Skip to main content
Glama
ajaybe-ops
by ajaybe-ops

Read a persisted triage report

get_incident_report
Read-onlyIdempotent

Retrieve the persisted triage report for an incident ID to review findings or resume an investigation. Returns an error when no report exists.

Instructions

Read the latest persisted triage report for an incident id. Use after triage_incident, or to resume an investigation. Returns an error when no report exists. Read-only. Scope: aegis:read.

Input Schema

NameRequiredDescriptionDefault
incident_idYes

Output Schema

NameRequiredDescriptionDefault
statusYes
actionsNo
sourcesNo
summaryYesDeterministic, template-generated summary
coverageYes
findingsNo
report_idYes
risk_bandYes
incident_idYes
generated_atYes
trust_noticeNoFindings combine untrusted external feeds with deterministic local scoring. No text from a feed is executed. Confirm affected versions before remediation.
max_risk_scoreYes
policy_versionNorisk-v1
reused_existingNo
partial_failuresNo
asset_criticalityYes
input_fingerprintYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent and non-destructive, so the description earns credit for adding what they don't cover: an error is returned when no report exists, 'latest' implies versioned reports with older ones superseded, and the required 'aegis:read' scope is an auth prerequisite. Return payload details are rightly omitted since an output schema exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four short sentences, front-loaded with the action and scope, then ordering guidance, then failure mode. No redundant restatement of the title or annotations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read tool with an output schema and full annotations, the description covers purpose, timing, failure mode, and permissions. The remaining gap is where the agent obtains a valid incident_id, which is the one thing an agent could get wrong when calling this.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the only parameter, incident_id, is undocumented in the schema. The description only says 'for an incident id' and does not add format, provenance (presumably the id returned by triage_incident), or what happens with an unknown id beyond the generic no-report error.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Read the latest persisted triage report for an incident id.' The word 'persisted' plus 'latest' distinguishes it from the sibling triage_incident, which produces reports rather than reading them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete ordering guidance ('Use after triage_incident, or to resume an investigation'), which tells the agent when this is the right call. It stops short of an explicit exclusion, such as telling the agent to run triage_incident instead when no report exists yet.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.