Skip to main content
Glama
detection-enabler

detection-enabler

by cjohnston33

check_rule_readiness

Read-only

Verify whether an Elastic detection rule will work by checking source indices, data freshness, field mappings, and projected alert volume against the noise threshold without creating real alerts.

Instructions

Check whether a rule will work here: source indices exist, data is recent, required fields are populated, and the projected alert volume is below the noise threshold.

    Volume is estimated with Kibana's rule preview, which writes only to an isolated
    preview index and does not create real alerts.
    

Input Schema

NameRequiredDescriptionDefault
rule_idYes
lookback_hoursNo
estimate_volumeNo

Output Schema

NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A3.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint/openWorldHint annotations, the description discloses a real behavioral nuance: volume is estimated via Kibana's rule preview, which writes only to an isolated preview index and creates no real alerts. That directly clarifies the apparent tension between a 'write to an index' and a read-only tool, which is exactly the context the annotations cannot convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short paragraphs: a front-loaded checklist of checks, then a focused note on how volume is estimated. Every sentence earns its place; only minor tightening of the second paragraph's wording would improve it.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values needn't be explained, and the safety profile is well covered. However, for a tool with three parameters and zero schema descriptions, leaving lookback_hours and estimate_volume undefined is a meaningful gap for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry parameter meaning, and it largely does not. It hints at volume estimation (mapping loosely to estimate_volume) and 'data is recent' (loosely to lookback_hours), but never defines rule_id, the lookback window's default/units, or what happens when estimate_volume is false.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb ('Check') plus a resource ('rule') and enumerates the exact conditions verified: source indices exist, data is recent, fields are populated, and projected volume is under the noise threshold. This reads clearly as a preflight/dry-run tool and is readily distinguishable from siblings like request_rule_enable or get_enable_request.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The use case (validating a rule before doing something else) is implied by 'will work here,' but the description never states explicitly that this should be run before request_rule_enable, nor does it say when it can be skipped. No alternative tool is named, so the agent must infer the workflow position.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.