Skip to main content
Glama
binhnguyen143

IBM QRadar SIEM MCP Server

qradar_list_reference_tables

List multi-column reference tables in QRadar SIEM, applying filters and pagination to find specific tables for threat intelligence management.

Instructions

List Reference Tables (multi-column tables) available in QRadar SIEM.

Args: filter_expr: Optional filter expression. limit: Maximum number of tables to return (default: 50). offset: Starting index for pagination (default: 0).

Returns: JSON string containing list of Reference Tables.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
limitNo
offsetNo
filter_exprNo

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
resultYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It does reveal the operation is a listing operation and explicitly states the return format ('JSON string containing list of Reference Tables'), which is useful. However, it does not explicitly state that this is read-only, nor does it describe behavior for empty results, invalid filters, or pagination edge cases.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured: a one-sentence purpose, an Args block, and a Returns line. There is no filler or repetition of the tool name, and the most important information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple listing tool with three optional parameters and an output schema, the description is largely complete: it names the resource, documents all parameters, and states the return type. The main gap is the lack of filter-syntax detail and explicit read-only confirmation, but the output schema and the simple nature of the operation reduce the severity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It gives some meaning to all three parameters: filter_expr is an optional filter expression, limit is the maximum number of tables, and offset is the starting index for pagination. However, filter_expr remains vague—no filter syntax or format is described—so the added value is only partial.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear verb and resource: 'List Reference Tables (multi-column tables) available in QRadar SIEM.' The parenthetical 'multi-column tables' helps distinguish this tool from sibling tools like qradar_list_reference_sets and qradar_list_reference_maps, so an agent can tell what resource is being listed.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The intended use is implied by the name and the phrase 'available in QRadar SIEM,' but the description does not explicitly state when to prefer this tool over the sibling reference-set or reference-map tools, nor does it mention any exclusions or alternative tools. It provides clear context but no when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.