PeerGlass
Uses Cloudflare's RPKI validator to verify ROA status and provides comprehensive intelligence on Cloudflare's internet resources, including IP registration, BGP routing visibility, and historical allocation data.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@PeerGlassCheck the RPKI status and BGP visibility for 1.1.1.0/24"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
π PeerGlass β Internet Resource Intelligence

Protocol note: PeerGlass uses RDAP (Registration Data Access Protocol β RFC 7480β7484). RDAP (RFC 7480β7484) is the IANA-mandated JSON successor to legacy plain-text WHOIS. Where you see "historical-whois" in source code or API responses, that is RIPE Stat's own name for their endpoint β it is not our protocol choice.
Query all 5 global Regional Internet Registries simultaneously using RDAP, validate routes via RPKI, inspect BGP routing visibility, trace full historical allocation timelines, discover IXP peering data via PeeringDB, and monitor network health β all from natural language in Claude or via REST API.
What Are the 5 RIRs?
Think of the internet's IP address space like a global land registry. IANA (the root) delegates large blocks to 5 regional bodies:
RIR | Region | Countries |
π AFRINIC | Africa | 54 |
π APNIC | Asia-Pacific | 56 economies |
π ARIN | North America | USA, Canada, Caribbean |
π LACNIC | Latin America & Caribbean | 33 |
π RIPE NCC | Europe, Middle East, Central Asia | 75+ |
Related MCP server: NetworksDB-MCP
Quick Start
Install
git clone https://github.com/duksh/peerglass
cd peerglass
pip install -e .Configure MCP Clients (Claude and others)
PeerGlass runs as a standard MCP stdio server (mcp.run() in server.py),
so any MCP-compatible AI client can use it β not just Claude Desktop.
For Claude Desktop, edit
~/Library/Application Support/Claude/claude_desktop_config.json (macOS)
or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"peerglass": {
"command": "peerglass",
"args": []
}
}
}If peerglass is not in your PATH, use:
{
"mcpServers": {
"peerglass": {
"command": "python",
"args": ["/full/path/to/peerglass/server.py"]
}
}
}Restart Claude Desktop. All 42 tools become immediately available.
Start the REST API
uvicorn api:app --host 0.0.0.0 --port 8000 --reloadInteractive docs at: http://localhost:8000/docs
Start the Web UI
cd ui
npm install
npm run dev # Dev server at http://localhost:5173For production build:
cd ui
npm run build # Output in ui/dist/Set VITE_API_BASE_URL to point at your PeerGlass API deployment:
VITE_API_BASE_URL=https://api.peerglass.io npm run buildExample Queries (Natural Language in Claude)
Phase 1 β Registry lookups:
"Who owns the IP address 185.220.101.1?"
"What is the abuse contact for 8.8.8.8?"
"Who is AS13335 registered to?"
"Are all 5 RIR RDAP servers online right now?"Phase 2 β Routing security:
"Is the route 1.1.1.0/24 via AS13335 RPKI valid?"
"Is 8.8.8.0/24 currently visible in the global BGP table?"
"What prefixes is AS15169 (Google) announcing right now?"
"Find all internet resources registered to Cloudflare globally."Phase 3 β Historical intelligence:
"Show me the full registration history of 8.8.8.0/24."
"Has the prefix 192.0.2.0/24 ever been transferred between organizations?"
"Give me the global IPv4 exhaustion stats for all 5 RIRs."
"Show me the prefix hierarchy for 1.1.1.0/24 β parent blocks and sub-assignments."Phase 4 β Peering, IXPs, health & monitoring:
"Who does AS13335 (Cloudflare) peer with at internet exchanges?"
"List all IXPs where Google has a presence."
"Is the network for 1.1.1.0/24 currently healthy β any ROA issues or BGP anomalies?"
"Monitor AS13335 for changes since last baseline."Phase 5 β DNS intelligence:
"What DNS records does cloudflare.com have?"
"Is the DNSSEC chain valid for google.com?"
"Check if 1.2.3.4 is on any spam blocklist."
"Audit the email security posture of example.com."
"Has my DNS change for api.example.com propagated globally yet?"Phase 6 β TLS, certificates & threat intel:
"When does the TLS certificate for cloudflare.com expire?"
"Show me all certificates ever issued for *.example.com."
"Is 198.51.100.1 flagged as malicious β what ports and CVEs does Shodan see?"
"What hostnames has the IP 1.2.3.4 served historically?"All 42 MCP Tools
Phase 1 β Registry Queries
Tool | Description | Cache TTL |
| Query all 5 RIRs for an IP address (parallel) | 1 hour |
| Query all 5 RIRs for an ASN (parallel) | 1 hour |
| Find abuse contact for any IP globally | 1 hour |
| Health check all 5 RDAP servers | live |
| View query cache state and TTLs | live |
Phase 2 β Routing Intelligence
Tool | Description | Cache TTL |
| Validate RPKI/ROA status for prefix + ASN | 15 min |
| Check BGP visibility for a prefix or ASN | 5 min |
| List all BGP-announced prefixes for an ASN | 5 min |
| Audit all IP/ASN resources for an organization | 6 hours |
Phase 3 β Historical Intelligence
Tool | Description | Cache TTL |
| Full ownership timeline for any prefix or ASN | 12 hours |
| Detect cross-org / cross-RIR resource transfers | 12 hours |
| Global IPv4/IPv6/ASN dashboard + optional delegated IPv4 block listing ( | 24 hours |
| Prefix hierarchy: parent, children, BGP status | 1 hour |
Phase 4 β Peering, IXPs, Health & Monitoring
Tool | Description | Cache TTL |
| PeeringDB peering data + BGP neighbours for an ASN | 1 hour |
| Search Internet Exchange Points globally | 6 hours |
| RPKI + BGP + RDAP health composite check | 5 min |
| Detect changes since last baseline (delta report) | live |
Phase 5 β DNS Intelligence
Tool | Description | Cache TTL |
| DNS resolution with RDAP IP correlation (A/AAAA/PTR/MX/TXT/NSβ¦) | 5 min |
| Full DNS record enumeration β all types in one call + SPF/DMARC extraction | 5 min |
| DNSSEC chain-of-trust validation (SECURE / INSECURE / BOGUS / INDETERMINATE) | 5 min |
| DNS blocklist check against 30 RBLs in parallel (Spamhaus, Barracuda, SORBSβ¦) | 15 min |
| Email security audit: SPF, DMARC, DKIM, MX, BIMI + risk score | 15 min |
| DNS propagation check across 10 global resolvers simultaneously | live |
Phase 6 β TLS, Certificates & Threat Intelligence
Tool | Description | Cache TTL |
| TLS certificate inspection: subject, SANs, expiry, cipher suite, HSTS | 1 hour |
| Certificate Transparency log search via crt.sh β discover all certs ever issued | 6 hours |
| Threat intelligence: Shodan InternetDB (open ports, CVEs) + GreyNoise (classification, risk score) | 15 min |
| Passive DNS history via RIPE Stat β what IPs/hostnames were associated over time | 12 hours |
Phase 7 β BGP Depth
Tool | Description | Cache TTL |
| IRR route object validation via IRRExplorer β checks RIPE/RADB/ARIN/APNIC/LACNIC consistency | 1 hour |
| BGP route leak detection β identifies valley-free violations and multi-origin anomalies | 5 min |
| BGP looking glass via RIPE RIS β real AS paths from global vantage points | 5 min |
| Route flap and stability analysis β state changes, uptime %, stability score | 15 min |
Phase 8 β Humanitarian & Crisis Intelligence
Tool | Description | Cache TTL |
| Country BGP shutdown detection β compares current prefix counts vs baseline | 5 min |
| Register webhook alerts for shutdown/change events | live |
| Historical BGP shutdown timeline with SHA-256 integrity hash (for UN reports) | 1 hour |
| DNS censorship fingerprinting β detects NXDOMAIN injection, IP poisoning, DPI blocking | 10 min |
| Satellite internet tracking β Starlink, Viasat, OneWeb BGP presence | 15 min |
| Country internet chokepoint mapping β critical transit providers, resilience score | 6 hours |
| OONI censorship measurements β blocked domains, Tor accessibility, circumvention tools | 30 min |
| Composite country internet health dashboard β 0β100 score from BGP + DNS + OONI + satellite | 5 min |
Phase 9 β Advanced Platform
Tool | Description | Cache TTL |
| AS relationship classification (provider/customer/peer) via CAIDA AS-Rank API | 7 days |
| GeoIP enrichment via MaxMind GeoLite2-City (requires | 24 hours |
| RIPE Atlas distributed traceroute from global vantage points (requires | 5 min |
REST API β 41 Endpoints
PeerGlass exposes every tool as a REST endpoint, allowing integration with dashboards, scripts, and CI/CD pipelines β no Claude required.
Registry & Routing
Method | Endpoint | Description |
GET |
| RDAP lookup for an IP address |
GET |
| RDAP lookup for an ASN |
GET |
| Abuse contact for any IP |
GET |
| RPKI validation |
GET |
| BGP visibility status |
GET |
| Announced prefixes for an ASN |
GET |
| Audit all resources for an org name |
GET |
| Prefix/ASN ownership history |
GET |
| Transfer detection |
GET |
| Global IPv4/IPv6/ASN stats |
GET |
| Prefix hierarchy overview |
GET |
| Peering info from PeeringDB |
GET |
| IXP search and listing |
GET |
| Composite network health check |
GET |
| Change monitoring (delta) |
DNS Intelligence
Method | Endpoint | Description |
GET |
| DNS resolution + RDAP IP correlation |
GET |
| Full DNS record enumeration (all types) |
GET |
| DNSSEC chain-of-trust validation |
GET |
| DNS blocklist check (30 RBLs in parallel) |
GET |
| Email security audit (SPF/DMARC/DKIM/BIMI) |
GET |
| DNS propagation across 10 global resolvers |
TLS, Certificates & Threat Intel
Method | Endpoint | Description |
GET |
| TLS certificate inspection |
GET |
| Certificate Transparency log search |
GET |
| Threat intelligence (Shodan + GreyNoise) |
GET |
| Passive DNS history (RIPE Stat) |
BGP Depth
Method | Endpoint | Description |
GET |
| IRR route object validation |
GET |
| BGP route leak detection |
GET |
| BGP looking glass (RIPE RIS) |
GET |
| Route flap stability analysis |
Humanitarian & Crisis
Method | Endpoint | Description |
GET |
| Country BGP shutdown detection |
POST |
| Register shutdown webhook alert |
GET |
| Historical shutdown timeline |
GET |
| DNS censorship fingerprinting |
GET |
| Satellite connectivity status |
GET |
| Country internet chokepoints |
GET |
| OONI censorship measurements |
GET |
| Composite country internet health |
Advanced Platform
Method | Endpoint | Description |
GET |
| AS relationship classification (CAIDA) |
GET |
| GeoIP enrichment (MaxMind GeoLite2) |
GET |
| RIPE Atlas distributed traceroute |
POST |
| Bulk query up to 50 resources in one call |
Quick example:
# Look up who owns 1.1.1.1
curl http://localhost:8000/v1/ip/1.1.1.1
# Validate RPKI for Cloudflare's prefix
curl "http://localhost:8000/v1/rpki?prefix=1.1.1.0/24&asn=AS13335"
# Get BGP peers for Google
curl http://localhost:8000/v1/peering/AS15169
# List AFRINIC delegated IPv4 blocks (allocated + Ghana), paginated
curl "http://localhost:8000/v1/stats/ipv4?rir=AFRINIC&include_blocks=true&status=allocated&country=GH&limit=5&offset=0&format=json"
# DNS β enumerate all record types for a domain
curl http://localhost:8000/v1/dns/enumerate/cloudflare.com
# DNS β check email security (SPF/DMARC/DKIM)
curl http://localhost:8000/v1/dns/email/cloudflare.com
# DNS β check if an IP is on any blocklist
curl http://localhost:8000/v1/dns/dnsbl/1.2.3.4
# DNS β check propagation across 10 global resolvers
curl "http://localhost:8000/v1/dns/propagation/cloudflare.com?record_type=A"
# TLS β inspect certificate for a hostname
curl http://localhost:8000/v1/tls/cloudflare.com
# Certificates β find all certs ever issued for a domain
curl http://localhost:8000/v1/ct/cloudflare.com
# Threat intel β open ports, CVEs, risk score for an IP
curl http://localhost:8000/v1/threat/1.2.3.4
# Passive DNS β what hostnames has this IP served?
curl http://localhost:8000/v1/pdns/1.1.1.1Interactive docs (Swagger UI): http://localhost:8000/docs
Architecture
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β PEERGLASS β
β β
β Claude (LLM) REST Clients β
β β MCP / stdio β HTTP β
β βΌ βΌ β
β server.py (42 tools) api.py (41 endpoints) β
β β β β
β ββββββββββββ¬ββββββββββββββββ β
β βΌ β
β rir_client.py ββ All async HTTP calls β
β β β
β ββββββββββββΌβββββββββββββββββββ β
β βΌ βΌ βΌ β
β normalizer.py formatters.py cache.py β
β (unify RDAP) (markdown/JSON) (TTL tiers) β
β β β
β βΌ β
β models.py (Pydantic v2 data models) β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
External APIs called at runtime:
βββ RDAP: rdap.afrinic.net / rdap.apnic.net / rdap.arin.net
β rdap.lacnic.net / rdap.db.ripe.net
βββ RPKI: rpki.cloudflare.com
βββ BGP: stat.ripe.net (bgp-state, announced-prefixes,
β routing-status, asn-neighbours, historical-whois)
βββ IXP: peeringdb.com/api/net, /api/ix, /api/netixlan
βββ Stats: NRO Extended Delegation Stats (all 5 RIRs)
βββ Routing: data.iana.org/rdap/ (IANA bootstrap)How Parallel Queries Work
asyncio.gather() fires all 5 RIR queries at exactly the same time:
AFRINIC ββββ responds in 1.1s ββββ 404 Not Found
APNIC ββββ responds in 0.9s ββββ β
200 OK β authoritative
ARIN ββββ responds in 1.2s ββββ 404 Not Found
LACNIC ββββ responds in 1.4s ββββ 404 Not Found
RIPE ββββ responds in 0.8s ββββ 404 Not Found
Total wall-clock time: ~1β2s (parallel) vs ~6β8s (sequential)Web UI (Sprint 7)
PeerGlass includes a search-first, dark terminal-themed web frontend built with React 18 + Vite 5 + TypeScript + Tailwind CSS.
Features
Auto-detection: Paste any IP, ASN, prefix, domain, or 2-letter country code β the UI auto-detects the type and runs the right tool
7 tool categories: Registry Β· Routing Β· DNS Β· TLS Β· Threat Β· Crisis Β· Peering
Dark terminal theme: Dark background, monospace font (JetBrains Mono), cyan/green accent palette
Markdown rendering: All API results rendered as formatted markdown with syntax highlighting
Crisis dashboard: One-click country health check for Syria, Myanmar, Ukraine, Belarus, Iran, Russia and more
41 tools accessible: Every REST endpoint is exposed via the UI
Configuration
Variable | Default | Description |
|
| PeerGlass API base URL |
Directory structure
ui/
βββ src/
β βββ App.tsx # Main layout + tab state
β βββ components/
β β βββ SearchBar.tsx # Search input with auto-type detection
β β βββ ResultPanel.tsx # Markdown result renderer
β β βββ TabBar.tsx # Category + tool tab navigation
β β βββ StatusBadge.tsx # RPKI/BGP/shutdown status indicators
β β βββ CountryDashboard.tsx # Crisis country quick-access grid
β βββ hooks/
β β βββ usePeerGlass.ts # Query state management hook
β βββ api/
β βββ client.ts # Typed wrappers for all 41 endpoints
βββ dist/ # Production build outputTesting
PeerGlass has two separate test suites serving different purposes. You should run both β they catch different categories of problems.
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β TESTING PYRAMID β
β β
β πΊ INTEGRATION TESTS (test_integration.py) β
β /\ Real internet. Real APIs. Real data. β
β / \ Proves the product actually works end-to-end. β
β /ββββ\ Run this on your machine or a GCP VM. β
β β
β πΊ UNIT / STATIC TESTS (test_peerglass.py) β
β /\ In-memory. No network. Instant. β
β / \ Proves code structure, branding, and wiring. β
β /ββββ\ Runs anywhere including CI/CD. β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββTest 1 β Static / Unit Tests (test_peerglass.py)
What it checks:
# | Test | What It Verifies |
1 | Compile check | All 7 |
2 | Branding audit | No stale legacy product/server identity strings |
3 | RDAP endpoints | All 5 RIR RDAP URLs are present and correct |
4 | Protocol header |
|
5 | User-Agent | Updated to |
6 | MCP server name |
|
7 | Tool count | Exactly 42 |
8 | REST endpoints | All 41 routes present in |
9 | FastAPI runtime | TestClient hits 3 endpoints in-memory, validates responses |
10 | README | PeerGlass branding, 42 tools, RDAP note all present |
How to run:
cd peerglass
python test_peerglass.pyExpected output:
============================================================
PEERGLASS β COMPLETE TEST SUITE
============================================================
1. COMPILE CHECK
β
server.py β
rir_client.py β
formatters.py
β
models.py β
cache.py β
normalizer.py β
api.py
2. BRANDING AUDIT β no stale WHOIS identity strings
β
server.py β
rir_client.py β
README.md ...
...
β
ALL TESTS PASSED β 0 errors
Python files: 7 | MCP tools: 42 | REST endpoints: 41
Protocol: RDAP throughout (RFC 7480-7484)
Branding: PeerGlass throughout
============================================================When to run: Before every commit. Runs in under 3 seconds. No internet required.
Test 2 β Integration Tests (test_integration.py)
What it checks:
Real HTTP calls to external internet registries/data providers using well-known, stable test fixtures (Cloudflare AS13335, Google AS15169, 1.1.1.0/24). Every test asserts on actual response data β not just that the server responded.
# | Test | API Called | Fixture | Assertion |
1 | RDAP reachability | All 5 RIRs |
| HTTP 200 or 404 (both mean server is up) |
2 | RDAP IP lookup | APNIC |
|
|
3 | RDAP ASN lookup | ARIN |
|
|
4 | RPKI validation | RIPE Stat |
|
|
5 | BGP status | RIPE Stat |
| Prefix visible to RIS peers, origin ASN present |
6 | Announced prefixes | RIPE Stat |
| >= 5 prefixes, mix of IPv4 + IPv6 |
7 | Historical data | RIPE Stat |
|
|
8 | PeeringDB network | PeeringDB |
| Network record found, peering policy present |
9 | IANA Bootstrap | IANA |
| Mapped to correct RDAP service URL |
10 | AFRINIC RDAP | AFRINIC |
|
|
11 | ASN neighbours | RIPE Stat |
| Upstream / peer ASN list returned |
12 | PeeringDB IXPs | PeeringDB | global | IXP list with name and country |
13 | IANA consistency | IANA/ICANN | IPv4 + IPv6 + ASN bootstrap files | All 5 RIR service URLs present |
How to run:
# On your local machine or a GCP VM (requires internet access)
cd peerglass
python test_integration.pyExpected output (passing):
============================================================
PEERGLASS β LIVE INTEGRATION TEST SUITE
Real HTTP calls. No mocks. No fakes.
============================================================
Time: 2026-02-20 14:00:00 UTC
APIs: RIPE Β· ARIN Β· APNIC Β· LACNIC Β· AFRINIC Β· RIPE Stat Β· PeeringDB Β· IANA
ββββββββββββββββββββββββββββββββββββββββββββ
TEST 1 β RDAP Server Reachability (all 5 RIRs)
ββββββββββββββββββββββββββββββββββββββββββββ
β
PASS RIPE RDAP reachable HTTP 404
β
PASS ARIN RDAP reachable HTTP 404
β
PASS APNIC RDAP reachable HTTP 200
β
PASS LACNIC RDAP reachable HTTP 404
β
PASS AFRINIC RDAP reachable HTTP 404
...
============================================================
SUMMARY
Checks run : 48
β
Passed : 47
β Failed : 0
β οΈ Skipped : 1
Duration : ~20-40s
π ALL TESTS PASSED β PeerGlass live APIs confirmed working!
============================================================When to run:
Before a release
After any change to
rir_client.py(the HTTP layer)After any change to the external API URLs or parameters
On a schedule (e.g. daily cron on a GCP VM) to detect API changes upstream
Why this cannot run in CI/CD without configuration:
The integration tests require outbound internet access to external APIs
(RIPE, ARIN, APNIC, LACNIC, AFRINIC, RIPE Stat, PeeringDB, IANA). Standard CI runners (GitHub Actions
free tier) have internet access, so these tests can run there. Restricted
sandboxes (Anthropic Claude environment, some corporate proxies) will block
the outbound calls and every test will fail with 403 Forbidden β this is
expected behaviour of the sandbox, not a bug in PeerGlass.
Understanding Test Results
Why does RDAP return 404 and still pass?
APNIC owns 1.1.1.0/24 (Cloudflare's block). If you ask RIPE for 1.1.1.1:
You: GET https://rdap.db.ripe.net/ip/1.1.1.1
RIPE: HTTP 404
This 404 is RIPE saying "I know about this IP but it's not mine."
The server is alive and working correctly. 404 = server reachable.
200 = server reachable AND it's the authoritative RIR for that IP.
Both are valid success states for the reachability test.Why does Test 7 sometimes SKIP?
RIPE Stat's historical-whois endpoint has variable coverage. For some
ASNs it returns rich history; for others the objects array is empty.
An empty array is a valid API response β the skip is logged to distinguish
"no data" from "API broken".
Running Both Suites Together
cd peerglass
# Step 1: Always run static tests first (fast, catches code errors)
python test_peerglass.py
echo "Exit code: $?"
# Step 2: Only run integration tests if static tests pass
if [ $? -eq 0 ]; then
python test_integration.py
fiVerification β Source-Pinned Retrieval vs Model Recall
If you want to verify that PeerGlass is deterministic and source-pinned (real API retrieval) rather than model recall, run this quick check.
Ask ChatGPT to fetch all 5 RIR RDAP endpoints for
1.1.1.1and return raw JSON only.Repeat the exact same prompt multiple times.
Compare ChatGPT output against direct endpoint results below.
Use this prompt in ChatGPT:
For IP 1.1.1.1, query these exact RDAP endpoints and return ONLY JSON:
- AFRINIC: https://rdap.afrinic.net/rdap/ip/1.1.1.1
- APNIC: https://rdap.apnic.net/ip/1.1.1.1
- ARIN: https://rdap.arin.net/registry/ip/1.1.1.1
- LACNIC: https://rdap.lacnic.net/rdap/ip/1.1.1.1
- RIPE: https://rdap.db.ripe.net/ip/1.1.1.1
Output schema per RIR:
{
"rir": "...",
"url": "...",
"http_status": ...,
"objectClassName": "... or null",
"handle": "... or null",
"error": "... or null"
}
Do not summarize. Do not infer.Ground-truth script (direct endpoint calls):
python - <<'PY'
import asyncio
import json
import httpx
ENDPOINTS = {
"AFRINIC": "https://rdap.afrinic.net/rdap/ip/1.1.1.1",
"APNIC": "https://rdap.apnic.net/ip/1.1.1.1",
"ARIN": "https://rdap.arin.net/registry/ip/1.1.1.1",
"LACNIC": "https://rdap.lacnic.net/rdap/ip/1.1.1.1",
"RIPE": "https://rdap.db.ripe.net/ip/1.1.1.1",
}
async def query_one(client, rir, url):
try:
r = await client.get(url, timeout=20)
content_type = r.headers.get("content-type", "")
data = r.json() if "json" in content_type else {}
return {
"rir": rir,
"url": url,
"http_status": r.status_code,
"objectClassName": data.get("objectClassName"),
"handle": data.get("handle"),
"error": None,
}
except Exception as exc:
return {
"rir": rir,
"url": url,
"http_status": None,
"objectClassName": None,
"handle": None,
"error": str(exc),
}
async def main():
headers = {
"Accept": "application/rdap+json",
"User-Agent": "peerglass/verification",
}
async with httpx.AsyncClient(headers=headers, follow_redirects=True) as client:
results = await asyncio.gather(*[
query_one(client, rir, url) for rir, url in ENDPOINTS.items()
])
print(json.dumps(results, indent=2))
asyncio.run(main())
PYIf ChatGPT outputs are inconsistent or fail to fetch while direct calls are stable, that difference is exactly why PeerGlass uses deterministic source-pinned retrieval.
Adding Your Own Integration Tests
The test_integration.py script is designed to be extended. Each test follows
this pattern:
async def test_your_thing():
section("TEST N β Short description")
print(" What API, what fixture, what you expect")
url = "https://example-api.com/endpoint"
params = {"resource": "your-fixture", "sourceapp": "peerglass-test"}
headers = {"Accept": "application/json", "User-Agent": "peerglass/1.0.0 (integration-test)"}
try:
async with httpx.AsyncClient(timeout=25.0) as client:
resp = await client.get(url, params=params, headers=headers)
if resp.status_code != 200:
fail("API returned 200", f"HTTP {resp.status_code}"); return
data = resp.json()
value = data.get("some", {}).get("field", "")
ok("Field is what I expected", f"value='{value}'") if value == "expected" else fail("Field check", f"Got '{value}'")
except Exception:
fail("API call failed", traceback.format_exc()[-120:])Then add it to the main() coroutine:
async def main():
...
await test_your_thing() # β add here
...External APIs Used
API | Purpose | Cache TTL |
All 5 RIR RDAP endpoints | IP/ASN registration data (RDAP JSON) | 1 hr |
| Bootstrap: which RIR owns which IP/ASN range | permanent |
| RPKI/ROA validation (Validated ROA Payloads) | 15 min |
| BGP routing table visibility | 5 min |
| Prefixes announced by an ASN | 5 min |
| BGP peer/upstream/downstream ASNs | 1 hr |
| RDAP object change history (RIPE's naming) | 12 hr |
| Allocation lifecycle events | 12 hr |
| Prefix hierarchy metadata | 1 hr |
| Routing status and visibility | 5 min |
| Network peering policies | 1 hr |
| Internet Exchange Point directory | 6 hr |
| Network-to-IXP membership records | 1 hr |
NRO Extended Delegation Stats | Authoritative IPv4/IPv6/ASN allocation counts (all 5 RIRs) | 24 hr |
Phase 3 Data Sources Explained
RIPE Stat historical-whois
Records every change ever made to an RDAP object: when the org field changed,
when the status changed, when a new maintainer was added. Used by
rir_prefix_history and rir_detect_transfers. The name "historical-whois"
is RIPE Stat's own endpoint naming β PeerGlass uses RDAP protocol throughout.
Coverage: Best for RIPE NCC resources. Partial for other RIRs.
RIPE Stat allocation-history
Logs the full allocation lifecycle: when a block was first allocated from the RIR pool, when it was sub-allocated to an ISP, when it was returned.
NRO Extended Delegation Stats
Published daily by each RIR as a pipe-delimited text file. Contains every
single IP and ASN record ever created, with current status. Authoritative
source for rir_ipv4_stats.
RIPE Stat prefix-overview / less-specifics / more-specifics
Three APIs queried in parallel to build the prefix hierarchy tree for
rir_prefix_overview.
Use Case Workflows
BGP Hijack Investigation
1. rir_query_ip(suspicious_ip) β Who registered this IP?
2. rir_check_bgp_status(prefix) β Which ASN is announcing it right now?
3. rir_check_rpki(prefix, asn) β Is the announcement RPKI-valid?
4. rir_prefix_overview(prefix) β Any unexpected more-specifics?
5. rir_detect_transfers(prefix) β Did this block recently change hands?M&A Due Diligence
1. rir_audit_org(company_name) β What IP blocks does this company own?
2. rir_prefix_history(each_prefix) β When were they acquired?
3. rir_detect_transfers(each_prefix) β Were any transferred recently?
4. rir_get_announced_prefixes(asn) β What are they actively routing?Peering & IXP Analysis
1. rir_get_peering_info(asn) β Where does this network peer?
2. rir_lookup_ixps(city or ixp_name) β Find IXPs in a region
3. rir_network_health(asn) β Is the network healthy?
4. rir_change_monitor(asn) β Any changes since last check?Policy Research / ISOC Report
1. rir_ipv4_stats() β Full global IPv4/IPv6/ASN dashboard
2. rir_ipv4_stats(rir_filter="AFRINIC")β Africa-specific detail
3. Compare ipv6_total_prefixes across β IPv6 adoption rates by regionIPv4 Exhaustion Context
RIR | IPv4 Free Pool Exhausted |
APNIC | 15 April 2011 |
RIPE NCC | 14 September 2012 |
ARIN | 24 September 2015 |
LACNIC | June 2020 |
AFRINIC | 2020β2021 |
All RIRs now operate under transfer policies. IPv4 addresses trade on the
secondary market. rir_ipv4_stats tracks remaining pools in real time.
License
MIT
Available Tools
42 toolspeerglass_atlas_traceARead-only
Launch a RIPE Atlas traceroute measurement to a target IP or hostname.
Uses the RIPE Atlas global probe network (thousands of vantage points). Requires PEERGLASS_RIPE_ATLAS_KEY environment variable with a valid Atlas API key (free from atlas.ripe.net).
Args: params (AtlasTraceInput): - target (str): IP address or hostname - probes (int): Number of probes to use (default 5, max 25) - response_format (str): 'markdown' (default) or 'json'
Returns: str: Traceroute hop tables per probe with RTT and IP at each hop.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds significant context beyond annotations: discloses the API key authentication requirement (auth needs), explains the distributed nature of the probe network (architectural context), and details the return format ('Traceroute hop tables per probe with RTT and IP'). Annotations only cover safety profile (readOnly/destructive), while description explains operational requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with front-loaded purpose sentence followed by context (network), prerequisites (API key), and docstring-style Args/Returns sections. No wasted sentences given the schema description gap. Slightly formal structure but appropriate for the technical complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Complete coverage for a measurement tool: explains what it does, what it needs (auth), parameter semantics, and return format ('hop tables with RTT and IP'). With annotations covering safety hints and the description covering operational details, no significant gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 0% description coverage (no property descriptions), but the Args section fully compensates by documenting all three sub-parameters: target semantics ('IP address or hostname'), probes constraints ('default 5, max 25'), and response_format options ('markdown' or 'json'). Carries the full documentation burden effectively.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Excellent specificity: 'Launch a RIPE Atlas traceroute measurement' provides exact verb, service (RIPE Atlas), and operation type (traceroute). The mention of 'global probe network' distinguishes it from local traceroute tools and siblings like `rir_looking_glass` or `peerglass_dns_resolve`.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit prerequisite: 'Requires PEERGLASS_RIPE_ATLAS_KEY environment variable.' The mention of 'thousands of vantage points' implies the distributed use case (when you need geographic diversity). Lacks explicit comparison to local traceroute alternatives, but the API key requirement serves as a clear gate for when-to-use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
peerglass_country_chokepointsARead-onlyIdempotent
Map internet resilience for a country by identifying transit providers that many in-country ASNs depend on, and computing a resilience score.
Countries with 1β2 dominant upstream providers are catastrophically vulnerable β cutting those providers isolates the entire country.
Args: params (ChokePointInput): - country_code (str): ISO 3166-1 alpha-2 code e.g. 'SY', 'BY' - response_format (str): 'markdown' (default) or 'json'
Returns: str: Resilience score (0β100), transit providers by dependency, single-upstream count.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true and destructiveHint=false, establishing the safety profile. The description adds valuable behavioral context beyond these booleans: it explains the scoring methodology (0β100 scale), defines catastrophic vulnerability thresholds (1β2 providers), and details the specific output components (transit providers by dependency, single-upstream count), helping the agent understand what constitutes a 'good' vs 'bad' result.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description uses a structured docstring format (Args/Returns) with zero filler. The vulnerability explanation ('cutting those providers isolates the entire country') earns its place by contextualizing the tool's value proposition. Information is front-loaded with the core action in the first sentence, followed by parameter and return value specifications.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema (noted in context signals) and good annotations, the description appropriately focuses on domain-specific context rather than repeating structural metadata. It comprehensively covers the complex BGP/infrastructure domain by explaining what the resilience score measures, the risk model (upstream dependency), and the specific data returned, making it sufficient for an agent to use effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage (the schema properties lack descriptions), the description fully compensates by documenting both parameters in the Args section: country_code includes the format standard (ISO 3166-1 alpha-2) and concrete examples ('SY', 'BY'), while response_format specifies the enum values ('markdown', 'json') and default behavior.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the tool 'Map[s] internet resilience for a country by identifying transit providers that many in-country ASNs depend on, and computing a resilience score.' This provides a specific verb (map/identify/compute), resource (transit providers/ASNs), and distinguishes from siblings like peerglass_country_health by focusing specifically on chokepoint analysis and dependency concentration rather than general health metrics.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear contextual guidance by explaining that 'Countries with 1β2 dominant upstream providers are catastrophically vulnerable,' which signals when this tool is valuable (assessing isolation risk). However, it does not explicitly name sibling alternatives (e.g., 'use peerglass_country_health for general connectivity status instead') to guide selection against the 30+ related tools available.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
peerglass_country_healthARead-onlyIdempotent
Composite country internet health score combining: β’ BGP shutdown detection (40%) β routing table withdrawal analysis β’ DNS censorship probe (30%) β neutral vs ISP resolver comparison β’ OONI app score (20%) β blocked domains and tool access β’ Satellite availability (10%) β Starlink/Viasat/OneWeb BGP presence
Gives journalists, NGO directors, and crisis responders a single 0β100 score and plain-language summary of internet conditions.
Args: params (CountryHealthInput): - country_code (str): ISO 3166-1 alpha-2 code e.g. 'UA', 'SY', 'MM' - response_format (str): 'markdown' (default) or 'json'
Returns: str: Overall score, severity level, component scores, and plain-language summary.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate read-only, idempotent, non-destructive behavior. The description adds valuable context about the methodology (BGP withdrawal analysis, neutral vs ISP resolver comparison) and data sources (OONI, Starlink/Viasat/OneWeb) without contradicting the safety annotations. It could enhance further by mentioning data freshness or caching behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description uses efficient bullet points for the four weighted components and structured Args/Returns sections. Every sentence conveys distinct information (methodology, weighting, audience, parameters), with no redundant filler despite the rich detail provided.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (composite aggregation of four distinct measurement types) and the presence of an output schema, the description provides sufficient context by explaining the scoring methodology, target audience, and return value structure without needing to replicate the full output schema definition.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage for the input properties, the description fully compensates by documenting both parameters in the Args section: country_code includes the ISO 3166-1 alpha-2 standard and concrete examples ('UA', 'SY', 'MM'), while response_format specifies the enum values and default behavior ('markdown' default or 'json').
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly defines the tool as providing a 'Composite country internet health score' with specific component weightings (40/30/20/10). It clearly identifies target users (journalists, NGO directors, crisis responders) and distinguishes this dashboard view from individual probe tools by listing the four distinct data sources it aggregates.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly establishes when to use this tool (for a single 0-100 score and plain-language summary) and implies its scope through the composite methodology. However, it does not explicitly direct users to sibling tools like peerglass_shutdown_detect or peerglass_dns_censorship for component-level detail versus this aggregate view.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
peerglass_ct_logsARead-onlyIdempotent
Search crt.sh for all TLS certificates ever issued for a domain via Certificate Transparency logs. Returns deduplicated entries showing common name, issuer CA, validity period, and SAN name_value.
Useful for:
Discovering shadow IT / undocumented subdomains
Auditing which CAs have been used for a domain
Finding certificates issued before/after security incidents
Verifying certificate rotation
Args: params (CTLogInput): - domain (str): Domain name (e.g. 'cloudflare.com') - limit (int): Max entries to return (default 50, max 500) - response_format (str): 'markdown' (default) or 'json'
Returns: str: Certificate log table with CN, CA, validity dates, and unique CA summary.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations establish the safety profile (readOnlyHint, idempotentHint), while the description adds valuable behavioral context absent from structured fields: it discloses the external data source (crt.sh), deduplication behavior, and the specific output fields returned (CN, CA, validity, SAN). The openWorldHint annotation is implicitly confirmed by the crt.sh reference.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and front-loaded: single-sentence purpose statement followed by use-case bullets and structured Args/Returns sections. Every sentence adds valueβno tautology or redundancy with the tool name. Length is appropriate for the parameter complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema and clear annotations, the description provides adequate completeness: it summarizes the return type (certificate table with CA summary) and covers all input parameters. Minor gap: no mention of rate limits or crt.sh availability constraints, though not strictly required.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With schema description coverage at 0% (or near-zero), the Args section in the description provides essential semantic meaning for all three parameters: domain includes an example ('cloudflare.com'), limit explains constraints ('default 50, max 500'), and response_format clarifies the enum options. This fully compensates for the schema's lack of descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb ('Search') and clearly identifies the resource (TLS certificates via Certificate Transparency logs) and scope ('ever issued for a domain'). It effectively distinguishes from sibling tools like peerglass_tls_inspect by emphasizing historical certificate transparency data versus real-time inspection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'Useful for:' section provides four concrete scenarios (shadow IT discovery, CA auditing, incident forensics, rotation verification) that clearly signal when to invoke the tool. However, it lacks explicit guidance on when NOT to use it or direct comparisons to siblings like peerglass_tls_inspect or peerglass_dns_enumerate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
peerglass_dns_censorshipARead-onlyIdempotent
Probe for DNS censorship by querying a domain from multiple resolver vantage points β neutral global resolvers (Cloudflare, Google, Quad9) and optionally country-specific ISP resolvers.
Detects: β’ NXDOMAIN injection β domain exists globally but ISP returns NXDOMAIN β’ IP poisoning β ISP returns a different (block-page) IP β’ DPI block β timeout / connection refused
Args: params (CensorshipProbeInput): - domain (str): Domain to probe e.g. 'twitter.com' - country_code (str, optional): ISO code for country-specific resolvers - response_format (str): 'markdown' (default) or 'json'
Returns: str: Censorship status, technique, and per-resolver response table.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover safety profile (readOnly, idempotent, non-destructive). The description adds valuable behavioral context: specific resolver sources (Cloudflare, Google, Quad9), detection methods, and return format (per-resolver response table). Does not mention timeout behavior or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Excellent structure with clear sections for purpose, detection list, arguments, and returns. Bullet points enhance scannability. No redundant text; every sentence conveys essential information about tool behavior or parameters.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Comprehensive for a censorship detection tool: covers detection logic, vantage points, parameter semantics, and return value summary. Given the presence of an output schema, the brief return description is sufficient. Minor gap: no mention of execution time expectations for multi-resolver queries.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the Args section fully compensates by documenting all three parameters (domain, country_code, response_format) with types, optionality, defaults, and examples (e.g., 'twitter.com', 'markdown').
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the tool 'Probe[s] for DNS censorship by querying a domain from multiple resolver vantage points' and lists specific detection techniques (NXDOMAIN injection, IP poisoning, DPI block) that clearly distinguish it from sibling tools like peerglass_dns_resolve or peerglass_dns_propagation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'Detects' section implies usage by listing specific censorship techniques, but the description lacks explicit when-to-use guidance relative to sibling DNS tools (e.g., 'use this instead of dns_resolve when investigating censorship').
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
peerglass_dns_dnsblARead-onlyIdempotent
Check an IPv4 address against 30 DNS blocklists simultaneously, including Spamhaus ZEN, Barracuda, SORBS, URIBL, and more. All queries run in parallel for fast results.
Args: params (DNSBLInput): - ip (str): IPv4 address to check (e.g. '1.2.3.4') - response_format (str): 'markdown' (default) or 'json'
Returns: str: Per-list listed/clean status with return codes and descriptions.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds valuable behavioral details beyond annotations: notes parallel execution ('All queries run in parallel for fast results'), lists specific blocklist providers included in the check, and describes the return value format ('Per-list listed/clean status with return codes'). Does not mention rate limits or error behaviors, but covers execution model well.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with front-loaded purpose statement, followed by behavioral details (parallel execution), then explicit Args and Returns sections. Every sentence adds value. Minor deduction because the Args section duplicates information that belongs in schema (though schema coverage is reported as inadequate).
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Adequately complete for a read-only lookup tool: combines rich annotations (idempotent, readOnly, openWorld) with description coverage of inputs, outputs, and execution behavior. Given the presence of output schema documentation in the description and the simple single-input nature, no critical gaps exist.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Compensates effectively for 0% schema description coverage at the root level by documenting both nested parameters (ip, response_format) in the Args section, including the default value ('markdown') and valid options for response_format. Provides redundant example for ip that schema also contains, but ensures clarity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Excellent specificity: states the exact action ('Check'), resource ('IPv4 address'), and scope ('30 DNS blocklists' including named lists like Spamhaus ZEN, Barracuda, SORBS). The mention of specific blocklists distinguishes it from generic threat intel or DNS resolution tools in the sibling list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides implicit usage context by specifying the domain (DNS blocklists/RBLs for spam/security), but lacks explicit guidance on when to use this versus siblings like peerglass_threat_intel or peerglass_dns_censorship. No explicit prerequisites or exclusions listed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
peerglass_dns_dnssecARead-onlyIdempotent
Validate the DNSSEC chain-of-trust for a domain. Checks DNSKEY, DS, and RRSIG records and reports SECURE / INSECURE / BOGUS / INDETERMINATE.
BOGUS status means signatures exist but fail validation β a serious indicator of misconfiguration or potential tampering.
Args: params (DNSSECInput): - domain (str): Domain name (e.g. 'cloudflare.com') - response_format (str): 'markdown' (default) or 'json'
Returns: str: DNSSEC status, chain validity, record counts, and signing algorithms.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover the safety profile (readOnly/idempotent), but the description adds valuable behavioral context not in structured data: the four possible return statuses (SECURE/INSECURE/BOGUS/INDETERMINATE), the specific meaning of BOGUS (signatures exist but fail validation), and the security implications. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with clear sections: purpose statement, BOGUS status explanation, Args, and Returns. The Args/Returns sections slightly duplicate schema information but provide necessary context given the 0% top-level coverage. The BOGUS explanation sentence earns its place by highlighting security relevance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (cryptographic validation), the description adequately covers inputs, outputs, and behavioral traits. It documents return value meanings and signing algorithms. Minor gap: it assumes network access (openWorldHint is true in annotations) but doesn't describe network dependency or potential timeouts in the text.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% top-level schema description coverage (the 'params' object lacks a description), the description compensates via the Args section detailing the nested DNSSECInput structure, including the domain example ('cloudflare.com') and response_format options ('markdown' or 'json'). This adds necessary semantic meaning beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('Validate the DNSSEC chain-of-trust') and resource (DNSSEC records for a domain), distinguishing it from generic DNS resolution siblings like peerglass_dns_resolve by explicitly mentioning DNSKEY, DS, and RRSIG record types.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
While the description clearly explains what BOGUS status means (misconfiguration/tampering indicator), it lacks explicit guidance on when to use this versus sibling tools like peerglass_dns_resolve or peerglass_dns_censorship. The usage is implied by technical specificity but not explicitly stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
peerglass_dns_email_securityARead-onlyIdempotent
Comprehensive email security posture check for a domain:
SPF: record presence, validity, and policy strength (-all / ~all / ?all)
DMARC: policy (none/quarantine/reject), pct coverage, rua/ruf reporting
DKIM: probes common selectors (google, selector1, default, k1, mail β¦)
MX: mail server records
BIMI: brand indicator for message identification
Risk score: LOW / MEDIUM / HIGH / CRITICAL with specific issues listed
Args: params (EmailSecurityInput): - domain (str): Domain name (e.g. 'example.com') - response_format (str): 'markdown' (default) or 'json'
Returns: str: Full email security audit with risk level, score, and recommendations.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint, destructiveHint, and openWorldHint. The description adds valuable behavioral context beyond these annotations: it specifies exactly what gets probed (common DKIM selectors like google/selector1/default), what validations occur (SPF policy strength, DMARC pct coverage), and the risk scoring methodology (LOW/MEDIUM/HIGH/CRITICAL). It does not mention rate limits or timeout behavior, preventing a perfect score.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is excellently structured with bullet points for scannability, followed by clearly labeled Args and Returns sections. Every sentence conveys specific information about functionality, parameters, or output format. No filler text is present.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (5 distinct protocol checks) and the presence of an output schema (per context signals), the description provides complete contextual coverage. It explains what the tool does, what it returns (audit with risk level/recommendations), and documents parameters adequately without needing to replicate the output schema structure.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With schema description coverage at 0%, the description compensates effectively via the 'Args' section, documenting both the domain parameter (with example) and response_format (with allowed values and default). It provides sufficient semantic meaning for an agent to construct valid inputs, though it omits validation constraints like maxLength that appear in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states it performs a 'Comprehensive email security posture check' and lists specific protocols audited (SPF, DMARC, DKIM, MX, BIMI) along with risk scoring. This clearly distinguishes it from sibling tools like peerglass_dns_resolve or peerglass_dns_dnssec which handle general resolution or DNSSEC rather than email authentication analysis.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
While the detailed bullet points imply the tool is used for auditing email authentication configurations, there is no explicit guidance on when to select this over peerglass_dns_resolve for simple MX lookups, or when not to use it. Usage is implied by the specific capabilities listed but lacks explicit 'when-to-use' or alternative comparisons.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
peerglass_dns_enumerateARead-onlyIdempotent
Enumerate all common DNS record types for a domain in one call: A, AAAA, MX, NS, TXT, SOA, CNAME, CAA, SRV β plus extracts SPF and DMARC policies inline.
Args: params (DNSEnumerateInput): - domain (str): Domain name (e.g. 'cloudflare.com') - response_format (str): 'markdown' (default) or 'json'
Returns: str: Per-type record tables with TTL values and extracted SPF/DMARC.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and openWorldHint. The description adds valuable behavioral context beyond these: it specifies the return format includes 'Per-type record tables with TTL values' and clarifies that SPF/DMARC policies are extracted 'inline' rather than requiring separate calls. It does not mention error behaviors for invalid domains.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections (action, Args, Returns) and front-loaded with the primary verb. Every sentence provides specific value: the record type list, the extraction feature, parameter types, and return structure. The docstring format adds slight verbosity but improves scanability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the rich annotations (4 hints) and the presence of an output schema, the description provides sufficient context by detailing what data is returned (tables with TTL) and the specific record types covered. It appropriately focuses on functional specifics rather than re-stating safety properties already covered by annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With schema description coverage reported at 0% (the 'params' wrapper lacks description), the description carries the full burden. It clearly documents both parameters: domain with type and example, and response_format with type, allowed values ('markdown', 'json'), and default value. It does not mention domain length constraints present in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action (enumerate), resource (DNS record types), and comprehensive scope (A, AAAA, MX, NS, TXT, SOA, CNAME, CAA, SRV). It also distinguishes this from sibling tools by emphasizing 'all common... in one call' and highlighting the bonus SPF/DMARC extraction feature.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this is a comprehensive enumeration tool via 'in one call' and the exhaustive list of record types, suggesting use when complete DNS data is needed. However, it lacks explicit guidance on when to prefer this over siblings like peerglass_dns_resolve or peerglass_dns_email_security, and doesn't advise on selecting between markdown vs JSON formats.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
peerglass_dns_propagationARead-onlyIdempotent
Check whether a recent DNS change has propagated globally by querying 10 geographically distributed resolvers simultaneously: Cloudflare (1.1.1.1), Google (8.8.8.8), Quad9, OpenDNS, Comodo, Verisign, Level3, FreeDNS, CleanBrowsing, and Alternate DNS.
Compares each resolver's answer to the majority answer and reports which resolvers are stale, diverging, or failing.
Args: params (DNSPropagationInput): - domain (str): Domain name (e.g. 'cloudflare.com') - record_type (str): DNS record type to check (default: A) - response_format (str): 'markdown' (default) or 'json'
Returns: str: Per-resolver answer table with propagation status and majority answer.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnly/idempotent status, while the description adds crucial behavioral details: it queries specific named resolvers (Cloudflare, Google, etc.), compares answers against a majority consensus, and classifies results as 'stale, diverging, or failing.' This provides clear execution context beyond the safety hints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with clear Purpose β Args β Returns sections. Lists the 10 specific resolvers to establish scope without excess verbosity. Every sentence conveys necessary information about functionality, comparison logic, or output format.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the nested input schema and presence of output schema (Returns: str with table description), the description provides sufficient context. The Args section clarifies the wrapper object structure that the schema's 0% top-level coverage obscures, and annotations cover operational safety aspects.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage at the top level (only a $ref), the Args section compensates effectively by documenting the nested structure (params containing domain, record_type, response_format), providing examples ('cloudflare.com'), and noting defaults. It does not mention pattern constraints or enum values explicitly, but covers essential semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description explicitly states the tool checks 'whether a recent DNS change has propagated globally' using '10 geographically distributed resolvers simultaneously.' It distinguishes from sibling tools like peerglass_dns_resolve by emphasizing propagation status checking and majority consensus logic rather than simple resolution.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context ('recent DNS change') but does not explicitly state when to use this versus siblings like peerglass_dns_resolve or peerglass_dns_censorship. No 'when-not-to-use' guidance or explicit alternatives are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
peerglass_dns_resolveARead-onlyIdempotent
Resolve a hostname or reverse-lookup an IP address and correlate the result with RDAP registration data (holder, country, RIR, covering prefix).
Args: params (DNSResolveInput): - target (str): Hostname or IP address (e.g. '8.8.8.8', 'cloudflare.com') - record_type (str): DNS record type β A, AAAA, PTR, MX, TXT, NS, CNAME β¦ - response_format (str): 'markdown' (default) or 'json'
Returns: str: DNS records table + RDAP owner details for each resolved IP.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and openWorldHint. The description adds valuable context about the specific RDAP fields returned (holder, country, RIR, covering prefix) and the output format (DNS records table + RDAP details), which goes beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The Args/Returns structure is organized and front-loaded with the core purpose, but the inclusion of the non-existent record_type parameter wastes space and creates confusion. The length is otherwise appropriate for the complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description adequately explains the return value (string with table + RDAP details) which complements the existing output schema. However, the parameter documentation is incomplete/inaccurate due to the phantom parameter, and it lacks guidance on rate limits or auth needs despite openWorldHint being true.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Given 0% schema description coverage per context signals, the description attempts to compensate by documenting parameters with examples (e.g., '8.8.8.8', 'cloudflare.com'). However, it erroneously documents a 'record_type' parameter that does not exist in the input schema, which could confuse the agent about available functionality.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool resolves hostnames or reverse-looks up IPs and specifically distinguishes itself from basic DNS tools by correlating results with RDAP registration data (holder, country, RIR, covering prefix). The specific verb+resource combination is precise.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage through the RDAP correlation feature but provides no explicit guidance on when to use this versus siblings like peerglass_dns_enumerate, peerglass_geo_lookup, or rir_query_ip. It does clarify it handles both forward and reverse lookups.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
peerglass_geo_lookupARead-onlyIdempotent
Look up the geographic location of an IP address using MaxMind GeoLite2.
Returns city, region, country, coordinates, and timezone when available. Requires the PEERGLASS_GEOIP_DB environment variable pointing to a GeoLite2-City.mmdb file (free download from maxmind.com with account).
Args: params (GeoLookupInput): - ip (str): IPv4 or IPv6 address - response_format (str): 'markdown' (default) or 'json'
Returns: str: City, region, country, coordinates, timezone, EU membership.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent hints. The description adds valuable behavioral context: external dependency on the MaxMind DB file, specific return fields (city, coordinates, EU membership), and data freshness limitations ('when available'). No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Uses structured docstring format (Args/Returns) that is front-loaded with purpose. While slightly verbose due to boilerplate, every section provides necessary information given the lack of schema descriptions. No filler content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers the critical deployment requirement (env var path) that annotations cannot express. Since output schema exists, the return value description is supplementary but helpful for understanding semantic content. Could mention error cases (invalid IP, missing DB file) for completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description carries full documentation burden. It clearly documents both nested parameters: 'ip' as IPv4/IPv6 and 'response_format' with valid options and default ('markdown'). This compensates perfectly for the sparse schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening sentence 'Look up the geographic location of an IP address using MaxMind GeoLite2' provides a specific verb, resource, target, and data source. This clearly distinguishes it from sibling tools like peerglass_dns_resolve (DNS) or rir_query_ip (RIR registration data).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides critical operational context (requires PEERGLASS_GEOIP_DB environment variable) and output format options, but lacks explicit when-to-use guidance comparing it to similar IP lookup siblings like rir_query_ip or peerglass_passive_dns.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
peerglass_monitor_registerAIdempotent
Register a country code, ASN, or prefix for shutdown monitoring with a webhook URL. When the withdrawn% exceeds the threshold, PeerGlass will POST a JSON alert to the webhook.
Args: params (MonitorRegisterInput): - resource (str): Country code, ASN, or prefix to monitor - webhook_url (str): HTTPS URL to POST alerts to - threshold_pct (float): Alert threshold in % withdrawn (default 20%) - interval_minutes (int): Polling interval (default 5 min)
Returns: str: Registration confirmation and registration count.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover idempotency and safety (idempotentHint: true, destructiveHint: false). The description adds valuable behavioral context: the specific trigger condition (when withdrawn% exceeds threshold), the alert format (JSON POST), the polling nature (interval_minutes), and the return value semantics (confirmation and count).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with the core purpose in the first sentence, followed by clearly labeled Args and Returns sections. Every sentence conveys essential information; no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the moderate complexity (4 parameters, webhook setup) and presence of return value documentation, the description is substantially complete. It could enhance by mentioning the idempotent behavior (already in annotations) or error handling for invalid webhooks, but covers the essential operational contract.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage at the top level and only titles (no descriptions) for threshold_pct and interval_minutes in the nested schema, the Args section in the description carries the full load. It clearly documents all four parameters including their types, purposes, and default values (20% threshold, 5min interval).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the specific action (Register), resource type (country code/ASN/prefix), and mechanism (webhook URL for shutdown monitoring). It distinguishes from siblings like 'peerglass_shutdown_detect' by emphasizing the webhook/alert-based continuous monitoring aspect rather than one-time detection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies continuous monitoring use cases through the webhook mechanism and threshold trigger, but provides no explicit guidance on when to choose this over siblings like 'rir_change_monitor' or 'peerglass_shutdown_detect', nor any prerequisites for the webhook URL.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
peerglass_ooni_reportARead-onlyIdempotent
Fetch OONI (Open Observatory of Network Interference) censorship measurements for a country over the last 30 days.
Shows confirmed blocked websites, Tor accessibility, and circumvention tool status (Psiphon, OpenVPN, Signal) as measured by OONI probes running inside the country.
Args: params (OONIReportInput): - country_code (str): ISO 3166-1 alpha-2 code e.g. 'IR', 'RU' - domain (str, optional): Filter to a specific domain - response_format (str): 'markdown' (default) or 'json'
Returns: str: Blocked domains, Tor accessibility, and circumvention tool status.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover safety profile (readOnly/idempotent). Description adds crucial behavioral constraint 'last 30 days' not present in annotations, and details specific measurement categories. Could improve by mentioning probe coverage limitations or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with clear sections: purpose statement, Args block, Returns line. No filler. Front-loaded with key scope (30 days, country-level) in first sentence. Docstring-style format is efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Complete for moderate complexity (1 nested param object). With output schema present, description appropriately focuses on behavior and parameter semantics rather than return structure. Addresses all 3 sub-parameters via Args section.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so description carries full burden. Args section compensates perfectly: documents country_code format (ISO 3166-1 alpha-2 with examples), domain purpose (filter), and response_format options (markdown/json with default).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb 'Fetch' + resource 'OONI censorship measurements' + clear scope 'country over the last 30 days'. Distinguishes from siblings like peerglass_dns_censorship by specifying OONI probe methodology and specific measurement types (Tor, Psiphon, Signal).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context about what data is returned (blocked websites, circumvention tools) and the 30-day time window, helping agents understand when OONI data is appropriate. Lacks explicit 'when-not' guidance or named sibling alternatives (e.g., vs peerglass_dns_censorship).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
peerglass_passive_dnsARead-onlyIdempotent
Query RIPE Stat Passive DNS for historical DNS records associated with an IP address or domain name. Shows what hostnames pointed to an IP (or what IPs a hostname resolved to) over time, with first/last seen timestamps and observation counts.
Useful for:
Tracing infrastructure changes over time
Finding previously-used domains for an IP
Investigating historical malware C2 infrastructure
Attribution and threat hunting
Data source: RIPE NCC's Passive DNS system, which aggregates DNS queries from recursive resolvers across the network.
Args: params (PassiveDNSInput): - resource (str): IP address or domain name - limit (int): Max records (default 100, max 500) - response_format (str): 'markdown' (default) or 'json'
Returns: str: Historical DNS records table with rrtype, value, and first/last seen dates.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate read-only, idempotent, non-destructive behavior. The description adds valuable context about the data source ('RIPE NCC's Passive DNS system, which aggregates DNS queries from recursive resolvers') and return format specifics ('first/last seen timestamps and observation counts') that clarify what 'historical' means in practice.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is well-structured with distinct sections (main purpose, useful for, data source, args, returns) and no wasted text. Every sentence provides unique valueβwhether describing the external data source, enumerating use cases, or documenting parameters.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has an output schema and annotations covering safety hints, the description provides comprehensive coverage: it explains the external data source, return value structure ('Historical DNS records table with rrtype, value, and first/last seen dates'), and fully documents all parameters despite zero schema coverage. Complete for a historical lookup tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage (per context signals), the description fully compensates by documenting all three nested parameters under 'Args': resource (IP or domain), limit (default 100, max 500), and response_format (markdown/json options). This provides complete semantic meaning absent from the structured schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description explicitly states the tool 'Query RIPE Stat Passive DNS for historical DNS records' specifying the verb (Query), data source (RIPE Stat), resource type (historical DNS records), and targets (IP or domain). This clearly distinguishes it from active DNS resolution siblings like peerglass_dns_resolve.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'Useful for:' section provides four specific scenarios (tracing infrastructure changes, finding previously-used domains, investigating C2 infrastructure, threat hunting) giving clear context for when to use the tool. However, it does not explicitly name alternatives (e.g., peerglass_dns_resolve for current DNS) or exclusion criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
peerglass_satellite_connectivityARead-onlyIdempotent
Check whether satellite internet providers (Starlink, Viasat, OneWeb, SES, Inmarsat, HughesNet) are actively announcing BGP prefixes.
During ground-based internet shutdowns, satellite services often remain the only available connectivity option for journalists and aid workers.
Args: params (SatelliteConnectivityInput): - country_code (str): ISO 3166-1 alpha-2 code (used for context) - response_format (str): 'markdown' (default) or 'json'
Returns: str: Per-provider active status and announced prefix count.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate readOnly/idempotent/non-destructive operations. Description adds valuable behavioral context beyond annotations: specifies the six satellite providers monitored, explains the ground-shutdown scenario where satellite remains available, and documents return format ('Per-provider active status and announced prefix count'). No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with clear sections: purpose statement, usage context, Args, and Returns. Front-loaded with specific providers and use case. Args/Returns sections necessary given poor schema coverage. Slightly verbose but information-dense without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Comprehensive for a read-only monitoring tool: annotations cover safety profile (read-only, non-destructive), description covers target providers, use case, and return value semantics. Given output schema exists (per context signals), description appropriately focuses on input parameters and behavioral context rather than output structure details. Could mention rate limits or caching behavior for perfect completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the Args section effectively compensates by documenting both parameters: clarifies country_code expects 'ISO 3166-1 alpha-2 code' and notes it is 'used for context', and specifies response_format accepts 'markdown' (default) or 'json'. Could improve by noting country_code is required, but covers essential semantics well.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states specific action ('Check whether satellite internet providers... are actively announcing BGP prefixes') and lists exact providers monitored (Starlink, Viasat, OneWeb, SES, Inmarsat, HughesNet). Clearly distinguishes from sibling rir_check_bgp_status by specifying satellite-specific providers and BGP prefix announcement monitoring.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly identifies use case context ('During ground-based internet shutdowns, satellite services often remain the only available connectivity option for journalists and aid workers'), helping agents understand when this tool is valuable versus general connectivity checks. Does not explicitly name alternative tools, but contextualizes the specific humanitarian/emergency scenario where this tool applies.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
peerglass_shutdown_detectARead-onlyIdempotent
Detect internet shutdowns at the country level by comparing current BGP prefix counts against a stored baseline.
On the first call for a country the baseline is established. Subsequent calls measure how many prefixes have been withdrawn and classify severity: β’ NORMAL < 5% withdrawn β’ DEGRADED 5β20% withdrawn β’ PARTIAL_SHUTDOWN 20β80% withdrawn β’ FULL_SHUTDOWN > 80% withdrawn
Args: params (ShutdownDetectInput): - country_code (str): ISO 3166-1 alpha-2 code e.g. 'SY', 'IR', 'MM' - response_format (str): 'markdown' (default) or 'json'
Returns: str: Severity level, withdrawn percentage, and sampled ASN prefix counts.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Excellent disclosure beyond annotations. While annotations declare readOnly/idempotent hints, the description explains the critical stateful behavior (baseline storage between calls), the exact severity classification thresholds (5%, 20%, 80%), and the return value composition. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with clear sections. The severity level bullet points efficiently communicate complex thresholds. Every sentence serves a purposeβexplaining mechanism, state management, or parameter formats. No redundant or filler text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Very complete for a detection tool with stateful behavior. Explains the baseline mechanism, severity levels, and return format. Minor gap: could mention `peerglass_shutdown_timeline` as a complementary tool for users needing historical data rather than current detection.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite the schema having minimal coverage (country_code only partially described), the description fully compensates by documenting both parameters with concrete examples ('SY', 'IR', 'MM') and clarifying the response_format default and options ('markdown' vs 'json') that the schema lacks.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action (detect internet shutdowns), the resource (country-level), and the mechanism (BGP prefix comparison against baseline). It distinguishes this from generic monitoring tools by specifying the BGP/withdrawal methodology.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides critical usage context about the stateful nature (first call establishes baseline, subsequent calls measure) and explains the severity classification thresholds. However, it does not explicitly mention sibling tools like `peerglass_shutdown_timeline` as an alternative for historical analysis vs. current detection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
peerglass_shutdown_timelineARead-onlyIdempotent
Retrieve a timestamped BGP withdrawal/restoration timeline for a country or ASN over a date range. Includes a SHA-256 content hash for evidence integrity verification (useful for UN reports, press, legal proceedings).
Args: params (ShutdownTimelineInput): - resource (str): Country code (e.g. 'SY') or ASN (e.g. 'AS29256') - start_date (str): ISO date e.g. '2023-10-07' - end_date (str): ISO date e.g. '2023-10-14' - response_format (str): 'markdown' (default) or 'json'
Returns: str: Timeline of BGP events, total downtime hours, and SHA-256 integrity hash.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true and idempotentHint=true, so the description focuses on adding the evidence integrity context (SHA-256 hash) and return value structure (timeline, downtime hours). It successfully adds behavioral traits not covered by annotations, such as the evidentiary nature of the output and its suitability for legal proceedings.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description follows a clear logical structure: purpose statement, evidence use case, then organized Args and Returns blocks. Every sentence conveys distinct information (scope, integrity feature, use cases, parameter types, return contents). The Args/Returns headers add slight verbosity but are appropriate for technical clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's specific forensic purpose and the presence of good annotations covering safety (read-only, idempotent), the description adequately covers the evidentiary context (SHA-256 hash) and documents the return value contents (timeline, hours, hash) without requiring a separate output schema. The forensic use cases complete the contextual picture.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% top-level schema coverage (the params object lacks a description) and a nested object structure, the Args section in the description performs essential work documenting all four nested fields (resource, start_date, end_date, response_format) with clear examples and format specifications (e.g., ISO dates, markdown/json options), effectively compensating for the wrapper object structure.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves a 'timestamped BGP withdrawal/restoration timeline' using specific verbs and identifies the resource. It distinguishes itself from generic monitoring tools via the explicit mention of SHA-256 integrity hashes for legal/forensic use, implicitly differentiating it from sibling tools like peerglass_shutdown_detect.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides implied usage guidance by specifying the tool is 'useful for UN reports, press, legal proceedings,' indicating forensic/evidence contexts. However, it lacks explicit comparisons to siblings (e.g., peerglass_shutdown_detect) or statements about when not to use this tool versus real-time detection alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
peerglass_threat_intelARead-onlyIdempotent
Passive threat intelligence for an IP address from two sources:
Shodan InternetDB (always available, no API key required):
Open ports detected via internet scanning
CVE identifiers for detected services
Reverse DNS hostnames
Shodan tags (cdn, vpn, tor-exit, etc.)
GreyNoise Community (requires GREYNOISE_API_KEY env var):
Classification: malicious / benign / unknown
RIOT flag: trusted service (Google, Amazon, etc.)
Noise flag: benign internet background scanner
Named actor or service attribution
Produces an aggregated risk score (0β100) and level (LOW / MEDIUM / HIGH / CRITICAL).
Args: params (ThreatIntelInput): - ip (str): IPv4 address (e.g. '1.2.3.4') - response_format (str): 'markdown' (default) or 'json'
Returns: str: Open ports, CVEs, GreyNoise classification, and risk assessment.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Despite annotations declaring readOnlyHint/openWorldHint, the description adds critical behavioral context: GreyNoise requires GREYNOISE_API_KEY while Shodan does not, data source limitations (Community vs InternetDB), and output structure details (aggregated risk score 0-100 with specific levels). No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Excellent structure with hierarchical organization: high-level summary, numbered data sources with bullet points, and standard Args/Returns sections. Every sentence delivers valueβsource capabilities, authentication requirements, or output format detailsβwithout redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (dual external APIs, aggregated scoring logic) and 0% schema coverage, the description is remarkably complete. It covers input semantics, authentication prerequisites, data source behaviors, and return value structure, leaving no critical gaps for invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With schema description coverage at 0%, the Args section fully compensates by documenting both the 'ip' parameter (with IPv4 example) and 'response_format' (with valid values and default). This provides complete semantic meaning missing from the raw schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Passive threat intelligence for an IP address from two sources'βa specific verb-resource combination that clearly distinguishes it from sibling tools like peerglass_geo_lookup or peerglass_dns_resolve. The explicit naming of Shodan and GreyNoise further differentiates its unique function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage through detailed capability listing (risk scores, CVEs, GreyNoise classification), allowing an agent to infer this is for security assessment rather than general network debugging. However, it lacks explicit 'when to use vs alternatives' guidance comparing it to siblings like peerglass_atlas_trace or peerglass_passive_dns.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
peerglass_tls_inspectARead-onlyIdempotent
Connect to hostname:port over TLS and return full certificate details: subject, issuer, Subject Alternative Names (SANs), expiry date, days remaining, self-signed flag, TLS protocol version, cipher suite, chain length, and HSTS header presence.
Useful for:
Verifying certificate validity before expiry
Detecting self-signed or untrusted certificates
Checking TLS configuration (version, cipher suite)
Auditing HSTS deployment
Args: params (TLSInspectInput): - hostname (str): Target hostname (e.g. 'cloudflare.com') - port (int): TCP port β default 443 - response_format (str): 'markdown' (default) or 'json'
Returns: str: Certificate details, expiry countdown, issuer chain, and HSTS status.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations correctly declare the tool as readOnlyHint=true and idempotentHint=true. The description adds valuable context about what gets inspected (certificate chain length, HSTS header presence) and the return format, but omits behavioral details like connection timeouts, handling of non-TLS hosts, or rate limits that would be expected for an openWorldHint=true network tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear visual sections (summary, use cases, Args, Returns). The first sentence is front-loaded with the complete value proposition. While dense, every section earns its place; the colon-separated list of return values is efficient, and the bullet points are scannable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool is read-only with provided safety annotations, the description achieves completeness by covering the input contract (with examples), the output contract (described in Returns), and operational use cases. It appropriately omits error-schema details since it describes the successful return value, making it sufficient for agent invocation planning.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite the schema's 0% description coverage (only response_format has a schema description), the Args section compensates effectively by providing runtime semantics: hostname includes a realistic example ('cloudflare.com'), port clarifies 'TCP' context and default 443, and response_format enumerates allowed values. This bridges the gap left by the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a precise action verb ('Connect') and resource ('hostname:port over TLS'), then enumerates specific outputs (subject, issuer, SANs, cipher suite, etc.). This clearly distinguishes it from sibling DNS tools (peerglass_dns_*) and network routing tools (rir_*) by focusing specifically on TLS certificate metadata.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'Useful for:' section provides four concrete scenarios (verifying expiry, detecting self-signed certs, checking TLS configuration, auditing HSTS) that establish clear context for when to invoke the tool. While it lacks explicit 'when not to use' exclusions or named sibling alternatives, the specificity of the use cases effectively guides selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rir_as_relationshipsARead-onlyIdempotent
Fetch AS relationship data from CAIDA AS-Rank API.
Classifies neighbouring ASNs as: β’ Providers (upstream transit) β’ Customers (downstream networks) β’ Peers (settlement-free peering)
Unlike RIPE Stat asn-neighbours (which only gives left/right/uncertain), CAIDA AS-Rank uses a BGP-path-based inference algorithm for higher accuracy.
Args: params (ASRelationshipInput): - asn (str): ASN e.g. 'AS13335' or '13335' - response_format (str): 'markdown' (default) or 'json'
Returns: str: Classified providers, customers, and peers with relationship type.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover safety profile (readOnly, idempotent, non-destructive). Description adds value by disclosing the inference methodology (BGP-path-based algorithm), classification taxonomy (upstream/downstream/settlement-free), and external data source (CAIDA AS-Rank API).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Docstring format (Args/Returns) is slightly verbose but efficiently structured. Classification bullets front-load key value propositions. Every section earns its place, particularly parameter documentation which fills schema gaps.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Comprehensive for a data-fetch tool: covers source API, inference methodology, classification categories, parameter details, and return format. Well-supported by annotations covering safety; no significant gaps despite zero schema description coverage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 0% description coverage but description fully compensates via Args section: documents 'asn' with format examples ('AS13335' or '13335'), and 'response_format' with allowed values and default. Explains semantics beyond raw schema types.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb 'Fetch' + resource 'AS relationship data' + explicit scope (CAIDA AS-Rank API). Explicitly distinguishes from sibling/alternative RIPE Stat asn-neighbours tool by contrasting accuracy levels and classification methods.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear comparative context: explains that unlike RIPE Stat (which gives left/right/uncertain), this uses BGP-path-based inference for higher accuracy, implicitly guiding selection when accurate classification is needed. Lacks explicit 'when not to use' constraints.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rir_audit_orgARead-onlyIdempotent
Find all IP blocks and ASNs registered to an organization across all RIRs.
Searches RDAP entity databases at AFRINIC, APNIC, ARIN, and RIPE (LACNIC does not support RDAP entity search β a limitation is noted). Aggregates results into a unified inventory.
Use cases:
M&A due diligence: What internet resources does Company X own globally?
Security research: What is the full IP footprint of an organization?
ICANN/RIR policy: Are resources distributed across multiple RIRs?
Incident response: Did this org transfer/sell IP space recently?
Tips:
Use org handles for precision (e.g. 'GOOGL-ARIN' not 'Google')
Partial name matching is supported (e.g. 'Cloudflare' finds 'Cloudflare Inc.')
Results are cached for 6 hours.
Args: params (OrgAuditInput): - org_name (str): Organization name or handle (e.g. 'Cloudflare', 'GOOGL-ARIN') - response_format (str): 'markdown' (default) or 'json'
Returns: str: Summary of all IP blocks and ASNs by RIR, with handles, names, countries, and allocation dates. JSON schema: { "org_query": str, "total_resources": int, "ip_blocks": [{"rir": str, "handle": str, "prefix_or_asn": str, "name": str, "country": str}], "asns": [...], "rirs_found_in": [str], "errors": [str] }
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations establish read-only/idempotent safety; the description adds critical behavioral context not present in annotations: 6-hour caching policy, LACNIC RDAP limitation, and RDAP entity database sources. Could be improved by mentioning rate limits or authentication requirements, but coverage of data source limitations and caching is valuable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with clear sections (overview, use cases, tips, args, returns). The use cases and tips earn their space by preventing misuse. The JSON return schema is somewhat verbose given that an output schema exists, but it ensures the LLM understands the structured string output. Front-loaded with the core action in the first sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Comprehensive for a complex aggregation tool spanning multiple external RIR databases. Documents return structure (including error field), notes the LACNIC limitation, explains partial matching behavior, and provides the JSON output schema. Complete enough that an agent can predict both success and failure modes.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With schema description coverage at 0% (per context signals), the Args section compensates effectively by documenting both parameters with concrete examples ('GOOGL-ARIN', 'Cloudflare') and default values ('markdown'). The distinction between handles and partial name matching is clarified, adding necessary semantic context for successful invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a precise action ('Find all IP blocks and ASNs') and scope ('registered to an organization across all RIRs'). The 'across all RIRs' and 'organization-wide' framing clearly distinguishes this from siblings like rir_query_ip or rir_query_asn which handle single resources.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides four specific use cases (M&A due diligence, security research, ICANN policy, incident response) that establish when to select this tool. Includes practical tips for query precision (org handles vs names) and caching behavior. Lacks explicit 'when not to use' contrast with single-resource lookup siblings, though the use cases imply the scope.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rir_cache_statsARead-onlyIdempotent
View the current state of the in-memory TTL cache.
The cache prevents repeated queries to RIRs within short windows, respecting rate limits and reducing latency for repeated lookups.
Returns: str: JSON with cache entry counts (total, alive, expired) and the configured TTL for each query type. Schema: { "cache_stats": {"total_entries": int, "alive": int, "expired": int}, "ttl_seconds": {"ip": int, "asn": int, "org": int, "abuse": int, "bgp": int, "rpki": int} }
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover safety profile (readOnly, idempotent, non-destructive). Description adds valuable behavioral context about TTL caching mechanism and rate limit respect. Includes detailed return value schema. Could mention if calling this affects cache state (e.g., does it trigger cleanup?), but otherwise comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with purpose front-loaded, followed by value proposition, then detailed returns. The embedded JSON schema in the Returns section is slightly verbose but functionally useful given the context. No wasted sentences.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters and rich annotations (readOnly, idempotent hints), the description is complete. It explains the 'why' (rate limiting), the 'what' (cache stats), and the 'how' (JSON structure). For a simple diagnostic tool, this coverage is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has zero input parameters, establishing a baseline score of 4 per evaluation rules. No parameter semantics are needed or provided, which is appropriate for a parameterless statistics retrieval function.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description opens with specific verb 'View' and clear resource 'in-memory TTL cache'. The second paragraph distinguishes this from sibling RIR query tools by explaining it monitors the cache that 'prevents repeated queries to RIRs', clearly differentiating it from active query tools like rir_query_ip or rir_check_rpki.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context on when the cache matters ('respecting rate limits and reducing latency for repeated lookups'), implying this tool is useful for debugging cache behavior or rate limit issues. Lacks explicit 'when not to use' or named alternatives, but the value proposition is clearly stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rir_change_monitorARead-only
Monitor a prefix or ASN for registration and BGP routing changes between calls.
How it works:
First call: captures a baseline snapshot of RDAP + BGP state. Stores it in memory for the server's lifetime.
Subsequent calls: fetches the current state and diffs it against the baseline. Reports exactly which fields changed and from what to what.
When changes are detected: automatically updates the baseline so the next call diffs from the new state (not the original).
reset_baseline=True: discards any stored baseline and captures fresh.
Tracked fields (8 total): RDAP: Holder, RIR, Country, Allocation Status, Abuse Email BGP: Announced (bool), Origin ASN(s), Visibility %
Severity of changes: π΄ BGP Origin ASN changed β possible hijack, verify with rir_check_rpki π΄ RDAP Holder changed β possible transfer, check rir_detect_transfers π‘ BGP Announced changed β prefix appeared/disappeared from routing π‘ Country changed β registration country updated π’ Visibility % changed β normal BGP fluctuation
Baseline persists in server memory β not in a database. If the server restarts, baselines are lost and will be recreated on next call.
Args: params (ChangeMonitorInput): - resource (str): IP prefix (e.g. '8.8.8.0/24') or ASN (e.g. 'AS15169') - reset_baseline (bool): If True, discard baseline and start fresh
Returns: str: Baseline created confirmation (first call), or diff table (subsequent calls). JSON schema: { "resource": str, "status": str, (baseline_created|changes_detected|no_changes) "baseline_captured_at": str, "checked_at": str, "changes": [{"field": str, "old_value": str, "new_value": str}], "current_holder": str, "current_rir": str, "message": str }
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare idempotentHint=false and readOnlyHint=true; the description explains exactly whyβbaseline capture creates server-side state that changes between invocations. It adds critical behavioral context: baseline persistence in memory (not database), automatic baseline updates on change detection, and loss of state on server restart. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Appropriately structured with clear sections (How it works, Tracked fields, Severity, Args, Returns). The length is justified by the tool's complexity (8 tracked fields, 4 severity levels, stateful behavior). The embedded JSON return schema is valuable for parsing. Minor redundancy exists between the Args section and the schema descriptions.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the high complexity (stateful diffing across RDAP and BGP data) and presence of output schema, the description is remarkably complete. It documents all 8 tracked fields, explains the severity taxonomy, provides the output JSON schema, and warns about session-scoped baseline persistence.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
While the input schema has high description coverage (despite the context signal indicating 0%), the description adds crucial temporal semantics in the 'How it works' sectionβexplaining that the same resource parameter triggers baseline capture on first call and diffing on subsequent calls. This stateful behavior is not apparent from the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening sentence 'Monitor a prefix or ASN for registration and BGP routing changes between calls' provides a specific verb and resource. It distinguishes itself from siblings by explicitly naming rir_check_rpki and rir_detect_transfers as follow-up tools for specific severity findings, clarifying its role as a monitoring/diffing tool rather than a deep inspection tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly documents the stateful 'first call vs subsequent calls' behavior and when to use reset_baseline ('after reviewing detected changes'). The severity section provides clear action guidance (e.g., 'verify with rir_check_rpki' for origin ASN changes), functioning as explicit when-to-use-alternatives guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rir_check_bgp_statusARead-onlyIdempotent
Check whether a prefix or ASN is currently visible in the global BGP routing table.
Uses RIPE Stat (which aggregates data from RIPE RIS route collectors worldwide). BGP is the internet's routing protocol β the "GPS" that tells traffic how to navigate from one network to another.
For a prefix, returns:
Whether it is currently announced in BGP
Which ASN(s) are announcing it (multiple = potential hijack)
Percentage of global BGP peers that can see it (visibility)
For an ASN, returns:
Whether the ASN has any active BGP announcements
A list of all announced prefixes (use rir_get_announced_prefixes for details)
Combine with rir_check_rpki for complete routing security assessment. Results are cached for 5 minutes (BGP tables change frequently).
Args: params (BGPStatusInput): - resource (str): Prefix (e.g. '1.1.1.0/24') or ASN (e.g. 'AS15169') - response_format (str): 'markdown' (default) or 'json'
Returns: str: BGP visibility, announcing ASNs, and prefix list. JSON schema: { "resource": str, "resource_type": str, "is_announced": bool, "announcing_asns": [str], "visibility_percent": float, "announced_prefixes": [{"prefix": str, "peers_seeing": int}] }
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds valuable operational context beyond annotations: specifies the 5-minute cache duration ('BGP tables change frequently'), identifies the external data source (RIPE Stat route collectors), and explains the 'potential hijack' interpretation of multiple announcing ASNs. Annotations already cover safety profile (readOnly, idempotent), so this adds temporal and sourcing context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with clear delineation between prefix and ASN return behaviors. The BGP 'GPS' analogy adds educational value without excessive verbosity. The embedded JSON return schema in the Returns section is functional but slightly lengthy; however, it serves as necessary documentation given the complexity of BGP visibility data.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Comprehensive coverage for a complex networking tool: explains RIPE Stat data source, documents both input modes (prefix/ASN) with their respective output structures, includes the JSON output schema, notes caching behavior, and provides sibling tool integration guidance. Complete despite the technical complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With schema description coverage reported at 0% (top-level 'params' lacks description), the Args section compensates effectively by documenting the 'resource' format (prefix or ASN examples) and 'response_format' options (markdown vs json). Provides concrete examples ('1.1.1.0/24', 'AS15169') not explicitly shown in the schema reference.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the tool 'Check[s] whether a prefix or ASN is currently visible in the global BGP routing table' using RIPE Stat. It clearly distinguishes the resource types (prefix vs ASN) and differentiates from siblings by referencing rir_get_announced_prefixes for ASN details and rir_check_rpki for security assessments.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly guides tool selection by stating 'use rir_get_announced_prefixes for details' when querying ASNs, and recommends combining with 'rir_check_rpki for complete routing security assessment.' It clearly delineates different return behaviors for prefixes (visibility check) versus ASNs (prefix listing).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rir_check_irrARead-onlyIdempotent
Check IRRExplorer for route objects covering a prefix and verify they are consistent with the claimed origin ASN.
IRR (Internet Routing Registry) route objects tell ISPs which ASN is authorised to originate a prefix. Inconsistent or missing route objects can cause route filtering and reachability issues even when RPKI is valid.
Args: params (IRRCheckInput): - prefix (str): CIDR prefix e.g. '1.1.1.0/24' - asn (str): Expected origin ASN e.g. 'AS13335' or '13335' - response_format (str): 'markdown' (default) or 'json'
Returns: str: Route objects per IRR source, consistency status, and missing IRR coverage.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true and idempotentHint=true. The description adds valuable domain context: it explains what IRR is, warns about consequences of missing objects (route filtering), and describes the return value structure ('Route objects per IRR source, consistency status'). No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and front-loaded with the core purpose. The IRR explanation paragraph provides necessary domain context. The Args/Returns sections use a standard docstring format that efficiently documents inputs and outputs without verbosity, though they duplicate some schema information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's medium complexity (external registry lookup), the description is comprehensive: it covers domain concepts, input requirements, output summary, and safety profile (via annotations). It adequately prepares an agent to select and invoke the tool without overwhelming detail.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With schema description coverage reported at 0%, the Args section compensates effectively by documenting all three parameters (prefix, asn, response_format) with types and examples. It adds the 'Expected origin' semantic to the ASN parameter, clarifying its validation purpose.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description immediately states the specific action ('Check IRRExplorer') and resource ('route objects'), explaining that it verifies consistency 'with the claimed origin ASN.' It distinguishes from siblings by specifying IRR (vs RPKI) and explaining what IRR objects are for, ensuring clear differentiation from tools like rir_check_rpki.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains the operational context ('Inconsistent or missing route objects can cause route filtering and reachability issues') and implies when to use it (troubleshooting reachability). It references RPKI ('even when RPKI is valid'), implicitly distinguishing from rir_check_rpki, though it could explicitly name the sibling alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rir_check_rpkiARead-onlyIdempotent
Validate a prefix + ASN pair against the global RPKI using Cloudflare's validator.
RPKI (Resource Public Key Infrastructure) is the internet's route security framework. RIRs issue Route Origin Authorizations (ROAs) β digital certificates that cryptographically prove an ASN is authorized to announce a prefix.
Validity states: β VALID β A matching ROA exists. Route is cryptographically authorized. π¨ INVALID β A ROA exists but this ASN/prefix violates it. Possible hijack. β οΈ NOT-FOUND β No ROA exists. Route is unverified (common, not inherently bad). β UNKNOWN β Could not determine validity.
Combine with rir_check_bgp_status for full routing security assessment.
Results are cached for 15 minutes (ROAs can change, but not frequently).
Args: params (RPKICheckInput): - prefix (str): CIDR prefix e.g. '1.1.1.0/24' or '2400:cb00::/32' - asn (str): Originating ASN e.g. 'AS13335' or '13335'
Returns: str: RPKI validity state, description, and list of covering ROAs. JSON schema: { "prefix": str, "asn": str, "validity": "valid"|"invalid"|"not-found"|"unknown", "covering_roas": [{"asn": int, "prefix": str, "maxLength": int}], "description": str }
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
While annotations declare read-only/idempotent hints, the description adds critical context: 15-minute cache duration with rationale ('ROAs can change, but not frequently'), external dependency (Cloudflare's validator), and detailed semantic meaning of each validity state (e.g., 'Possible hijack' for INVALID). No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with clear visual hierarchy: summary, RPKI background, validity states with emoji indicators, usage note, caching note, Args, and Returns. Slightly verbose due to embedded RPKI primer and JSON return schema, but justified given the specialized domain and lack of formal output schema in structured fields.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Comprehensive for a validation tool: documents input semantics, provides full JSON output schema in description (including covering_roas structure), explains cryptographic meaning of results, and notes caching behavior. Given the complexity of RPKI validation and rich output structure, the description provides sufficient context for correct invocation and result interpretation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Context signals indicate 0% schema description coverage (the top-level 'params' object lacks description). The description compensates effectively with an 'Args' section documenting both nested fields (prefix, asn) with format examples (CIDR notation, ASN formats). This compensates for the schema coverage gap and clarifies the expected string formats.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with specific action ('Validate a prefix + ASN pair against the global RPKI') and identifies the external validator (Cloudflare). Explicitly distinguishes from sibling tool 'rir_check_bgp_status' by recommending combination for 'full routing security assessment', clearly delineating this tool's specific scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit pairing guidance ('Combine with rir_check_bgp_status') and explains the four validity states (VALID, INVALID, NOT-FOUND, UNKNOWN) with contextual meaning to guide interpretation. Lacks explicit 'when NOT to use' exclusions, but the validity state descriptions effectively guide appropriate usage contexts.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rir_detect_route_leakARead-onlyIdempotent
Detect potential BGP route leaks or hijacks for a prefix using RIPE Stat BGP-state data.
Checks for:
Multiple distinct origin ASNs (possible hijack β two ASNs claiming the same prefix)
AS-path loops (valley-free violations β a transit ASN re-exporting a learned route)
Args: params (RouteLeakInput): - prefix (str): CIDR prefix e.g. '1.1.1.0/24' - response_format (str): 'markdown' (default) or 'json'
Returns: str: Leak detection result with confidence, suspect ASNs, and anomalous AS paths.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare read-only/idempotent safety, while the description adds substantial detection methodology context: specific heuristics (distinct origin AS detection, valley-free violation checking), data provenance (RIPE Stat), and return value structure (confidence scores, suspect ASNs). No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Excellent docstring structure with clear sections (Args/Returns), front-loaded purpose statement, and zero waste. Bullet points efficiently enumerate detection criteria without verbosity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Comprehensive for a detection tool: covers input parameters, detection algorithms, and output format (including data types). Given the complexity of BGP analysis and presence of output schema hints in the Returns section, only minor gaps exist (no mention of RIPE Stat data freshness or rate limits).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage on leaf parameters, the description effectively compensates by documenting both the 'prefix' parameter (with CIDR format example '1.1.1.0/24') and 'response_format' (enumerating valid values and default), adding crucial semantic context missing from the structured schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description specifies the exact action ('Detect'), resource ('BGP route leaks or hijacks'), data source ('RIPE Stat BGP-state data'), and distinguishes from sibling tools like rir_check_bgp_status or rir_prefix_history by focusing specifically on leak/hijack detection via origin ASN and AS-path analysis.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides implied usage context by listing specific anomalies it checks for (multiple origin ASNs, AS-path loops), suggesting use when investigating hijacks or valley-free violations. However, lacks explicit when-to-use guidance or named alternatives from the extensive sibling list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rir_detect_transfersARead-onlyIdempotent
Detect past ownership or cross-RIR transfers for an IP prefix or ASN.
An ownership transfer happens when a registered org (e.g. 'GOOGL-ARIN') changes to another org ('META-1-ARIN') in the registration record. A cross-RIR transfer is rarer β it means the resource physically moved between registries (e.g. from ARIN to RIPE NCC after an acquisition).
Transfer types detected: π’ Org Change β The registering organization changed πβπ Cross-RIR β The resource moved to a different RIR π Intra-RIR β Maintainer changed within the same RIR
How it works: compares consecutive historical WHOIS object versions. If 'org' or 'mnt-by' changed between versions, a transfer is flagged. If RIR-specific suffixes in the handles differ, it's cross-RIR.
Results are cached for 12 hours.
Args: params (TransferDetectInput): - resource (str): IP prefix (e.g. '8.8.8.0/24') or ASN (e.g. 'AS15169') - response_format (str): 'markdown' (default) or 'json'
Returns: str: List of detected transfers with dates, types, from/to org, and evidence. JSON schema: { "resource": str, "resource_type": str, "transfers_detected": int, "transfers": [{"transfer_date": str, "transfer_type": str, "from_org": str, "to_org": str, "from_rir": str, "to_rir": str, "evidence": str}], "current_holder": str, "first_registered": str, "sources": [str], "notes": [str] }
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds substantial value beyond the annotations by explaining the detection methodology (comparing consecutive WHOIS object versions), specific heuristics (checking 'org' or 'mnt-by' fields, RIR suffix differences), and operational constraints (12-hour cache). It clarifies the 'openWorld' nature by explaining it queries historical data across different RIRs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
While well-structured with clear sections (intro, transfer types, methodology, args, returns), the description is verbose. The inclusion of a full JSON schema in the Returns section is redundant given the context signal indicates an output schema exists, and the emoji-style list, while clear, adds length. The core information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex analytical tool involving WHOIS parsing, historical comparison, and cross-RIR logic, the description is comprehensive. It covers detection algorithms, data sources (WHOIS), caching behavior, return structure with field explanations, and the distinction between different transfer types, providing sufficient context for invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With schema description coverage at 0%, the description compensates effectively via the Args section, documenting the nested 'resource' parameter (with syntactic examples like '8.8.8.0/24' and 'AS15169') and 'response_format' options. It adds semantic meaning by explaining that the resource is what gets scanned for transfers.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a precise action (Detect) and scope (past ownership or cross-RIR transfers for an IP prefix or ASN). It distinguishes from generic history tools by specifying it identifies organizational changes and cross-RIR moves, not merely retrieving registration records.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear contextual guidance by defining what constitutes an ownership transfer vs. a cross-RIR transfer and listing the specific detection types (Org Change, Cross-RIR, Intra-RIR). However, it lacks explicit sibling comparisons or when-not-to-use guidance (e.g., it doesn't state to use rir_prefix_history for simple historical lookups without transfer analysis).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rir_get_abuse_contactARead-onlyIdempotent
Find the abuse contact for any IP address globally using IANA bootstrap routing.
Uses IANA RDAP Bootstrap to identify the authoritative RIR first (efficient), then queries only that RIR. Falls back to querying all 5 if bootstrap fails. Extracts abuse contacts from entity roles: 'abuse', 'technical', 'noc'.
Use this tool as the first step in any network abuse reporting workflow: spam, DDoS attacks, port scanning, credential stuffing, etc.
Results are cached for 1 hour.
Args: params (AbuseContactInput): - ip_address (str): IPv4 or IPv6 address (e.g. '185.220.101.1')
Returns: str: Markdown report with abuse email(s), phone(s), network name, organization, country, and authoritative RIR. JSON schema: { "ip_address": str, "authoritative_rir": str, "abuse_email": [str], "abuse_phone": [str], "network_name": str, "org_name": str, "country": str }
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond annotations (readOnly/idempotent), description details algorithm ('IANA RDAP Bootstrap... Falls back to querying all 5'), data extraction logic ('entity roles: abuse, technical, noc'), and caching behavior ('cached for 1 hour'). No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured docstring format with Purpose β Mechanism β Usage β Caching β Args β Returns. Every sentence earns its place; technical details (bootstrap logic, fallback, caching) are essential for an external-query tool. No fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given complex external dependencies (5 RIRs, bootstrap protocol) and rich output, description provides complete picture: input spec, detailed JSON output schema, error-handling strategy (fallback), and caching policy. Fully sufficient for invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With claimed 0% schema coverage, the Args section compensates by documenting the single parameter with type (str) and format example ('185.220.101.1'). Would benefit from mentioning IPv6 format specifics, but adequately covers the input semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description opens with specific verb 'Find' and resource 'abuse contact for any IP address', plus distinguishes method 'using IANA bootstrap routing'. Explicitly differentiates from sibling RIR tools by focusing specifically on abuse contact extraction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states 'Use this tool as the first step in any network abuse reporting workflow' followed by concrete scenarios (spam, DDoS, port scanning). Clear value proposition for when to select this over other network tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rir_get_announced_prefixesARead-onlyIdempotent
Retrieve all IP prefixes currently being announced by an ASN in BGP.
This shows the ASN's complete routing footprint β every IP range it is actively advertising to the global internet via BGP. Uses RIPE Stat's announced-prefixes endpoint.
Useful for:
Understanding an organization's complete IP footprint
Detecting unexpected prefix announcements (possible hijacks)
M&A due diligence on network assets
Security research and threat intelligence
min_peers_seeing filters out unstable/flapping routes that only a small number of BGP peers can see. Higher = more stable routes only.
Results are cached for 5 minutes.
Args: params (AnnouncedPrefixesInput): - asn (str): ASN to query (e.g. 'AS13335' or '15169') - min_peers_seeing (int): Minimum peer count filter (default: 5)
Returns: str: Complete list of announced prefixes with peer visibility and first/last seen timestamps. JSON schema: { "resource": str, "is_announced": bool, "announced_prefixes": [ {"prefix": str, "peers_seeing": int, "first_seen": str, "last_seen": str} ] }
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds valuable behavioral context beyond annotations: cites RIPE Stat as data source, discloses 5-minute cache, explains min_peers_seeing filters 'unstable/flapping routes' (semantic meaning beyond schema), and documents the complete return structure including peer visibility and timestamps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with clear visual hierarchy: one-line summary β scope elaboration β bulleted use cases β Args/Returns documentation. Front-loaded with the core action. Slightly verbose but every section earns its place by providing distinct value (use cases vs technical specs).
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity and existing safety annotations (readOnly, non-destructive), the description is complete: covers data source, freshness/caching, input semantics, and detailed output schema with JSON structure. No gaps remain for agent invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
While input schema describes the two parameters (asn, min_peers_seeing), the description adds critical semantic context: explains min_peers_seeing controls route stability ('Higher = more stable routes only') and provides ASN format examples ('AS13335' or '15169'). Also documents the return structure not present in input schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with specific verb 'Retrieve' + resource 'IP prefixes' + scope 'currently being announced by an ASN in BGP'. Clearly distinguishes from siblings like rir_prefix_history (historical) and rir_check_bgp_status (status check) by emphasizing 'complete routing footprint' and 'currently'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides four concrete use cases (IP footprint, hijack detection, M&A diligence, threat intel) and explains the min_peers_seeing filter purpose. Lacks explicit 'when not to use' guidance or named alternatives, though 'currently' implies distinction from historical tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rir_ipv4_statsARead-onlyIdempotent
Fetch global IPv4, IPv6, and ASN allocation statistics from all 5 RIRs.
Parses the NRO Extended Delegation Stats files β the authoritative daily publication of how each RIR has distributed address space:
How many IPv4 prefixes allocated (to ISPs) vs assigned (to end users)
Remaining free IPv4 pool (where published β most RIRs are exhausted)
IPv6 prefix count and growth
Total ASNs issued
Why this matters:
IPv4 was exhausted at IANA in 2011
APNIC exhausted in 2011, RIPE in 2012, ARIN in 2015
LACNIC near exhaustion 2020, AFRINIC followed
IPv6 transition is the only long-term solution
This tool lets you track adoption and exhaustion state in real time
Results are cached for 24 hours (stats files are published once daily).
Args: params (IPv4StatsInput): - rir_filter (str, optional): Filter to one RIR ('AFRINIC', 'APNIC', 'ARIN', 'LACNIC', 'RIPE'). Leave empty for all 5. - include_blocks (bool): Include raw delegated IPv4 blocks for the selected RIR. Requires rir_filter to be set. - status_filter (str, optional): allocated | assigned | available (free is normalized). - country_filter (str, optional): 2-letter country code filter (e.g. 'GH', 'ZA'). - limit (int): Max number of block rows when include_blocks=true. - offset (int): Pagination offset for block rows. - response_format (str): 'markdown' (default) or 'json'
Returns: str: Per-RIR table of IPv4/IPv6/ASN counts with totals and exhaustion context. JSON schema: { "queried_at": str, "rirs": [{"rir": str, "region": str, "ipv4_total_prefixes": int, "ipv4_allocated": int, "ipv4_assigned": int, "ipv4_available": int, "ipv6_total_prefixes": int, "asn_total": int, "stats_date": str}], "global_ipv4_prefixes": int, "global_ipv6_prefixes": int, "global_asns": int, "ipv4_blocks": [ {"rir": str, "country": str|null, "start_ip": str, "end_ip": str, "address_count": int, "date": str|null, "status": str} ], "blocks_total": int, "blocks_returned": int, "blocks_limit": int|null, "blocks_offset": int|null, "blocks_filters": {"rir_filter": str|null, "status_filter": str|null, "country_filter": str|null} }
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover safety (readOnly, idempotent, non-destructive). Description adds significant value: authoritative data source (NRO Extended Delegation Stats files), 24-hour cache policy, and domain-specific context (exhaustion dates by RIR). No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with clear purpose statement. Well-structured with logical sections (summary, data source, why it matters, args, returns). Slightly verbose due to embedded JSON schema in Returns section, but every section earns its place for this complex domain tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Exceptionally complete for a complex multi-RIR statistics tool. Covers data source authority, historical exhaustion context, all filter parameters, pagination logic, and includes full output JSON schema. Returns section explicitly documents the response structure expected.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite 0% schema description coverage at root level (single 'params' object), the Args section comprehensively documents all 7 inner parameters including constraints (rir_filter requires include_blocks), valid enums (RIR names), and dependencies. Fully compensates for schema structure.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description opens with specific verb+resource: 'Fetch global IPv4, IPv6, and ASN allocation statistics from all 5 RIRs.' It clearly distinguishes from sibling 'rir_query_ip' and 'rir_query_asn' (specific resource lookups) by emphasizing global statistics, allocation counts, and exhaustion dashboard functionality.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides rich context in 'Why this matters' section explaining IPv4 exhaustion timeline and use cases (tracking adoption/exhaustion states). Caching behavior (24 hours) is disclosed. Lacks explicit sibling comparison (e.g., 'for specific IP details use rir_query_ip'), but the global/dashboard scope is clearly differentiated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rir_ixp_lookupARead-onlyIdempotent
Search PeeringDB for Internet Exchange Points (IXPs) by country code or name.
An IXP is a physical location where ISPs and networks directly interconnect. Without IXPs, all traffic between two ISPs would travel via paid transit providers, costing more and adding latency. IXPs are the backbone of regional internet ecosystems.
Searching by country:
Use 2-letter ISO country code: 'MU' (Mauritius), 'ZA' (South Africa), 'DE' (Germany), 'US' (United States), 'SG' (Singapore)
Searching by name:
Partial name match: 'AMS-IX', 'LINX', 'Nairobi', 'Frankfurt'
Notable IXPs worldwide:
DE-CIX Frankfurt (Germany) β Europe's busiest, 13+ Tbps
AMS-IX (Netherlands) β 10+ Tbps
LINX (UK) β London Internet Exchange
JPNAP (Japan) β Asia-Pacific hub
Nap.Africa / JINX β African exchanges
MAURITIUS-IX β your local exchange!
Results are cached for 12 hours.
Args: params (IXPLookupInput): - query (str): 2-letter country code (e.g. 'MU') or IXP name fragment - response_format (str): 'markdown' (default) or 'json'
Returns: str: Table of matching IXPs with city, country, member count, and contact. JSON schema: { "query": str, "total_found": int, "ixps": [{"name": str, "city": str, "country": str, "member_count": int, "website": str, "tech_email": str}], "errors": [str] }
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnly/idempotent/openWorld; description adds critical behavioral context: data source (PeeringDB), cache duration ('12 hours'), and domain explanation (what IXPs are and their role). No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with clear Args/Returns sections, but includes verbose 'Notable IXPs worldwide' list (7 bullets) with casual editorializing ('your local exchange!'). Educational paragraph on IXPs is useful context but combined with examples makes the description longer than necessary.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Comprehensive coverage: explains domain concepts (IXP ecosystem), documents parameters (compensating for schema coverage), specifies cache behavior, and provides complete JSON output schema with field definitions. With readOnly/destructive annotations present and output detailed, nothing material is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Context signals indicate 0% schema coverage (top-level param lacks description). Description compensates effectively via Args section documenting both nested parameters ('query' accepting country codes or name fragments, 'response_format' options) and noting the markdown default. Also provides JSON output schema adding return value semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description opens with specific verb ('Search'), resource ('PeeringDB for Internet Exchange Points'), and filter criteria ('by country code or name'). Clearly distinguishes from sibling RIR tools which focus on BGP, ASN relationships, or DNS rather than IXPs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit guidance on search syntax (2-letter ISO codes vs. partial name matches) with concrete examples ('MU', 'AMS-IX', 'Nairobi'). Lacks explicit 'when not to use' or sibling alternatives (e.g., doesn't contrast with rir_peering_info), but usage patterns are clearly implied through examples.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rir_looking_glassARead-onlyIdempotent
Show BGP routing table entries for a prefix as seen from RIPE RIS (Route Information Service) collectors around the world.
Unlike BGP visibility (which answers whether a route exists), a looking glass shows how the route is announced β the actual AS paths from different geographic vantage points.
Args: params (LookingGlassInput): - prefix (str): CIDR prefix e.g. '1.1.1.0/24' - vantage_points (int): Max entries to return (default 10, max 50) - response_format (str): 'markdown' (default) or 'json'
Returns: str: AS paths per RIPE RIS collector with region and BGP community values.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover safety profile (readOnly, non-destructive, idempotent). Description adds valuable behavioral context: geographic distribution of collectors, specific return data format (AS paths with region and BGP community values), and data source (RIPE RIS). No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with clear Args/Returns sections. Front-loads the critical sibling distinction before diving into parameters. Efficient use of space though docstring format is slightly more verbose than pure prose. No wasted content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Comprehensive coverage for a network diagnostic tool: explains data source (RIPE RIS), geographic scope (worldwide collectors), output format (markdown/json), and return value structure (AS paths with metadata). Adequate for tool complexity despite no output schema being provided in the description section.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 0% parameter description coverage (only titles/types). Description fully compensates by documenting all three parameters with clear semantics: prefix includes CIDR example, vantage_points explains 'max entries' semantics with default/max values, response_format lists allowed values. Exceptional compensation for sparse schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Excellent specificity: describes exact action (show BGP routing table entries/AS paths), specific resource (RIPE RIS collectors), and explicitly distinguishes from siblings ('Unlike BGP visibility...'). Clear value proposition.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear conceptual guidance contrasting with BGP visibility tools (existence vs. AS paths). Explains the 'how' vs 'whether' distinction effectively. Does not explicitly name the alternative sibling tool (rir_check_bgp_status) to use instead, but the conceptual differentiation is strong.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rir_network_healthARead-onlyIdempotent
Run a comprehensive parallel health check on any IP address, prefix, or ASN.
Fires all checks simultaneously (parallel asyncio): RDAP β Who owns it? Which RIR? Country? Abuse contact? BGP β Is it announced? Which ASNs? What global visibility %? RPKI β Is the announcing ASN cryptographically authorized? (prefix only) PeeringDB β Peering policy? NOC email? IXP count? (ASN only)
Synthesises a health signal dashboard: β All good β registered, announced, RPKI valid β οΈ Warning β not announced, unprotected route (no ROA), missing contacts π¨ Critical β RPKI invalid (possible hijack!), multiple origin ASNs (MOAS)
This is your first-response tool for:
"Is this IP address legitimate?"
"Is this ASN healthy and reachable?"
"Is there anything suspicious about this prefix?"
NOC incident triage, security team first-response
Results are cached for 5 minutes (includes live BGP data).
Args: params (NetworkHealthInput): - resource (str): IP ('1.1.1.1'), prefix ('1.1.1.0/24'), or ASN ('AS13335') - response_format (str): 'markdown' (default) or 'json'
Returns: str: Health signal dashboard + RDAP + BGP + RPKI + PeeringDB sections. JSON schema: { "resource": str, "resource_type": str, "queried_at": str, "rdap_holder": str, "rdap_rir": str, "rdap_country": str, "bgp_announced": bool, "bgp_announcing_asns": [str], "bgp_visibility_pct": float, "rpki_validity": str, "peering_policy": str, "peering_ixp_count": int, "health_signals": [str], "errors": [str] }
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Despite annotations declaring readOnly/idempotent, the description adds crucial behavioral context not present in structured fields: parallel asyncio execution model, 5-minute caching behavior with explicit stale data warning ('includes live BGP data'), and detailed synthesis logic explaining how emoji health signals (β /β οΈ/π¨) are derived from underlying check results.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with clear visual hierarchy (headers, bullet points, emoji) and front-loaded purpose. Every section earns its place: parallel execution details explain performance, health signal legend explains output semantics, and Args/Returns sections clarify interface. Minor deductions for length, though justified by tool complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Excellent completeness for a multi-modal tool. Includes output JSON schema in Returns section, explains the four parallel sub-operations (RDAP/BGP/RPKI/PeeringDB) and their specific outputs, documents caching duration, and provides use-case guidance. No gaps remain given the presence of output schema documentation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
While the input schema technically has nested descriptions (resulting in 0% top-level coverage per context signals), the description compensates with an explicit Args block documenting both the 'resource' parameter (with format examples: '1.1.1.1', 'AS13335') and 'response_format' (explaining markdown vs JSON semantics). It could slightly improve by noting constraints like maxLength.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb ('Run') and resource ('health check on any IP address, prefix, or ASN'). It clearly distinguishes from sibling tools (e.g., rir_check_bgp_status, rir_query_ip) by emphasizing it is a 'comprehensive parallel' check that combines RDAP, BGP, RPKI, and PeeringDB simultaneously, positioning it as the consolidated first-response option versus individual deep-dive tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit usage guidance under 'This is your first-response tool for:' with four concrete scenarios including 'Is this IP address legitimate?' and 'NOC incident triage'. This clearly signals when to use this consolidated tool versus more specific sibling tools, effectively serving as a routing guide for the agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rir_peering_infoARead-onlyIdempotent
Fetch peering policy, IXP presence, NOC contacts, and BGP neighbours for an ASN.
Data sources (queried in parallel):
PeeringDB (www.peeringdb.com) β the internet's peering registry
RIPE Stat asn-neighbours β live BGP upstream/downstream relationships
Information returned:
Peering policy: Open / Selective / Restrictive / No Peering
IRR AS-SET (used in route filters, e.g. AS-CLOUDFLARE)
NOC email, abuse email, peering contact email
IXP presence: which exchange points, peering IPs, link speed
BGP neighbours: up to 30 adjacent ASNs in the routing table
Use cases:
"Does Cloudflare have an Open peering policy?"
"Which IXPs is AS13335 present at?"
"What is the NOC email for AS1234 to report an incident?"
"Is this ASN a residential ISP or a CDN?"
Results are cached for 6 hours.
Args: params (PeeringInfoInput): - asn (str): ASN to look up (e.g. 'AS13335', '13335', 'AS-CLOUDFLARE') - response_format (str): 'markdown' (default) or 'json'
Returns: str: Peering policy table, IXP presence table, contacts, BGP neighbours. JSON schema: { "asn": str, "network_name": str, "policy_general": str, "noc_email": str, "irr_as_set": str, "ixp_presence": [{"name": str, "city": str, "country": str, "ipaddr4": str, "ipaddr6": str, "speed": int}], "neighbour_asns": [str], "errors": [str] }
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the safety annotations (readOnly/idempotent), the description adds critical behavioral context: the 6-hour cache duration, parallel querying of PeeringDB and RIPE Stat, and the 'up to 30 adjacent ASNs' result limit. It does not mention authentication requirements or rate limits, preventing a perfect score.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is densely packed but well-structured with clear sections (Data sources, Information returned, Use cases, Args, Returns). Every sentence earns its place by providing specific technical details. It is slightly verbose but appropriately so for the complexity of the data returned.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (multiple data sources, nested output objects), the description is complete. It documents the return value's JSON schema explicitly, explains all output fields in the 'Information returned' section, and notes caching behavior. The output schema presence means return values don't need exhaustive prose explanation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage at the top level (the 'params' object lacks a description), the Args section fully compensates by documenting both parameters with clear types, examples ('AS13335', '13335'), and allowed values ('markdown' or 'json'). This effectively bridges the schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a precise verb ('Fetch') and enumerates specific resources (peering policy, IXP presence, NOC contacts, BGP neighbours) scoped to an ASN. It clearly differentiates from siblings like `rir_query_asn` or `rir_as_relationships` by specifying the exact PeeringDB and RIPE Stat data sources used.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'Use cases' section provides four concrete scenarios (e.g., 'Does Cloudflare have an Open peering policy?') that clearly establish when to invoke this tool. However, it lacks explicit guidance on when NOT to use it or which sibling tools (like `rir_query_asn`) should be preferred for simpler lookups.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rir_prefix_historyARead-onlyIdempotent
Fetch the complete registration history for an IP prefix or ASN.
Returns a chronological timeline of every change ever recorded:
Initial registration (who, when, under which RIR)
Org / maintainer changes (potential ownership transfers)
Status changes (allocated β assigned β available)
Last-changed updates
Uses RIPE Stat's historical-whois and allocation-history APIs. Coverage is best for RIPE NCC resources; partial for other RIRs.
Use cases:
"Has this IP block ever changed hands?"
"When was this ASN first registered?"
"What organization historically owned this prefix?"
Due diligence, incident response, fraud investigation
Results are cached for 12 hours (historical records are stable).
Args: params (PrefixHistoryInput): - resource (str): IP prefix (e.g. '8.8.8.0/24') or ASN (e.g. 'AS15169') - response_format (str): 'markdown' (default) or 'json'
Returns: str: Chronological event timeline with dates, event types, and attribute changes. JSON schema: { "resource": str, "resource_type": str, "current_holder": str, "current_rir": str, "registration_date": str, "total_events": int, "events": [{"event_date": str, "event_type": str, "attribute": str, "old_value": str, "new_value": str}], "sources": [str], "errors": [str] }
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds critical behavioral context beyond annotations: explicitly notes RIPE NCC has best coverage while other RIRs are partial (data quality limitation), identifies the specific upstream APIs used (RIPE Stat's historical-whois and allocation-history), and discloses the 12-hour caching behavior. Annotations only cover safety/readonly aspects, while description explains data provenance and limitations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with clear visual hierarchy: purpose statement, bullet list of returned event types, implementation details, coverage caveats, use cases, and Args/Returns sections. Front-loaded with the core action. The JSON schema in Returns is verbose but necessary as no separate output schema is provided in the structured fields.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Exceptionally complete for a complex data retrieval tool: covers API sources, RIR coverage limitations, caching policy, specific use cases, input parameter details, and provides a full output schema structure. Given the existence of output schema documentation in the description and the tool's complexity (RDAP/RIR history), no critical gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The Args section explicitly documents the nested params (resource, response_format) with clear type annotations and value examples ('8.8.8.0/24', 'AS15169'), effectively compensating for the schema's structure where top-level coverage may appear limited. While the schema has some descriptions, the description provides a consolidated, readable view of the required resource parameter and optional format toggle.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a precise action statement: 'Fetch the complete registration history for an IP prefix or ASN.' It specifies the exact resource (registration history), the data scope (complete, chronological timeline), and distinguishes itself from current-state siblings like rir_prefix_overview through its focus on historical changes (ever recorded, initial registration, changes).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides specific use cases ('Has this IP block ever changed hands?', 'Due diligence, incident response, fraud investigation') that clearly signal when to use this tool versus current-state alternatives. Lacks explicit 'do not use for X, use Y instead' sibling comparisons, but the historical focus is distinct enough to guide selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rir_prefix_overviewARead-onlyIdempotent
Fetch a rich hierarchical overview of an IP prefix.
IP address space is organized in a tree structure:
A /8 contains 256 /16s, each /16 contains 256 /24s, and so on.
'Less-specific' = the parent block this prefix was carved from.
'More-specific' = smaller blocks assigned within this prefix.
Think of it like a real estate map: Less-specific = the city block (containing your property) The prefix itself = your land parcel More-specific = subdivisions within your parcel
This tool fetches all three layers in parallel (3 RIPE Stat API calls simultaneously) and returns a unified view including:
Current holder and announcement status
Which ASN(s) are announcing it (multiple = potential hijack)
All less-specific (parent) prefixes up the tree
All more-specific (child) prefixes within the block
Combine with rir_check_rpki to validate the announcing ASN. Results are cached for 1 hour.
Args: params (PrefixOverviewInput): - prefix (str): IP prefix in CIDR notation (e.g. '1.1.1.0/24') - response_format (str): 'markdown' (default) or 'json'
Returns: str: Holder info, BGP status, and full prefix hierarchy table. JSON schema: { "prefix": str, "holder": str, "rir": str, "country": str, "announced": bool, "announcing_asns": [str], "allocation_status": str, "related_prefixes": [{"prefix": str, "relationship": str, "holder": str, "origin_asn": str}], "errors": [str] }
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare read-only/idempotent status, but description adds critical behavioral context: makes '3 RIPE Stat API calls simultaneously,' has '1 hour' cache duration, and explains the tree traversal logic (parent/child relationships) that annotations don't cover.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with clear 'Args:' and 'Returns:' sections. The real estate analogy, while adding length, efficiently conveys complex IP hierarchy concepts. Every sentence earns its place by explaining scope (3 layers), behavior (parallel calls), or output format.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Comprehensive for a complex tool: explains hierarchical concepts, documents the JSON return schema inline, specifies caching behavior, and identifies integration points with sibling tools. Complete given the rich output schema and multi-API-call implementation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With schema description coverage at 0% (top-level 'params' lacks description), the description compensates by documenting both nested parameters under 'Args:' with examples ('1.1.1.0/24') and valid values ('markdown' or 'json'), effectively clarifying the wrapped schema structure.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description explicitly states it 'fetches a rich hierarchical overview' distinguishing it from simple lookups. The real estate analogy and explicit mention of 'less-specific' vs 'more-specific' clearly differentiate this from siblings like rir_query_ip or rir_check_bgp_status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly recommends combining with 'rir_check_rpki to validate the announcing ASN,' providing clear sibling tool coordination. Mentions 1-hour caching implying refresh behavior. Could be improved by contrasting with rir_query_ip for non-hierarchical lookups.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rir_query_asnARead-onlyIdempotent
Query all 5 global RIRs simultaneously for an Autonomous System Number.
An ASN is a unique number assigned to a network operator (ISP, CDN, large enterprise) that participates in BGP routing. Examples: AS15169 = Google, AS13335 = Cloudflare, AS36864 = AFRINIC itself.
Accepts: 'AS15169', '15169', or named sets like 'AS-GOOGLE'. Results are cached for 1 hour.
Args: params (ASNQueryInput): - asn (str): ASN in any format (e.g. 'AS15169', '13335', 'AS-CLOUDFLARE') - response_format (str): 'markdown' (default) or 'json'
Returns: str: ASN registration details including owner, country, allocation date, abuse email, and responses from all 5 RIRs. JSON schema: { "asn": str, "results": [{"rir": str, "status": str}], "normalized": [{"rir": str, "asn": str, "name": str, "org_name": str, "country": str, "abuse_email": str}] }
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate read-only/idempotent/safe operation, while the description adds valuable behavioral context beyond these: it discloses the 1-hour caching policy, explains the simultaneous querying of all 5 RIRs (vs single source), and provides a complete JSON output schema showing the exact structure of normalized results and per-RIR responses.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured and front-loaded: one-line summary followed by domain context, input format examples, caching note, Args block, and Returns block. The inclusion of the JSON output schema is justified for an agent needing to parse structured responses. Minor verbosity in the ASN explanation is acceptable for clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (multi-source aggregation across 5 RIRs) and rich output schema, the description is comprehensive. It covers function, input semantics, output structure with schema, caching behavior, and provides concrete examples. The presence of output schema documentation in the description satisfies completeness despite the lack of a formal outputSchema field.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage at the top level (the 'params' property lacks a description field), the description compensates effectively via the Args section documenting both nested parameters (asn and response_format), including valid format examples and enum values ('markdown' or 'json'). It clarifies the nested ASNQueryInput structure that the schema references via $ref.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with the specific action 'Query all 5 global RIRs simultaneously for an Autonomous System Number' - clear verb, resource, and scope. It distinguishes from sibling rir_query_ip by explicitly focusing on ASN (Autonomous System Number) rather than IP addresses, and explains what an ASN is with concrete examples (AS15169 = Google).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides implicit guidance through examples of accepted input formats ('AS15169', '15169', or named sets like 'AS-GOOGLE'), but lacks explicit when-to-use guidance compared to siblings. It does not clarify when to use this versus rir_query_ip or rir_as_relationships, nor does it mention prerequisites or rate limits.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rir_query_ipARead-onlyIdempotent
Query all 5 global RIRs simultaneously for an IP address using RDAP.
Fires parallel RDAP requests to AFRINIC, APNIC, ARIN, LACNIC, and RIPE NCC. Exactly one RIR will be authoritative; the others return 'not found'. Normalizes all responses into a unified schema and returns a clear summary.
Results are cached for 1 hour to respect RIR rate limits.
Args: params (IPQueryInput): - ip_address (str): IPv4 or IPv6 address e.g. '1.1.1.1', '2001:4860:4860::8888' - response_format (str): 'markdown' (default) or 'json'
Returns: str: Registration details including prefix, owner, country, allocation date, abuse email, and responses from all 5 RIRs. JSON schema: { "ip": str, "results": [{"rir": str, "status": str, "error": str|null}], "normalized": [{"rir": str, "prefix": str, "name": str, "org_name": str, "country": str, "allocation_date": str, "abuse_email": str}] }
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Excellent disclosure beyond the annotations: it reveals the parallel request pattern to all 5 RIRs (AFRINIC, APNIC, ARIN, LACNIC, RIPE NCC), the normalization of responses into a unified schema, and the 1-hour caching behavior for rate limit compliance. This provides crucial context for a distributed query operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with clear sections pivoted from general description to Args to Returns. The information is front-loaded with the core purpose in the first sentence. The JSON schema block in Returns is verbose but appropriately detailed for a complex return structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Comprehensive coverage appropriate for a multi-API tool: includes input/output schemas, behavioral details (parallelism, normalization), performance constraints (caching, rate limits), and the complete JSON response structure. Nothing critical is missing given the output schema is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The Args section documents parameters with examples (e.g., '1.1.1.1' and '2001:4860:4860::8888'), but largely duplicates the well-described input schema. It does add explicit mention of the default value ('markdown') for response_format, which complements the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool 'Query[s] all 5 global RIRs simultaneously for an IP address using RDAP,' which is a specific verb-resource combination that distinguishes it from siblings like rir_query_asn or rir_get_abuse_contact.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explains that exactly one RIR will be authoritative while others return 'not found,' setting correct expectations for the parallel query pattern. It also documents the 1-hour cache to respect rate limits, providing operational context. It could explicitly mention when to use single-RIR alternatives, but the scope is clearly defined.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rir_route_stabilityARead-onlyIdempotent
Analyse BGP route stability for a prefix over a configurable time window using RIPE Stat routing-history data.
A stable route has no state changes (no withdrawal/re-announcement cycles). Repeated flapping can indicate hardware failure, misconfiguration, or DDoS and causes router CPU load and convergence delays for peers.
Args: params (RouteStabilityInput): - prefix (str): CIDR prefix e.g. '1.1.1.0/24' - hours (int): Analysis window in hours (default 24, max 168 = 7 days) - response_format (str): 'markdown' (default) or 'json'
Returns: str: Stability score (0β100), state change count, uptime %, and event timeline.
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (readOnlyHint=true, idempotentHint=true), the description adds valuable domain context: defining what a stable route means (no withdrawal/re-announcement cycles), explaining causes of flapping (hardware, misconfiguration, DDoS), and outlining consequences (CPU load, convergence delays). It mentions the RIPE Stat data source. It could be improved by noting any rate limits or caching behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The structure is efficient and well-organized: one sentence for purpose, two sentences for domain context (stability definition and flapping implications), then structured Args/Returns sections. Every sentence earns its placeβno tautological filler. The Returns section concisely maps the output schema to user-meaningful metrics (stability score, uptime %, timeline).
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema and the tool's moderate complexity (single prefix analysis), the description is complete. It covers the operational domain (BGP routing), input requirements (CIDR format, time windows), and output interpretation (score 0-100, event timeline). No gaps remain that would impede correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage for the nested parameters (prefix, hours, response_format have no schema descriptions), the description fully compensates. It provides critical semantics: example format ('1.1.1.0/24'), constraint explanations ('default 24, max 168 = 7 days'), and valid option values ('markdown' or 'json'), effectively documenting all three parameters that the schema leaves undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb ('Analyse') and clear resource ('BGP route stability for a prefix'), including the data source ('RIPE Stat routing-history data'). It distinguishes from siblings like 'rir_check_bgp_status' or 'rir_prefix_history' by specifically focusing on stability/flapping analysis over time windows, and defines what constitutes a stable route versus flapping behavior.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Clear context is provided for when to use the tool: investigating route flapping that 'can indicate hardware failure, misconfiguration, or DDoS.' It explains the operational impact (router CPU load, convergence delays). However, it lacks explicit guidance on when to prefer this over siblings like 'rir_prefix_history' or 'rir_check_bgp_status', though the focus on stability metrics implicitly suggests the use case.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rir_server_statusARead-only
Check the real-time health of all 5 RIR RDAP servers simultaneously.
Queries the /help endpoint of each RIR (lightweight, no IP/ASN needed). Returns RDAP conformance levels and availability status.
Use this before bulk queries to verify connectivity, or to diagnose why a specific RIR's responses are failing.
Returns: str: Markdown table with RIR name, region, status (Online/Unreachable), and supported RDAP conformance extensions.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true and destructiveHint=false (safety profile), while the description adds valuable implementation context: it specifies the '/help' endpoint is queried, clarifies the operation is 'lightweight', and details the exact return format (Markdown table with specific columns: RIR name, region, status, conformance extensions).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Every sentence earns its place: the opening defines the action, the second explains the technical mechanism (/help endpoint, lightweight nature), the third provides usage guidance, and the fourth documents return values. No redundancy with structured metadata.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter health check tool, the description is complete. It covers the operational mechanism, usage context, failure scenarios (diagnosing RIR failures), and return value structure (Markdown table format), compensating for the lack of a formal output schema in the structured data.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With zero parameters, the baseline score is 4 per scoring rules. The description reinforces this by explicitly stating 'no IP/ASN needed', which explains why the schema is empty and distinguishes it from parameter-heavy siblings like rir_query_asn or rir_audit_org.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific action ('Check') targeting a specific resource ('5 RIR RDAP servers') with clear scope ('real-time health', 'simultaneously'). It distinguishes from siblings like rir_query_ip or rir_query_asn by emphasizing it requires 'no IP/ASN needed' and queries '/help' endpoints rather than specific resources.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use: 'before bulk queries to verify connectivity' and 'to diagnose why a specific RIR's responses are failing.' This provides clear temporal guidance (pre-flight check) and diagnostic context that separates it from data-retrieval siblings in the rir_* namespace.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
Most tools have distinct purposes, with clear separation between categories like DNS, RIR queries, and internet health monitoring. However, some overlap exists within categories, such as multiple DNS tools that could be confused (e.g., dns_resolve vs dns_enumerate vs dns_propagation), and RIR tools like query_ip and query_asn that might be ambiguous without careful reading of descriptions.
All tool names follow a consistent snake_case pattern with a clear prefix structure: 'peerglass_' for internet health tools and 'rir_' for RIR-related tools. This predictable naming convention makes it easy to understand the tool's domain and purpose at a glance, with no deviations or mixed styles.
With 42 tools, the count is excessive for a single server, making it overwhelming and difficult for an agent to navigate efficiently. While the domain (internet infrastructure and health monitoring) is broad, the tool set feels bloated and could benefit from consolidation or splitting into multiple focused servers to improve usability.
The tool set provides comprehensive coverage for internet infrastructure analysis, including DNS, BGP, RIR data, threat intelligence, and censorship detection. It supports full CRUD-like operations where applicable (e.g., monitoring registration and detection) and leaves no obvious gaps, enabling agents to perform end-to-end analyses without dead ends.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
IP geolocation, ASN and network data, plus VPN, proxy and Tor detection. ASN tools need no key.
Free no-key IP intelligence: geolocation, VPN detection, DNS, WHOIS, blacklists, breach checks
Domain intelligence for DNS, WHOIS/RDAP, TLS, reputation, valuation, and brand protection.
WHOIS/RDAP lookup, IP geolocation and Punycode conversion. 1400+ TLDs incl. IDN. No API key.
Related MCP Servers
- AlicenseAqualityCmaintenanceEnables network information lookup through WHOIS and RIPE Database queries. Supports domain/IP/ASN lookups, AS-SET expansion, route validation, and contact information retrieval across multiple Regional Internet Registries.144MIT
- FlicenseNot gradedqualityDmaintenanceEnables natural language queries for network intelligence, IP geolocation, organization details, and DNS information via the NetworksDB API.15
- AlicenseAqualityCmaintenanceProvides GeoIP and ASN intelligence lookup for IP addresses, enabling AI agents to retrieve location and network information via the IPRout API.2MIT
- AlicenseNot gradedqualityCmaintenanceEnables querying Cloudflare Radar data for internet traffic, attacks, BGP, and quality insights via natural language or direct tool calls.9MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/duksh/peerglass'
If you have feedback or need assistance with the MCP directory API, please join our Discord server