alerts, which this connector treats as in-scope - so even the reduced role doesn't map cleanly onto this connector's own scope boundary.
A further role, "Infrastructure Administrator," is more restrictive still, but (a) cannot create its own access tokens at all (only be assigned one after creation by an Administrator), and (b) per Teramind's docs is "not able to list employee or computer accounts" - i.e. it would also block this connector's own computer/agent inventory tools, so it is not a usable configuration for this connector's purpose either.
Net finding: by default, nothing about the Teramind access token credential itself prevents it from reaching every endpoint this connector deliberately excludes. The connector's own code is the actual control boundary (per point 1 above), not the credential. Recommendation for whoever operates Gate 3 review or advises customers connecting this vendor: consider documenting that customers should create the token under a dedicated Operational Administrator account rather than a full Administrator, as defense-in-depth against a differently-configured client reusing the same stored token - while treating this connector's own code (which never calls a content-capture endpoint) as the primary, verified control.
Development
npm install
npm run build
npm test
npm run lint # tsc --noEmitDocker
docker build -t teramind-mcp .
docker run -p 8080:8080 -e TERAMIND_ACCESS_TOKEN=... -e TERAMIND_INSTANCE_URL=https://yourcompany.teramind.co teramind-mcpAvailable Tools
16 toolsteramind_get_accountA
Get the authenticated account's own settings (account name, timezone, currency) - a credential sanity check, not employee/agent data. Does not reveal what permission tier the access token's creating account holds; see this connector's README Credential scope section.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses a limitation (does not reveal permission tier) and points to README for credential scope details, adding meaningful behavioral context beyond a simple 'gets account' statement.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler. The first sentence states the core action and scope; the second clarifies limitations. Every phrase adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter tool with no output schema and no annotations, the description is remarkably complete: it states what is returned, what is not included, and a key limitation with a pointer for more details. An agent can decide to call it without further research.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. The description appropriately notes the tool takes no inputs by not adding any, and the schema coverage is trivially 100%.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Defines a specific verb (Get) and resource (authenticated account's own settings) with examples (account name, timezone, currency). Explicitly distinguishes from employee/agent data, which differentiates it from sibling tools like list_agents and get_agent.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies usage as a credential sanity check and clarifies what it is not (employee/agent data), guiding the agent away from using it for employee/agent lookups. Does not name sibling alternatives explicitly, but the contrast provides adequate context for when to use this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
teramind_get_agentA
Get full detail for a single monitored agent (user). Requires an agent ID from teramind_list_agents. Same field restriction as teramind_list_agents - no compensation or LDAP attribute data.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | Agent ID, from teramind_list_agents. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present, the description carries the burden of behavioral disclosure. It usefully reveals that the tool omits compensation and LDAP attribute data, which is a meaningful field-level restriction. However, it does not mention auth requirements, error behavior, or return shape, so transparency is only partial.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler: the core purpose is first, the prerequisite second, and the field restriction third. Every sentence contributes essential information, and the structure is easy to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter getter, the description covers the required input, the prerequisite source, and a key data limitation. It is reasonably complete even without an output schema, though a brief note on what the response contains or whether it can fail would have made it fully self-sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents the agent_id parameter adequately. The description reinforces that the ID comes from teramind_list_agents, which adds useful provenance context, but it does not add new semantic detail beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb ('Get'), a resource ('single monitored agent (user)'), and the scope ('full detail' for one agent). It is immediately distinguishable from the list-oriented sibling teramind_list_agents and the other get_* tools by naming the exact resource type.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly tells the agent that a prerequisite agent ID must come from teramind_list_agents, which is clear and actionable. It also routes around a known limitation by referencing the same field restriction as teramind_list_agents, though it does not explicitly contrast when to use this over other tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
teramind_get_anomaly_ruleA
Get full detail for a single anomaly rule. Requires a rule ID from teramind_list_anomaly_rules.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Anomaly rule ID, from teramind_list_anomaly_rules. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral disclosure burden. 'Get' implies a read operation and 'full detail' indicates the return scope, but it does not state error behavior, missing-ID handling, or whether any side effects exist; for a simple getter this is minimally acceptable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with no filler. The core action and resource are front-loaded, and the prerequisite is stated in the second sentence without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter getter with no output schema, the description provides the essential information: what it gets, how much detail, and where the ID comes from. It does not describe failure modes, but those are less critical given the simple read-only nature and required parameter.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema description already identifies the ID as an anomaly rule ID from teramind_list_anomaly_rules. The description repeats that provenance rather than adding new semantic information, so it meets the baseline but does not exceed it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Get') and resource ('full detail for a single anomaly rule'), clearly distinguishing it from list operations. It also names the upstream tool that supplies the required ID, which reinforces its role as a one-item getter among sibling list/get tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states the prerequisite: an anomaly rule ID must first be obtained from teramind_list_anomaly_rules. This gives an agent a clear entry condition, though it does not explicitly state exclusions or when to prefer a sibling tool beyond the obvious get-one vs list distinction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
teramind_get_behavior_policyA
Get full detail for a single behavior policy. Requires a policy ID from teramind_list_behavior_policies.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Behavior policy ID, from teramind_list_behavior_policies. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It says 'Get full detail,' which implies a read operation, but it does not explicitly disclose that it is read-only, nor does it mention any side effects, permissions, or response format. Since it's a simple get, the lack of extra disclosure is a minor gap; a 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One concise sentence with zero waste. The purpose is stated first, followed by the prerequisite. It is front-loaded and easily parseable, making it efficient for an agent to extract key information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple get operation with one parameter, the description is complete. It specifies the required input and its source. There is no output schema, but for a get the return structure is often inferable; still, it does not describe what fields are returned or any error conditions, but those are not critical for calling the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description for the parameter 'id' already provides 100% coverage and repeats the source (from list). The tool description adds the same information, so it does not add meaning beyond the schema. Baseline 3 is correct because the schema fully covers the parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Get full detail for a single behavior policy.' Clearly distinguishes from the sibling list tool by emphasizing 'single' and referencing the list tool for ID sourcing. The description makes it obvious this is the per-item getter, not the list or group getter.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context on when to use: 'Requires a policy ID from teramind_list_behavior_policies.' This implies a two-step flow (list then get) and gives the prerequisite. It does not explicitly state alternatives or when-not-to-use, but for a simple get the context is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
teramind_get_behavior_policy_groupA
Get full detail for a single behavior policy group. Requires a group ID from teramind_list_behavior_policy_groups.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Behavior policy group ID, from teramind_list_behavior_policy_groups. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It implies a read operation via 'Get' but does not state it explicitly, nor does it describe the return format, potential errors, or any side effects. For a simple getter this is acceptable but minimal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences with no redundancy. It front-loads the purpose and immediately provides the key prerequisite, making it efficient for an agent to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description should clarify what 'full detail' means, such as whether it includes nested objects or specific fields. The vague phrase 'full detail' leaves some ambiguity, though the tool's simplicity mitigates the gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already fully documents the 'id' parameter with a clear description referencing the source. The tool description repeats this information without adding additional semantic detail, so it adds no value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Get full detail') and the resource ('a single behavior policy group'), and explicitly references the sibling tool that provides the required ID, distinguishing it from list and get functions for other entities.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states the prerequisite ('Requires a group ID from teramind_list_behavior_policy_groups'), which is essential for correct usage. It doesn't mention alternatives or when not to use it, but the context of sibling tools makes the use case clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
teramind_get_computerA
Get full detail for a single monitored computer. Requires a computer ID from teramind_list_computers.
| Name | Required | Description | Default |
|---|---|---|---|
| computer_id | Yes | Computer ID, from teramind_list_computers. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. 'Get full detail' implies a read operation and scopes the behavior to a single computer, but it doesn't explicitly state read-only semantics, describe the return format, or mention any edge behaviors. This is adequate but not rich for a tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, zero filler. The purpose is front-loaded, and the prerequisite is stated immediately after. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter get tool with no output schema, the description fully equips an agent: what it does, what it needs, and where to obtain that input. Nothing essential for selecting or invoking the tool is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the parameter's description already states 'Computer ID, from teramind_list_computers.' The tool description repeats the same provenance requirement, reinforcing it but adding no new semantic information beyond the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Get'), a specific resource ('full detail for a single monitored computer'), and clearly distinguishes from siblings like teramind_list_computers and teramind_get_agent. An agent can immediately identify this as the single-entity retrieval counterpart to the list tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says the tool requires a computer ID from teramind_list_computers, giving a clear prerequisite and usage flow. It doesn't state explicit exclusions or name alternatives, but the list-then-get pattern is strongly implied and sufficient for this simple get tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
teramind_get_departmentA
Get full detail for a single department. Requires a department ID from teramind_list_departments.
| Name | Required | Description | Default |
|---|---|---|---|
| department_id | Yes | Department ID, from teramind_list_departments. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral context. It conveys that the operation is a read ('Get') and that it returns 'full detail,' but it does not mention error behavior, permissions, or side effects. For a simple lookup this is minimally viable but not richly disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences with no fluff. The core purpose is front-loaded, and the prerequisite is stated in a compact follow-up sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter, single-department lookup, the description plus schema cover the essential details: what is fetched and where the input ID comes from. The absence of an output schema makes 'full detail' somewhat vague, but the low complexity keeps this from being a significant gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema already documents department_id and its source. The description adds no new parameter meaning beyond the schema, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Get full detail for a single department,' which clearly distinguishes it from list-type siblings like teramind_list_departments. It is immediately obvious what the tool does and what it operates on.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states that a department ID from teramind_list_departments is required, which gives the agent a clear prerequisite and source for the ID. It does not explicitly spell out when not to use this tool, but the 'single department' qualifier and the requirement wording imply the appropriate context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
teramind_list_agentsA
List Teramind agents (Teramind's term for a monitored employee/user identity - not the software agent installed on a computer): id, name, email, avatar, online status. Agent IDs from this response are required by teramind_get_agent and are usable as filters on teramind_list_alerts. This connector never requests the underlying API's optional extended fields (salary_type, default_wage, ldap_attrs) - only these basic identity fields are ever returned.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden and does well: it explicitly discloses that extended fields (salary_type, default_wage, ldap_attrs) are never requested, so only basic identity fields are ever returned. This prevents an agent from assuming richer data is available. It does not discuss rate limits or auth, but as a simple read-only list that is a minor gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three dense sentences, each earning its place: purpose and disambiguation, downstream usage of Agent IDs, and a precise statement about omitted extended fields. No fluff or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description must explain return values, and it does: id, name, email, avatar, online status, plus the explicit note that extended fields are never returned. It also covers how the output integrates with sibling tools. For a parameterless list operation, nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. The description adds value by explaining what the response contains and how IDs can be reused, but there are no parameter semantics to elaborate beyond the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('List Teramind agents') and immediately disambiguates the term 'agent' as a monitored employee/user identity, not a software agent. It also enumerates the returned fields, making the tool's purpose unmistakable and distinct from sibling list tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear practical context for when to use this tool: it produces Agent IDs required by teramind_get_agent and usable as filters on teramind_list_alerts. It does not explicitly name when not to use it versus sibling list tools, but the usage context is strong enough for an agent to route correctly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
teramind_list_alertsA
List alerts (fired rule-violation events) in a time window - which rule fired, when, for which agent/computer, and the rule's own description/caption fields. periodStart and periodEnd are required (ISO 8601 datetime, e.g. 2026-01-01T00:00:00Z); optionally scope to specific agents/computers/departments (comma-separated IDs). NOTE: depending on the rule type that fired, a rule's description/caption/values fields MAY include a short excerpt of the triggering context (e.g. a matched keyword or URL) rather than pure metadata - this is Teramind's documented alert response shape, passed through as received.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max results. Defaults to 50. | |
| agents | No | Comma-separated agent IDs to filter by. From teramind_list_agents. | |
| offset | No | Pagination offset. Defaults to 0. | |
| computers | No | Comma-separated computer IDs to filter by. From teramind_list_computers. | |
| periodEnd | Yes | ISO datetime, inclusive upper bound. | |
| departments | No | Comma-separated department IDs to filter by. From teramind_list_departments. | |
| periodStart | Yes | ISO datetime, inclusive lower bound. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses a key behavioral nuance: the rule's description/caption/values fields may include triggering-context excerpts rather than pure metadata, and are passed through as received. This is valuable beyond the schema. However, it does not mention authentication, rate limits, or pagination behavior, which are less critical for a list operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three tight sentences. The first front-loads the core purpose, the second covers required/optional parameters, and the third contains an important caveat. Each sentence earns its place, with no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 7 parameters and no output schema, the description adequately explains the return content and the main filtering options. It doesn't mention pagination defaults or sorting, but those are inferable from the schema. The caveat about response shape adds completeness that an agent would otherwise lack.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds an ISO 8601 example for the datetime parameters and notes comma-separated IDs for filters, slightly reinforcing the schema but not adding substantial new meaning. It does not explain limit/offset beyond what the schema already says.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'List alerts (fired rule-violation events) in a time window', and enumerates the key fields returned (which rule, when, agent/computer, rule's description/caption). This clearly distinguishes it from sibling tools that list/get static entities like computers, agents, or policies.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit invocation context: required periodStart/periodEnd with ISO 8601 format and optional agent/computer/department filters. It doesn't explicitly name alternatives or when-not-to-use, but the purpose is so distinct from siblings that an agent would correctly select it. Lacks explicit exclusions, hence 4.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
teramind_list_anomaly_rulesA
List configured ML-based anomaly-detection rules (Teramind UI: "Anomaly Rules") - rule name, type/subtype, risk quotient, trigger conditions, and assignment scope. Rule CONFIGURATION metadata only - describes what is being watched for, never the captured activity that triggered a rule. Rule IDs from this response are required by teramind_get_anomaly_rule.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the behavioral disclosure burden. It satisfies this by clarifying that the tool returns rule configuration metadata only and never captured activity that triggered a rule. It also implies a read-only list operation. It does not mention pagination, rate limits, or authorization requirements, but for a zero-parameter list tool the provided boundary is meaningful and sufficient to avoid misuse.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and information-dense with no filler. The primary action comes first, followed by the returned fields, the important behavioral boundary, and the dependency relationship with teramind_get_anomaly_rule. Every clause adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter list tool with no output schema and no annotations, the description is complete enough for an agent to select and invoke it correctly. It identifies the tool's purpose, what fields will be returned, what the response represents, and how the returned IDs connect to a sibling tool. No critical missing context is apparent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there are no parameter semantics for the description to clarify. The baseline of 4 applies, and the description does not need to add parameter-specific meaning beyond what the empty input schema already shows.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the operation as listing configured ML-based anomaly-detection rules, names the resource, and enumerates the returned fields (rule name, type/subtype, risk quotient, trigger conditions, assignment scope). It also distinguishes itself from activity capture and from the sibling teramind_get_anomaly_rule by framing this as the list/metadata counterpart.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives strong context for when to use the tool: when you need configured anomaly rule metadata, and it explicitly notes that this is configuration data only, not captured triggering activity. It also states that rule IDs from this response are required by teramind_get_anomaly_rule, which effectively routes the agent to the correct next step. It does not explicitly state when not to use it relative to list_alerts or list_anomaly_rule_tags, so it falls slightly short of a full 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
teramind_list_anomaly_rule_tagsA
List the tags available to categorize anomaly rules.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. The verb 'List' clearly implies a read-only operation, but the description does not disclose response shape, error behavior, permissions, or whether tags are returned as strings or structured objects. It is not misleading, but it is minimal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single focused sentence with no filler. It front-loads the action and the object, making it immediately scannable and concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, low-complexity listing tool, the description is nearly complete: it identifies the resource and what is returned (tags). The only minor gap is the lack of an explicit response format, which is not covered by an output schema, but for such a simple operation this is a small omission.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, and the schema coverage is 100%. Per the rubric, a zero-parameter tool gets a baseline of 4. The description adds no parameter-specific semantics but none are needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List') and a specific resource ('tags available to categorize anomaly rules'). It clearly distinguishes this tool from sibling tools that list computers, agents, departments, alerts, or anomaly rules themselves.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The context of use is implied: use this tool when you need the set of valid tags for anomaly rules. However, it does not explicitly state when to prefer this over alternatives or mention any prerequisites, though the zero-parameter interface makes the usage fairly obvious.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
teramind_list_behavior_policiesA
List behavior policies (Teramind UI: "behavior policy rule") - what activity type each policy watches (e.g. web/email/print), its match conditions, and configured actions/reactions. Rule CONFIGURATION metadata only - the condition a policy matches on, never the captured activity that matched it. Policy IDs from this response are required by teramind_get_behavior_policy.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It clearly discloses a key behavioral boundary: this returns rule configuration metadata, never captured activity that matched a policy. This is useful and goes beyond the tool name alone, though it does not mention output shape or pagination.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences with no filler. The parenthetical UI mapping is useful, the configuration-only scope is front-loaded, and the dependency on get_behavior_policy is stated efficiently. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter list tool with no output schema, the description is complete enough: it explains what is listed, what kind of data is excluded, and how the response connects to a sibling tool. Nothing essential is missing for an agent to select and invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. There is nothing for the description to explain about parameters, and the schema coverage is effectively complete since there are no fields.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource ('List behavior policies') and states exactly what the response contains: activity type watched, match conditions, and actions/reactions. It also explicitly distinguishes itself from the sibling get_behavior_policy by noting that this is configuration metadata only, not captured activity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly frames this list tool as a prerequisite for teramind_get_behavior_policy by stating that policy IDs from this response are required by that tool. It does not explicitly state when not to use it or name direct alternatives, but the dependency relationship gives strong usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
teramind_list_behavior_policy_groupsA
List behavior policy groups (Teramind UI: "Behavior policy") - the containers that organize behavior policies. Group IDs from this response are required by teramind_get_behavior_policy_group.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. 'List' implies a read-only operation and the description notes that the response contains group IDs. However, it does not explicitly declare the absence of side effects, mention pagination, or describe the full response shape.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that front-loads the verb and resource, then adds two pieces of high-value context: the UI naming and the downstream dependency on the returned group IDs. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple parameterless list tool, it covers the essentials: what behavior policy groups are, how they relate to policies, and what the response is used for. It does not explicitly contrast with teramind_list_behavior_policies or enumerate response fields, but the absence of an output schema makes this a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so no parameter explanations are needed. The description correctly omits parameter details, and the 0-parameter baseline of 4 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States the exact operation ('List behavior policy groups') and identifies the resource as the containers that organize behavior policies. This clearly distinguishes it from the sibling teramind_list_behavior_policies, and the UI mapping ('Behavior policy') adds extra clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides a concrete use case: group IDs from this response are required by teramind_get_behavior_policy_group. This tells the agent when this tool is needed, though it does not explicitly state when not to use it (e.g., when listing policies themselves via teramind_list_behavior_policies).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
teramind_list_computersA
List computers under Teramind monitoring - hostname, FQDN, MAC/IP addresses, OS, monitoring status (is_monitored), and agent-software install/update state. Computer IDs from this response are required by teramind_get_computer. Inventory metadata only - never screen recordings or captured activity content.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral disclosure burden. It clearly discloses the key boundary: 'Inventory metadata only - never screen recordings or captured activity content.' It also identifies the monitoring status and agent-software state fields, giving a solid sense of what the tool does and does not expose.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each earning its place: scope and fields, downstream relationship, and data-boundary caveat. The main action is front-loaded and there is no filler or repetition of schema information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless list tool with no output schema, the description is complete enough. It names the response fields, clarifies the monitoring/agent-state semantics, links to the dependent get_computer tool, and states the critical exclusion of recording content. An agent can select and invoke it correctly without additional context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema is empty, so there are no parameters to document; the baseline of 4 applies. The description adds no parameter syntax, but none is needed, and it enriches the agent's understanding by enumerating the response fields.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('List computers under Teramind monitoring') and enumerates the returned fields, making the tool's purpose immediate. It is clearly distinct from sibling tools like teramind_list_agents and teramind_get_computer, and it even names the downstream consumer of the returned IDs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use this tool: to obtain computer inventory metadata and the IDs required by teramind_get_computer. It also adds an exclusion by warning that screen recordings or captured activity content are never returned, though it does not explicitly enumerate alternatives or a full when-not-to-use set.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
teramind_list_departmentsA
List departments configured in Teramind - org-structure metadata used to group agents/computers. Department IDs from this response are usable as filters on teramind_list_alerts.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden for behavioral disclosure, but it only reveals that department IDs appear in the response. It does not state that the operation is read-only/safe, whether results are paginated, what fields a department record contains, or what happens when no departments exist. The description adds the filter-usage hint but leaves the behavior largely implicit.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with no filler: the first states the action and domain meaning, the second delivers a concrete downstream use case. Every clause earns its place, and the most important information (what the tool lists) is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless list tool with no output schema, the description explains the resource, its purpose, and a realistic calling context (generating filter IDs for alerts). The main remaining gap is the response shape beyond 'department IDs' and any pagination or auth considerations, but the description is otherwise sufficient for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and the schema is empty, so there is nothing for the description to document. Per the baseline for parameterless tools, a score of 4 applies; the description needs to convey no parameter semantics because none exist.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses a specific verb-resource pair ('List departments configured in Teramind') and clarifies what departments are (org-structure metadata for grouping agents/computers). It also differentiates from the sibling teramind_get_department by framing this as the list variant, and gives the response a distinct purpose via the filter hint for teramind_list_alerts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context: the tool's output (department IDs) is meant to be consumed as filter values by teramind_list_alerts, which tells an agent when this list is useful. It does not explicitly state exclusions or alternate choices (e.g., when to prefer teramind_get_department), so it stops short of full when/when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
teramind_list_monitoring_profilesA
List monitoring profiles - named configurations describing WHICH data types are captured (e.g. web activity, email, keystrokes) and for which agents, plus whether the profile is private. This is metadata ABOUT the scope of monitoring (what is configured to be watched, and for whom) - never the captured content itself.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden and does substantive work: it clarifies that the result is metadata about monitoring scope, not monitored content, and notes the private flag. It does not address pagination, authorization, or errors, but for a zero-parameter list operation the core behavior and semantic boundary are disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two compact sentences, with the action and resource front-loaded and a clarifying boundary in the second sentence. No filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple (no parameters, no output schema), and the description explains what a monitoring profile is, which attributes are present (data types, agents, privacy), and what it is not (content). This is enough for an agent to call it correctly, though exact response formatting is not specified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, so the baseline is 4 and no parameter documentation is needed. The description adds no parameter semantics, but there are none to document; it instead helps by describing what the returned profiles contain.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource ('List monitoring profiles') and immediately defines what a monitoring profile is, differentiating it from sibling list tools for computers, agents, departments, alerts, and policies. The clarification that this is metadata and never captured content removes ambiguity about what is being listed.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for retrieving profile configuration metadata and explicitly says it is not for captured content, but it does not name sibling alternatives or state when to choose this over a related list tool. Usage context is inferable from the resource, not explicitly routed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
16 tool updates
v0.1.0- First observed
teramind_get_account - First observed
teramind_get_agent - First observed
teramind_get_anomaly_rule - First observed
teramind_get_behavior_policy - First observed
teramind_get_behavior_policy_group - First observed
teramind_get_computer - First observed
teramind_get_department - First observed
teramind_list_agents - First observed
teramind_list_alerts - First observed
teramind_list_anomaly_rule_tags - First observed
teramind_list_anomaly_rules - First observed
teramind_list_behavior_policies - First observed
teramind_list_behavior_policy_groups - First observed
teramind_list_computers - First observed
teramind_list_departments - First observed
teramind_list_monitoring_profiles
TDQS
Scored across 16 tools
Each tool targets a distinct resource or operation: computers, agents, departments, alerts, rules, policies, groups, profiles, and account settings are clearly separated. The list/get pairs are unambiguous, and descriptions clarify potentially overlapping concepts like anomaly rules versus behavior policies.
All tools follow a consistent teramind_list_<plural> / teramind_get_<singular> pattern with snake_case throughout. Minor exceptions like teramind_get_account and teramind_list_alerts still fit the broader list/get convention and do not create confusion.
With 16 tools, the server is slightly above the typical 3-15 range, but each tool maps to a meaningful entity or lookup operation in the Teramind domain. The count is reasonable for the breadth of resources covered and does not feel bloated.
The read-only metadata surface covers the major Teramind entities: computers, agents, departments, alerts, anomaly rules, behavior policies, policy groups, and monitoring profiles. Minor gaps exist, such as no single-alert getter or monitoring-profile detail endpoint, but agents can accomplish core monitoring and configuration-discovery workflows without dead ends.
Maintenance
Related MCP Connectors
Read-only access to your VortexIQ store data: audits, KPIs, alerts, Brand DNA, reports, Ask VIQ.
Read-only access to your Drivara fleet — jobs, drivers, vehicles, fuel, profit & analytics.
Read-only access to a Lumin project's logs, metrics, uptime checks, alerts and infrastructure.
Read-only MCP access to a documented IT fleet: state, changes, posture. 15 tools.
Related MCP Servers
- FlicenseBqualityDmaintenanceEnables read-only access to FileMaker databases through the Data API, allowing users to retrieve records, analyze metadata, search across layouts, and infer relationships while maintaining data security.16-
- AlicenseNot gradedqualityCmaintenanceProvides read-only access to Tactical RMM, enabling agent searches, detailed agent information, audit log queries, and execution of information-gathering PowerShell scripts on agents, with Entra ID authentication and a strict read-only guard.MIT
- AlicenseAqualityAmaintenanceEnables MCP clients to securely access Jisr's documented HR Open API read-only operations, including employees, attendance, leave, payroll, finance, and discovery tools, with role-based field policies and dual protocol support.11MIT
- AlicenseNot gradedqualityCmaintenanceEnables inspecting customer-data sources, destinations, connections, and warehouses through Segment's Public API with read-only access.MIT