Skip to main content
Glama
amittell

firewalla-mcp-server

by amittell
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Remote

get_flow_insights

Read-only

Analyze network traffic by content category and device bandwidth over a period, optionally including blocked flows, to identify accessed sites like social media or porn.

Instructions

Get category-based flow analysis for a period: top content categories and their domains, top devices by bandwidth, and optionally blocked traffic. Ideal for answering questions like "what porn sites were accessed" or "what social media was used". Computed client-side from the period's largest flows (GET /v2/flows by total bytes: up to 500 for categories, 200 for devices) and, with include_blocked, the 50 most frequent blocked flows, so on a busy network it covers the largest flows, not all of them. Scoped to FIREWALLA_BOX_ID when set, otherwise every box.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
periodNoTime period for analysis (default: 24h)24h
categoriesNoFilter to specific content categories (optional)
include_blockedNoInclude blocked traffic analysis (default: false)
response_formatNoResponse format. 'json' (default): the compact JSON response. 'markdown': the same response as readable markdown, its fields as bullet lists and each list of records as a table of up to 8 columns and DEFAULT_PAGE_SIZE rows (default 100), ending with a line that says what the view leaves out. Omitted or null: 'json'. Errors are JSON either way.json

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changedv2.0.1
    • addedInput schema / properties / response_format
      Added value: +{
+  "default": "json",
+  "description": "Response format. 'json' (default): the compact JSON response. 'markdown': the same response as readable markdown, its fields as bullet lists and each list of records as a table of up to 8 columns and DEFAULT_PAGE_SIZE rows (default 100), ending with a line that says what the view leaves out. Omitted or null: 'json'. Errors are JSON either way.",
+  "enum": [
+    "json",
+    "markdown",
+    null
+  ],
+  "type": [
+    "string",
+    "null"
+  ]
+}
  2. First observed

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the readOnly/openWorld annotations by disclosing the sampling basis (GET /v2/flows by total bytes: up to 500 for categories, 200 for devices; 50 most frequent blocked flows with include_blocked), an explicit coverage caveat ('covers the largest flows, not all of them'), and the scope rule (FIREWALLA_BOX_ID when set, otherwise every box). These are exactly the behavioral traits an agent needs and cannot infer from structured fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and use cases are front-loaded, and every sentence carries information. However, it is a single dense paragraph with deep nesting like '(GET /v2/flows by total bytes: up to 500 for categories, 200 for devices)', which slightly taxes readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With annotations covering the safety profile and no output schema required, the description supplies the remaining essentials: use cases, computation method, sampling limits, and scoping. An agent has everything needed to call it correctly and to know when not to rely on it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is already 100%, so the baseline is 3. The description still adds meaning beyond the schema by explaining what include_blocked actually pulls in (the 50 most frequent blocked flows) and how period-scoped aggregation is computed, exceeding the flat schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

It gives a specific verb and resource ('Get category-based flow analysis for a period') and enumerates the concrete payload: top categories/domains, top devices by bandwidth, and optional blocked traffic. The aggregate-analysis framing implicitly separates it from raw-flow siblings like search_flows and get_flow_data, but no sibling is named, so it stops short of explicit differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Strong when-to-use signal via the concrete example questions ('what porn sites were accessed', 'what social media was used'). The mention that it covers only the largest flows hints at when a raw-flow alternative is needed, but no alternative tool or explicit exclusion is named.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools