dataranger

Overview Schema Source Related Servers Discussions Admin

get_incident

Read-onlyIdempotent

Retrieve the full evidence for one recorded incident from a completed patrol to explain why a partition was auto-fixed or escalated and show what to review.

Instructions

Return the full evidence behind one incident from a patrol that has already run.

Use this after patrol_duckdb, patrol_files or run_demo, when you need to explain why a partition was
auto-fixed or escalated, or to show the user what to review. A patrol records at most one incident per
partition, so the folder plus the partition date identifies it. Do not call it before a patrol.

Behavior: read-only. It reads audit.jsonl in out_dir and changes nothing; no network calls, returns
immediately, and the result is one record of a few kilobytes. Fails with a readable error if the
folder has no audit.jsonl (run a patrol first) or no incident exists for that partition.

Returns one record with: partition, detectors (the problems found), decision, context (row counts and
amounts for the day and for each segment, next to the source's control totals), candidates (every fix
that was tried, with whether it kept the invariants and the residual gap it left) and chosen (the
best-supported candidate).

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "out_dir": "<out_dir>",
      "partition": "<partition>"
    },
    "name": "get_incident"
  }
}

Input Schema

Name	Required	Description	Default
`out_dir`	Yes	The outputs.folder value returned by patrol_duckdb, patrol_files or run_demo.
`partition`	Yes	Which incident: the partition date as YYYY-MM-DD, copied from an incident's 'partition' field, or 'table-level' for a problem with the whole table such as a schema change.

Output Schema

Name	Required	Description	Default
No arguments

Schema Changelog

Changes observed during successful MCP inspections.

Changed3 schema fields changedv0.4.2Nov 12, 2026

addedInput schema / properties / out_dir / description

Added value: +"The outputs.folder value returned by patrol_duckdb, patrol_files or run_demo."

addedInput schema / properties / partition / description

Added value: +"Which incident: the partition date as YYYY-MM-DD, copied from an incident's 'partition' field, or 'table-level' for a problem with the whole table such as a schema change."

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "additionalProperties": true,
+  "title": "get_incidentDictOutput",
+  "type": "object"
+}

First observedv0.1.0Nov 12, 2026

TDQS

A4.8/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare read-only, idempotent, closed-world, non-destructive, but the description adds real value beyond them: it names the file read (audit.jsonl in out_dir), states no network calls, immediate return, result size of a few kilobytes, and two concrete failure modes (missing audit.jsonl, no incident for that partition).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is front-loaded and segmented with 'Behavior:' and 'Returns one record with:' labels, and every sentence carries information. The return-field enumeration slightly overlaps the existing output schema, which is the only redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter read tool with annotations and an output schema, nothing an agent needs is absent: prerequisites, side-effect profile, failure behavior, and the identifying semantics of the arguments are all covered.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so both parameters are already documented; the description still adds uniqueness semantics ('a patrol records at most one incident per partition, so the folder plus the partition date identifies it'), which tells the agent why the pair of arguments is sufficient and unambiguous.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Return the full evidence behind one incident from a patrol that has already run.' It explicitly ties itself to the patrol-producing siblings (patrol_duckdb, patrol_files, run_demo), so an agent can place it in the workflow without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states both when to use it ('after patrol_duckdb, patrol_files or run_demo, when you need to explain why a partition was auto-fixed or escalated') and when not to ('Do not call it before a patrol'), with the motivating user scenario included.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server