ThreatByte-MCP
ThreatByte-MCP is a deliberately vulnerable SOC (Security Operations Center) case management MCP server designed for cybersecurity training, featuring a Flask web UI and an MCP server exposing tools across several domains:
Case Management
cases.create— Create a case with title, status, and severitycases.list/cases.list_all— List cases by owner or all cases across users (broken access control — intentional)cases.get/cases.rename/cases.set_status/cases.delete— Retrieve, rename, update status, or delete cases (ownership not enforced — intentional)
Notes Management
notes.create— Add a note to a case (HTML supported — stored XSS intentional)notes.list/notes.update/notes.delete— List, update, or delete notes (ownership not enforced — intentional)
File Management
files.upload— Upload a base64-encoded file and associate it with a casefiles.list/files.get— List or retrieve files by ID (returns base64)files.read_path— Read arbitrary filesystem paths (intentional vulnerability)
Indicator Search
indicators.search— Query a mock IOC dataset by string (SQL injection — intentional)
AI Agent Workflows
agent.summarize_case— LLM-powered summarization of case notesagent.run_task— Run custom analyst tasks over case context (prompt injection — intentional; requires OpenAI API key)
Tool Registry
tools.registry.list/tools.registry.register/tools.registry.delete— List, register/update, or delete dynamic tool definitions (tool poisoning — intentional)tools.builtin.list— List all built-in server tools
Intentional Vulnerabilities (Training Focus)
Broken Object Level Authorization (BOLA) on cases, notes, and files
Stored XSS via HTML-rendered notes
SQL injection in indicator search
Prompt injection in agent task runner
Arbitrary file read via
files.read_pathTool poisoning via schema-driven registry overrides
Hardcoded/exposed tokens and identity spoofing via over-trusted client headers
Cross-user file overwrite due to shared filename namespace
Integrates with OpenAI's models to provide Large Language Model capabilities for agent-driven workflows, including automated task execution and case summarization within the management platform.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@ThreatByte-MCPsummarize case #12 and search for any related indicators"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
ThreatByte-MCP
ThreatByte-MCP is a deliberately vulnerable, MCP-based case management web app. It mirrors a realistic SOC analyst workflow with a server-rendered UI and a real MCP server. The MCP tools are intentionally vulnerable for training and demonstration.
For educational use in controlled environments only.
Related MCP server: Damn Vulnerable Model Context Protocol (DVMCP)
Features
Safe web authentication (signup/login/logout)
Case management UI (create/list/view cases)
Notes and attachments tied to cases
Indicator search and agent workflows via MCP tools
Agent customization with schema-based tool registry
MCP Server (SDK, JSON-RPC)
ThreatByte-MCP is a split architecture:
SOC Web App (client/UI) runs on port 5001.
MCP Server (tools + agent) runs on port 5002 using the official MCP Python SDK (FastMCP).
The MCP server exposes JSON-RPC at POST http://localhost:5002/mcp (Streamable HTTP). The web UI calls the MCP server through a server-side proxy to keep auth consistent with the SOC session; the proxy streams agent responses to the browser via SSE. A sample mcp.json manifest is included at the repo root.
All direct MCP calls must include MCP-Protocol-Version: 2025-11-25 and Accept: application/json, text/event-stream.
Architecture (simplified):
Browser
|
v
+------------------+ X-TBMCP-Token + X-TBMCP-User +-------------------+
| SOC Web App | ---------------------------------------> | MCP Server |
| (Flask, :5001) | /mcp-proxy (server-side) | (FastMCP, :5002) |
+------------------+ +-------------------+
| |
v v
SQLite DB Tool registry
Agent + tool handlersArchitecture (detailed):
Mode A (Web UI as HTTP MCP client)
Browser (Analyst)
|
v
SOC Web App (Flask, :5001)
- Auth session (cookie)
- Dashboards, cases, notes, files UI
- POST /mcp-proxy forwards JSON-RPC
- Injects X-TBMCP-Token + X-TBMCP-User to the MCP server
|
+--> SQLite DB (users/cases/notes/files/indicators)
+--> Uploads (app/uploads)
|
v
MCP Server (FastMCP, :5002)
- /mcp JSON-RPC (Streamable HTTP)
- Tool registry (mcp_tools)
- Agent runtime + tool handlers
- Persistence: agent_contexts, agent_logs, mcp_audit_logs
Mode B (Local agent/IDE as stdio MCP client)
Local Agent / IDE (e.g., Claude Desktop) spawns:
python run_mcp_server.py --stdio
and communicates via stdin/stdout JSON-RPC (stdio transport).Diagram: ThreatByte-MCP architecture diagram
MCP Auth Between Web App and MCP Server
The web app proxies MCP calls with these headers:
X-TBMCP-Token: shared secret fromTBMCP_MCP_SERVER_TOKEN(configured on both servers).X-TBMCP-User: current user id from the authenticated SOC session.
Direct MCP calls require the same headers.
Supported tools:
cases.createcases.listcases.list_allcases.getcases.renamecases.set_statuscases.deletenotes.createnotes.listnotes.updatenotes.deletefiles.upload(base64)files.listfiles.get(base64)files.read_pathindicators.searchagent.summarize_caseagent.run_tasktools.registry.listtools.builtin.listtools.registry.registertools.registry.delete
Vulnerability Themes (Training-Focused)
The following weaknesses are intentionally present for teaching:
Broken object level authorization (cases/notes/files, list_all)
Stored XSS (notes rendered as trusted HTML)
SQL injection in indicator search
Prompt injection in agent task runner
Token mismanagement & secret exposure (hardcoded tokens in prompts, persisted contexts, full logs)
Tool poisoning via schema-driven tool registry overrides (MCP03)
Over-trusting client context (MCP header identity spoofing)
Arbitrary file read via
files.read_pathCross-user file overwrite (shared filename namespace)
Running Locally
cd ThreatByte-MCP
python -m venv venv_threatbyte_mcp
source venv_threatbyte_mcp/bin/activate
pip install -r requirements.txt
python db/create_db_tables.py
python run_mcp_server.py --http
python run.pyOpen: http://localhost:5001
MCP Server: http://localhost:5002/mcp
HTTP vs stdio
This repository ships two MCP server transports:
HTTP (Streamable HTTP): what the ThreatByte web app uses. The web app is an HTTP MCP client only, via the server-side
/mcp-proxyforwarder.stdio: for external MCP clients (e.g., IDE/agent clients) that spawn the MCP server and communicate over stdin/stdout.
Examples:
# HTTP (required for the web app)
python run_mcp_server.py --http --host 127.0.0.1 --port 5002
# stdio (for MCP clients that support stdio transport; the web app will NOT work with this)
# In stdio mode there are no HTTP headers, so the server reads user context from env vars.
# Note: stdio mode runs the MCP server on AnyIO's Trio backend; ensure `trio>=0.28.0` is installed.
export TBMCP_MCP_SERVER_TOKEN=tbmcp-mcp-token
export TBMCP_MCP_USER_ID=1
python run_mcp_server.py --stdioClaude Desktop compatibility (tool names)
Some MCP clients (e.g., Claude Desktop) enforce strict tool name validation (^[a-zA-Z0-9_-]{1,64}$) and will reject dotted tool names like cases.create.
To run the MCP server in a Claude-compatible mode, set:
TBMCP_TOOL_NAME_MODE=claude
This exposes tools as underscore names (e.g., cases_create, tools_registry_register, files_read_path) instead of dotted names.
For a complete walkthrough (Windows + WSL stdio), see Claude Desktop setup.
Running with Docker or Podman
The repository includes a Dockerfile and startup script that initialize the DB and run both services in one container:
SOC Web App on
:5001MCP Server on
:5002
Build the image:
# Docker
docker build -t threatbyte-mcp .
# Podman
podman build -t threatbyte-mcp .Run the container:
# Docker
docker run --rm -p 5001:5001 -p 5002:5002 threatbyte-mcp
# Podman
podman run --rm -p 5001:5001 -p 5002:5002 threatbyte-mcpRun with optional environment variables:
# Docker
docker run --rm -p 5001:5001 -p 5002:5002 \
-e TBMCP_MCP_SERVER_TOKEN=tbmcp-mcp-token \
-e OPENAI_API_KEY=your_api_key \
-e TBMCP_OPENAI_MODEL=gpt-4o-mini \
threatbyte-mcp
# Podman
podman run --rm -p 5001:5001 -p 5002:5002 \
-e TBMCP_MCP_SERVER_TOKEN=tbmcp-mcp-token \
-e OPENAI_API_KEY=your_api_key \
-e TBMCP_OPENAI_MODEL=gpt-4o-mini \
threatbyte-mcpPersist SQLite data between runs (optional):
# Docker
docker run --rm -p 5001:5001 -p 5002:5002 \
-v "$(pwd)/db:/app/db" \
-v "$(pwd)/app/uploads:/app/app/uploads" \
threatbyte-mcp
# Podman
podman run --rm -p 5001:5001 -p 5002:5002 \
-v "$(pwd)/db:/app/db:Z" \
-v "$(pwd)/app/uploads:/app/app/uploads:Z" \
threatbyte-mcpPopulate Sample Data
python db/populate_db.py --users 8 --cases 20 --notes 40 --files 20This creates random users, cases, notes, and file artifacts. All user passwords are Password123!.
LLM Integration (Required for Agent Responses)
The agent task endpoint requires a real LLM. Without an API key, the agent returns an error indicating it is unavailable.
Environment variables:
TBMCP_OPENAI_API_KEYorOPENAI_API_KEYTBMCP_OPENAI_MODEL(default:gpt-4o-mini)
Keep API keys server-side only and never expose them in the browser.
MCP Server Configuration
The SOC web app proxies MCP calls to the MCP server using a shared token.
Environment variables:
TBMCP_MCP_SERVER_URL(default:http://localhost:5002/mcp)TBMCP_MCP_SERVER_TOKEN(shared secret between the SOC app and MCP server)
Notes
The UI uses server-rendered templates.
MCP tools are exposed under
http://localhost:5002/mcp(JSON-RPC). The UI calls them through/mcp-proxy.Useful UI pages for training:
My Cases(all cases owned by the logged-in user)MCP Audit Logs(server-side audit trail of MCP tool calls from HTTP + stdio clients)Agent Logs(internal agent runner traces; populated byagent.run_task)
This app is intentionally insecure. Do not deploy it to the public internet.
Available Tools
22 toolsagent.run_taskC
Run an analyst task over case context.
| Name | Required | Description | Default |
|---|---|---|---|
| case_id | Yes | ||
| task | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It states the action ('run') but doesn't disclose behavioral traits such as whether this is a read-only or mutating operation, expected runtime, error conditions, or output format. For a tool with no annotations and two parameters, this leaves significant gaps in understanding its behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that gets straight to the point without unnecessary words. It's appropriately sized for a basic tool, though it could be more informative. The structure is clear but under-specified rather than concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (a task-running tool with no annotations, 0% schema coverage, and no output schema), the description is incomplete. It doesn't explain what 'run' entails, what tasks are available, expected outputs, or how it integrates with the system. For a tool that likely involves execution logic, this is inadequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It mentions 'case context' and 'analyst task', hinting at the parameters 'case_id' and 'task', but doesn't explain what values are valid for 'task' (e.g., types of tasks) or how 'case_id' relates to other tools. This adds minimal meaning beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Run an analyst task over case context' specifies the verb ('run') and resource ('analyst task'), but is vague about what constitutes a 'task' or what 'run' entails. It distinguishes from obvious siblings like 'cases.get' but not clearly from 'agent.summarize_case' which might be a specific task type. The purpose is understandable but lacks specificity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. It doesn't mention prerequisites (e.g., needing an existing case), exclusions, or how it relates to siblings like 'agent.summarize_case' (which might be a specialized task). The description implies usage for tasks on cases but offers no further context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agent.summarize_caseD
Summarize case notes.
| Name | Required | Description | Default |
|---|---|---|---|
| case_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It only states the action without detailing how summarization works (e.g., algorithm, length, format), whether it requires specific permissions, or what the output looks like. This leaves critical behavioral traits unspecified.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with just three words, making it front-loaded and free of unnecessary details. However, this brevity contributes to underspecification rather than effective communication.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of a summarization tool with no annotations, 0% schema coverage, and no output schema, the description is severely incomplete. It lacks details on behavior, parameters, output, and differentiation from siblings, making it inadequate for effective tool selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description provides no information about the single parameter 'case_id'. It does not explain what a case ID is, where to find it, or its format, failing to compensate for the lack of schema documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Summarize case notes' restates the tool name 'agent.summarize_case' in slightly different words, making it tautological. While it indicates the general action (summarize) and target (case notes), it lacks specificity about what 'summarize' entails or how it differs from related tools like notes.list or notes.create.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. With sibling tools like notes.list, notes.create, and cases.get, the description fails to specify scenarios, prerequisites, or exclusions for using this summarization tool over other note-related operations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cases.createC
Create a new security case.
| Name | Required | Description | Default |
|---|---|---|---|
| title | Yes | ||
| severity | No | low | |
| status | No | open |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. While 'Create' implies a write operation, it doesn't specify required permissions, whether the operation is idempotent, what happens on failure, or the response format. This is inadequate for a mutation tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with no wasted words. It's front-loaded with the core action and resource, making it easy to parse quickly, though this brevity comes at the cost of detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a creation tool with 3 parameters, 0% schema coverage, no annotations, and no output schema, the description is insufficient. It doesn't explain the parameters, behavioral traits, or what to expect upon success/failure, leaving significant gaps for the agent to operate effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, meaning none of the parameters (title, severity, status) are documented in the schema. The description adds no information about these parameters—it doesn't explain what 'title' represents, what 'severity' levels are available, or what 'status' options exist. This fails to compensate for the schema's lack of documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Create') and resource ('a new security case'), making the purpose immediately understandable. However, it doesn't differentiate this tool from sibling tools like 'notes.create' or 'files.upload' that also create resources, missing the opportunity to specify this is specifically for security cases.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites, when to choose this over similar creation tools (like 'notes.create'), or any contextual constraints, leaving the agent with minimal usage direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cases.deleteB
Delete a case by id.
| Name | Required | Description | Default |
|---|---|---|---|
| case_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool deletes a case, implying a destructive, irreversible mutation, but fails to mention critical details like required permissions, confirmation prompts, error handling (e.g., what happens if the case doesn't exist), or side effects (e.g., whether associated notes or files are also deleted). This is inadequate for a destructive operation with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, direct sentence with no wasted words. It front-loads the key action ('Delete') and resource ('a case'), making it immediately scannable and efficient. Every word earns its place, achieving optimal conciseness for such a straightforward tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's destructive nature, lack of annotations, and absence of an output schema, the description is incomplete. It doesn't address behavioral risks, error conditions, or return values, leaving significant gaps for safe and effective use. For a deletion tool with no structured safety cues, more context is needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaningful context beyond the input schema by specifying that deletion requires a case ID. Since the schema has 0% description coverage (no parameter descriptions) and only one parameter, this clarification is valuable. However, it doesn't elaborate on ID format or validation rules, which slightly limits its utility.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Delete') and resource ('a case by id'), making the purpose immediately understandable. It distinguishes from sibling tools like cases.get, cases.list, and cases.create by specifying deletion rather than retrieval or creation. However, it doesn't explicitly differentiate from other deletion tools like notes.delete or tools.registry.delete, which prevents a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites (e.g., needing an existing case ID), exclusions (e.g., not for deleting notes or files), or comparisons with similar tools like cases.set_status for archiving instead of deletion. This leaves the agent with insufficient context for optimal tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cases.getC
Get a case by id (ownership not enforced).
| Name | Required | Description | Default |
|---|---|---|---|
| case_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden but offers minimal behavioral context. 'Get' implies a read operation, but it doesn't disclose error handling, authentication needs, rate limits, or what 'ownership not enforced' entails operationally.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with a single sentence that directly states the tool's function. There is no wasted language, making it efficiently front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no annotations, no output schema, and 0% schema coverage, the description is incomplete. It lacks details on return values, error conditions, and the implications of 'ownership not enforced', leaving significant gaps for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate but adds little beyond the schema. It mentions 'by id' which aligns with the case_id parameter, but provides no additional meaning about format, constraints, or examples.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Get') and resource ('a case by id'), making the purpose specific and understandable. It distinguishes from siblings like cases.list by focusing on retrieval of a single case, though it doesn't explicitly name alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like cases.list or cases.list_all. It mentions 'ownership not enforced' but doesn't explain what this means in practice or when it's relevant.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cases.listC
List cases. Accepts optional owner_id.
| Name | Required | Description | Default |
|---|---|---|---|
| owner_id | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. 'List cases' implies a read operation, but doesn't disclose pagination behavior, sorting, default limits, authentication requirements, or rate limits. The optional 'owner_id' parameter is mentioned but without context about what happens when omitted. For a list tool with zero annotation coverage, this leaves significant behavioral questions unanswered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise with just two sentences. The first sentence states the core purpose, the second adds the only parameter information. No wasted words or redundant phrasing. Perfectly front-loaded with the essential information first.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero annotation coverage, no output schema, and a list operation that likely returns multiple items, the description is incomplete. It doesn't explain what a 'case' is in this context, what fields are returned, whether results are paginated, or how to interpret the output. The sibling tool 'cases.list_all' suggests this might be a limited listing, but that distinction isn't clarified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It mentions the single parameter 'owner_id' and indicates it's optional, which adds value beyond the bare schema. However, it doesn't explain what 'owner_id' represents (user ID, team ID?), what format it expects, or what filtering logic is applied. The description provides basic parameter awareness but insufficient semantic detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'List cases' states the basic action and resource, but it's vague about scope or format. It doesn't distinguish from sibling 'cases.list_all' (which suggests this might be a limited subset). The description provides minimal differentiation beyond the tool name itself.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like 'cases.list_all' or 'cases.get'. The mention of 'owner_id' parameter implies filtering capability, but doesn't specify when filtering by owner is appropriate versus other filtering methods. No prerequisites or exclusions are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cases.list_allC
List all cases.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden for behavioral disclosure. 'List all cases' implies a read operation but reveals nothing about permissions, rate limits, pagination, sorting, or what 'all' entails (e.g., archived cases). For a tool with zero annotation coverage, this is insufficient behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise at three words, front-loaded with the core action, and has zero wasted text. It efficiently communicates the basic purpose without unnecessary elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (simple list operation), lack of annotations, and no output schema, the description is incomplete. It doesn't explain what 'cases' are, what data is returned, or how this differs from 'cases.list', leaving significant gaps for an agent to understand context and output.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters with 100% schema description coverage, so the schema fully documents the absence of inputs. The description doesn't need to add parameter semantics, and the baseline for zero parameters is 4, as there's nothing to compensate for.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'List all cases' states a clear verb ('List') and resource ('cases'), but it's vague about scope and doesn't distinguish from sibling 'cases.list'. It provides basic purpose but lacks specificity about what 'all' means compared to other listing tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided about when to use this tool versus alternatives like 'cases.list' or 'agent.summarize_case'. The description gives no context about prerequisites, limitations, or appropriate use cases, leaving the agent with no usage direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cases.renameC
Rename a case by id.
| Name | Required | Description | Default |
|---|---|---|---|
| case_id | Yes | ||
| title | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description provides minimal behavioral information beyond the basic operation. With no annotations provided, it fails to disclose critical details: whether this is a destructive/mutative operation, what permissions are required, whether the rename is reversible, what happens to case history or references, or what the response looks like. For a mutation tool with zero annotation coverage, this represents a significant transparency gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise at just 5 words, with zero wasted language. It's front-loaded with the core action ('Rename a case') followed by the key constraint ('by id'). Every word serves a purpose, making it easy to parse quickly while communicating the essential operation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations, no output schema, and 0% schema description coverage, the description is inadequate. It doesn't explain what happens after renaming, whether there are side effects, what permissions are needed, or what format the new title should follow. The agent would need to guess about error conditions, validation rules, and the operation's impact on the system.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage for both parameters, the description carries the full burden of explaining parameter meaning. While it mentions 'by id' which hints at the case_id parameter, it doesn't explicitly describe either parameter's purpose, format constraints, or relationship. The 'title' parameter isn't mentioned at all, leaving users to guess whether this represents the new case name or some other title field.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Rename') and resource ('a case'), making the purpose immediately understandable. It specifies the operation is performed 'by id', which adds useful context about how the case is identified. However, it doesn't differentiate this tool from potential alternatives like 'cases.update' or explain how it differs from other case modification tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance about when to use this tool versus alternatives. With sibling tools like 'cases.update' potentially available for similar modifications, there's no indication whether this is the preferred method for renaming cases or if other tools should be used for different types of case modifications. No prerequisites, constraints, or exclusions are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cases.set_statusC
Set case status (open | resolved | closed).
| Name | Required | Description | Default |
|---|---|---|---|
| case_id | Yes | ||
| status | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It states 'Set case status' which implies a mutation operation, but doesn't disclose behavioral traits such as required permissions, whether changes are reversible, error handling (e.g., invalid case_id), or side effects. For a mutation tool with zero annotation coverage, this is a significant gap in transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise and front-loaded in a single sentence: 'Set case status (open | resolved | closed).' Every word earns its place by specifying the action, resource, and valid options without any waste or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (a mutation tool with 2 parameters), no annotations, no output schema, and 0% schema description coverage, the description is incomplete. It lacks details on behavioral aspects (e.g., permissions, reversibility), parameter semantics beyond status values, and expected outcomes. For a tool that modifies data, this leaves critical gaps for an AI agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It adds meaning by specifying the allowed status values ('open | resolved | closed'), which clarifies the 'status' parameter beyond the schema's generic string type. However, it doesn't explain the 'case_id' parameter (e.g., format, source) or other constraints, leaving half of the parameters with minimal context.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Set') and resource ('case status') with specific values ('open | resolved | closed'). It distinguishes from siblings like cases.create, cases.delete, cases.get, and cases.rename by focusing on status updates rather than creation, deletion, retrieval, or renaming. However, it doesn't explicitly differentiate from cases.list or cases.list_all, which are read-only operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites (e.g., needing an existing case), exclusions (e.g., not for new cases), or comparisons to siblings like cases.update (if it existed) or notes.update for related updates. The context is implied but not explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
files.getC
Get a file by id (returns base64).
| Name | Required | Description | Default |
|---|---|---|---|
| file_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states that the tool returns base64 data, which is useful, but lacks details on permissions, error handling, rate limits, or whether it's a read-only operation. This leaves significant gaps for a tool that retrieves files.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise—a single sentence that efficiently conveys the core action and key detail (base64 return). It's front-loaded with the main purpose, with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations, 0% schema coverage, and no output schema, the description is incomplete. It covers the basic purpose and return format but misses critical context like error cases, authentication needs, and how to handle the base64 data, which is essential for a file retrieval tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, so the description must compensate. It mentions 'by id' which clarifies the purpose of the 'file_id' parameter, but doesn't add meaning beyond that, such as format constraints or examples. With one undocumented parameter, this is insufficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Get') and resource ('a file by id'), making the purpose understandable. However, it doesn't differentiate from sibling tools like 'files.list' or 'files.read_path' beyond mentioning the 'by id' approach, which is somewhat implied but not explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'files.list' for listing files or 'files.read_path' for accessing files by path. It mentions 'by id' but doesn't clarify scenarios where this is preferred or required over other methods.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
files.listC
List files for a case.
| Name | Required | Description | Default |
|---|---|---|---|
| case_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden for behavioral disclosure. It states it's a list operation but doesn't describe what 'list' entails—whether it returns metadata, full file contents, pagination behavior, or permission requirements. This leaves significant gaps for a tool that presumably interacts with case files.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence with zero wasted words. It's front-loaded with the core action and resource, making it efficient and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of file operations, lack of annotations, no output schema, and low schema coverage, the description is incomplete. It doesn't address what the tool returns (e.g., file names, metadata), error conditions, or how it fits into the broader case management context with siblings like 'files.upload'.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for the undocumented parameter. It mentions 'for a case,' which implies the 'case_id' parameter's purpose, but doesn't explain what a case is, valid ID ranges, or how to obtain one. This adds minimal value beyond the schema's basic structure.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('List') and resource ('files for a case'), making the purpose immediately understandable. However, it doesn't differentiate from sibling tools like 'files.get' or 'files.read_path', which prevents a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'files.get' (for specific files) or 'cases.list' (for cases themselves). It lacks any mention of prerequisites, exclusions, or contextual triggers for selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
files.read_pathC
Read a filesystem path.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden for behavioral disclosure. 'Read a filesystem path' implies a read-only operation but doesn't specify what 'read' entails (e.g., returns file contents, metadata, or existence), permissions required, error handling, or any rate limits. This leaves significant gaps in understanding the tool's behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with a single sentence 'Read a filesystem path.' It's front-loaded and wastes no words, making it easy to parse quickly. Every word earns its place by conveying the core action and target.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (filesystem operations can involve permissions, formats, and errors), no annotations, no output schema, and 0% schema coverage, the description is incomplete. It doesn't address what the tool returns, how it handles errors, or any constraints, leaving the agent with insufficient information for reliable use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, with one required parameter 'path' undocumented. The description doesn't add any meaning beyond the schema—it doesn't explain what 'path' represents (e.g., absolute/relative path, file/directory), format constraints, or examples. This fails to compensate for the low schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Read a filesystem path' clearly states the verb ('Read') and resource ('filesystem path'), making the purpose understandable. However, it doesn't distinguish this tool from sibling 'files.get' or 'files.list', leaving ambiguity about what specific reading operation it performs compared to alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like 'files.get' or 'files.list'. The description lacks context about appropriate use cases, prerequisites, or exclusions, leaving the agent to infer usage from the tool name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
files.uploadC
Upload a file as base64.
| Name | Required | Description | Default |
|---|---|---|---|
| case_id | Yes | ||
| filename | Yes | ||
| content_base64 | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden for behavioral disclosure. 'Upload' implies a write/mutation operation, but the description doesn't disclose permissions needed, whether this overwrites existing files, error conditions, or response format. The base64 requirement is mentioned but without explaining why it's needed or limitations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise at just 5 words, front-loading the core purpose with zero wasted words. Every element ('Upload', 'file', 'as base64') earns its place by conveying essential information about the operation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 3-parameter mutation tool with no annotations and no output schema, the description is inadequate. It doesn't explain the relationship between parameters, what happens after upload, error scenarios, or the purpose of 'case_id'. The base64 requirement is mentioned but without context about why this format is necessary or alternatives.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for undocumented parameters. It mentions 'file' and 'base64' which relate to 'filename' and 'content_base64', but doesn't explain the 'case_id' parameter at all. The description adds minimal value beyond what parameter names suggest, failing to fully compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Upload a file as base64' clearly states the action (upload) and resource (file), with the specific method (base64 encoding) providing useful context. However, it doesn't distinguish this from sibling tools like 'files.get' or 'files.list', which would require mentioning it's for creating/adding files rather than reading existing ones.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. There's no mention of prerequisites (e.g., needing an existing case), comparison to other file-related tools like 'files.read_path', or when not to use it (e.g., for reading files). The base64 mention implies a format constraint but doesn't explain why this is necessary.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
indicators.searchC
Search mock IOC dataset.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It only states the action without detailing aspects like whether the search is read-only, if it requires authentication, what the output format is, or any rate limits. This is inadequate for a tool with no annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise with a single sentence, 'Search mock IOC dataset.', which is front-loaded and wastes no words. However, it is overly brief to the point of under-specification, slightly reducing its effectiveness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (a search tool with no annotations, no output schema, and low parameter coverage), the description is incomplete. It does not explain what 'IOC' entails, the search scope, result format, or usage context, making it insufficient for effective tool invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 1 parameter with 0% description coverage, and the tool description does not mention the parameter 'q' or explain its semantics (e.g., what to search for, such as keywords or filters). This fails to compensate for the lack of schema documentation, leaving the parameter's purpose unclear.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Search mock IOC dataset' states the action (search) and target (mock IOC dataset), providing a basic purpose. However, it lacks specificity about what 'IOC' means (Indicators of Compromise) and doesn't distinguish this tool from other search-related tools like 'cases.list' or 'files.list', making it vague rather than precise.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. The description does not mention any context, prerequisites, or exclusions, such as when to search indicators versus cases or files. This leaves the agent without clear direction on tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
notes.createC
Create a note for a case.
| Name | Required | Description | Default |
|---|---|---|---|
| case_id | Yes | ||
| content | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states 'Create a note', implying a write operation, but doesn't cover permissions, side effects, error handling, or response format. This leaves significant gaps for a mutation tool with no structured safety hints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with no wasted words. It is appropriately sized for a simple tool and front-loaded with the core action, making it easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a mutation tool with no annotations, 0% schema description coverage, and no output schema, the description is incomplete. It fails to address behavioral aspects like permissions or side effects, and doesn't clarify parameter meanings, leaving the agent with insufficient context for reliable use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for undocumented parameters. It mentions 'for a case', hinting at the 'case_id' parameter, but doesn't explain what 'case_id' represents or the 'content' parameter's purpose. This adds minimal value beyond the schema's basic property names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Create a note for a case' clearly states the verb ('Create') and resource ('note'), and specifies the context ('for a case'), which is adequate. However, it doesn't distinguish this tool from sibling tools like 'notes.update' or 'notes.delete', leaving the purpose somewhat vague in relation to alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives such as 'notes.update' or 'notes.list'. It lacks any mention of prerequisites, exclusions, or contextual cues, offering only a basic statement of function without usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
notes.deleteB
Delete a note by id (ownership not enforced).
| Name | Required | Description | Default |
|---|---|---|---|
| note_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden for behavioral disclosure. It states the tool deletes a note and mentions 'ownership not enforced,' which adds some context about permissions. However, it lacks critical behavioral details: whether deletion is permanent/reversible, what happens to associated data, error conditions (e.g., invalid ID), or response format. For a destructive operation with zero annotation coverage, this is inadequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise—just one sentence with a parenthetical clarification. Every word earns its place: 'Delete' (action), 'a note' (resource), 'by id' (parameter), and '(ownership not enforced)' (permission context). It's front-loaded with the core purpose and wastes no space.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given this is a destructive tool with no annotations and no output schema, the description is incomplete. It doesn't cover what happens after deletion (success response, error handling), whether the operation is idempotent, or how it interacts with sibling tools (e.g., notes.list after deletion). The minimal parameter explanation and missing behavioral details leave significant gaps for an agent to use this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description specifies the single parameter ('note_id') and its purpose ('by id'), adding meaning beyond the schema which has 0% description coverage and only shows 'Note Id' as a title. Since there's only one parameter and the description clarifies it's for identifying the note to delete, this compensates well for the low schema coverage, though it doesn't explain format constraints (e.g., integer range).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Delete') and target resource ('a note by id'), providing a specific verb+resource combination. However, it doesn't distinguish this tool from sibling tools like 'cases.delete' or 'tools.registry.delete', which would require mentioning it's specifically for notes rather than cases or registry entries.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites (e.g., needing the note_id from notes.list or notes.create), when not to use it, or how it differs from similar deletion tools like cases.delete. The parenthetical '(ownership not enforced)' hints at permission context but doesn't constitute explicit usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
notes.listC
List notes for a case.
| Name | Required | Description | Default |
|---|---|---|---|
| case_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It only states the action ('list') without disclosing behavioral traits such as read-only nature, pagination, sorting, error handling, or authentication requirements. This is inadequate for a tool with no annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with zero waste. It's front-loaded and appropriately sized for its minimal content, though this conciseness comes at the cost of completeness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations, 0% schema coverage, and no output schema, the description is incomplete. It lacks essential context like return format, error cases, or usage nuances, making it insufficient for effective tool invocation in this complex environment.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It mentions 'case_id' implicitly but adds no meaning beyond the schema's type (integer). No details on format, constraints, or examples are provided, leaving the parameter poorly documented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'List notes for a case' clearly states the verb ('list') and resource ('notes'), but it's vague about scope (e.g., all notes or filtered) and doesn't distinguish from sibling tools like 'notes.create' or 'notes.update'. It's functional but lacks specificity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. It doesn't mention prerequisites (e.g., needing a valid case_id), exclusions, or how it differs from other note-related tools like 'notes.create' or general case tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
notes.updateC
Update a note by id (ownership not enforced).
| Name | Required | Description | Default |
|---|---|---|---|
| note_id | Yes | ||
| content | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden. It mentions 'ownership not enforced', which adds some behavioral context about permissions, but fails to disclose critical traits like whether the update is idempotent, what happens on invalid IDs, if content validation occurs, or response format. For a mutation tool with zero annotation coverage, this is insufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with a single sentence that front-loads the core action ('Update a note by id') and adds a clarifying note ('ownership not enforced'). Every word serves a purpose, with zero wasted information, making it highly efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a mutation tool with 2 parameters, 0% schema coverage, no annotations, and no output schema, the description is incomplete. It lacks details on error handling, success responses, idempotency, and parameter semantics. The 'ownership not enforced' hint is helpful but insufficient for full contextual understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It only implies 'note_id' is used for identification and 'content' is updated, without explaining parameter meanings, formats, or constraints (e.g., ID range, content length). This adds minimal value beyond the schema's property names, failing to adequately document the two required parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Update') and resource ('a note'), specifying it's done 'by id'. It distinguishes from siblings like notes.create, notes.delete, and notes.list by indicating this is an update operation. However, it doesn't explicitly differentiate from cases.update or other potential update operations, keeping it at 4 rather than 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides minimal guidance with 'ownership not enforced', hinting at permission context, but lacks explicit when-to-use rules, prerequisites, or alternatives. No comparison to notes.create or notes.delete is made, and there's no mention of when this tool should be preferred over other methods.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tools.builtin.listB
List built-in tools bundled with the server.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It only states what the tool does without mentioning any behavioral traits like whether it's read-only, if it requires permissions, or what the output format might be. For a tool with zero annotation coverage, this is a significant gap in transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence with no wasted words. It's front-loaded with the core action and resource, making it efficient and easy to understand. Every part of the sentence contributes directly to the tool's purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (0 parameters, no output schema, no annotations), the description is minimally adequate. It states the basic purpose but lacks context on usage, behavioral traits, or output details. For a tool with no structured data to rely on, it should provide more guidance to be fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0 parameters with 100% coverage, meaning no parameters need documentation. The description doesn't add any parameter information, which is acceptable here since there are no parameters to explain. A baseline of 4 is appropriate as the schema fully handles the parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'List built-in tools bundled with the server.' It uses a specific verb ('List') and identifies the resource ('built-in tools'), making the action clear. However, it doesn't explicitly differentiate from sibling tools like 'tools.registry.list', which also lists tools but from a registry context, so it misses full sibling distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention any context, prerequisites, or exclusions, such as comparing it to 'tools.registry.list' for listing registered tools versus built-in ones. This leaves the agent with no usage direction beyond the basic purpose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tools.registry.deleteC
Delete a registered tool by name.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the action is 'Delete,' implying a destructive mutation, but doesn't cover critical aspects like permissions required, whether deletion is permanent or reversible, error handling (e.g., what happens if the tool doesn't exist), or side effects. This leaves significant gaps for a destructive operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, direct sentence with zero wasted words. It's front-loaded with the core action and resource, making it highly efficient and easy to parse. Every word earns its place by conveying essential information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (a destructive mutation with no annotations, 0% schema coverage, and no output schema), the description is incomplete. It lacks details on behavioral traits, error scenarios, return values, and how it fits within the broader tool registry context (e.g., interaction with 'tools.registry.list' or 'tools.registry.register'). This is inadequate for safe and effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds minimal semantic context: it indicates the 'name' parameter refers to a registered tool's name. However, with 0% schema description coverage (the schema has no descriptions for parameters), the description doesn't compensate by explaining format, constraints, or examples (e.g., expected naming conventions). This meets the baseline since it provides some meaning, but doesn't fully address the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Delete') and the resource ('a registered tool by name'), making the purpose immediately understandable. However, it doesn't explicitly differentiate this tool from sibling deletion tools like 'cases.delete' or 'notes.delete', which would require specifying it's specifically for tool registry entries rather than cases or notes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites (e.g., needing an existing registered tool), exclusions, or related tools like 'tools.registry.list' for checking what's available before deletion. The agent must infer usage from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tools.registry.listB
List registered tools available to the agent.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states it 'lists' tools, implying a read-only operation, but does not cover aspects like permissions, rate limits, response format, or pagination. This is inadequate for a tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that directly states the tool's function without any wasted words. It is front-loaded and appropriately sized for its simple purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (0 parameters, no output schema), the description is minimally adequate. However, with no annotations and no output schema, it lacks details on behavioral traits like response format or constraints, which could be helpful for completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has 0 parameters, and the schema description coverage is 100%, so no parameter information is needed. The description does not add param details, which is appropriate, earning a baseline score of 4 for tools with no parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('List') and resource ('registered tools available to the agent'), making the purpose unambiguous. It does not explicitly differentiate from sibling tools like 'tools.builtin.list', which would require a 5, but it's still specific enough for understanding.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives, such as 'tools.builtin.list' or other listing tools. It lacks context about prerequisites, timing, or exclusions, leaving the agent with minimal usage direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tools.registry.registerC
Register or update a tool definition via schema JSON.
| Name | Required | Description | Default |
|---|---|---|---|
| schema_json | Yes | ||
| schema | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden but offers minimal behavioral insight. It mentions 'register or update' but doesn't clarify permissions required, whether this affects existing tools, or what happens on success/failure. For a mutation tool with zero annotation coverage, this is inadequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with zero waste, front-loading the core action. It's appropriately sized for the tool's complexity, making it easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's mutation nature, 2 parameters with 0% schema coverage, no annotations, and no output schema, the description is incomplete. It doesn't address critical aspects like input formats, behavioral outcomes, or error handling, leaving significant gaps for agent understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate but fails to do so. It mentions 'schema JSON' but doesn't explain what 'schema_json' or 'schema' parameters represent, their formats, or how they interact. With 2 parameters undocumented, this adds little value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('register or update') and resource ('a tool definition'), making the purpose understandable. However, it doesn't distinguish this from its sibling 'tools.registry.delete' or 'tools.registry.list', which would require more specific differentiation to earn a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like 'tools.builtin.list' or 'tools.registry.delete'. The description lacks context about prerequisites, such as when registration is needed or what 'update' entails, leaving usage unclear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
Most tools have distinct purposes, with clear separation between cases, files, notes, indicators, and tools. However, cases.list and cases.list_all could cause confusion as their descriptions are similar, with list_all implying broader access but lacking clarity on how it differs from list with optional owner_id.
Tool names follow a highly consistent pattern using dot notation for grouping (e.g., cases.create, files.list) and verb_noun structure within groups. This makes the tool set predictable and easy to navigate, with no deviations in style.
With 22 tools, the count is on the higher side but reasonable for a security case management domain, covering multiple resource types like cases, files, notes, indicators, and tools. It might feel slightly heavy but each tool appears to serve a specific purpose.
The tool set provides comprehensive CRUD and lifecycle coverage for cases, files, and notes, along with search capabilities for indicators and tool management. There are no obvious gaps; agents can perform full workflows from case creation to resolution with file handling and note-taking.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Enrich, search, assess, and manage threat intelligence through 80+ typed MCP tools.
MEOK MCP Hardening MCP — automated security red-team for any MCP server. Maps OWASP LLM Top 10
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
AI-security knowledge as MCP: standards-mapped tools (OWASP, NIST, MITRE) for AI agents.
Related MCP Servers
- AlicenseCqualityDmaintenanceA vulnerable MCP server implementation that demonstrates how poor coding practices can lead to security issues like Remote Code Execution, designed for educational purposes to add numbers.12MIT
- FlicenseNot gradedqualityFmaintenanceAn educational project that deliberately implements vulnerable MCP servers to demonstrate various security risks like prompt injection, tool poisoning, and code execution for training security researchers and AI safety professionals.1,341
- FlicenseNot gradedqualityDmaintenanceA security-focused MCP server that enables automated log retrieval and threat analysis using LangGraph orchestration and RAG. It allows users to detect suspicious activity and generate structured security insights by integrating LLM reasoning with log data and runbook documentation.
- FlicenseNot gradedqualityDmaintenanceA deliberately insecure MCP server designed as a pentest lab to demonstrate common vulnerabilities in MCP deployments.
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/anotherik/ThreatByte-MCP'
If you have feedback or need assistance with the MCP directory API, please join our Discord server