Skip to main content
Glama
brendanong95

tenable-patch-management-logs-mcp

by brendanong95

diagnose

Read-onlyIdempotent

Run symptom playbooks on Tenable Patch Management logs to identify root causes, return verdicts with evidence, and provide remediation for issues like patch failures or connectivity problems.

Instructions

Run a symptom playbook: read the right logs and return a verdict with evidence.

Symptoms:

  • patch_install_failed - deployment results, installer exit codes (decoded), MSI failures

  • content_download - content / peer-to-peer / CDN download problems on clients

  • client_connectivity - client transport errors, server retries per client ID, registrations rejected for missing install authentication

  • vm_integration - Tenable VM / Security Center access settings, API key failures, vulnerability import runs

  • feeds - periodic feed checks, last success, failure root causes

  • content_publication - content uploads to the CDN that failed

  • service_health - service starts with versions, restart loops, crashes, out-of-memory

  • database - SQL errors, SQL Server authentication, deadlocks

  • client_upgrade - upgrade problems and versions seen over time

  • feature_update_readiness - free disk space vs the 50 GB requirement, NOT INSTALLED scans

Args: symptom: One of the symptom ids above. since: Window start (ISO or relative like 24h). Default 7d. until: Window end. source: Source name; omit for all sources. device: Only this device.

Returns: verdict, findings (known issues with remediation), other related errors, playbook-specific details, missing_logs with how to get them, and advice.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
sinceNo7d
untilNo
deviceNo
sourceNo
symptomYes

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds meaningful behavioral context: it discloses that the tool reads logs, returns a structured verdict with findings/remediation, and includes a missing_logs field that tells the agent how to obtain absent data. It also implies a time-window default (7d) and per-device/source scoping. This goes beyond the annotations without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is longer than average, but every section earns its place: the one-sentence summary is front-loaded, the symptom list is a compact reference table, the Args block is a clear parameter guide, and the Returns block lists the output fields. It uses bullet-like formatting and avoids redundancy. The length is proportional to the tool's complexity, and the structure makes it scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with five parameters and ten symptom variants, the description covers all necessary aspects: what it does, which symptoms it handles, how to set time windows and filters, and what it returns (verdict, findings, details, missing_logs, advice). An output schema exists, so the description needn't detail every return field, but it names them all. Nothing an agent needs to select or invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides zero documentation for parameters (coverage 0%), so the description carries the full burden. It does this thoroughly: 'symptom' is explained with a list of ten valid ids and what each checks; 'since' and 'until' specify ISO or relative formats with a default; 'source' and 'device' clarify scope and that 'omit for all sources'. This is exactly the semantic enrichment an agent needs and goes well beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb ('Run a symptom playbook') and a clear resource ('logs'), and states the output ('verdict with evidence'). It also enumerates ten distinct symptom playbooks, which sharply distinguishes it from sibling tools like search_logs or summarize_errors by establishing it as a high-level diagnostic orchestration rather than a low-level log query. The purpose is unambiguous and fully covers the tool's role.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The symptom list itself is a strong implicit usage guide: it tells an agent exactly which symptom ids map to which diagnostic scenarios, and the description notes it 'read[s] the right logs' per symptom. However, it never explicitly says when NOT to use this tool or points to an alternative (e.g., 'for raw log inspection use search_logs'). The context is clear enough for most cases, but explicit exclusions are missing, so it falls just short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.