Skip to main content
Glama
OpenCDR MCP

OpenCDR MCP

Official
by dbnz-io

opencdr_detections_feed

Read-onlyIdempotent

Read a bounded page of signals and correlated alerts in durable commit order, using a cursor to resume safely without resetting on retention gaps.

Instructions

Read a bounded page of signals and correlated alerts in durable commit order.

Requires an IAM Core connection advertising detection_feed 1.x. In Fleet mode select one agent_id; this forwards a read, not a fleet-wide central search. Reading does not acknowledge delivery. Retention gaps are returned as errors; never silently reset a cursor. start=latest deliberately skips retained records and cannot be combined with a cursor.

In fleet mode, supply agent_id explicitly. Core mode leaves agent_id unset.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "opencdr_detections_feed"
  }
}

Input Schema

NameRequiredDescriptionDefault
limitNo
startNoearliest
cursorNo
agent_idNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv0.3.0

TDQS

A4.2/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnly, idempotent, non-destructive), it adds real operational context: reads do not acknowledge delivery, retention gaps surface as errors, cursors must never be silently reset, and start=latest deliberately skips retained records. These are the exact failure modes an agent needs to know, and they are not derivable from the annotations or schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Dense but front-loaded: the purpose and ordering guarantee come first, then connection prerequisites, then mode selection, then cursor pitfalls. No filler sentences, though the final fleet-mode restatement partially duplicates the earlier agent_id sentence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no schema-level parameter descriptions, the description does the heavy lifting well: connection requirements, mode semantics, cursor error handling, and pagination intent. It falls short only in not characterizing the shape of a returned signal/alert record or page-boundary behavior on limit.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must carry parameter meaning, and it largely does: agent_id mode rules, cursor invariants and its incompatibility with start=latest, and start=latest vs. default earliest behavior. Limit is only implied via 'bounded page' with no mention of the default of 100 or any maximum, leaving one gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence uses a specific verb and resource plus an ordering guarantee: 'Read a bounded page of signals and correlated alerts in durable commit order.' The follow-up 'this forwards a read, not a fleet-wide central search' implicitly distinguishes it from the query-style siblings, though it never names opencdr_detections_query directly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states when the tool is usable ('Requires an IAM Core connection advertising detection_feed 1.x') and how to select mode ('In fleet mode, supply agent_id explicitly. Core mode leaves agent_id unset'), plus the exclusion that start=latest cannot be combined with a cursor. There are no explicit pointers to alternative tools for filtered or historical lookups, so it stops short of full when/when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.