Skip to main content
Glama
duksh

PeerGlass

by duksh

rir_change_monitor

Read-only

Monitor IP prefixes or ASNs for registration and BGP routing changes between calls. Detects RDAP holder shifts, BGP origin changes, and routing announcements to identify potential hijacks or transfers.

Instructions

Monitor a prefix or ASN for registration and BGP routing changes between calls.

How it works:

  • First call: captures a baseline snapshot of RDAP + BGP state. Stores it in memory for the server's lifetime.

  • Subsequent calls: fetches the current state and diffs it against the baseline. Reports exactly which fields changed and from what to what.

  • When changes are detected: automatically updates the baseline so the next call diffs from the new state (not the original).

  • reset_baseline=True: discards any stored baseline and captures fresh.

Tracked fields (8 total): RDAP: Holder, RIR, Country, Allocation Status, Abuse Email BGP: Announced (bool), Origin ASN(s), Visibility %

Severity of changes: 🔴 BGP Origin ASN changed → possible hijack, verify with rir_check_rpki 🔴 RDAP Holder changed → possible transfer, check rir_detect_transfers 🟡 BGP Announced changed → prefix appeared/disappeared from routing 🟡 Country changed → registration country updated 🟢 Visibility % changed → normal BGP fluctuation

Baseline persists in server memory — not in a database. If the server restarts, baselines are lost and will be recreated on next call.

Args: params (ChangeMonitorInput): - resource (str): IP prefix (e.g. '8.8.8.0/24') or ASN (e.g. 'AS15169') - reset_baseline (bool): If True, discard baseline and start fresh

Returns: str: Baseline created confirmation (first call), or diff table (subsequent calls). JSON schema: { "resource": str, "status": str, (baseline_created|changes_detected|no_changes) "baseline_captured_at": str, "checked_at": str, "changes": [{"field": str, "old_value": str, "new_value": str}], "current_holder": str, "current_rir": str, "message": str }

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
paramsYes

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
resultYes
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare idempotentHint=false and readOnlyHint=true; the description explains exactly why—baseline capture creates server-side state that changes between invocations. It adds critical behavioral context: baseline persistence in memory (not database), automatic baseline updates on change detection, and loss of state on server restart. No contradictions with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Appropriately structured with clear sections (How it works, Tracked fields, Severity, Args, Returns). The length is justified by the tool's complexity (8 tracked fields, 4 severity levels, stateful behavior). The embedded JSON return schema is valuable for parsing. Minor redundancy exists between the Args section and the schema descriptions.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the high complexity (stateful diffing across RDAP and BGP data) and presence of output schema, the description is remarkably complete. It documents all 8 tracked fields, explains the severity taxonomy, provides the output JSON schema, and warns about session-scoped baseline persistence.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

While the input schema has high description coverage (despite the context signal indicating 0%), the description adds crucial temporal semantics in the 'How it works' section—explaining that the same resource parameter triggers baseline capture on first call and diffing on subsequent calls. This stateful behavior is not apparent from the schema alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence 'Monitor a prefix or ASN for registration and BGP routing changes between calls' provides a specific verb and resource. It distinguishes itself from siblings by explicitly naming rir_check_rpki and rir_detect_transfers as follow-up tools for specific severity findings, clarifying its role as a monitoring/diffing tool rather than a deep inspection tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly documents the stateful 'first call vs subsequent calls' behavior and when to use reset_baseline ('after reviewing detected changes'). The severity section provides clear action guidance (e.g., 'verify with rir_check_rpki' for origin ASN changes), functioning as explicit when-to-use-alternatives guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/duksh/peerglass'

If you have feedback or need assistance with the MCP directory API, please join our Discord server