Skip to main content
Glama
brendanong95

tenable-patch-management-logs-mcp

by brendanong95

tenable-patch-management-logs-mcp

Tests

An MCP server that does the log digging for Tenable Patch Management (TPM), for both SaaS and on-prem deployments. Point it at server logs (the Admin Portal zip, or the on-prem logs folder) and client logs (device folders, collector bundles, or a log requested from a client), then ask questions like "why are my Tenable VM vulnerabilities not showing up in TPM?" or "what changed on the server in the last 24 hours?".

The server does the analysis. Parsing, de-duplication across logs, error-code decoding, known-issue matching and threshold comparisons all happen in Python; tools return finished, structured results (verdict, ranked issues with counts and fixes, findings with reasoning) instead of piles of raw lines for the model to add up.

What it gives you

Tool

Purpose

check_log_sources

Start here. Sources, devices, server/client/setup logs, time span, SaaS vs on-prem (with evidence), TPM versions, version advisories, and where to get missing logs.

summarize_errors

Every warning and error grouped into distinct issues, ranked, de-duplicated across logs, with decoded error codes, root causes, the latest example (file and line) and known-issue fixes. Platform noise is counted separately.

diagnose

Symptom playbooks with a verdict: patch_install_failed, content_download, client_connectivity, vm_integration, feeds, content_publication, service_health, database, client_upgrade, feature_update_readiness.

search_logs

Literal or regex search across all logs, including multi-line messages and stack traces, with context and paging.

build_timeline

Server and client logs merged into one time-ordered sequence, around a moment or over a window.

compare_devices

Warnings and errors a problem device has that a healthy device does not.

detect_log_anomalies

A recent window compared with the days before it: new error signatures, error spikes, restart loops, logs that went quiet.

list_log_files

Files with device, role, purpose, size and time span.

explain

What a log file records, what an error code means (0x80070643, 1603, http 407), or what a symptom / known issue covers.

add_log_source / remove_log_source

Register a folder, UNC path, single log file, .zip or .tar.gz; remembered between sessions.

Safety properties worth knowing:

  • Read-only. Sources are never modified. The only writes are data/sources.json (sources added with add_log_source) and an extracted copy of each bundle under data/bundles.

  • Nothing that looks like a credential is returned. TPM writes the Tenable VM access key into VulnerabilityManagement.log and adaptiva.err in plain text; 64-hex key material, token: / password= / secretKey= values, bearer tokens and URL passwords are masked to their last 4 characters. Host names, IPs, e-mail addresses, GUIDs and client IDs are kept because troubleshooting needs them.

  • No silent truncation. Each call reads at most 1 GB / 5,000 files (newest first); anything not read is listed in coverage with how to narrow the call. Lines in an unrecognised format are never merged into one entry.

  • Bundles are extracted defensively: path-traversal entries are skipped, and extraction stops at 8 GB or 100,000 files.

  • No network access and no Tenable API keys. TPM has no documented public API; everything comes from its logs.

Related MCP server: Log Analyzer MCP Server

How it covers SaaS and on-prem

Server logs

Client logs

SaaS

Admin Portal → gear icon → LogsDownload All Server Logs, then add_log_source with the zip. This is the only way to get SaaS server logs.

Same for both: copy %ADAPTIVACLIENT%\logs (default C:\Program Files\Tenable\PatchClient\logs; /opt/tenable/patchclient/logs on Linux/macOS), run collect/Collect-TPMLogs.ps1, or request a log from the server (10.2.973.9+), which downloads as e.g. 13_adaptiva.log (client ID 13).

On-prem

Register %ADAPTIVASERVER%\logs directly (default C:\Program Files\Tenable\PatchServer\logs), locally or as a UNC path; or download from Admin Portal → Logs.

Client logs look the same in both deployments, so every tool works the same way. The deployment is inferred per source from the logs themselves and shown with its evidence by check_log_sources, for example a PostgreSQL database and /opt/adaptiva/adaptiva-server paths (SaaS) or ntlmauth.log and SQL Server (on-prem). Set TPM_DEPLOYMENT or pass deployment to add_log_source to override.

Requirements

  • Python 3.11+

  • uv

  • TPM logs (see above). No Tenable credentials are needed.

Setup

uv sync --extra dev

Optionally copy .env.example to .env to preconfigure sources:

cp .env.example .env

Variable

Meaning

TPM_LOG_SOURCES

name=path;name2=path2 - folders, UNC paths, log files, .zip / .tar.gz bundles.

TPM_DEPLOYMENT

saas, onprem or auto (default: inferred per source).

TPM_AUTO_DISCOVER

Also use TPM installed on this machine (%ADAPTIVASERVER%, %ADAPTIVACLIENT%, %windir%\AdaptivaSetupLogs, /opt/tenable/patchclient/logs). Default true.

TPM_MCP_DATA_DIR

Where runtime sources and extracted bundles live. Default ./data.

Sources can also be added in conversation with add_log_source, which is usually easier for support bundles.

Run the server directly (it speaks MCP over stdio, so it will just sit there waiting for a client - that is the correct behaviour):

uv run python -m src.server

Connecting a client

Use the absolute path to this folder in the config below.

Claude Desktop

Edit claude_desktop_config.json (%APPDATA%\Claude\claude_desktop_config.json on Windows, ~/Library/Application Support/Claude/claude_desktop_config.json on macOS):

{
  "mcpServers": {
    "tenable-patch-logs": {
      "command": "uv",
      "args": [
        "--directory",
        "C:\\path\\to\\tenable-patch-management-logs-mcp",
        "run",
        "python",
        "-m",
        "src.server"
      ],
      "env": {
        "TPM_LOG_SOURCES": "saas-server=C:\\cases\\acme\\logs.zip;clients=C:\\cases\\acme\\TPM-Logs-20260917"
      }
    }
  }
}

Restart Claude Desktop afterwards. If uv is not on the launcher's PATH, use its absolute path ((Get-Command uv).Source / which uv) as command. The env block is optional.

Claude Code

claude mcp add tenable-patch-logs -- uv --directory /absolute/path/to/tenable-patch-management-logs-mcp run python -m src.server

Add --env TPM_LOG_SOURCES=... to preconfigure sources, or add the same block as above to a project-level .mcp.json.

Getting the logs

  • SaaS server: Admin Portal → gear icon → Logs → Download All Server Logs. The zip contains adaptiva-server/ with adaptiva*.log, adaptiva.err, componentlogs/ and workflowlogs/. Downloading it twice gives two slightly different snapshots; use the newer one.

  • On-prem server: the logs folder itself, or a UNC path such as \\tpm01\c$\Program Files\Tenable\PatchServer\logs.

  • Clients, several at once (Windows):

    .\collect\Collect-TPMLogs.ps1 -ComputerName WS-BAD07, WS-GOOD01 -Days 3
    .\collect\Collect-TPMLogs.ps1 -ComputerName TPM01 -IncludeServer     # on-prem server box

    One folder per device, zipped, plus the Client Validator results from the registry. Include a healthy device so compare_devices has something to compare against.

  • Linux / macOS clients: sudo ./collect/collect-tpm-logs.sh 3 /tmp (tar.gz, includes the adaptivaclientd journal).

  • One client from the console: 10.2.973.9 and later can request a log file from a client; the download (<clientId>_adaptiva.log) can be registered as is.

Example questions to ask once connected

  • "Add C:\cases\acme\logs.zip as acme-saas and check the log sources."

  • "Summarise what's wrong on the TPM server over the last 7 days, ignoring noise."

  • "Why is Tenable VM data not showing up in Patch Management?" (runs diagnose vm_integration)

  • "Why did patching fail on WS-BAD07 yesterday? Decode the exit codes."

  • "Build a timeline for WS-BAD07 from 30 minutes before the first installer failure."

  • "What does WS-BAD07 have that WS-GOOD01 doesn't?"

  • "Anything new or spiking in the last 24 hours compared with the week before?"

  • "Which clients is the server retrying messages to?"

How the analysis works

Parsing. Log layouts were taken from real TPM 10.2.973.9 logs (a SaaS server bundle and a Windows client), plus the standard Windows Installer log:

Layout

Where

Example

adaptiva

adaptiva.log, adaptiva.err, every component log, server and client

2026-09-12 18:00:25,141 - INFO - <message> - PolicyManager - TID=3340624, <thread>

workflow

workflowlogs/<name>_<id>_<seq>.log

09-17-2026 14:00:00:2 : Exec: Starting: Start1.Global_Approvals

blocks

SQLUploader.log

----- START(2026-09-02T01:44:27.942) -----

msi

msiLogs/*.log (UTF-16 handled)

MSI (s) (A4:B8) [10:01:02:300]: ... error status: 1603.

timestamped

setup logs, exported journalctl

2026-09-10T08:15:02+0800 host adaptivaclientd[812]: ...

Multi-line messages (the component suffix can sit on a later line) and stack traces stay attached to their entry. Rotated files (adaptiva.2.log, Feeds.1.log, .gz) are read as one log.

De-duplication. TPM writes an error to adaptiva.log or a component log and to adaptiva.err. Events are matched on device, timestamp, level, thread and message, and counted once (duplicate_lines_in_other_logs reports how many repeats were removed).

Severity. TPM sometimes logs real failures at INFO. The documented Services-sensor issue, for example, is an INFO line carrying an exception. Entries with a stack trace or a non-zero Adaptiva Error Code are raised to ERROR and flagged with raised_from_lower_level.

Known issues (src/knowledge.py) each carry a confidence:

  • documented: described by Tenable or Adaptiva, with a source link (for example the 9.2 Services-sensor DLL issue, or the 9.1.965.x client upgrade failure).

  • observed: seen in real TPM 10.2.973.9 logs, explained from the message and surrounding lines (for example Tenable VM keys rejected with "not related to any active containers", periodic feed check failures, CDN publication failures, clients rejected for missing install authentication).

  • generic: standard Java, Windows, SQL or network errors.

Issues with impact: none are platform noise (for example the SQL Server monitoring query that fails daily on the SaaS PostgreSQL database, or receipt-cleanup warnings). About two thirds of the warning and error events in the real SaaS bundle were noise. They are counted under noise, not listed as issues.

Error codes are decoded from context: MSI / Win32 exit codes (1603, 1618, 3010), HRESULTs including HRESULT_FROM_WIN32 values (0x80070643), Windows Update (0x8024xxxx), component servicing (0x800Fxxxx), negative decimal HRESULTs and HTTP statuses. Adaptiva's own Error Code = N values are shown but never decoded as Windows errors.

Anomalies compare a window with the period before it, read from the same logs, so no state has to build up. Thresholds are constants at the top of src/anomaly.py and are echoed in every result:

Constant

Default

Meaning

SPIKE_MULTIPLIER

3.0

Window rate per day must exceed this multiple of the baseline rate

SPIKE_MIN_WINDOW_EVENTS

10

Minimum window events before a spike is flagged

NEW_SIGNATURE_HIGH_COUNT

10

A new ERROR signature with this many events is rated high

MIN_BASELINE_COVERAGE_PCT

50.0

Below this share of the baseline covered by a log, "new" findings are low confidence

RESTART_MIN_STARTS

3

Service starts in the window that count as repeated restarts

SILENT_LOG_MIN_BASELINE_EVENTS

50

Baseline entries a log needs before going quiet is notable

Each finding is judged against the log(s) it appears in. A log that only started recently is not reported as a spike just because the device's other logs go back further.

Time. Relative windows (90m, 24h, 7d, 2w) count back from the newest entry in the selected logs, not from now, so an old support bundle still gives sensible results. Timestamps are shown as written. TPM 10.2 SaaS server logs and Windows client logs were observed to be in UTC.

Layout

src/
  server.py        MCP entrypoint and the eleven tool definitions
  sources.py       Source configuration, bundle extraction, device / role / rotation detection
  logformat.py     Line layouts, multi-line entries, encodings, time spans
  classifier.py    Redaction, signatures, severity, known-issue matching, extractions
  error_codes.py   Win32 / MSI / HRESULT / Windows Update / CBS / HTTP code decoding
  knowledge.py     Log catalog, known issues, playbooks, version advisories, where to get logs
  analysis.py      Scoped, bounded scanning; summaries, search, timelines, playbooks, comparisons
  anomaly.py       Window-versus-baseline findings and thresholds
collect/
  Collect-TPMLogs.ps1    Windows collector (local or WinRM), one folder per device
  collect-tpm-logs.sh    Linux / macOS collector
scripts/
  smoke_local.py   Offline end-to-end run of every tool
  live_check.py    Read-only run against your configured logs
tests/
  sample_logs.py   Synthetic, sanitised logs in the real layouts
  test_*.py

Dependency direction is one-way: server → {analysis, anomaly} → {classifier, sources} → {logformat, error_codes, knowledge}.

Testing

1. Unit tests (no network)

uv run pytest -q

162 tests covering every layout, rotation and encoding, bundle extraction guards, device/role detection, redaction, signatures, severity escalation, known issues, every playbook, anomaly thresholds and the tool contracts. All fixtures are synthetic (tests/sample_logs.py); no real log content is stored in the repository.

2. Offline end-to-end

uv run python scripts/smoke_local.py

Registers a synthetic SaaS server bundle, a two-device client bundle and a single requested client log through the tools, calls every tool, and asserts the results: duplicates counted once, noise set aside, planted secrets redacted, known issues found, bad input returned as a structured error. Exits non-zero on any failure, so it works as a CI gate.

3. Against your logs (read-only)

uv run python scripts/live_check.py 7d

Uses the same configuration as the server and prints sources, the error summary, the playbooks relevant to the logs you have, and anomalies. On the real 80 MB SaaS bundle every call finished in under 5 seconds.

4. Through an MCP client

npx @modelcontextprotocol/inspector uv --directory . run python -m src.server

Or connect Claude Desktop / Claude Code (above) and ask one of the example questions.

Known limitations

  • Formats validated on 10.2.973.9 SaaS server logs and a Windows client adaptiva.log. On-prem server logs use the same Java logging and are expected to match, but have not been checked against a real on-prem bundle. The same applies to Linux and macOS client logs. check_log_sources lists any file whose format was not recognised.

  • Client component logs were not in the real samples. The playbooks for _SDMErrors.log, SoftwareInstaller.log and WindowsPatching.log rely on exit codes, HRESULTs, exceptions and the documented PatchDeploymentResult line rather than exact message wording. Add real patterns to KNOWN_ISSUES as you meet them.

  • PatchDeploymentResult status and reason values are undocumented. They are shown as logged; failure evidence comes from non-zero reason codes and exceptions.

  • Timestamps are not converted between time zones. Mixing logs from machines that log in different zones shifts them relative to each other in timelines.

  • Relative windows follow the newest entry in the selected logs. Filter to one source or device when their logs end at very different times.

  • Anomaly detection only sees what the logs still contain. Heavily rotated logs give short baselines; findings then carry low_confidence.

  • The knowledge base is a starting point. Known issues marked observed come from one tenant's logs; confirm fixes against current Tenable documentation.

Disclaimer

Not affiliated with, endorsed by, or supported by Tenable, Inc. or Adaptiva. "Tenable", "Tenable Patch Management", "Tenable Vulnerability Management" and "Adaptiva" are trademarks of their respective owners. This project reads log files you already have; it is an independent troubleshooting aid, not a Tenable product, and its findings should be confirmed against current vendor documentation before you act on them.

Sources

Available Tools

11 tools
add_log_sourceA

Register TPM logs to analyse; remembered between sessions.

Nothing at path is modified. Bundles are extracted once into the server's data folder.

Args: name: Short label, e.g. "acme-saas-server" or "clients-0917" (letters, digits, '.', '_', '-'). path: A folder (local or UNC, e.g. \tpm01\c$\Program Files\Tenable\PatchServer\logs), a single log file (e.g. 13_adaptiva.log requested from a client), or a .zip / .tar.gz bundle such as the Admin Portal "Download All Server Logs" zip. deployment: "saas", "onprem" or "auto" (infer from the logs).

Returns: The registered source, the devices and log counts found, and the next step.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
pathYes
deploymentNoauto

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

It explicitly reassures that nothing at path is modified, discloses one-time bundle extraction into the server's data folder, and notes that registration persists between sessions. This goes well beyond the sparse annotations and gives an agent a clear safety picture.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose, then uses short labeled Args and Returns sections to organize details. Every sentence carries needed information, including the important 'nothing modified' guarantee.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a registration tool with three parameters and nontrivial path handling, the description covers all required inputs, edge-case input types, side effects, and what the call returns. The presence of an output schema means the return-value summary is sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema contains no descriptions, yet the description fully documents all three parameters: name format, accepted path types with realistic examples, and deployment allowed values. An agent can construct correct arguments without opening anything else.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening line 'Register TPM logs to analyse; remembered between sessions' states a specific action, resource, and persistence behavior. This clearly separates it from siblings like remove_log_source, check_log_sources, and list_log_files.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear, concrete guidance on what inputs are valid: folder, single file, or archive bundle, with examples and a deployment value of 'saas', 'onprem', or 'auto'. It does not explicitly contrast this tool with siblings such as check_log_sources or list_log_files, so it stops short of full when-to-use-versus-alternatives guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

build_timelineA
Read-onlyIdempotent

Merge all logs into one chronological sequence - what happened before and after.

Useful for "what led up to this failure": server and client logs are interleaved by timestamp, duplicates across logs removed, and consecutive repeats collapsed (repeats). When there are more rows than limit, WARN and above are always kept and the rest are sampled evenly (sampled).

Args: around: Centre the window on this time (ISO, or relative like 2h). minutes_before: Minutes before around (default 15). minutes_after: Minutes after around (default 15). since: Window start when not using around. Default: the last 60 minutes of logs. until: Window end when not using around. source: Source name; omit for all sources. device: Only this device. role: "server", "client" or "setup". files: Log names or globs. min_severity: INFO (default), WARN, ERROR; DEBUG to include debug lines. keyword: Only entries containing this text. include_noise: Include known platform noise. collapse_repeats: Merge consecutive identical rows (default true). limit: Rows to return (10-1000).

Returns: rows in time order, each with time, device, severity, log, component, message and at (file:line).

ParametersJSON Schema
NameRequiredDescriptionDefault
roleNo
filesNo
limitNo
sinceNo
untilNo
aroundNo
deviceNo
sourceNo
keywordNo
min_severityNoINFO
include_noiseNo
minutes_afterNo
minutes_beforeNo
collapse_repeatsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnly, idempotent, non-destructive), the description discloses important behavior: duplicate removal, consecutive repeat collapsing, and the overflow policy where WARN and above are kept while the rest are sampled. It also documents the return row structure, giving the agent a clear model of what the tool does.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a front-loaded purpose, behavior notes, a compact Args list, and a short Returns section. Every sentence earns its place; despite covering 14 parameters, it remains readable and free of redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 14-parameter tool with zero schema descriptions, the description covers purpose, filtering options, defaults, behavioral edge cases (limit overflow), and return fields. Nothing essential for correctly invoking the tool appears to be missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries full responsibility for parameter meaning. The 'Args' section explains all 14 parameters, including defaults for minutes_before, minutes_after, min_severity, collapse_repeats, and the limit range, making every parameter actionable without schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific action and resource: 'Merge all logs into one chronological sequence - what happened before and after.' It also ties the tool to a concrete use case ('what led up to this failure') and distinguishes it from sibling log tools by emphasizing interleaving server/client logs by timestamp.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly states when the tool is useful: reconstructing what led up to a failure by merging and time-ordering logs. It does not explicitly name alternatives or state when not to use it, but the scenario is concrete enough for an agent to select it appropriately.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_log_sourcesA
Read-onlyIdempotent

Show which TPM logs are available, and whether they can be read and parsed.

Run this first. For every source it reports the devices found (server / client / setup logs), the time span each device's logs cover, whether the deployment looks like SaaS or on-prem (with the evidence), TPM versions seen in service start lines, version advisories, and any files whose line format was not recognised. It also says where to get missing logs (for example the Admin Portal zip for SaaS server logs).

Returns: A dict with ok, a message, per-source details, guidance for missing logs, and the active configuration.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, so the safety profile is covered. The description adds useful behavioral context by explaining that the tool scans log sources, reports parseability and format issues, and provides guidance for missing logs, all consistent with a non-mutating diagnostic step.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with 'Run this first' and organized into a clear overview followed by output details. It is a bit longer than strictly necessary, and the 'Returns' section may duplicate what the output schema already conveys, but nearly every sentence adds useful context.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter discovery tool, the description is complete: it states what it checks, what it reports, where missing logs can be found, and what the return structure looks like. Combined with rich annotations and an output schema, an agent has everything needed to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there are no parameter semantics for the description to clarify. Baseline for 0-parameter tools is 4, and the description does not need to compensate for any schema gaps.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Show which TPM logs are available, and whether they can be read and parsed.' It then enumerates concrete outputs such as devices found, time spans, SaaS/on-prem determination, and TPM versions, which clearly distinguishes it from sibling tools like list_log_files or search_logs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Run this first,' giving a clear directive on when to invoke this tool. It does not explicitly enumerate when-not-to-use or alternatives, but the sequencing guidance is unambiguous and actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compare_devicesA
Read-onlyIdempotent

Show warnings and errors on a problem device that a healthy device does not have.

Args: healthy_device: A device that patches correctly. problem_device: The device with the problem. since: Window start (ISO or relative). Default 7d. until: Window end. source: Source name; omit for all sources. min_severity: WARN (default) or ERROR. include_noise: Include known platform noise. top: Issues per list (1-100).

Returns: only_on_problem_device and more_frequent_on_problem_device, with counts.

ParametersJSON Schema
NameRequiredDescriptionDefault
topNo
sinceNo7d
untilNo
sourceNo
min_severityNoWARN
include_noiseNo
healthy_deviceYes
problem_deviceYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, covering safety and side-effect profile. The description adds value by explaining the comparison logic (only issues not present on healthy device) and the return format (lists with counts). It does not contradict annotations and provides context beyond what the structured fields carry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with a one-sentence summary, followed by a clean Args list and a Returns note. There is no wasted text; each sentence earns its place. The structure makes it easy for an agent to parse quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 8 parameters and an output schema (not shown), the description covers all parameters, explains the comparison semantics, and describes the return keys. It is complete for an agent to invoke the tool correctly without external documentation. The only minor gap is that device identifiers are not specified as names or IDs, but this is likely context-dependent and not critical.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description fully compensates by explaining every parameter in the Args block: healthy_device, problem_device, since, until, source, min_severity, include_noise, and top. Each gets a concise, meaningful definition (e.g., 'A device that patches correctly', 'WARN (default) or ERROR'). This is essential for an agent to populate parameters correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('Show warnings and errors on a problem device that a healthy device does not have') with a clear resource and comparison logic. It is distinct from siblings like diagnose or summarize_errors, though it does not explicitly name alternatives. The verb 'Show' and the two-device comparison make the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use this tool (when you have a healthy and problem device to compare) but does not explicitly state when not to use it or mention alternative tools. There is no guidance on choosing between this and diagnose or summarize_errors. The context is clear enough for an agent to infer, but explicit routing would be better.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

detect_log_anomaliesA
Read-onlyIdempotent

Compare a recent window with the days before it, in the same logs.

Flags error signatures never seen in the baseline, errors whose rate jumped above the spike threshold, services that started repeatedly, and logs that stopped writing. Each finding has evidence, the threshold crossed and a reasoning sentence. Findings are marked low confidence when the logs do not reach far enough back.

Args: since: Window start (ISO or relative like 24h, counted back from the newest entry). until: Window end. Default: newest entry. baseline_days: Days before the window to compare against (1-90, default 7). source: Source name; omit for all sources. device: Only this device. role: "server", "client" or "setup".

Returns: Severity-ordered findings, counts by type and severity, baseline coverage and the active thresholds.

ParametersJSON Schema
NameRequiredDescriptionDefault
roleNo
sinceNo24h
untilNo
deviceNo
sourceNo
baseline_daysNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover readOnly, idempotent, non-destructive. The description adds key behavioral details: confidence levels, baseline coverage, threshold crossing, and return criteria. It does not mention pagination or rate limits, but that's minor here.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured: high-level purpose first, then anomaly types, then explicit Args and Returns sections. Every sentence adds value; no fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Complex tool with 6 params, but annotations cover safety and output schema exists. The description explains return structure, parameter semantics and confidence. Effectively complete for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must explain parameters. It provides useful detail for since, until, baseline_days, and mentions source, device, role. However, it omits the 'role' parameter's default and doesn't elaborate on 'until' accepted formats beyond ISO/relative. Also, it doesn't explain the effect of omitting source/device. Lacks completeness despite some effort.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clear verb+resource (detect anomalies in logs), describes specific anomaly types, and implicitly distinguishes from related tools like check_log_sources (checks sources) and summarize_errors (summarizes errors).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

States how to use (compare recent window with baseline), but does not explicitly say when not to use or name alternatives. However, the context is clear enough to route an agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

diagnoseA
Read-onlyIdempotent

Run a symptom playbook: read the right logs and return a verdict with evidence.

Symptoms:

  • patch_install_failed - deployment results, installer exit codes (decoded), MSI failures

  • content_download - content / peer-to-peer / CDN download problems on clients

  • client_connectivity - client transport errors, server retries per client ID, registrations rejected for missing install authentication

  • vm_integration - Tenable VM / Security Center access settings, API key failures, vulnerability import runs

  • feeds - periodic feed checks, last success, failure root causes

  • content_publication - content uploads to the CDN that failed

  • service_health - service starts with versions, restart loops, crashes, out-of-memory

  • database - SQL errors, SQL Server authentication, deadlocks

  • client_upgrade - upgrade problems and versions seen over time

  • feature_update_readiness - free disk space vs the 50 GB requirement, NOT INSTALLED scans

Args: symptom: One of the symptom ids above. since: Window start (ISO or relative like 24h). Default 7d. until: Window end. source: Source name; omit for all sources. device: Only this device.

Returns: verdict, findings (known issues with remediation), other related errors, playbook-specific details, missing_logs with how to get them, and advice.

ParametersJSON Schema
NameRequiredDescriptionDefault
sinceNo7d
untilNo
deviceNo
sourceNo
symptomYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds meaningful behavioral context: it discloses that the tool reads logs, returns a structured verdict with findings/remediation, and includes a missing_logs field that tells the agent how to obtain absent data. It also implies a time-window default (7d) and per-device/source scoping. This goes beyond the annotations without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is longer than average, but every section earns its place: the one-sentence summary is front-loaded, the symptom list is a compact reference table, the Args block is a clear parameter guide, and the Returns block lists the output fields. It uses bullet-like formatting and avoids redundancy. The length is proportional to the tool's complexity, and the structure makes it scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with five parameters and ten symptom variants, the description covers all necessary aspects: what it does, which symptoms it handles, how to set time windows and filters, and what it returns (verdict, findings, details, missing_logs, advice). An output schema exists, so the description needn't detail every return field, but it names them all. Nothing an agent needs to select or invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides zero documentation for parameters (coverage 0%), so the description carries the full burden. It does this thoroughly: 'symptom' is explained with a list of ten valid ids and what each checks; 'since' and 'until' specify ISO or relative formats with a default; 'source' and 'device' clarify scope and that 'omit for all sources'. This is exactly the semantic enrichment an agent needs and goes well beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb ('Run a symptom playbook') and a clear resource ('logs'), and states the output ('verdict with evidence'). It also enumerates ten distinct symptom playbooks, which sharply distinguishes it from sibling tools like search_logs or summarize_errors by establishing it as a high-level diagnostic orchestration rather than a low-level log query. The purpose is unambiguous and fully covers the tool's role.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The symptom list itself is a strong implicit usage guide: it tells an agent exactly which symptom ids map to which diagnostic scenarios, and the description notes it 'read[s] the right logs' per symptom. However, it never explicitly says when NOT to use this tool or points to an alternative (e.g., 'for raw log inspection use search_logs'). The context is clear enough for most cases, but explicit exclusions are missing, so it falls just short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

explainA
Read-onlyIdempotent

Explain a TPM log file, an error code, a symptom or a known issue.

Args: topic: A log name ("_SDMErrors.log", "13_adaptiva.log"), an error code ("0x80070643", "-2147467259", "1603", "http 407"), a symptom id ("patch_install_failed") or a known issue id. Omit for the index.

Returns: What the topic is, where it comes from, and related symptoms or fixes.

ParametersJSON Schema
NameRequiredDescriptionDefault
topicNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish that the tool is read-only, idempotent, and non-destructive. The description adds meaningful behavioral detail beyond that: it defines the acceptable input formats, the edge-case behavior when topic is omitted (returning the index), and the shape of the response (what the topic is, where it comes from, related symptoms/fixes).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured, with an opening purpose sentence followed by Args and Returns sections. Every sentence contributes useful information, and the concrete examples are high-signal without being verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter, read-only tool with an output schema, the description covers everything an agent needs: what inputs are valid, what happens without an argument, and what the response contains. No critical gaps are apparent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Even though schema description coverage is 0%, the description fully compensates for the single optional topic parameter. It lists concrete examples of each accepted topic type and explicitly states the default behavior when omitted, which is richer guidance than the bare schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: explaining a TPM log file, error code, symptom, or known issue. It enumerates the accepted topic types clearly, which helps differentiate it from siblings like search_logs and summarize_errors, though it does not explicitly name those alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The accepted topic categories and the 'Omit for the index' note clearly imply when to use this tool: any time an agent needs an explanation of a log, error, symptom, or known issue. However, it does not explicitly state when not to use it or mention a sibling alternative, so the routing signal is implied rather than direct.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_log_filesA
Read-onlyIdempotent

List log files with device, role, purpose, size and the time span they cover.

Args: source: Source name; omit for all sources. device: Device name (e.g. "server", "client-13", "WS-BAD07"). role: "server", "client", "setup" or "unknown". name: Log name or glob, e.g. "adaptiva.log", "_SDMErrors.log", "content*.log". Rotated files (adaptiva.2.log) match their base name. limit: Maximum rows (1-1000).

Returns: files (one row per file) plus counts by device, role and log name.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNo
roleNo
limitNo
deviceNo
sourceNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds useful behavioral context beyond annotations: it discloses that rotated files (e.g., adaptiva.2.log) match their base name, and it outlines the return structure (one row per file plus counts). These details help the agent anticipate results without overstepping.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured with a clear purpose line, a parameter list, and a return note. It is longer than minimal but every sentence adds value; the rotated-file behavior and return-count detail are not filler. The front-loading of the purpose is effective, and the docstring-style formatting improves scannability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a list-metadata tool with an existing output schema (though not shown), the description is complete. It covers all parameters, gives matching semantics, and describes the return structure including aggregate counts. An agent can call this tool correctly without additional external knowledge, and the tool's simplicity (no nested objects, all optional params) aligns with this level of detail.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, so the description carries the full burden. It explains every parameter with type hints and concrete examples: source (omit for all), device (with sample names), role (enumeration), name (exact or glob, rotated matching), and limit (range 1-1000). This far exceeds minimal schema information and fully compensates for missing schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description begins with a specific verb ('List') and resource ('log files') and enumerates the attributes returned (device, role, purpose, size, time span). It clearly distinguishes this from content-searching siblings like search_logs by focusing on file metadata, and the parameter examples (e.g., 'content*.log') reinforce the listing scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for retrieving log file metadata but does not explicitly state when to prefer this over siblings like search_logs or summarize_errors. It does provide practical parameter guidance (e.g., 'omit for all sources') and explains how rotated files match base names, which helps correct invocation, but it lacks explicit when-to-use or when-not-to-use conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

remove_log_sourceA

Unregister a source added with add_log_source.

The original folder or bundle is never touched; only the extracted copy of a bundle kept by this server is deleted. Sources from TPM_LOG_SOURCES or auto-discovery are configured outside the server and cannot be removed here.

Args: name: The source name.

Returns: What was removed.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses that only the extracted copy is deleted, never the original, which adds valuable nuance beyond the annotations (all false, so they offer no safety signal). It also notes the inability to remove externally configured sources. However, it does not mention idempotency or other behavioral details that the annotations leave unaddressed, so it is not fully transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, front-loaded with purpose, and structured with clear Args and Returns sections. Every sentence contributes value: the core action, the safety guarantee, the exclusion, and the parameter/return notes. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with an output schema, the description covers purpose, side effects, exclusions, and the return value. It is complete enough for an agent to invoke it correctly without additional context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description must compensate for the single 'name' parameter. It merely restates 'The source name,' which adds no meaning beyond the schema's type and title. It does not clarify format, source, or validation requirements, leaving the agent with minimal guidance.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Unregister') and resource ('a source added with add_log_source'), clearly distinguishing it from sibling tools like add_log_source and check_log_sources. It also clarifies the side effect, leaving no ambiguity about what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states that sources from TPM_LOG_SOURCES or auto-discovery cannot be removed here, giving a clear when-not-to-use condition. It also implies the primary use case (sources added via add_log_source) but does not name alternative tools for those cases, so it stops short of full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_logsA
Read-onlyIdempotent

Search every log, including multi-line messages and stack traces.

Matches are whole entries (not single lines), de-duplicated across logs that repeat the same event, sorted by time, and redacted.

Args: pattern: Text to find (literal unless regex=true), e.g. a KB number, patch ID, client ID, content ID ("Policy_104117") or error text. regex: Treat pattern as a regular expression. case_sensitive: Default false. since: Window start (ISO or relative like 24h); default all history. until: Window end. source: Source name; omit for all sources. device: Only this device. role: "server", "client" or "setup". files: Log names or globs to search. component: Exact component name, e.g. "TenableClient". min_severity: Only entries at or above INFO/WARN/ERROR. context: Entries of context before and after each match from the same file (0-5). limit: Matches to return (1-200). offset: Skip this many matches (paging; see next_offset). order: "newest" (default) or "oldest" first.

Returns: total_matches, matches (with file, line, component, thread, codes) and paging.

ParametersJSON Schema
NameRequiredDescriptionDefault
roleNo
filesNo
limitNo
orderNonewest
regexNo
sinceNo
untilNo
deviceNo
offsetNo
sourceNo
contextNo
patternYes
componentNo
min_severityNo
case_sensitiveNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the operation as read-only, idempotent, and non-destructive. The description adds meaningful behavior beyond that: matches are whole entries, de-duplicated across logs, sorted by time, and redacted, with paging behavior disclosed. There is no contradiction with the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with a one-line purpose, followed by a compact behavioral note, a well-organized Args list, and a Returns line. Every section contributes useful information and there is no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only search tool with an output schema, the description covers the use case, all filter parameters, behavioral quirks, and paging/return shape. An agent has enough context to select and invoke the tool correctly without additional inference.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full parameter-documentation burden. It documents every parameter with defaults, constraints, and examples, including regex, since, source, role, files, component, min_severity, context, limit, offset, and order.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Search every log', a specific verb plus resource, and adds 'including multi-line messages and stack traces' to define the scope precisely. It is clearly distinguishable from sibling analysis tools like summarize_errors or diagnose even without naming them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes the intended use clear: search raw log entries by pattern over all logs, with rich filtering options. It does not explicitly mention alternatives or exclusion conditions, but the search semantics and filter list provide strong contextual guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

summarize_errorsA
Read-onlyIdempotent

Group every warning and error into distinct issues, ranked, with known fixes.

The best first call for "what is wrong?". Repeats are collapsed into signatures (IDs, GUIDs, IPs, numbers and paths normalised); the same event written to several logs is counted once. Each issue has counts, first/last seen, devices, decoded error codes, root causes from stack traces, the latest example with file and line, and - when recognised - a known-issue explanation and remediation. INFO lines that carry stack traces are raised to ERROR (flagged). Known platform noise is counted under noise instead of cluttering issues.

Args: since: Window start: ISO time (2026-09-17T08:00) or relative (90m, 24h, 7d, 2w) counted back from the newest log entry. Default 7d. until: Window end (same formats). Default: newest entry. source: Source name; omit for all sources. device: Only this device. role: "server", "client" or "setup". files: Log names or globs, e.g. ["VulnerabilityManagement.log"]. min_severity: WARN (default), ERROR or FATAL. include_noise: Include known platform noise in issues. top: Issues to return (1-100).

Returns: totals, ranked issues, noise, top components/logs and coverage.

ParametersJSON Schema
NameRequiredDescriptionDefault
topNo
roleNo
filesNo
sinceNo7d
untilNo
deviceNo
sourceNo
min_severityNoWARN
include_noiseNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate read-only, idempotent, non-destructive behavior. The description adds rich behavioral detail beyond that: repeat collapsing via normalized signatures, cross-log duplicate counting, INFO lines with stack traces elevated to ERROR, known platform noise separated into `noise`, and per-issue metadata like counts, first/last seen, devices, root causes, and fixes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose, then provides dense but scannable behavioral details and an Args/Returns structure. Every sentence earns its place; the length is justified by the complexity of a 9-parameter diagnostic tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity and the 0% schema description coverage, the description is complete: it explains filtering, deduplication, severity elevation, noise handling, known-fix metadata, and return sections. An output schema exists to handle detailed return structure, so no essential guidance is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden for all 9 parameters. The Args section documents every parameter with formats, defaults, allowed values, examples, and semantics, e.g. `since` supports ISO or relative times, `role` accepts server/client/setup, `files` accepts globs, and `top` is bounded to 1-100.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'Group every warning and error into distinct issues, ranked, with known fixes.' It also positions itself as 'The best first call for "what is wrong?"', which clearly distinguishes it from sibling tools like search_logs, diagnose, and detect_log_anomalies.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear situational advice: use this as the first call when diagnosing what is wrong. It does not, however, explicitly name siblings as alternatives or state cases where another tool such as search_logs or diagnose should be preferred instead, so it stops just short of full exclusion guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 11 tool updatesv0.1.0
    • First observedadd_log_source
    • First observedbuild_timeline
    • First observedcheck_log_sources
    • First observedcompare_devices
    • First observeddetect_log_anomalies
    • First observeddiagnose
    • First observedexplain
    • First observedlist_log_files
    • First observedremove_log_source
    • First observedsearch_logs
    • First observedsummarize_errors

TDQS

A4.5/5.0

Scored across 11 tools

Disambiguation5/5

Each tool has a clearly distinct responsibility: source lifecycle, listing, searching, timeline building, error summarization, symptom diagnosis, device comparison, and anomaly detection. Even the analysis tools are well-separated by their inputs and outputs, so an agent is unlikely to confuse them.

Naming Consistency4/5

The tool names mostly follow a predictable verb_noun pattern in snake_case, such as add_log_source, list_log_files, and summarize_errors. Minor deviations exist: 'explain' and 'diagnose' are bare verbs without an object, and source appears as both singular and plural, but the overall convention remains readable.

Tool Count5/5

With 11 tools, the server is well-scoped for a log-analysis domain. The number feels justified: source management, log discovery, search, timeline, error analysis, diagnosis, comparison, and anomaly detection all earn their place without redundancy.

Completeness5/5

The tool surface covers the full workflow from registering log sources, checking their health, listing and searching files, building timelines, summarizing errors, and running symptom-specific diagnoses. There are no obvious dead ends; even advanced needs like comparative and baseline anomaly analysis are addressed.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • F
    license
    B
    quality
    C
    maintenance
    Enables AI-assisted analysis of log files through advanced searching, filtering, and test execution capabilities. Supports time-based queries, pattern matching, test summarization, and code coverage reporting directly within compatible MCP clients.
    12
    -
  • F
    license
    Not graded
    quality
    D
    maintenance
    Enables querying and analyzing logs from multiple remote Unix hosts via the Log Collector API, with tools for search, error detection, and summary generation.
    -
  • A
    license
    A
    quality
    B
    maintenance
    Enables querying and analyzing Tenable Vulnerability Management audit logs, including activity summaries, API key usage, and anomaly detection through MCP tools.
    6
    1
    MIT