Illumio MCP Server

get-traffic-flows

Retrieve Illumio PCE traffic flows with date, source, destination, service, and policy filters; group results to analyze network communication and policy impact.

Instructions

Get traffic flows from the PCE with comprehensive filtering options

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "start_date": "<start_date>",
      "end_date": "<end_date>"
    },
    "name": "get-traffic-flows"
  }
}

Input Schema

Name	Required	Description
`end_date`	Yes	Ending datetime (YYYY-MM-DD or timestamp)
`group_by`	No	Dimensions to aggregate by. Any of: process, service_name, user, source, source_app, destination, dest_app, fqdn, ip_list, port, proto, policy, rule, direction. Fewer dimensions gives fewer, larger rows - e.g. ['process','fqdn'] answers 'which binary talks to which external name'. Defaults to a full per-flow breakdown.
`query_name`	No
`start_date`	Yes	Starting datetime (YYYY-MM-DD or timestamp)
`max_results`	No
`exclude_sources`	No	Sources to exclude (label/IP list/workload HREFs, IPs; FQDNs are destination-only)
`include_sources`	No	Sources to include. Accepts label shorthand 'key=value' (e.g. 'app=vdi'), which the server resolves to a label HREF, as well as label/IP list/workload HREFs and IPs. FQDNs and broadcast/multicast/unicast are destination-only (the PCE rejects them on sources). Omit to match all sources.
`exclude_services`	No
`include_services`	No
`policy_decisions`	No
`exclude_destinations`	No	Destinations to exclude (label/IP list/workload HREFs, FQDNs, IPs)
`include_destinations`	No	Destinations to include. Accepts label shorthand 'key=value' (e.g. 'app=vdi'), as well as label/IP list/workload HREFs, FQDNs and IPs. Omit to match all destinations.
`exclude_workloads_from_ip_list_query`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed2 schema fields changedv0.13.0Oct 31, 2026

changedInput schema / properties / exclude_sources / description

Previous value: -"Sources to exclude (label/IP list/workload HREFs, FQDNs, IPs)"New value: +"Sources to exclude (label/IP list/workload HREFs, IPs; FQDNs are destination-only)"

changedInput schema / properties / include_sources / description

Previous value: -"Sources to include. Accepts label shorthand 'key=value' (e.g. 'app=vdi'), which the server resolves to a label HREF, as well as label/IP list/workload HREFs, FQDNs and IPs. Omit to match all sources."New value: +"Sources to include. Accepts label shorthand 'key=value' (e.g. 'app=vdi'), which the server resolves to a label HREF, as well as label/IP list/workload HREFs and IPs. FQDNs and broadcast/multicast/unicast are destination-only (the PCE rejects them on sources). Omit to match all sources."

Changed3 schema fields changedv0.8.0Sep 18, 2026

addedInput schema / properties / group_by

Added value: +{
+  "description": "Dimensions to aggregate by. Any of: process, service_name, user, source, source_app, destination, dest_app, fqdn, ip_list, port, proto, policy, rule, direction. Fewer dimensions gives fewer, larger rows - e.g. ['process','fqdn'] answers 'which binary talks to which external name'. Defaults to a full per-flow breakdown.",
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}

changedInput schema / properties / include_destinations / description

Previous value: -"Destinations to include (label/IP list/workload HREFs, FQDNs, IPs)"New value: +"Destinations to include. Accepts label shorthand 'key=value' (e.g. 'app=vdi'), as well as label/IP list/workload HREFs, FQDNs and IPs. Omit to match all destinations."

changedInput schema / properties / include_sources / description

Previous value: -"Sources to include (label/IP list/workload HREFs, FQDNs, IPs)"New value: +"Sources to include. Accepts label shorthand 'key=value' (e.g. 'app=vdi'), which the server resolves to a label HREF, as well as label/IP list/workload HREFs, FQDNs and IPs. Omit to match all sources."

Addedv1.0.0Jan 2, 2026

TDQS

C2.6/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden, yet it discloses nothing beyond the bare operation. It does not state that this is a read-only query, how max_results or query_name behave, whether results are paginated, or what a returned flow record contains — meaningful gaps for a 13-parameter analytics query.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence is efficiently sized, but it is not front-loaded with anything actionable and the 'comprehensive filtering options' clause is filler that could have been replaced with real guidance at no extra length cost.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 13 parameters, no annotations, and no output schema, the description is far too thin: it does not explain the return shape, result caps, the purpose of query_name, or the source-vs-destination asymmetry that the schema only partially captures. An agent would be calling this largely blind.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 54%, and the description contributes nothing parameter-specific — 'comprehensive filtering options' tells an agent nothing about include/exclude semantics, group_by aggregation, or the port/proto service objects. Parameters left undocumented in the schema (query_name, max_results, include_services, policy_decisions, exclude_workloads_from_ip_list_query) remain unexplained in both places.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Get traffic flows from the PCE'), so an agent knows the core operation. However, it does not distinguish this from close siblings such as get-traffic-flows-summary, get-traffic-timeline, or find-unmanaged-traffic, and the trailing phrase 'with comprehensive filtering options' adds no discriminating information.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use guidance, no when-not-to-use exclusions, and no mention of the summary/timeline siblings that overlap heavily. An agent must infer from the name alone whether it wants raw per-flow data or an aggregated view.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server