Skip to main content
Glama
extralabs

octowatch-mcp

Official
by extralabs

OctoWatch DLP MCP Server

PyPI package: octowatch-mcp · product: octowatchdlp.com (not related to other products named “OctoWatch”).

PyPI Python CI MCP License: MIT

Install in Cursor Install in VS Code Install in VS Code Insiders

Read-only Model Context Protocol (MCP) server for OctoWatch DLP Cloud employee monitoring and data-loss prevention — ask Cursor, Claude, or VS Code about risks, idle time, productivity, and monitoring in plain language.

Python MCP SDK v2 (MCPServer). Built for SecOps and managers — open-source companion to the OctoWatch console.

Contents: Status · Where to find us · Prerequisites · Example questions · Security · Limitations · Quick start · Your account · Tools · Configuration · Documentation · Contributing

Status

Alpha (v0.5.1). APIs and tool shapes may change; pin a PyPI version in production configs.

Tool failures return MCP is_error (ToolError). All tools advertise read_only_hint.

Related MCP server: Purple AI MCP Server

Where to find us

The MCP runs locally (no ExtrLabs-hosted MCP). Catalogs point at PyPI / GitHub; you supply Cloud login via env.

Channel

Link

PyPI

octowatch-mcp

Official MCP Registry

io.github.extralabs/octowatch-mcp

GitHub

extralabs/octowatch-mcp-server

Cursor Marketplace

Plugin manifest .cursor-pluginpublish form (manual review)

Directories

Glama · mcpservers.org · mcpfind.org · mcpmarket.com · PulseMCP · awesome-mcp-servers#13003 (mcp.so skipped — paid)

cursor.directory

Open Plugins: root .mcp.json + .cursor-plugin/plugin.json — re-submit after these are on main

Directory / Marketplace maintainer notes: docs/distribution.md.

Prerequisites

  • Python 3.10+

  • An MCP-capable host (Cursor, Claude Desktop, VS Code, …)

  • Network access to your Cloud API host (default https://cloud.octowatchdlp.com)

Example questions

  • “Which Risks in the last day?”

  • “Who was idle the longest yesterday?”

  • “Productivity summary for Accounting”

  • “Show Monitoring keystrokes for Emily”

  • “Find keyword invoice across monitoring last week”

  • “List users and groups”

Short scenarios

Goal

Ask something like…

DLP / policy hits

“Summarize risks for today by user and rule”

Idle time (not formal alerts)

“Who was idle more than 2 hours yesterday?”

Top apps/sites

“Top applications for group Accounting last 7 days”

Keyword hunt

“Search monitoring for confidential last 30 days”

Directory

“List users and groups, then show info for AliasID 4”

Security & privacy

Defaults use the public demo account.
Do not put production passwords in MCP config or git. Use env vars and a least-privilege console operator.
No writes, no screenshot/video binary downloads.

Monitoring responses can contain sensitive employee data (activity, keystrokes snippets, mail metadata). Treat tool output as confidential. Full policy: SECURITY.md.

Limitations

  • Read-only — not a full console replacement (Web Console)

  • No screenshot/video binary downloads (stream metadata only)

  • Not a mirror of product docs or the REST catalog — those stay at docs and /api/

  • Alpha — expect breaking changes between minors until 1.0

Quick start (PyPI)

Use the Install badges at the top of this README (Cursor / VS Code; demo credentials). First ensure the CLI is available:

pip install octowatch-mcp

Or configure manually — example for Cursor / Claude-style mcpServers (demo credentials):

{
  "mcpServers": {
    "octowatch": {
      "command": "octowatch-mcp",
      "env": {
        "OCTOWATCH_API_BASE": "https://cloud.octowatchdlp.com",
        "OCTOWATCH_EMAIL": "demo@octowatchdlp.com",
        "OCTOWATCH_PASSWORD": "demo"
      }
    }
  }
}

Ready-made files: examples/cursor-mcp-pypi.json, examples/claude-desktop-pypi.json. Per-host steps: docs/hosts.md.

Restart the host, then try: “Using OctoWatch, who am I logged in as?” or “List risks for the last week.”

Demo credentials work without a .env. Be gentle with the shared demo tenant (avoid aggressive agent loops).

From source

git clone https://github.com/extralabs/octowatch-mcp-server.git
cd octowatch-mcp-server
python -m venv .venv
# Windows: .venv\Scripts\activate
# macOS/Linux: source .venv/bin/activate
pip install -e .
cp .env.example .env   # optional
python -m octowatch_mcp

Use examples/cursor-mcp.json / examples/claude-desktop.json and set cwd to your clone (Windows: D:\\path\\to\\octowatch-mcp-server).

ChatGPT and other hosts

There is no single public ChatGPT JSON config we ship yet — ChatGPT / similar products often use remote MCP connectors rather than a local command stdio process.

  • For local desktop agents, prefer Cursor, Claude Desktop, or VS Code with the examples above.

  • If your host supports custom MCP over HTTP, you can run octowatch-mcp --transport streamable-http (localhost only by default) and register that endpoint per the host’s docs — see docs/hosts.md.

Your account (email / password)

OctoWatch Cloud still needs a console login. The MCP does not store passwords for you — the host passes them as process env.

Mode

What to set

Demo (try-out)

Defaults / Install badges: demo@octowatchdlp.com / demo

Your tenant

Your least-privilege operator email + password in MCP env (or Cursor plugin Configure)

Variable

Meaning

OCTOWATCH_EMAIL

Console operator email

OCTOWATCH_PASSWORD

Console password (isSecret in Registry metadata)

OCTOWATCH_API_BASE

Cloud API host if not the default public cloud

Recommended: put them in the MCP host JSON env block — examples/cursor-mcp-pypi-with-env.json / examples/claude-desktop-pypi-with-env.json. Cursor plugin variables: .cursor-plugin/plugin.json.

Alternatively, for a source install, copy .env.example.env next to the process working directory.

Never commit real passwords. Verify the same data in the Web Console. Walkthrough: docs/hosts.md.

Core tools

Tool

Cloud area

Notes

octowatch_whoami

Auth session

Account / host (no password)

list_users_groups

Directory tree

Type 0 root, 1 group, 2 user

list_risks

Risks + Analytics

Default mode=summary

list_anomalies

Alerts

Formal deviations (not idle)

get_idle_summary

Productivity

Rank by InactiveTime

get_activity_summary

Activity

Top apps/sites

get_timesheet

TimeSheet

Worked vs expected hours

get_productivity_summary

Productivity + analytics

Per-user rollup

list_reports

Reports

Scheduled + processing tasks

Console coverage tools

Tool

Cloud area

Notes

get_analytics

Analytics

view=overall|disciplina|activity|productivity

get_dashboard

Dashboard

Widgets; blobs stripped

get_chrono

Chrono

Timeline

get_day_structure

Day structure

list or detail

list_monitoring

Monitoring

One kind; compact by default

search_monitoring

Tools → Search

filter_key across kinds

get_activity_detail

Activity window

Drill-down

list_online

Live

Presence only

list_stream_meta

Stream

Metadata only

list_directory

Edit Get*

users/groups/computers/…

get_user_info

User card

AliasID / computer

get_account_readonly

Account Get*

No Set*/PIN

list_api_coverage

(static)

Gap summary

Full arguments, routing, and scenarios: docs/TOOLS.md.
MCP prompts/resources: docs/MCP.md.

Configuration

Env

Default

Meaning

OCTOWATCH_API_BASE

https://cloud.octowatchdlp.com

API host (serverBase)

OCTOWATCH_EMAIL

demo@octowatchdlp.com

Console operator

OCTOWATCH_PASSWORD

demo

Demo only by default

OCTOWATCH_DEFAULT_DAYS

1

Lookback when tools omit dates/period

OCTOWATCH_TOOLSETS

all

all | core | console (console includes core)

octowatch-mcp                                      # stdio (default)
octowatch-mcp --transport streamable-http          # http://127.0.0.1:8000/mcp

Periods & filters

Prefer period=today|yesterday|last_7_days|last_30_days, or date_from / date_to.

  • Date-only values cover the full calendar day (date_to23:59:59).

  • Optional user_id (AliasID) and group_id on most read tools.

  • POST body TreeviewUsers: all → NodeType=-666666; group → NodeType=14; user → NodeType=1.

Documentation

Doc

Contents

docs/README.md

Doc index

docs/hosts.md

Install per host + your login

docs/TOOLS.md

Tool reference + when-which

docs/MCP.md

Protocol, resources, prompts

docs/API.md

MCP coverage audit (not a full REST mirror)

docs/troubleshooting.md

Common failures

docs/registry.md

Official MCP Registry (server.json)

docs/distribution.md

Directories, Marketplace, deferred hosted channels

Product & console

Roadmap

Planned (not scheduled): tighter payload budgets, client-side rate limits, argument completions, server icon, optional MCP Apps UI, tool-routing evals. Registry metadata: docs/registry.md. Protocol surface: docs/MCP.md.

Contributing

See CONTRIBUTING.md. Changelog: CHANGELOG.md. Issues: GitHub Issues.

License

MIT — see LICENSE.

Available Tools

22 tools
get_account_readonlyAccount read-onlyB
Read-only

Read-only account/profile/license Gets (SPA header contracts).

profiles: GetProfiles2 — ProfilesType 0|1|2; optional user_id + alias_type (1=user, 14=group); defaults AliasID/AliasType=-1. timetable/rules/profile_settings/computer_settings: require profile_id. computer_profiles: optional computer_guid (Guid header).

ParametersJSON Schema
NameRequiredDescriptionDefault
sourceNoAccount/profile/license Get source (no Set*/PIN).account_settings
compactNo
user_idNoUser filter: AliasID as TreeviewUsers NodeType=1.
alias_typeNo
profile_idNo
computer_guidNo
profiles_typeNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint=true annotation already establishes safety, and the description reinforces this with 'Read-only' and 'no Set*/PIN'. It adds contract details like AliasID/AliasType defaults and profile_id requirements, but it does not describe auth context, output behavior, or rate limits; acceptable but not deeply transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loads the core read-only purpose, then uses scannable source-to-parameter rules. The 'SPA header contracts' phrase is terse, but there is no filler and each line earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is usable for the core sources and an output schema covers return shape, but with 17 possible sources and 7 parameters, several source behaviors are not clarified and compact has no stated semantics. An agent would still need to guess for the less common sources.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With only 29% schema description coverage, the description adds meaningful semantics for profiles_type (0|1|2), alias_type (1=user, 14=group), and the profile_id/computer_guid conditional requirements. However, compact and many enum sources such as license, categories, reports, or processing_tasks remain unexplained, so it only partially compensates for the low coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly labels the tool as providing read-only account/profile/license Gets and enumerates concrete source variants such as profiles, timetable, and computer_profiles. This goes beyond the title and avoids tautology, though it remains a broad aggregate getter rather than a single crisp verb+resource statement.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives useful source-dependent parameter rules, e.g., profiles takes optional user_id/alias_type, timetable/rules/profile_settings/computer_settings require profile_id, and computer_profiles accepts computer_guid. However, it never mentions alternatives among the sibling tools, so the agent must infer when to choose this tool over get_user_info or list_users_groups.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_activity_detailActivity detailB
Read-only

Activity drill-down: ActivityWindow (needs activity_name) or CategoryWindow (needs category_guid).

ParametersJSON Schema
NameRequiredDescriptionDefault
modeNoactivity_window needs activity_name; category_window needs category_guid.activity_window
periodNoRelative period: today|yesterday|last_7_days|last_30_days (wins over date_from/date_to when set).
compactNo
date_toNoEnd datetime; date-only covers until 23:59:59 that day.
user_idNoUser filter: AliasID as TreeviewUsers NodeType=1.
group_idNoGroup filter: TreeviewUsers NodeType=14 (console group id).
date_fromNoStart datetime YYYY-MM-DD or YYYY-MM-DD HH:MM:SS (full day if date-only).
is_websiteNo
activity_nameNo
category_guidNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=true, so the safety profile is externally covered. The description adds only the mode/parameter dependency; it does not disclose output shape, pagination, or precedence behavior, though much of that lives in the schema and output schema. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The single sentence is tightly worded and front-loads the core modes. It is very concise, but for a 10-parameter tool it achieves conciseness by omitting practical guidance, so it is not fully appropriately sized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Because output schema and annotations exist, the primary missing context is when to invoke this tool versus siblings and how mode, period, and filters combine. The description and schema together are adequate for a simple drill-down call, but the agent must infer usage context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 60%, and the description restates the mode-to-parameter mapping already present in the mode property. It adds value for activity_name and category_guid by marking them as the deciding inputs, but compact and is_website remain unspecified; their names/defaults carry them partially.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly labels the tool as an activity drill-down with two modes, ActivityWindow and CategoryWindow, and identifies the required parameter for each. It does not explicitly differentiate itself from get_activity_summary or other siblings, but the term 'drill-down' plus mode names convey a detail-oriented purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides mode-selection guidance: activity_window needs activity_name; category_window needs category_guid. It does not state when to prefer this tool over siblings like get_activity_summary or search_monitoring, so exclusion/alternative guidance is absent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_activity_summaryActivity summaryB
Read-only

Top apps and sites by ActiveTime (POST /api/Activity/Overall2).

ParametersJSON Schema
NameRequiredDescriptionDefault
rawNo
top_nNoHow many top apps/sites to keep.
periodNoRelative period: today|yesterday|last_7_days|last_30_days (wins over date_from/date_to when set).
date_toNoEnd datetime; date-only covers until 23:59:59 that day.
user_idNoUser filter: AliasID as TreeviewUsers NodeType=1.
group_idNoGroup filter: TreeviewUsers NodeType=14 (console group id).
date_fromNoStart datetime YYYY-MM-DD or YYYY-MM-DD HH:MM:SS (full day if date-only).

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnlyHint=true and openWorldHint=true, covering the safety profile. The description adds the endpoint and the ActiveTime-based aggregation but does not disclose additional behavioral traits such as date-window handling or response structure; this is acceptable but not additive given the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, scannable sentence that front-loads the core purpose and includes the endpoint for reference. It is concise, though it is a fragment rather than a complete instruction.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema and thorough parameter schema, the description is sufficient for basic invocation. However, it does not differentiate this tool from closely related siblings or clarify when the summary view is appropriate, leaving some contextual ambiguity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 86%, which is above the 80% threshold, so the baseline of 3 applies. The description adds no parameter-specific meaning beyond what the schema already documents.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the resource as a summary of top apps and sites ranked by ActiveTime, which distinguishes it from detail-oriented siblings like get_activity_detail. It lacks an explicit verb such as 'returns' or 'lists', but the meaning is still unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No usage guidance is provided. The description does not mention when to prefer this tool over similar siblings like get_activity_detail, get_productivity_summary, or get_idle_summary, nor does it state any exclusions or context-specific scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_analyticsGet analyticsB
Read-only

Analytics rollups: view=overall|disciplina|activity|productivity.

ParametersJSON Schema
NameRequiredDescriptionDefault
viewNoAnalytics view: overall|disciplina|activity|productivity.overall
periodNoRelative period: today|yesterday|last_7_days|last_30_days (wins over date_from/date_to when set).
compactNo
date_toNoEnd datetime; date-only covers until 23:59:59 that day.
user_idNoUser filter: AliasID as TreeviewUsers NodeType=1.
group_idNoGroup filter: TreeviewUsers NodeType=14 (console group id).
date_fromNoStart datetime YYYY-MM-DD or YYYY-MM-DD HH:MM:SS (full day if date-only).

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=true, so the safety profile is covered. The description adds the 'rollups' framing and the view dimension, but it does not disclose additional behavioral details such as default period handling or precedence rules; those live only in the schema. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence with no filler, and the key view dimension is placed immediately after the resource. It is concise without being a tautology, though it prioritizes brevity over explanatory richness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given seven optional parameters, a rich output schema, and many sibling analytics tools, the description is too thin to fully orient an agent. Parameters and output shape are already covered by structured schemas, so the main missing piece is contextual guidance about when this tool is the right choice versus comparable alternatives.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is high (86%), and the schema already documents view, period, date ranges, and user/group filters in detail. The description only restates the view enum values and adds the 'rollups' label, so it provides little semantic value beyond the structured schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the resource ('analytics rollups') and enumerates the available view modes, which is more informative than the generic title. It is specific enough to indicate this is an aggregated analytics tool, though it lacks an explicit verb and does not directly differentiate itself from sibling analytics tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no guidance on when to use get_analytics versus sibling tools like get_activity_summary, get_productivity_summary, or get_dashboard. The only implicit context is the view parameter, which is insufficient for an agent to reliably route between these overlapping analytics tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_chronoChronometryC
Read-only

Chronometry timeline (POST /api/Chrono/Overall2).

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMax rows to return (1–500).
offsetNoPagination offset (0-based).
periodNoRelative period: today|yesterday|last_7_days|last_30_days (wins over date_from/date_to when set).
compactNo
date_toNoEnd datetime; date-only covers until 23:59:59 that day.
user_idNoUser filter: AliasID as TreeviewUsers NodeType=1.
group_idNoGroup filter: TreeviewUsers NodeType=14 (console group id).
date_fromNoStart datetime YYYY-MM-DD or YYYY-MM-DD HH:MM:SS (full day if date-only).
filter_keyNoOptional text filter passed to the Cloud API FilterKey.

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

C2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=true and openWorldHint=true, so the read-only safety profile is already covered. The description adds only the HTTP endpoint, which is a minor behavioral detail, but it does not disclose response behavior, pagination semantics, the meaning of the 'compact' option, or any filtering caveats beyond what the schema already states.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is only six words plus an endpoint, which is concise but far too sparse for a tool with nine parameters and a non-obvious domain. It is under-specification rather than effective conciseness; a useful description would need at least a sentence explaining what a chronometry timeline represents.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite a rich input schema and an output schema, the description fails to establish what 'chronometry' means in this domain or what kind of timeline is returned. With many similar siblings, the missing contextual anchor makes it difficult for an agent to correctly select and invoke the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 89%, and the schema documents nearly all parameters with meaningful detail such as period precedence and date-only handling. With high coverage, the baseline is 3, and the description itself contributes no additional parameter meaning. There is no gap large enough to penalize further.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose2/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Chronometry timeline' essentially restates the title 'Chronometry' and the name get_chrono, adding only the word 'timeline' and an endpoint. It does not say what the timeline contains, what operation is performed, or how it differs from sibling analytics tools. This is closer to a tautology than a usable purpose statement.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines1/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance about when to use this tool versus alternatives like get_activity_detail, get_day_structure, or get_productivity_summary. The description provides no context, no exclusions, and no mention of which scenarios warrant calling get_chrono.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_dashboardGet dashboard widgetA
Read-only

Dashboard widgets (metadata only; screenshot blobs stripped when compact).

ParametersJSON Schema
NameRequiredDescriptionDefault
periodNoRelative period: today|yesterday|last_7_days|last_30_days (wins over date_from/date_to when set).
widgetNoDashboard widget id (users, risks, applications, …).users
compactNo
date_toNoEnd datetime; date-only covers until 23:59:59 that day.
user_idNoUser filter: AliasID as TreeviewUsers NodeType=1.
group_idNoGroup filter: TreeviewUsers NodeType=14 (console group id).
date_fromNoStart datetime YYYY-MM-DD or YYYY-MM-DD HH:MM:SS (full day if date-only).
num_screensNoScreens tile count.

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already communicate readOnlyHint and openWorldHint, so the bar for added behavioral disclosure is lower. The description adds meaningful context by noting the result is metadata-only and that compact mode strips screenshot blobs, which is behavior beyond what the annotations alone provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely short and front-loaded, with no filler words. It is slightly elliptical as a sentence fragment, but it earns its place by giving the most important qualification ('metadata only') before the compact-mode detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 8 filterable parameters and a rich output schema, the parameter-level details are already covered. However, the description lacks broader context about what dashboard widgets represent and when this tool should be selected over the many sibling tools, leaving an agent to infer usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is high (88%), so the baseline is 3. The description adds value by explaining the otherwise-undocumented 'compact' parameter's effect: screenshot blobs are stripped when compact. It does not need to repeat the parameter docs already present in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the resource ('Dashboard widgets') and adds a useful qualifier ('metadata only'), making it clear this returns dashboard widget data rather than full report content. It is not a bare restatement of the title, but it does not explicitly distinguish itself from sibling analytics/monitoring tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no guidance on when to use get_dashboard versus any of the many sibling tools such as get_analytics, get_activity_summary, or search_monitoring. It lacks both explicit alternatives and implied selection criteria beyond the tool's own name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_day_structureDay structureA
Read-only

Day structure: mode=list (DayStructureList) or detail (GetDayStructure).

detail requires user_id. Filters match console: ProductivityFilter 0–4, ActivityTypeFilter 0–2 (defaults 0).

ParametersJSON Schema
NameRequiredDescriptionDefault
modeNolist = DayStructureList; detail = GetDayStructure (needs user_id).list
periodNoRelative period: today|yesterday|last_7_days|last_30_days (wins over date_from/date_to when set).
compactNo
date_toNoEnd datetime; date-only covers until 23:59:59 that day.
user_idNoUser filter: AliasID as TreeviewUsers NodeType=1.
group_idNoGroup filter: TreeviewUsers NodeType=14 (console group id).
date_fromNoStart datetime YYYY-MM-DD or YYYY-MM-DD HH:MM:SS (full day if date-only).
productivity_filterNo
activity_type_filterNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and openWorldHint, so the description only needs to add context. It adds the mode behavior and filter defaults without contradicting the annotations, but does not enrich the behavioral picture much further.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short clauses deliver the mode split, the user_id requirement, and the filter ranges with no filler. The critical information is front-loaded and every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With nine parameters and many sibling tools, the description is adequate but leaves gaps: 'compact' is never explained, and no guidance connects this tool to the alternative monitoring/summary tools. The strong schema and output schema offset this, but the definition is not fully complete on its own.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 67%, and the description supplements the filter parameters by stating their console-compatible ranges and defaults, though the ranges already appear in the schema. It adds little semantic meaning for undocumented parameters such as compact.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description identifies a specific resource ('day structure') and exposes two modes, list and detail, so an agent can infer what operations are available. It lacks an explicit verb and does not distinguish itself from siblings, but the resource and mode names make the purpose clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides useful internal guidance: detail requires user_id and filters match console ranges/defaults. However, it gives no guidance on when to choose this tool over siblings like get_activity_summary or get_timesheet.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_idle_summaryIdle time summaryA
Read-only

Rank users by inactive (idle) time from Productivity/Overall3.

Use for: 'who was idle longest?', 'idle > N hours', InactiveTime totals. Do NOT use list_anomalies for idle — Alerts are formal deviations only.

ParametersJSON Schema
NameRequiredDescriptionDefault
periodNoRelative period: today|yesterday|last_7_days|last_30_days (wins over date_from/date_to when set).
date_toNoEnd datetime; date-only covers until 23:59:59 that day.
user_idNoUser filter: AliasID as TreeviewUsers NodeType=1.
group_idNoGroup filter: TreeviewUsers NodeType=14 (console group id).
date_fromNoStart datetime YYYY-MM-DD or YYYY-MM-DD HH:MM:SS (full day if date-only).
min_idle_hoursNoOnly include users with InactiveTime >= this many hours.

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover readOnlyHint and openWorldHint. The description adds useful context by naming the source metric (InactiveTime) and clarifying that list_anomalies represents only formal deviations, which helps set expectations about what this tool does and does not return.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is tight and front-loaded with the core purpose, followed by crisp usage examples and a short exclusion note. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With annotations covering safety, an output schema present, and all parameters documented in the schema, the description supplies the missing contextual pieces: the data source, the metric, and the sibling distinction. Nothing essential is left unexplained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all parameters. The description adds minimal parameter-specific meaning beyond 'idle > N hours' mapping to min_idle_hours, but the schema carries the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific action—'Rank users by inactive (idle) time'—and a clear data source, Productivity/Overall3. It also explicitly differentiates itself from list_anomalies, so an agent can distinguish this tool from its siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit example queries ('who was idle longest?', 'idle > N hours') and names a concrete alternative to avoid ('Do NOT use list_anomalies for idle'). This gives the agent unambiguous routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_productivity_summaryProductivity summaryB
Read-only

Per-user productivity rollup (Overall3 + stats + Analytics metrics).

ParametersJSON Schema
NameRequiredDescriptionDefault
rawNo
periodNoRelative period: today|yesterday|last_7_days|last_30_days (wins over date_from/date_to when set).
date_toNoEnd datetime; date-only covers until 23:59:59 that day.
user_idNoUser filter: AliasID as TreeviewUsers NodeType=1.
group_idNoGroup filter: TreeviewUsers NodeType=14 (console group id).
date_fromNoStart datetime YYYY-MM-DD or YYYY-MM-DD HH:MM:SS (full day if date-only).

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=true, so the safety profile is covered. The description adds that this is a rollup combining Overall3, stats, and Analytics metrics, but it does not disclose aggregation behavior or the effect of the raw flag.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no filler, and the core purpose is front-loaded. 'Overall3 + stats + Analytics metrics' is compact and substantive, even if the term Overall3 is somewhat cryptic.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present and readOnly annotations available, the description does not need to explain return values or safety. However, the meaning of 'Overall3' and the raw/period behavior remain under-explained, and the description does little to help an agent choose this over closely related summary tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already documents most parameters with 83% coverage, including period, user_id, group_id, and date ranges. The description adds little parameter-level meaning beyond reinforcing the per-user nature, which is already present in the user_id parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear resource and action: it returns a per-user productivity rollup and names the metric components (Overall3, stats, Analytics metrics). It is distinguishable from idle/activity summaries at a glance, though it does not explicitly contrast with siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance is given for when to use this tool versus alternatives like get_activity_summary, get_idle_summary, or get_analytics. The sibling list is provided but the description does not route the agent toward or away from any alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_timesheetTimesheetB
Read-only

Timesheet / attendance summary (POST /api/TimeSheet/Overall2).

ParametersJSON Schema
NameRequiredDescriptionDefault
rawNo
periodNoRelative period: today|yesterday|last_7_days|last_30_days (wins over date_from/date_to when set).
date_toNoEnd datetime; date-only covers until 23:59:59 that day.
user_idNoUser filter: AliasID as TreeviewUsers NodeType=1.
group_idNoGroup filter: TreeviewUsers NodeType=14 (console group id).
date_fromNoStart datetime YYYY-MM-DD or YYYY-MM-DD HH:MM:SS (full day if date-only).

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=true, covering the key safety and scope traits. The description adds the POST endpoint, but says nothing about aggregation behavior, date-window semantics, or how the response is shaped. This is adequate because the annotations carry the main behavioral burden.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence: 'Timesheet / attendance summary (POST /api/TimeSheet/Overall2).' It wastes no words and includes the endpoint without duplicating schema content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The detailed schema, annotations, and output schema cover most invocation knowledge, but the description is minimal and leaves gaps around the raw flag and how this tool relates to sibling summary tools. It is minimally viable but not richly contextual.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 83%, and the schema already explains period, date_from, date_to, user_id, and group_id. The description adds no parameter-level meaning, and the raw boolean remains undescribed both in the schema and in the tool description, so the agent is left guessing about that flag.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the resource as a 'Timesheet / attendance summary' and gives the endpoint, so an agent can tell it is about retrieving timesheet/attendance data. However, it does not use a specific verb and does not distinguish it from sibling summary tools like get_activity_summary or get_productivity_summary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance about when to use this tool instead of the many related summary/report siblings, nor any mention of prerequisites or typical use cases. The schema explains parameter precedence, but the description itself provides no usage direction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_user_infoGet user infoA
Read-only

User/computer detail reads (SPA GET headers).

user_data / tooltip / group: need user_id (AliasID). group = group path for that user (not load-by-GroupID). computer / users_from_computer: need computer_guid (ComputerGuid).

ParametersJSON Schema
NameRequiredDescriptionDefault
periodNoRelative period: today|yesterday|last_7_days|last_30_days (wins over date_from/date_to when set).
sourceNoUser/computer detail source.user_data
compactNo
date_toNoEnd datetime; date-only covers until 23:59:59 that day.
user_idNoUser filter: AliasID as TreeviewUsers NodeType=1.
date_fromNoStart datetime YYYY-MM-DD or YYYY-MM-DD HH:MM:SS (full day if date-only).
computer_guidNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare this as a read-only, open-world operation, and the description reinforces that with 'reads' and 'SPA GET headers'. It adds useful behavioral detail about source-specific key requirements and the group-path nuance. No contradiction with annotations exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three compact, front-loaded lines with no filler. Every line contributes a distinct constraint or mapping, making it easy for an agent to scan and act on.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only multi-source tool with an output schema, the description covers the essential invocation constraints: which ID each source needs and the group-path caveat. It does not describe the compact parameter or default behavior, but defaults are present in the schema and the conditional requirements are sufficiently explicit.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 71%, so the schema documents most parameters. The description adds valuable meaning beyond enumerations by mapping source values to the required IDs and clarifying that group is a path, not a GroupID. It also gives context for computer_guid, which the schema leaves undocumented, though compact remains unexplained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool performs user/computer detail reads and enumerates five distinct source modes. It is more specific than the title, but it does not explicitly differentiate this tool from sibling read tools such as get_activity_detail or get_account_readonly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives concrete conditional usage guidance: user_data, tooltip, and group require user_id, while computer and users_from_computer require computer_guid. It also disambiguates group as a path, not a GroupID, which prevents a likely misuse. It does not mention alternatives among sibling tools, but the context for correct invocation is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_anomaliesList formal alertsA
Read-only

List formal Alerts / deviations (POST /api/Alerts/Overall2).

Use for: lateness, overtime, unusual app-share, timetable-fired alerts. Do NOT use for idle/inactive duration — that is get_idle_summary (InactiveTime). Do NOT use for DLP keyword/USB policy hits — that is list_risks.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMax rows to return (1–500).
offsetNoPagination offset (0-based).
periodNoRelative period: today|yesterday|last_7_days|last_30_days (wins over date_from/date_to when set).
compactNo
date_toNoEnd datetime; date-only covers until 23:59:59 that day.
user_idNoUser filter: AliasID as TreeviewUsers NodeType=1.
group_idNoGroup filter: TreeviewUsers NodeType=14 (console group id).
date_fromNoStart datetime YYYY-MM-DD or YYYY-MM-DD HH:MM:SS (full day if date-only).
filter_keyNoOptional text filter passed to the Cloud API FilterKey.

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and openWorldHint. The description adds useful behavioral context beyond that: it names the API endpoint, clarifies the 'formal Alerts / deviations' scope, and explicitly excludes idle/duration and DLP policy hits. No contradictions with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, front-loaded with the core purpose, followed by compact scoped usage guidance. Every sentence earns its place with no filler or repetition of schema content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 9-parameter read-only tool with an output schema, the description is comprehensive for selection and routing. A minor gap is that the `compact` parameter has no description in either the schema or the tool description, leaving its behavioral impact unexplained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 89%, so the schema carries most parameter documentation. The description adds no parameter-level detail beyond examples of alert categories, meaning it does not elevate above the baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action and resource: 'List formal Alerts / deviations' with the underlying endpoint. It further differentiates the tool from siblings by naming what it is not for, making its purpose unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit 'Use for' and 'Do NOT use for' guidance names concrete scenarios (lateness, overtime, unusual app-share, timetable-fired alerts) and routes the agent to get_idle_summary and list_risks as alternatives. This is exemplary routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_api_coverageAPI coverage matrixA
Read-only

Static gap matrix: which console APIs are covered vs intentional out-of-scope.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already establish read-only and open-world semantics, and the description adds useful behavioral context by calling the matrix 'static' and clarifying that out-of-scope APIs are 'intentional'. This goes beyond the annotations without contradicting them. It does not describe update frequency or data provenance, but for a zero-parameter read-only tool this is acceptable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, tightly worded sentence that immediately states the tool's core value: a static gap matrix of coverage versus intentional exclusions. There is no filler, repetition, or unnecessary scaffolding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no parameters, read-only annotations, and an output schema, this description is sufficient for an agent to understand what the tool does and when to call it. The distinction between covered and intentional out-of-scope APIs is the key semantic, and it is stated clearly. Nothing essential for selection or invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the description carries no parameter-documentation burden. The input schema fully covers the (empty) argument list, and there is nothing more the description needs to explain about invocation arguments.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool's subject: a static gap matrix of console API coverage versus intentional out-of-scope items. It is distinguishable from the sibling tools, which focus on users, risks, activity, and monitoring rather than API coverage. However, it uses a noun phrase rather than an explicit verb like 'list' or 'show', so it falls just short of a perfect clarity score.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The intended use is implied: an agent would call this when it needs to know which console APIs are covered and which are intentionally not. There is no explicit guidance about when to prefer it over alternatives, nor any mention of when not to use it. The unique subject matter makes the use case reasonably clear, but the description does not articulate it directly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_directoryList directoryA
Read-only

Directory reads: users/groups tree, users, groups, computers, additional operators.

users_groups is session-cached (~5 min); pass refresh=true to force reload.

ParametersJSON Schema
NameRequiredDescriptionDefault
sourceNoDirectory Get source.users_groups
refreshNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=true, and the description's 'Directory reads' aligns with those. It adds valuable behavior beyond annotations: users_groups responses are session-cached for ~5 minutes and refresh=true forces a reload. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with no filler. The purpose is front-loaded, and the cache/refresh behavior is stated in a compact, directly actionable way.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema exists and annotations cover the read-only safety profile, the description is mostly complete: it names the main sources and explains the important cache/refresh behavior. The main gaps are the mismatch between 'additional operators' and the enumerated additional_users/additional_rights, and the lack of any distinction from the sibling list_users_groups.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50%; source is described as 'Directory Get source.' and refresh has no schema description. The description compensates partially by explaining that users_groups is cached and refresh=true forces reload, which gives the refresh parameter real meaning. However, it does not clarify the enum values such as additional_users and additional_rights, only vaguely referring to 'additional operators.'

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('Directory reads') and lists the resources covered: users/groups tree, users, groups, computers, and additional operators. It is clear enough, but it does not explicitly differentiate from the sibling list_users_groups and uses 'additional operators' rather than the exact enum values additional_users/additional_rights.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit guidance on when to use this tool versus alternatives such as list_users_groups. The caching note ('users_groups is session-cached (~5 min); pass refresh=true to force reload') helps with the refresh parameter, but it does not explain when this tool is the right directory read vs another sibling tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_monitoringList monitoringA
Read-only

Single Monitoring list (Sites, Apps, Screens, Keystrokes, Mail, …).

For keyword search across many Monitoring kinds (console Tools → Search), use search_monitoring(filter_key=…) instead of calling this 13–19 times.

Sensitive kinds return text truncated when compact=true. No binary media.

ParametersJSON Schema
NameRequiredDescriptionDefault
kindYesMonitoring table: Sites|Apps|Keystrokes|Mail|…
limitNoMax rows to return (1–500).
offsetNoPagination offset (0-based).
periodNoRelative period: today|yesterday|last_7_days|last_30_days (wins over date_from/date_to when set).
compactNo
date_toNoEnd datetime; date-only covers until 23:59:59 that day.
user_idNoUser filter: AliasID as TreeviewUsers NodeType=1.
group_idNoGroup filter: TreeviewUsers NodeType=14 (console group id).
date_fromNoStart datetime YYYY-MM-DD or YYYY-MM-DD HH:MM:SS (full day if date-only).
filter_keyNoOptional text filter passed to the Cloud API FilterKey.
filter_objectsNoOptional FilterObjects JSON/string for Monitoring POST.

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint/openWorldHint annotations, the description discloses two non-obvious traits: sensitive kinds return truncated text when compact=true, and no binary media is returned. These are genuinely informative and consistent with the read-only annotation — no contradiction. It could name which kinds are 'sensitive,' but the disclosure is solid for a read-only list tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short paragraphs with zero filler: resource identification, routing guidance, and behavioral caveats. Each sentence earns its place, and the most decision-relevant guidance (when to use the sibling instead) appears early rather than buried.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 11 parameters, high schema coverage, an output schema, and safety annotations, the description doesn't need to document every field. It covers the cross-tool routing decision and the key edge behaviors (truncation, binary media). The only minor ambiguity is which kinds count as 'sensitive,' which doesn't block correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 91%, so the schema already documents kind, limit, offset, period, date filters, and user/group filters. The description adds real meaning to compact — a parameter with no schema description — by explaining its truncation effect on sensitive kinds. That is genuine added value on top of a rich schema, justifying above the baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening line 'Single Monitoring list (Sites, Apps, Screens, Keystrokes, Mail, …)' identifies the resource and scope — one monitoring table per call — and the parenthetical kinds clarify what data is returned. The verb is implied rather than explicit ('returns a list of…'), so it stops short of a 5, but naming the search_monitoring sibling helps differentiate the tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The second paragraph explicitly instructs agents to use search_monitoring(filter_key=…) for keyword search across many Monitoring kinds, and gives the rationale: 'instead of calling this 13–19 times.' This is an unambiguous when-to-use vs alternative statement that names the sibling, the condition, and the cost of the wrong choice.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_onlineList online presenceA
Read-only

Online presence (POST /api/Live/Overall2). No webcam or live stream frames.

ParametersJSON Schema
NameRequiredDescriptionDefault
periodNoRelative period: today|yesterday|last_7_days|last_30_days (wins over date_from/date_to when set).
compactNo
date_toNoEnd datetime; date-only covers until 23:59:59 that day.
user_idNoUser filter: AliasID as TreeviewUsers NodeType=1.
group_idNoGroup filter: TreeviewUsers NodeType=14 (console group id).
date_fromNoStart datetime YYYY-MM-DD or YYYY-MM-DD HH:MM:SS (full day if date-only).

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already convey read-only behavior, and the description adds a behavioral limitation ('No webcam or live stream frames') plus the POST endpoint. It does not disclose response semantics or pagination, but with readOnlyHint/openWorldHint present this is acceptable context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with no filler; the main purpose and the differentiating negative scope are front-loaded. The endpoint information is a useful addition rather than redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only list tool with an output schema, six well-described parameters, and no required arguments, the definition covers the essentials. The remaining gap is that 'online presence' is not fully spelled out as a status list, but the negative framing and schema carry most of the context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 83%, so most parameters already carry meaning; the description adds no parameter detail of its own. The undocumented 'compact' parameter is not clarified, keeping this at the baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the resource ('online presence') and specifies a concrete endpoint, and the negative clause 'No webcam or live stream frames' helps separate it from stream-oriented siblings. It relies partly on the tool name/title for the verb, so it is not fully self-contained.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The only usage hint is the exclusion 'No webcam or live stream frames,' which implies this tool is for presence data rather than media. No sibling alternative is named and there is no explicit when-to-use guidance, so guidance is largely implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_reportsList reportsA
Read-only

List scheduled report mailing settings and background processing tasks.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=true, and the description's 'List' is consistent with those. It adds useful behavioral context by specifying the exact subjects being listed, though it does not mention pagination or response granularity; the output schema covers return shape.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence that front-loads the action and object with no filler. Every word contributes meaning, and the description is appropriately sized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless, read-only list tool with an output schema, the description fully defines the tool's scope. The agent has enough information to invoke it correctly without missing prerequisites or caveats.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema is empty with zero parameters, so there is no parameter semantic gap for the description to fill. The baseline 4 applies because no parameter documentation is needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description uses a specific verb 'List' and names concrete resources: scheduled report mailing settings and background processing tasks. This clearly differentiates the tool from sibling list tools such as list_risks, list_anomalies, and list_monitoring.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when the tool is relevant—when report mailing settings or background tasks are needed—but provides no explicit guidance on alternatives or exclusions. An agent must infer the usage context rather than being told directly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_risksList DLP risksA
Read-only

List or summarize DLP/rule Risks for a period.

Use for: policy/keyword/USB/AI rule hits. Default mode=summary (by_user from Analytics/Overall; by_rule/by_day/sample from Risks/Overall2). Not for idle time (get_idle_summary) or timetable deviations (list_anomalies).

ParametersJSON Schema
NameRequiredDescriptionDefault
modeNosummary = by_user/by_rule rollup; raw = Risks/Overall2 page.summary
limitNoMax rows to return (1–500).
offsetNoPagination offset (0-based).
periodNoRelative period: today|yesterday|last_7_days|last_30_days (wins over date_from/date_to when set).
compactNo
date_toNoEnd datetime; date-only covers until 23:59:59 that day.
user_idNoUser filter: AliasID as TreeviewUsers NodeType=1.
group_idNoGroup filter: TreeviewUsers NodeType=14 (console group id).
date_fromNoStart datetime YYYY-MM-DD or YYYY-MM-DD HH:MM:SS (full day if date-only).
fetch_allNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, covering safety. The description adds behavioral detail beyond that by explaining the default summary mode and its data sources ('by_user from Analytics/Overall; by_rule/by_day/sample from Risks/Overall2') and what 'raw' means. It does not describe return formatting, but an output schema exists, so that is not a required gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short and well-structured: a one-line purpose, a 'Use for' line, a default-mode note, and a 'Not for' line. Every sentence earns its place, and the most important scoping information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With a 10-parameter tool, 80% schema coverage, an output schema, and annotations, the description provides a strong selection and invocation context. It names alternatives and defaults, but does not clarify the semantics of compact and fetch_all, which are the two parameters without schema descriptions; this leaves a minor gap for fully-informed invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 80%, so most parameters are already documented. The description adds meaning by explaining mode semantics: 'summary' produces by_user/by_rule rollups and 'raw' maps to the Risks/Overall2 page. This goes beyond the schema's own enum labels, though the undocumented compact and fetch_all parameters are left to inference.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'List or summarize DLP/rule Risks for a period.' It further clarifies scope with 'Use for: policy/keyword/USB/AI rule hits' and explicitly differentiates from siblings by saying it is 'Not for idle time (get_idle_summary) or timetable deviations (list_anomalies).' This makes the tool's purpose unambiguous and distinguishable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit selection criteria with 'Use for' and 'Not for', naming the exact alternatives (get_idle_summary and list_anomalies). It also states the default mode ('Default mode=summary'), providing clear guidance on how to invoke the tool in its most common form.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_stream_metaStream metadataA
Read-only

Desktop video metadata (SPA GET contracts; no DownloadVideo).

which_content: needs user_id; uses DateTo (or period end) as DateTime. videos: needs user_id + DateFrom/DateTo (UserID header). downloads: Bearer only (exported file list).

ParametersJSON Schema
NameRequiredDescriptionDefault
periodNoRelative period: today|yesterday|last_7_days|last_30_days (wins over date_from/date_to when set).
sourceNowhich_content/videos need user_id; downloads is export list.which_content
compactNo
date_toNoEnd datetime; date-only covers until 23:59:59 that day.
user_idNoUser filter: AliasID as TreeviewUsers NodeType=1.
date_fromNoStart datetime YYYY-MM-DD or YYYY-MM-DD HH:MM:SS (full day if date-only).

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark readOnlyHint and openWorldHint, and the description reinforces this with 'SPA GET contracts; no DownloadVideo'. It adds behavioral context beyond annotations by disclosing auth requirements per source, e.g., 'downloads: Bearer only (exported file list)'. No contradiction exists between description and annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short and scannable: one introductory line plus three source-specific bullets. Every sentence contributes either the resource definition, an exclusion ('no DownloadVideo'), or a parameter requirement. There is no filler or repetition of the input schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the six optional parameters and source-dependent behavior, the description covers the main conditional logic well. It does not explain the 'compact' parameter, which is undocumented even in the schema, and some phrasing like 'SPA GET contracts' assumes API familiarity. However, the output schema exists, and the description provides enough per-source guidance to invoke the tool correctly in most cases.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is high at 83%, so the schema already documents most parameters. The description adds cross-parameter meaning by linking sources to required fields: which_content uses DateTo, videos requires DateFrom/DateTo with a UserID header, and downloads is an export list. This goes beyond the flat schema descriptions by clarifying conditional usage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description identifies the resource as 'Desktop video metadata' and the operation as 'SPA GET contracts', which together imply a read-only listing operation. The name 'list_stream_meta' adds the explicit verb. It does not explicitly distinguish from siblings, but the sibling tools cover clearly different domains such as users, risks, and analytics.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear per-source usage context: 'which_content: needs user_id', 'videos: needs user_id + DateFrom/DateTo', and 'downloads: Bearer only'. This tells the agent what inputs and authentication each variant requires. It does not explicitly name alternatives or state when not to use the tool, but the source-specific guidance is strong enough for practical invocation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_users_groupsList users and groupsA
Read-only

List users and groups tree (GetUsersGroups2). Type 0=root, 1=group, 2=user.

These Type values are for the UI tree only. For report POST filters use NodeType 14=group and NodeType 1=user (AliasID). Cached ~5 min per MCP session; pass refresh=true to force reload.

ParametersJSON Schema
NameRequiredDescriptionDefault
refreshNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds meaningful behavioral detail beyond the readOnlyHint annotation: the tool is cached for ~5 minutes per MCP session, and refresh=true forces a reload. It also clarifies that Type values have a restricted scope (UI tree only), which is important context for interpreting results. This goes beyond what annotations and schema already convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-organized: one line for purpose, one line for type-value scope, and one line for caching behavior. Every sentence adds necessary information without redundancy. No filler or repetition of the tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple—one optional boolean parameter—and has an output schema. The description explains the core output concept (tree with Type values), the caching behavior, and the refresh parameter. An agent has enough information to call the tool correctly and interpret its results in context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has only one parameter, refresh, with no schema description. The description compensates by explaining that refresh=true forces a cache reload, adding semantic value. It does not explicitly describe the default behavior when refresh is omitted, but the schema provides default: false, so the combination is sufficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action and resource: 'List users and groups tree (GetUsersGroups2)'. The word 'tree' clarifies the hierarchical nature of the output, which distinguishes this tool from sibling tools like get_user_info or list_risks. The purpose is immediately obvious and not a mere restatement of the name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context by stating that the Type values are for the UI tree only and that report POST filters should use NodeType values instead. This gives a concrete exclusion and prevents misuse. It does not explicitly name alternative sibling tools or describe exactly when to choose this tool over similar list tools, so it stops short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

octowatch_whoamiWho am IA
Read-only

Show which OctoWatch API host and account the MCP server is using (password never returned).

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint and openWorldHint, so the description need not restate safety. It adds a meaningful behavioral guarantee—password never returned—which is especially valuable for an identity/credential-related tool. It does not describe every edge case, but the output schema covers the return shape.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence that front-loads the main purpose and includes the key security caveat. Every word earns its place; there is no fluff or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only identity tool with an output schema and safety annotations, the description is fully adequate. It tells the agent what the tool returns at a conceptual level and reassures about sensitive data, and nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so there is no parameter documentation burden. Per the rubric, a 0-parameter tool receives a baseline of 4, and the description appropriately says nothing about parameters because nothing is needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Show') and resource ('OctoWatch API host and account'), making the intent immediately clear. The added caveat that the password is never returned sharpens the scope and helps distinguish it from account-detail tools like get_account_readonly, which would be more about account data than host identity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The usage is implied: use this when you need to verify which API host and account the MCP server is connected to. However, there is no explicit when-to-use vs. alternatives such as get_account_readonly or get_user_info, and no exclusions are stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_monitoringSearch monitoringA
Read-only

Console Tools → Search: parallel Monitoring fan-out with FilterKey.

Use for: 'find keyword X across activity' (sites/apps/keys/mail/files/…). Prefer this over calling list_monitoring many times. Not for Risks (list_risks), idle (get_idle_summary), or formal Alerts (list_anomalies). Does not search SearchQueries.

kinds: optional comma-separated subset (e.g. "Sites,Apps,Mail" or "sites,mail"). Default = all Tools Search sources.

ParametersJSON Schema
NameRequiredDescriptionDefault
kindsNoOptional comma-separated kinds, e.g. Sites,Apps,Mail.
offsetNoPagination offset (0-based).
periodNoRelative period: today|yesterday|last_7_days|last_30_days (wins over date_from/date_to when set).
date_toNoEnd datetime; date-only covers until 23:59:59 that day.
user_idNoUser filter: AliasID as TreeviewUsers NodeType=1.
group_idNoGroup filter: TreeviewUsers NodeType=14 (console group id).
max_rowsNo
date_fromNoStart datetime YYYY-MM-DD or YYYY-MM-DD HH:MM:SS (full day if date-only).
filter_keyYesKeyword for Tools → Search fan-out across Monitoring.
per_source_limitNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=true, so the safety profile is covered. The description adds non-obvious behavior: it is a parallel fan-out, defaults to all Tools Search sources, and explicitly does not search SearchQueries. This goes beyond the annotations and schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact, front-loads the core purpose, and uses short labeled lines for use/not-use/parameter guidance. Every sentence earns its place, with no repetition of the title or schema boilerplate.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 10-parameter tool with many siblings, the description covers the essential selection logic, exclusions, scope default, and the one parameter needing extra explanation. Since an output schema exists, return values do not need to be described, and the remaining parameter details are in the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is high (80%), so the baseline is 3. The description adds extra meaning for the 'kinds' parameter by noting case-insensitivity ('Sites,Apps,Mail' or 'sites,mail') and clarifying that null defaults to all sources, which the schema does not state. Other parameters are adequately covered by the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'parallel Monitoring fan-out with FilterKey' for 'find keyword X across activity'. It clearly distinguishes itself from siblings by explicitly excluding list_risks, get_idle_summary, list_anomalies, and SearchQueries, so an agent can select it without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage context is explicit: 'Use for: find keyword X across activity' and 'Prefer this over calling list_monitoring many times'. It also gives clear negative guidance with named sibling alternatives (list_risks, get_idle_summary, list_anomalies), leaving little to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

TDQS

B3.3/5.0
Disambiguation4/5

Most tools are sharply delineated with explicit cross-references, e.g. list_risks vs list_anomalies vs get_idle_summary. Some overlap remains between list_users_groups and list_directory, and between get_activity_summary, get_productivity_summary, and get_analytics, but descriptions largely resolve it.

Naming Consistency4/5

The set mostly follows a consistent list_/get_ + noun convention, with list_ for collection-style endpoints and get_ for details or summaries. Exceptions like octowatch_whoami and search_monitoring break the pattern slightly, keeping this from a 5.

Tool Count3/5

22 tools falls in the heavy 16-25 band. The breadth is justified by the wide OctoWatch read-only surface, but the count is more than most agents need at once and includes several summary/detail pairs that could be consolidated.

Completeness4/5

The toolset thoroughly covers read-only monitoring: risks, alerts, idle time, activity, productivity, directory, online presence, streams, and account info. Obvious gaps are write/manage operations and media/live-frame downloads, but these appear intentional for a monitoring-focused read-only server.

Maintenance

ActivityMaintained
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables read-only access to SentinelOne's platform through MCP, allowing security investigations, threat hunting, and asset inventory queries via natural language.
    MIT
  • A
    license
    A
    quality
    B
    maintenance
    Enables MCP clients to interact with SentinelOne's cybersecurity platform for security analysis, threat investigation, and asset management through natural language queries. Provides read-only access to alerts, vulnerabilities, misconfigurations, and inventory data.
    33
    94
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables natural-language investigation of Datadog data including logs, metrics, monitors, traces, hosts, dashboards, events, and incidents, all through read-only API access.
    3,024
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/extralabs/octowatch-mcp-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server