Skip to main content
Glama
brendanong95

tenable-patch-management-logs-mcp

by brendanong95

detect_log_anomalies

Read-onlyIdempotent

Compare recent log windows to a baseline to flag new error signatures, rate spikes, repeated service starts, and stopped logs, with evidence and severity.

Instructions

Compare a recent window with the days before it, in the same logs.

Flags error signatures never seen in the baseline, errors whose rate jumped above the spike threshold, services that started repeatedly, and logs that stopped writing. Each finding has evidence, the threshold crossed and a reasoning sentence. Findings are marked low confidence when the logs do not reach far enough back.

Args: since: Window start (ISO or relative like 24h, counted back from the newest entry). until: Window end. Default: newest entry. baseline_days: Days before the window to compare against (1-90, default 7). source: Source name; omit for all sources. device: Only this device. role: "server", "client" or "setup".

Returns: Severity-ordered findings, counts by type and severity, baseline coverage and the active thresholds.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
roleNo
sinceNo24h
untilNo
deviceNo
sourceNo
baseline_daysNo

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover readOnly, idempotent, non-destructive. The description adds key behavioral details: confidence levels, baseline coverage, threshold crossing, and return criteria. It does not mention pagination or rate limits, but that's minor here.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured: high-level purpose first, then anomaly types, then explicit Args and Returns sections. Every sentence adds value; no fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Complex tool with 6 params, but annotations cover safety and output schema exists. The description explains return structure, parameter semantics and confidence. Effectively complete for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must explain parameters. It provides useful detail for since, until, baseline_days, and mentions source, device, role. However, it omits the 'role' parameter's default and doesn't elaborate on 'until' accepted formats beyond ISO/relative. Also, it doesn't explain the effect of omitting source/device. Lacks completeness despite some effort.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clear verb+resource (detect anomalies in logs), describes specific anomaly types, and implicitly distinguishes from related tools like check_log_sources (checks sources) and summarize_errors (summarizes errors).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

States how to use (compare recent window with baseline), but does not explicitly say when not to use or name alternatives. However, the context is clear enough to route an agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.