tenable-patch-management-logs-mcp
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@tenable-patch-management-logs-mcpwhy are my Tenable VM vulnerabilities not showing up in TPM?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
tenable-patch-management-logs-mcp
An MCP server that does the log digging for Tenable Patch Management (TPM), for both SaaS and on-prem deployments. Point it at server logs (the Admin Portal zip, or the on-prem logs folder) and client logs (device folders, collector bundles, or a log requested from a client), then ask questions like "why are my Tenable VM vulnerabilities not showing up in TPM?" or "what changed on the server in the last 24 hours?".
The server does the analysis. Parsing, de-duplication across logs, error-code decoding,
known-issue matching and threshold comparisons all happen in Python; tools return finished,
structured results (verdict, ranked issues with counts and fixes, findings with
reasoning) instead of piles of raw lines for the model to add up.
What it gives you
Tool | Purpose |
| Start here. Sources, devices, server/client/setup logs, time span, SaaS vs on-prem (with evidence), TPM versions, version advisories, and where to get missing logs. |
| Every warning and error grouped into distinct issues, ranked, de-duplicated across logs, with decoded error codes, root causes, the latest example (file and line) and known-issue fixes. Platform noise is counted separately. |
| Symptom playbooks with a verdict: |
| Literal or regex search across all logs, including multi-line messages and stack traces, with context and paging. |
| Server and client logs merged into one time-ordered sequence, around a moment or over a window. |
| Warnings and errors a problem device has that a healthy device does not. |
| A recent window compared with the days before it: new error signatures, error spikes, restart loops, logs that went quiet. |
| Files with device, role, purpose, size and time span. |
| What a log file records, what an error code means ( |
| Register a folder, UNC path, single log file, |
Safety properties worth knowing:
Read-only. Sources are never modified. The only writes are
data/sources.json(sources added withadd_log_source) and an extracted copy of each bundle underdata/bundles.Nothing that looks like a credential is returned. TPM writes the Tenable VM access key into
VulnerabilityManagement.logandadaptiva.errin plain text; 64-hex key material,token:/password=/secretKey=values, bearer tokens and URL passwords are masked to their last 4 characters. Host names, IPs, e-mail addresses, GUIDs and client IDs are kept because troubleshooting needs them.No silent truncation. Each call reads at most 1 GB / 5,000 files (newest first); anything not read is listed in
coveragewith how to narrow the call. Lines in an unrecognised format are never merged into one entry.Bundles are extracted defensively: path-traversal entries are skipped, and extraction stops at 8 GB or 100,000 files.
No network access and no Tenable API keys. TPM has no documented public API; everything comes from its logs.
Related MCP server: Log Analyzer MCP Server
How it covers SaaS and on-prem
Server logs | Client logs | |
SaaS | Admin Portal → gear icon → Logs → Download All Server Logs, then | Same for both: copy |
On-prem | Register |
Client logs look the same in both deployments, so every tool works the same way. The deployment
is inferred per source from the logs themselves and shown with its evidence by check_log_sources,
for example a PostgreSQL database and /opt/adaptiva/adaptiva-server paths (SaaS) or
ntlmauth.log and SQL Server (on-prem). Set TPM_DEPLOYMENT or pass deployment to
add_log_source to override.
Requirements
Python 3.11+
TPM logs (see above). No Tenable credentials are needed.
Setup
uv sync --extra devOptionally copy .env.example to .env to preconfigure sources:
cp .env.example .envVariable | Meaning |
|
|
|
|
| Also use TPM installed on this machine ( |
| Where runtime sources and extracted bundles live. Default |
Sources can also be added in conversation with add_log_source, which is usually easier for
support bundles.
Run the server directly (it speaks MCP over stdio, so it will just sit there waiting for a client - that is the correct behaviour):
uv run python -m src.serverConnecting a client
Use the absolute path to this folder in the config below.
Claude Desktop
Edit claude_desktop_config.json (%APPDATA%\Claude\claude_desktop_config.json on Windows,
~/Library/Application Support/Claude/claude_desktop_config.json on macOS):
{
"mcpServers": {
"tenable-patch-logs": {
"command": "uv",
"args": [
"--directory",
"C:\\path\\to\\tenable-patch-management-logs-mcp",
"run",
"python",
"-m",
"src.server"
],
"env": {
"TPM_LOG_SOURCES": "saas-server=C:\\cases\\acme\\logs.zip;clients=C:\\cases\\acme\\TPM-Logs-20260917"
}
}
}
}Restart Claude Desktop afterwards. If uv is not on the launcher's PATH, use its absolute
path ((Get-Command uv).Source / which uv) as command. The env block is optional.
Claude Code
claude mcp add tenable-patch-logs -- uv --directory /absolute/path/to/tenable-patch-management-logs-mcp run python -m src.serverAdd --env TPM_LOG_SOURCES=... to preconfigure sources, or add the same block as above to a
project-level .mcp.json.
Getting the logs
SaaS server: Admin Portal → gear icon → Logs → Download All Server Logs. The zip contains
adaptiva-server/withadaptiva*.log,adaptiva.err,componentlogs/andworkflowlogs/. Downloading it twice gives two slightly different snapshots; use the newer one.On-prem server: the logs folder itself, or a UNC path such as
\\tpm01\c$\Program Files\Tenable\PatchServer\logs.Clients, several at once (Windows):
.\collect\Collect-TPMLogs.ps1 -ComputerName WS-BAD07, WS-GOOD01 -Days 3 .\collect\Collect-TPMLogs.ps1 -ComputerName TPM01 -IncludeServer # on-prem server boxOne folder per device, zipped, plus the Client Validator results from the registry. Include a healthy device so
compare_deviceshas something to compare against.Linux / macOS clients:
sudo ./collect/collect-tpm-logs.sh 3 /tmp(tar.gz, includes theadaptivaclientdjournal).One client from the console: 10.2.973.9 and later can request a log file from a client; the download (
<clientId>_adaptiva.log) can be registered as is.
Example questions to ask once connected
"Add C:\cases\acme\logs.zip as acme-saas and check the log sources."
"Summarise what's wrong on the TPM server over the last 7 days, ignoring noise."
"Why is Tenable VM data not showing up in Patch Management?" (runs
diagnose vm_integration)"Why did patching fail on WS-BAD07 yesterday? Decode the exit codes."
"Build a timeline for WS-BAD07 from 30 minutes before the first installer failure."
"What does WS-BAD07 have that WS-GOOD01 doesn't?"
"Anything new or spiking in the last 24 hours compared with the week before?"
"Which clients is the server retrying messages to?"
How the analysis works
Parsing. Log layouts were taken from real TPM 10.2.973.9 logs (a SaaS server bundle and a Windows client), plus the standard Windows Installer log:
Layout | Where | Example |
|
|
|
|
|
|
|
|
|
|
|
|
| setup logs, exported journalctl |
|
Multi-line messages (the component suffix can sit on a later line) and stack traces stay attached
to their entry. Rotated files (adaptiva.2.log, Feeds.1.log, .gz) are read as one log.
De-duplication. TPM writes an error to adaptiva.log or a component log and to
adaptiva.err. Events are matched on device, timestamp, level, thread and message, and counted
once (duplicate_lines_in_other_logs reports how many repeats were removed).
Severity. TPM sometimes logs real failures at INFO. The documented Services-sensor issue, for
example, is an INFO line carrying an exception. Entries with a stack trace or a non-zero Adaptiva
Error Code are raised to ERROR and flagged with raised_from_lower_level.
Known issues (src/knowledge.py) each carry a confidence:
documented: described by Tenable or Adaptiva, with a source link (for example the 9.2 Services-sensor DLL issue, or the 9.1.965.x client upgrade failure).observed: seen in real TPM 10.2.973.9 logs, explained from the message and surrounding lines (for example Tenable VM keys rejected with "not related to any active containers", periodic feed check failures, CDN publication failures, clients rejected for missing install authentication).generic: standard Java, Windows, SQL or network errors.
Issues with impact: none are platform noise (for example the SQL Server monitoring query that
fails daily on the SaaS PostgreSQL database, or receipt-cleanup warnings). About two thirds of the
warning and error events in the real SaaS bundle were noise. They are counted under noise, not
listed as issues.
Error codes are decoded from context: MSI / Win32 exit codes (1603, 1618, 3010),
HRESULTs including HRESULT_FROM_WIN32 values (0x80070643), Windows Update (0x8024xxxx),
component servicing (0x800Fxxxx), negative decimal HRESULTs and HTTP statuses. Adaptiva's own
Error Code = N values are shown but never decoded as Windows errors.
Anomalies compare a window with the period before it, read from the same logs, so no state
has to build up. Thresholds are constants at the top of src/anomaly.py and are echoed in every
result:
Constant | Default | Meaning |
|
| Window rate per day must exceed this multiple of the baseline rate |
|
| Minimum window events before a spike is flagged |
|
| A new ERROR signature with this many events is rated high |
|
| Below this share of the baseline covered by a log, "new" findings are low confidence |
|
| Service starts in the window that count as repeated restarts |
|
| Baseline entries a log needs before going quiet is notable |
Each finding is judged against the log(s) it appears in. A log that only started recently is not reported as a spike just because the device's other logs go back further.
Time. Relative windows (90m, 24h, 7d, 2w) count back from the newest entry in the
selected logs, not from now, so an old support bundle still gives sensible results. Timestamps
are shown as written. TPM 10.2 SaaS server logs and Windows client logs were observed to be in UTC.
Layout
src/
server.py MCP entrypoint and the eleven tool definitions
sources.py Source configuration, bundle extraction, device / role / rotation detection
logformat.py Line layouts, multi-line entries, encodings, time spans
classifier.py Redaction, signatures, severity, known-issue matching, extractions
error_codes.py Win32 / MSI / HRESULT / Windows Update / CBS / HTTP code decoding
knowledge.py Log catalog, known issues, playbooks, version advisories, where to get logs
analysis.py Scoped, bounded scanning; summaries, search, timelines, playbooks, comparisons
anomaly.py Window-versus-baseline findings and thresholds
collect/
Collect-TPMLogs.ps1 Windows collector (local or WinRM), one folder per device
collect-tpm-logs.sh Linux / macOS collector
scripts/
smoke_local.py Offline end-to-end run of every tool
live_check.py Read-only run against your configured logs
tests/
sample_logs.py Synthetic, sanitised logs in the real layouts
test_*.pyDependency direction is one-way: server → {analysis, anomaly} → {classifier, sources} → {logformat, error_codes, knowledge}.
Testing
1. Unit tests (no network)
uv run pytest -q162 tests covering every layout, rotation and encoding, bundle extraction guards, device/role
detection, redaction, signatures, severity escalation, known issues, every playbook, anomaly
thresholds and the tool contracts. All fixtures are synthetic (tests/sample_logs.py); no real log
content is stored in the repository.
2. Offline end-to-end
uv run python scripts/smoke_local.pyRegisters a synthetic SaaS server bundle, a two-device client bundle and a single requested client log through the tools, calls every tool, and asserts the results: duplicates counted once, noise set aside, planted secrets redacted, known issues found, bad input returned as a structured error. Exits non-zero on any failure, so it works as a CI gate.
3. Against your logs (read-only)
uv run python scripts/live_check.py 7dUses the same configuration as the server and prints sources, the error summary, the playbooks relevant to the logs you have, and anomalies. On the real 80 MB SaaS bundle every call finished in under 5 seconds.
4. Through an MCP client
npx @modelcontextprotocol/inspector uv --directory . run python -m src.serverOr connect Claude Desktop / Claude Code (above) and ask one of the example questions.
Known limitations
Formats validated on 10.2.973.9 SaaS server logs and a Windows client
adaptiva.log. On-prem server logs use the same Java logging and are expected to match, but have not been checked against a real on-prem bundle. The same applies to Linux and macOS client logs.check_log_sourceslists any file whose format was not recognised.Client component logs were not in the real samples. The playbooks for
_SDMErrors.log,SoftwareInstaller.logandWindowsPatching.logrely on exit codes, HRESULTs, exceptions and the documentedPatchDeploymentResultline rather than exact message wording. Add real patterns toKNOWN_ISSUESas you meet them.PatchDeploymentResultstatus and reason values are undocumented. They are shown as logged; failure evidence comes from non-zero reason codes and exceptions.Timestamps are not converted between time zones. Mixing logs from machines that log in different zones shifts them relative to each other in timelines.
Relative windows follow the newest entry in the selected logs. Filter to one source or device when their logs end at very different times.
Anomaly detection only sees what the logs still contain. Heavily rotated logs give short baselines; findings then carry
low_confidence.The knowledge base is a starting point. Known issues marked
observedcome from one tenant's logs; confirm fixes against current Tenable documentation.
Disclaimer
Not affiliated with, endorsed by, or supported by Tenable, Inc. or Adaptiva. "Tenable", "Tenable Patch Management", "Tenable Vulnerability Management" and "Adaptiva" are trademarks of their respective owners. This project reads log files you already have; it is an independent troubleshooting aid, not a Tenable product, and its findings should be confirmed against current vendor documentation before you act on them.
Sources
Tenable Patch Management docs: client logs, server logs, client install logs, Client Validator, SaaS vs self-hosted, 2025 and 2026 release notes.
Adaptiva (the TPM platform): logging configuration, Services sensor issue (9.2), client upgrade issue (9.1.965), 10.0.971 known issues, feature updates.
Available Tools
11 toolsadd_log_sourceA
Register TPM logs to analyse; remembered between sessions.
Nothing at path is modified. Bundles are extracted once into the server's data
folder.
Args: name: Short label, e.g. "acme-saas-server" or "clients-0917" (letters, digits, '.', '_', '-'). path: A folder (local or UNC, e.g. \tpm01\c$\Program Files\Tenable\PatchServer\logs), a single log file (e.g. 13_adaptiva.log requested from a client), or a .zip / .tar.gz bundle such as the Admin Portal "Download All Server Logs" zip. deployment: "saas", "onprem" or "auto" (infer from the logs).
Returns: The registered source, the devices and log counts found, and the next step.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| path | Yes | ||
| deployment | No | auto |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
It explicitly reassures that nothing at path is modified, discloses one-time bundle extraction into the server's data folder, and notes that registration persists between sessions. This goes well beyond the sparse annotations and gives an agent a clear safety picture.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose, then uses short labeled Args and Returns sections to organize details. Every sentence carries needed information, including the important 'nothing modified' guarantee.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a registration tool with three parameters and nontrivial path handling, the description covers all required inputs, edge-case input types, side effects, and what the call returns. The presence of an output schema means the return-value summary is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema contains no descriptions, yet the description fully documents all three parameters: name format, accepted path types with realistic examples, and deployment allowed values. An agent can construct correct arguments without opening anything else.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening line 'Register TPM logs to analyse; remembered between sessions' states a specific action, resource, and persistence behavior. This clearly separates it from siblings like remove_log_source, check_log_sources, and list_log_files.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear, concrete guidance on what inputs are valid: folder, single file, or archive bundle, with examples and a deployment value of 'saas', 'onprem', or 'auto'. It does not explicitly contrast this tool with siblings such as check_log_sources or list_log_files, so it stops short of full when-to-use-versus-alternatives guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
build_timelineARead-onlyIdempotent
Merge all logs into one chronological sequence - what happened before and after.
Useful for "what led up to this failure": server and client logs are interleaved
by timestamp, duplicates across logs removed, and consecutive repeats collapsed
(repeats). When there are more rows than limit, WARN and above are always
kept and the rest are sampled evenly (sampled).
Args:
around: Centre the window on this time (ISO, or relative like 2h).
minutes_before: Minutes before around (default 15).
minutes_after: Minutes after around (default 15).
since: Window start when not using around. Default: the last 60 minutes of logs.
until: Window end when not using around.
source: Source name; omit for all sources.
device: Only this device.
role: "server", "client" or "setup".
files: Log names or globs.
min_severity: INFO (default), WARN, ERROR; DEBUG to include debug lines.
keyword: Only entries containing this text.
include_noise: Include known platform noise.
collapse_repeats: Merge consecutive identical rows (default true).
limit: Rows to return (10-1000).
Returns:
rows in time order, each with time, device, severity, log, component, message
and at (file:line).
| Name | Required | Description | Default |
|---|---|---|---|
| role | No | ||
| files | No | ||
| limit | No | ||
| since | No | ||
| until | No | ||
| around | No | ||
| device | No | ||
| source | No | ||
| keyword | No | ||
| min_severity | No | INFO | |
| include_noise | No | ||
| minutes_after | No | ||
| minutes_before | No | ||
| collapse_repeats | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (readOnly, idempotent, non-destructive), the description discloses important behavior: duplicate removal, consecutive repeat collapsing, and the overflow policy where WARN and above are kept while the rest are sampled. It also documents the return row structure, giving the agent a clear model of what the tool does.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a front-loaded purpose, behavior notes, a compact Args list, and a short Returns section. Every sentence earns its place; despite covering 14 parameters, it remains readable and free of redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 14-parameter tool with zero schema descriptions, the description covers purpose, filtering options, defaults, behavioral edge cases (limit overflow), and return fields. Nothing essential for correctly invoking the tool appears to be missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries full responsibility for parameter meaning. The 'Args' section explains all 14 parameters, including defaults for minutes_before, minutes_after, min_severity, collapse_repeats, and the limit range, making every parameter actionable without schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific action and resource: 'Merge all logs into one chronological sequence - what happened before and after.' It also ties the tool to a concrete use case ('what led up to this failure') and distinguishes it from sibling log tools by emphasizing interleaving server/client logs by timestamp.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly states when the tool is useful: reconstructing what led up to a failure by merging and time-ordering logs. It does not explicitly name alternatives or state when not to use it, but the scenario is concrete enough for an agent to select it appropriately.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_log_sourcesARead-onlyIdempotent
Show which TPM logs are available, and whether they can be read and parsed.
Run this first. For every source it reports the devices found (server / client / setup logs), the time span each device's logs cover, whether the deployment looks like SaaS or on-prem (with the evidence), TPM versions seen in service start lines, version advisories, and any files whose line format was not recognised. It also says where to get missing logs (for example the Admin Portal zip for SaaS server logs).
Returns:
A dict with ok, a message, per-source details, guidance for missing
logs, and the active configuration.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, so the safety profile is covered. The description adds useful behavioral context by explaining that the tool scans log sources, reports parseability and format issues, and provides guidance for missing logs, all consistent with a non-mutating diagnostic step.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with 'Run this first' and organized into a clear overview followed by output details. It is a bit longer than strictly necessary, and the 'Returns' section may duplicate what the output schema already conveys, but nearly every sentence adds useful context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter discovery tool, the description is complete: it states what it checks, what it reports, where missing logs can be found, and what the return structure looks like. Combined with rich annotations and an output schema, an agent has everything needed to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there are no parameter semantics for the description to clarify. Baseline for 0-parameter tools is 4, and the description does not need to compensate for any schema gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Show which TPM logs are available, and whether they can be read and parsed.' It then enumerates concrete outputs such as devices found, time spans, SaaS/on-prem determination, and TPM versions, which clearly distinguishes it from sibling tools like list_log_files or search_logs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Run this first,' giving a clear directive on when to invoke this tool. It does not explicitly enumerate when-not-to-use or alternatives, but the sequencing guidance is unambiguous and actionable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
compare_devicesARead-onlyIdempotent
Show warnings and errors on a problem device that a healthy device does not have.
Args: healthy_device: A device that patches correctly. problem_device: The device with the problem. since: Window start (ISO or relative). Default 7d. until: Window end. source: Source name; omit for all sources. min_severity: WARN (default) or ERROR. include_noise: Include known platform noise. top: Issues per list (1-100).
Returns:
only_on_problem_device and more_frequent_on_problem_device, with counts.
| Name | Required | Description | Default |
|---|---|---|---|
| top | No | ||
| since | No | 7d | |
| until | No | ||
| source | No | ||
| min_severity | No | WARN | |
| include_noise | No | ||
| healthy_device | Yes | ||
| problem_device | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, covering safety and side-effect profile. The description adds value by explaining the comparison logic (only issues not present on healthy device) and the return format (lists with counts). It does not contradict annotations and provides context beyond what the structured fields carry.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with a one-sentence summary, followed by a clean Args list and a Returns note. There is no wasted text; each sentence earns its place. The structure makes it easy for an agent to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 8 parameters and an output schema (not shown), the description covers all parameters, explains the comparison semantics, and describes the return keys. It is complete for an agent to invoke the tool correctly without external documentation. The only minor gap is that device identifiers are not specified as names or IDs, but this is likely context-dependent and not critical.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description fully compensates by explaining every parameter in the Args block: healthy_device, problem_device, since, until, source, min_severity, include_noise, and top. Each gets a concise, meaningful definition (e.g., 'A device that patches correctly', 'WARN (default) or ERROR'). This is essential for an agent to populate parameters correctly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Show warnings and errors on a problem device that a healthy device does not have') with a clear resource and comparison logic. It is distinct from siblings like diagnose or summarize_errors, though it does not explicitly name alternatives. The verb 'Show' and the two-device comparison make the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use this tool (when you have a healthy and problem device to compare) but does not explicitly state when not to use it or mention alternative tools. There is no guidance on choosing between this and diagnose or summarize_errors. The context is clear enough for an agent to infer, but explicit routing would be better.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
detect_log_anomaliesARead-onlyIdempotent
Compare a recent window with the days before it, in the same logs.
Flags error signatures never seen in the baseline, errors whose rate jumped above the spike threshold, services that started repeatedly, and logs that stopped writing. Each finding has evidence, the threshold crossed and a reasoning sentence. Findings are marked low confidence when the logs do not reach far enough back.
Args: since: Window start (ISO or relative like 24h, counted back from the newest entry). until: Window end. Default: newest entry. baseline_days: Days before the window to compare against (1-90, default 7). source: Source name; omit for all sources. device: Only this device. role: "server", "client" or "setup".
Returns:
Severity-ordered findings, counts by type and severity, baseline coverage and
the active thresholds.
| Name | Required | Description | Default |
|---|---|---|---|
| role | No | ||
| since | No | 24h | |
| until | No | ||
| device | No | ||
| source | No | ||
| baseline_days | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover readOnly, idempotent, non-destructive. The description adds key behavioral details: confidence levels, baseline coverage, threshold crossing, and return criteria. It does not mention pagination or rate limits, but that's minor here.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured: high-level purpose first, then anomaly types, then explicit Args and Returns sections. Every sentence adds value; no fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Complex tool with 6 params, but annotations cover safety and output schema exists. The description explains return structure, parameter semantics and confidence. Effectively complete for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must explain parameters. It provides useful detail for since, until, baseline_days, and mentions source, device, role. However, it omits the 'role' parameter's default and doesn't elaborate on 'until' accepted formats beyond ISO/relative. Also, it doesn't explain the effect of omitting source/device. Lacks completeness despite some effort.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear verb+resource (detect anomalies in logs), describes specific anomaly types, and implicitly distinguishes from related tools like check_log_sources (checks sources) and summarize_errors (summarizes errors).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
States how to use (compare recent window with baseline), but does not explicitly say when not to use or name alternatives. However, the context is clear enough to route an agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
diagnoseARead-onlyIdempotent
Run a symptom playbook: read the right logs and return a verdict with evidence.
Symptoms:
patch_install_failed - deployment results, installer exit codes (decoded), MSI failures
content_download - content / peer-to-peer / CDN download problems on clients
client_connectivity - client transport errors, server retries per client ID, registrations rejected for missing install authentication
vm_integration - Tenable VM / Security Center access settings, API key failures, vulnerability import runs
feeds - periodic feed checks, last success, failure root causes
content_publication - content uploads to the CDN that failed
service_health - service starts with versions, restart loops, crashes, out-of-memory
database - SQL errors, SQL Server authentication, deadlocks
client_upgrade - upgrade problems and versions seen over time
feature_update_readiness - free disk space vs the 50 GB requirement, NOT INSTALLED scans
Args: symptom: One of the symptom ids above. since: Window start (ISO or relative like 24h). Default 7d. until: Window end. source: Source name; omit for all sources. device: Only this device.
Returns:
verdict, findings (known issues with remediation), other related errors,
playbook-specific details, missing_logs with how to get them, and advice.
| Name | Required | Description | Default |
|---|---|---|---|
| since | No | 7d | |
| until | No | ||
| device | No | ||
| source | No | ||
| symptom | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds meaningful behavioral context: it discloses that the tool reads logs, returns a structured verdict with findings/remediation, and includes a missing_logs field that tells the agent how to obtain absent data. It also implies a time-window default (7d) and per-device/source scoping. This goes beyond the annotations without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is longer than average, but every section earns its place: the one-sentence summary is front-loaded, the symptom list is a compact reference table, the Args block is a clear parameter guide, and the Returns block lists the output fields. It uses bullet-like formatting and avoids redundancy. The length is proportional to the tool's complexity, and the structure makes it scannable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with five parameters and ten symptom variants, the description covers all necessary aspects: what it does, which symptoms it handles, how to set time windows and filters, and what it returns (verdict, findings, details, missing_logs, advice). An output schema exists, so the description needn't detail every return field, but it names them all. Nothing an agent needs to select or invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides zero documentation for parameters (coverage 0%), so the description carries the full burden. It does this thoroughly: 'symptom' is explained with a list of ten valid ids and what each checks; 'since' and 'until' specify ISO or relative formats with a default; 'source' and 'device' clarify scope and that 'omit for all sources'. This is exactly the semantic enrichment an agent needs and goes well beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb ('Run a symptom playbook') and a clear resource ('logs'), and states the output ('verdict with evidence'). It also enumerates ten distinct symptom playbooks, which sharply distinguishes it from sibling tools like search_logs or summarize_errors by establishing it as a high-level diagnostic orchestration rather than a low-level log query. The purpose is unambiguous and fully covers the tool's role.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The symptom list itself is a strong implicit usage guide: it tells an agent exactly which symptom ids map to which diagnostic scenarios, and the description notes it 'read[s] the right logs' per symptom. However, it never explicitly says when NOT to use this tool or points to an alternative (e.g., 'for raw log inspection use search_logs'). The context is clear enough for most cases, but explicit exclusions are missing, so it falls just short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
explainARead-onlyIdempotent
Explain a TPM log file, an error code, a symptom or a known issue.
Args: topic: A log name ("_SDMErrors.log", "13_adaptiva.log"), an error code ("0x80070643", "-2147467259", "1603", "http 407"), a symptom id ("patch_install_failed") or a known issue id. Omit for the index.
Returns: What the topic is, where it comes from, and related symptoms or fixes.
| Name | Required | Description | Default |
|---|---|---|---|
| topic | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish that the tool is read-only, idempotent, and non-destructive. The description adds meaningful behavioral detail beyond that: it defines the acceptable input formats, the edge-case behavior when topic is omitted (returning the index), and the shape of the response (what the topic is, where it comes from, related symptoms/fixes).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and well-structured, with an opening purpose sentence followed by Args and Returns sections. Every sentence contributes useful information, and the concrete examples are high-signal without being verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter, read-only tool with an output schema, the description covers everything an agent needs: what inputs are valid, what happens without an argument, and what the response contains. No critical gaps are apparent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Even though schema description coverage is 0%, the description fully compensates for the single optional topic parameter. It lists concrete examples of each accepted topic type and explicitly states the default behavior when omitted, which is richer guidance than the bare schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: explaining a TPM log file, error code, symptom, or known issue. It enumerates the accepted topic types clearly, which helps differentiate it from siblings like search_logs and summarize_errors, though it does not explicitly name those alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The accepted topic categories and the 'Omit for the index' note clearly imply when to use this tool: any time an agent needs an explanation of a log, error, symptom, or known issue. However, it does not explicitly state when not to use it or mention a sibling alternative, so the routing signal is implied rather than direct.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_log_filesARead-onlyIdempotent
List log files with device, role, purpose, size and the time span they cover.
Args: source: Source name; omit for all sources. device: Device name (e.g. "server", "client-13", "WS-BAD07"). role: "server", "client", "setup" or "unknown". name: Log name or glob, e.g. "adaptiva.log", "_SDMErrors.log", "content*.log". Rotated files (adaptiva.2.log) match their base name. limit: Maximum rows (1-1000).
Returns:
files (one row per file) plus counts by device, role and log name.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | ||
| role | No | ||
| limit | No | ||
| device | No | ||
| source | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds useful behavioral context beyond annotations: it discloses that rotated files (e.g., adaptiva.2.log) match their base name, and it outlines the return structure (one row per file plus counts). These details help the agent anticipate results without overstepping.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is structured with a clear purpose line, a parameter list, and a return note. It is longer than minimal but every sentence adds value; the rotated-file behavior and return-count detail are not filler. The front-loading of the purpose is effective, and the docstring-style formatting improves scannability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a list-metadata tool with an existing output schema (though not shown), the description is complete. It covers all parameters, gives matching semantics, and describes the return structure including aggregate counts. An agent can call this tool correctly without additional external knowledge, and the tool's simplicity (no nested objects, all optional params) aligns with this level of detail.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, so the description carries the full burden. It explains every parameter with type hints and concrete examples: source (omit for all), device (with sample names), role (enumeration), name (exact or glob, rotated matching), and limit (range 1-1000). This far exceeds minimal schema information and fully compensates for missing schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description begins with a specific verb ('List') and resource ('log files') and enumerates the attributes returned (device, role, purpose, size, time span). It clearly distinguishes this from content-searching siblings like search_logs by focusing on file metadata, and the parameter examples (e.g., 'content*.log') reinforce the listing scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for retrieving log file metadata but does not explicitly state when to prefer this over siblings like search_logs or summarize_errors. It does provide practical parameter guidance (e.g., 'omit for all sources') and explains how rotated files match base names, which helps correct invocation, but it lacks explicit when-to-use or when-not-to-use conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
remove_log_sourceA
Unregister a source added with add_log_source.
The original folder or bundle is never touched; only the extracted copy of a bundle kept by this server is deleted. Sources from TPM_LOG_SOURCES or auto-discovery are configured outside the server and cannot be removed here.
Args: name: The source name.
Returns: What was removed.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses that only the extracted copy is deleted, never the original, which adds valuable nuance beyond the annotations (all false, so they offer no safety signal). It also notes the inability to remove externally configured sources. However, it does not mention idempotency or other behavioral details that the annotations leave unaddressed, so it is not fully transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, front-loaded with purpose, and structured with clear Args and Returns sections. Every sentence contributes value: the core action, the safety guarantee, the exclusion, and the parameter/return notes. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter tool with an output schema, the description covers purpose, side effects, exclusions, and the return value. It is complete enough for an agent to invoke it correctly without additional context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description must compensate for the single 'name' parameter. It merely restates 'The source name,' which adds no meaning beyond the schema's type and title. It does not clarify format, source, or validation requirements, leaving the agent with minimal guidance.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Unregister') and resource ('a source added with add_log_source'), clearly distinguishing it from sibling tools like add_log_source and check_log_sources. It also clarifies the side effect, leaving no ambiguity about what the tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states that sources from TPM_LOG_SOURCES or auto-discovery cannot be removed here, giving a clear when-not-to-use condition. It also implies the primary use case (sources added via add_log_source) but does not name alternative tools for those cases, so it stops short of full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_logsARead-onlyIdempotent
Search every log, including multi-line messages and stack traces.
Matches are whole entries (not single lines), de-duplicated across logs that repeat the same event, sorted by time, and redacted.
Args: pattern: Text to find (literal unless regex=true), e.g. a KB number, patch ID, client ID, content ID ("Policy_104117") or error text. regex: Treat pattern as a regular expression. case_sensitive: Default false. since: Window start (ISO or relative like 24h); default all history. until: Window end. source: Source name; omit for all sources. device: Only this device. role: "server", "client" or "setup". files: Log names or globs to search. component: Exact component name, e.g. "TenableClient". min_severity: Only entries at or above INFO/WARN/ERROR. context: Entries of context before and after each match from the same file (0-5). limit: Matches to return (1-200). offset: Skip this many matches (paging; see next_offset). order: "newest" (default) or "oldest" first.
Returns:
total_matches, matches (with file, line, component, thread, codes) and paging.
| Name | Required | Description | Default |
|---|---|---|---|
| role | No | ||
| files | No | ||
| limit | No | ||
| order | No | newest | |
| regex | No | ||
| since | No | ||
| until | No | ||
| device | No | ||
| offset | No | ||
| source | No | ||
| context | No | ||
| pattern | Yes | ||
| component | No | ||
| min_severity | No | ||
| case_sensitive | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark the operation as read-only, idempotent, and non-destructive. The description adds meaningful behavior beyond that: matches are whole entries, de-duplicated across logs, sorted by time, and redacted, with paging behavior disclosed. There is no contradiction with the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with a one-line purpose, followed by a compact behavioral note, a well-organized Args list, and a Returns line. Every section contributes useful information and there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only search tool with an output schema, the description covers the use case, all filter parameters, behavioral quirks, and paging/return shape. An agent has enough context to select and invoke the tool correctly without additional inference.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the full parameter-documentation burden. It documents every parameter with defaults, constraints, and examples, including regex, since, source, role, files, component, min_severity, context, limit, offset, and order.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Search every log', a specific verb plus resource, and adds 'including multi-line messages and stack traces' to define the scope precisely. It is clearly distinguishable from sibling analysis tools like summarize_errors or diagnose even without naming them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes the intended use clear: search raw log entries by pattern over all logs, with rich filtering options. It does not explicitly mention alternatives or exclusion conditions, but the search semantics and filter list provide strong contextual guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
summarize_errorsARead-onlyIdempotent
Group every warning and error into distinct issues, ranked, with known fixes.
The best first call for "what is wrong?". Repeats are collapsed into signatures
(IDs, GUIDs, IPs, numbers and paths normalised); the same event written to several
logs is counted once. Each issue has counts, first/last seen, devices, decoded error
codes, root causes from stack traces, the latest example with file and line, and -
when recognised - a known-issue explanation and remediation. INFO lines that carry
stack traces are raised to ERROR (flagged). Known platform noise is counted under
noise instead of cluttering issues.
Args:
since: Window start: ISO time (2026-09-17T08:00) or relative (90m, 24h, 7d, 2w)
counted back from the newest log entry. Default 7d.
until: Window end (same formats). Default: newest entry.
source: Source name; omit for all sources.
device: Only this device.
role: "server", "client" or "setup".
files: Log names or globs, e.g. ["VulnerabilityManagement.log"].
min_severity: WARN (default), ERROR or FATAL.
include_noise: Include known platform noise in issues.
top: Issues to return (1-100).
Returns:
totals, ranked issues, noise, top components/logs and coverage.
| Name | Required | Description | Default |
|---|---|---|---|
| top | No | ||
| role | No | ||
| files | No | ||
| since | No | 7d | |
| until | No | ||
| device | No | ||
| source | No | ||
| min_severity | No | WARN | |
| include_noise | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate read-only, idempotent, non-destructive behavior. The description adds rich behavioral detail beyond that: repeat collapsing via normalized signatures, cross-log duplicate counting, INFO lines with stack traces elevated to ERROR, known platform noise separated into `noise`, and per-issue metadata like counts, first/last seen, devices, root causes, and fixes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose, then provides dense but scannable behavioral details and an Args/Returns structure. Every sentence earns its place; the length is justified by the complexity of a 9-parameter diagnostic tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity and the 0% schema description coverage, the description is complete: it explains filtering, deduplication, severity elevation, noise handling, known-fix metadata, and return sections. An output schema exists to handle detailed return structure, so no essential guidance is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the full burden for all 9 parameters. The Args section documents every parameter with formats, defaults, allowed values, examples, and semantics, e.g. `since` supports ISO or relative times, `role` accepts server/client/setup, `files` accepts globs, and `top` is bounded to 1-100.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Group every warning and error into distinct issues, ranked, with known fixes.' It also positions itself as 'The best first call for "what is wrong?"', which clearly distinguishes it from sibling tools like search_logs, diagnose, and detect_log_anomalies.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear situational advice: use this as the first call when diagnosing what is wrong. It does not, however, explicitly name siblings as alternatives or state cases where another tool such as search_logs or diagnose should be preferred instead, so it stops just short of full exclusion guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
11 tool updates
v0.1.0- First observed
add_log_source - First observed
build_timeline - First observed
check_log_sources - First observed
compare_devices - First observed
detect_log_anomalies - First observed
diagnose - First observed
explain - First observed
list_log_files - First observed
remove_log_source - First observed
search_logs - First observed
summarize_errors
TDQS
Scored across 11 tools
Each tool has a clearly distinct responsibility: source lifecycle, listing, searching, timeline building, error summarization, symptom diagnosis, device comparison, and anomaly detection. Even the analysis tools are well-separated by their inputs and outputs, so an agent is unlikely to confuse them.
The tool names mostly follow a predictable verb_noun pattern in snake_case, such as add_log_source, list_log_files, and summarize_errors. Minor deviations exist: 'explain' and 'diagnose' are bare verbs without an object, and source appears as both singular and plural, but the overall convention remains readable.
With 11 tools, the server is well-scoped for a log-analysis domain. The number feels justified: source management, log discovery, search, timeline, error analysis, diagnosis, comparison, and anomaly detection all earn their place without redundancy.
The tool surface covers the full workflow from registering log sources, checking their health, listing and searching files, building timelines, summarizing errors, and running symptom-specific diagnoses. There are no obvious dead ends; even advanced needs like comparative and baseline anomaly analysis are addressed.
Maintenance
Related MCP Connectors
Search log events, investigate anomalies, and manage cases in your Knowledge Grid tenant.
Triage failing GitHub Actions jobs and see what self-heal repaired, in natural language.
Read-only CVE intelligence, remediation playbooks, and agent setup guides. Not a scanner.
Read-only access to Auralogs production logs: search logs, inspect errors, review AI analyses.
Related MCP Servers
- FlicenseBqualityCmaintenanceEnables AI-assisted analysis of log files through advanced searching, filtering, and test execution capabilities. Supports time-based queries, pattern matching, test summarization, and code coverage reporting directly within compatible MCP clients.12-
- FlicenseNot gradedqualityDmaintenanceEnables querying and analyzing logs from multiple remote Unix hosts via the Log Collector API, with tools for search, error detection, and summary generation.-
- AlicenseAqualityBmaintenanceEnables querying and analyzing Tenable Vulnerability Management audit logs, including activity summaries, API key usage, and anomaly detection through MCP tools.61MIT
- AlicenseAqualityBmaintenanceEnables analyzing Salesforce deployment logs, validating metadata manifests, assessing permission risks, and generating remediation plans through deterministic, local-only rules.4MIT