mcp-endpoint-central
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@mcp-endpoint-centrallist all computers with missing critical patches"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
mcp-endpoint-central
An MCP (Model Context Protocol) server for ManageEngine Endpoint Central — on-premise edition. It lets MCP clients such as Claude Code, Claude Desktop, and other LLM agents query and (optionally) operate your Endpoint Central server through its REST API: managed computers, inventory, patch status, vulnerabilities, BitLocker, device control, DLP reports, and more.
On-prem only. This server targets the self-hosted Endpoint Central product and its static API-token authentication. It does not implement Zoho OAuth2 and will not work against the Endpoint Central Cloud SaaS API.
Highlights
Read-only by default. Mutating tools (patch install/uninstall, agent uninstall, task changes, …) are not registered at all unless you explicitly opt in with
ENDPOINT_CENTRAL_ENABLE_WRITE_TOOLS=true. In the default mode the connected LLM has no write surface to call.Double confirmation on writes. Even with write tools enabled, every mutating tool refuses to act unless the call includes
confirm: true, so a client (or model) cannot trigger a destructive action in a single accidental step.MCP tool annotations. Every tool declares
readOnlyHint/destructiveHintannotations, so clients that implement annotation-based policies (auto-approve reads, always prompt on destructive) work out of the box.Context-friendly responses. Endpoint Central's raw API returns dozens of DB-style fields per record. List tools project responses down to a curated field set by default (pass
raw: truefor full fidelity) and every paginated tool tells the model exactly how to fetch the next page.Secure by design. Static token is kept out of logs, error messages, and tool results; request paths are SSRF-guarded; internal-CA TLS is supported without ever disabling certificate verification.
Related MCP server: superops-mcp
Requirements
Node.js ≥ 18
A reachable ManageEngine Endpoint Central on-premise server (default port 8383/HTTPS)
An API token generated in the Endpoint Central console: Admin → Integrations → API Key Management
Quick start
Four steps, about five minutes.
1. Install
git clone https://github.com/hdyrawan/mcp-endpoint-central.git
cd mcp-endpoint-central
npm installnpm install also builds the server, so there's no separate build step.
2. Get an API token
In the Endpoint Central console, go to Admin → Integrations → API Key Management and generate a key. Copy it somewhere safe.
Using Active Directory with MFA? That works fine — you complete MFA once here in the browser, and the key works headlessly from then on. See Generating the API token for the details and for choosing which account the key belongs to.
3. Add it to your MCP client
Use the absolute path to dist/index.js in this folder — run pwd to get it.
claude mcp add endpoint-central \
--env ENDPOINT_CENTRAL_BASE_URL=https://ec-server.corp.example:8383 \
--env ENDPOINT_CENTRAL_API_TOKEN=YOUR_TOKEN \
-- node /absolute/path/to/mcp-endpoint-central/dist/index.jsThat's Claude Code. For Claude Desktop, Codex CLI, OpenCode, or Hermes Agent, see client setup below — same idea, different config file.
4. Verify
cp .env.example .env # fill in the same base URL + token
npm run checkThis confirms the server is reachable and your token works, and tells you exactly what to fix if not. You're done — the server starts in read-only mode with 86 tools and no write access.
Want to use
npxinstead? It works:npx -y github:hdyrawan/mcp-endpoint-central. It's slower to start and has a couple of caveats — see alternative launch methods.
Client setup
Claude Code is covered in the quick start above. Every client needs the same three things: the command node, the absolute path to dist/index.js, and the two environment variables.
Claude Desktop
Add to claude_desktop_config.json (Settings → Developer → Edit Config):
{
"mcpServers": {
"endpoint-central": {
"command": "node",
"args": ["/absolute/path/to/mcp-endpoint-central/dist/index.js"],
"env": {
"ENDPOINT_CENTRAL_BASE_URL": "https://ec-server.corp.example:8383",
"ENDPOINT_CENTRAL_API_TOKEN": "YOUR_TOKEN"
}
}
}
}Codex CLI
Add to ~/.codex/config.toml (or use codex mcp add), then verify with /mcp in a session:
[mcp_servers.endpoint-central]
command = "node"
args = ["/absolute/path/to/mcp-endpoint-central/dist/index.js"]
[mcp_servers.endpoint-central.env]
ENDPOINT_CENTRAL_BASE_URL = "https://ec-server.corp.example:8383"
ENDPOINT_CENTRAL_API_TOKEN = "YOUR_TOKEN"OpenCode
Add to opencode.json in your project root (or globally in ~/.config/opencode/opencode.json). Note OpenCode wants one command array and the key environment, not env:
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"endpoint-central": {
"type": "local",
"command": ["node", "/absolute/path/to/mcp-endpoint-central/dist/index.js"],
"enabled": true,
"environment": {
"ENDPOINT_CENTRAL_BASE_URL": "https://ec-server.corp.example:8383",
"ENDPOINT_CENTRAL_API_TOKEN": "YOUR_TOKEN"
}
}
}
}Hermes Agent
Add to ~/.hermes/config.yaml, then restart Hermes or run /reload-mcp in an active session:
mcp_servers:
endpoint-central:
command: "node"
args: ["/absolute/path/to/mcp-endpoint-central/dist/index.js"]
env:
ENDPOINT_CENTRAL_BASE_URL: "https://ec-server.corp.example:8383"
ENDPOINT_CENTRAL_API_TOKEN: "YOUR_TOKEN"Hermes deliberately does not pass your shell environment to MCP subprocesses — only its safe baseline plus what you put in env. So every ENDPOINT_CENTRAL_* variable you need (including ENDPOINT_CENTRAL_CA_CERT_PATH or ENDPOINT_CENTRAL_ENABLE_WRITE_TOOLS if you use them) must be listed explicitly in this block.
Any other MCP client
The server speaks MCP over stdio. Point your client at node dist/index.js with the environment variables below.
Alternative launch methods
The MCP docs use two launch styles depending on where a server comes from:
Connecting a published server →
"command": "npx", "args": ["-y", "@modelcontextprotocol/server-filesystem", …]Building your own server →
"command": "node", "args": ["/ABSOLUTE/PATH/TO/…/build/index.js"]
This server is the second kind and is deliberately unpublished, so node + absolute path is the documented match. All three of these work:
Launch command | Start time | Notes |
| 0.3s | Runs exactly the code you cloned and built. No network at startup. Update with |
| 0.3s | Same code, no paths in your config. One extra setup step. |
| 7s | No checkout to manage. Recompiles and re-resolves the git ref on every launch, needs git access to the private repo, and follows branch tip unless pinned. |
To pin npx to a specific commit, so a later push can't change what runs with your API token:
npx -y github:hdyrawan/mcp-endpoint-central#a27ce7aWhy there's no npm package: this server holds a credential that, with write tools enabled, can deploy patches to every managed endpoint. Fetching and executing freshly-resolved code at each startup widens that blast radius for no gain on a single-host deployment. So npx mcp-endpoint-central resolves to nothing — only the explicit github: form works.
Local development run
cp .env.example .env # fill in your values; .env is gitignored
node --env-file=.env dist/index.jsTry it
Once connected, ask your MCP client things like:
"List all computers whose agent hasn't contacted the server in over 30 days."
"What critical vulnerabilities affect our network? Which systems are hit worst?"
"Show the patch summary, then the missing patches with severity Important or higher."
"Which computers still have BitLocker disabled on their system drive?"
"What prohibited software was found, and on which machines?"
Configuration
All configuration is via environment variables (see .env.example for the commented reference):
Variable | Required | Default | Purpose |
| yes | — | Base URL of your on-prem server, e.g. |
| yes | — | Static API token from Admin → Integrations → API Key Management. Treat like a password. |
| no | — | Path to a PEM CA bundle if the server's TLS certificate is issued by an internal/private CA. |
| no |
| Default page size for list tools (server hard cap: 1000). |
| no |
| Set |
Generating the API token
Endpoint Central on-prem offers two ways to authenticate to its API. This server uses the static API key, which is the only one that works unattended:
Static API key | Login API ( | |
How you get it | Generated in the console, once | POST username + base64 password each time |
With MFA enabled | You complete MFA once, in the browser, when generating the key | Every login needs a fresh OTP via |
Suitable for a headless MCP server | ✅ Yes | ❌ No — a human must read the OTP each time |
Credentials at rest | One revocable key | Your AD account password |
Steps:
Decide which account the key belongs to. The key inherits that account's RBAC role, and on the API Key Management screen some on-prem builds also let you scope the key itself (per-module CRUD, e.g.
Inventory.read,Patch.update) — check for a scope picker when you generate it. Either way, the account's role remains the outer bound: an unscoped key gets everything the role allows, and a scoped key can only narrow that further, never widen it. Prefer a dedicated service account over a person's day-to-day login, and the least-privileged role (and scope, if offered) that still covers the modules you need. (Note: generating an API key requires administrator privilege in the console, so verify with your Endpoint Central admin which roles/scopes are available to you.)Log in to the console as that account and complete MFA normally.
Go to Admin → Integrations → API Key Management, generate the key, and copy it straight into your secret store. If the form offers an expiry date, note it — the key stops working that day.
Put it in
ENDPOINT_CENTRAL_API_TOKENand verify withnpm run check(see below).
A key is invalidated by: regenerating it (the previous key dies immediately), deleting the user it belongs to, or reaching its expiry date if you set one.
Active Directory + MFA deployments
If your console uses AD authentication with MFA (email OTP, authenticator app, or similar), nothing changes for this server — that's the point of the static key. You authenticate interactively once (AD password + OTP) in the browser to generate the key; from then on the key is a self-contained credential and the MCP server never performs an interactive login, never sees your AD password, and never needs an OTP.
Consequences worth planning for:
Do not try to feed AD credentials to this server. It has no username/password mode by design: storing a domain password in an MCP client's config would be a worse credential than a scoped, revocable key, and email OTP would break the flow on every restart anyway.
Service account vs. personal account. A key tied to a person dies when their account is deleted or disabled — including when they leave. Ask your Endpoint Central admin for a dedicated service account where policy allows.
AD password rotation. The key is stored separately from the AD password, but this isn't documented by ManageEngine either way. Test it after your first rotation, and keep
npm run checkhandy for a 5-second verdict.Revocation. To kill access instantly, regenerate the key in the console (or disable the account). Then update
ENDPOINT_CENTRAL_API_TOKENwherever it's configured.
What npm run check tells you
It runs two probes and reports exactly where a setup breaks:
An unauthenticated probe (
server_discover) — isolates network/TLS problems from credential problems, and prints how your console authenticates (AD enabled, which domains, the default domain).An authenticated call — proves the API token itself works.
Because step 1 runs first, a failure at step 2 is unambiguous: the server is reachable and it's the key that's wrong. Diagnoses unreachable host, TLS trust failure, 401 (bad/expired/superseded key) and 403 (valid key, insufficient role) separately, each with the specific fix. It never prints your token.
✓ MCP server started — 86 tools registered
✓ Reached the Endpoint Central server (unauthenticated probe)
Console auth: Active Directory enabled | AD domains: CORP, SUBSIDIARY | default: CORP
✓ Reached Endpoint Central and authenticated successfullyTLS with an internal CA
If your Endpoint Central server uses a certificate from an internal CA, export the CA (PEM) and set ENDPOINT_CENTRAL_CA_CERT_PATH=/path/to/ca.pem. The server then trusts that CA in addition to performing full certificate verification — there is deliberately no "skip TLS verification" option.
Tool catalog
113 tools across 11 modules: 86 read-only (always registered) and 27 mutating (registered only when ENDPOINT_CENTRAL_ENABLE_WRITE_TOOLS=true). Legend: 🔍 read-only · ✏️ mutating · 🗑️ destructive.
Module | Tools | Covers |
Scope of Management | 6 | Managed computers, SoM summary, remote offices; agent install/uninstall, computer removal |
Inventory | 19 | Hardware, software, licenses, prohibited software, software metering, scan status; scan triggers |
Patch management (read) | 14 | Patch/system status, scan details, deployment policies & configs, approval settings, APD task list, DB update status |
Patch management (actions) | 16 | Approve/decline, scans, install/uninstall configurations, patch downloads, DB update, APD task lifecycle |
Threats & vulnerabilities | 10 | CVEs, vulnerability-to-computer mapping, system/web-server misconfigurations, per-system reports |
BitLocker | 3 | Encryption reports, recovery keys, TPM details |
Device control (DCM) | 9 | Device/block audits, per-computer device status, exemptions, file trace & shadow |
Data loss prevention (DLP) | 11 | Endpoint activity, justifications, false positives, deployed rules/devices/domains/printers |
Reports & groups | 7 | Query reports (+data), custom reports (+data), custom groups, server properties, auth discovery |
Custom fields | 11 | Custom column/data-type management, per-computer custom field reads & updates |
Digital Employee Experience | 7 | DEX scores per device/profile, metric breakdowns, score generation times |
🔍
som_computers_list— managed computers with hostname, IP, OS, agent/live status; rich filters🔍
som_summary— network-wide agent installation and live status summary🔍
som_remote_offices_list— remote/branch offices with replication and distribution server details✏️
som_agent_install— install the agent on computers already visible in SoM🗑️
som_agent_uninstall— uninstall the agent from computers🗑️
som_computer_remove— remove computers from the Scope of Management
🔍
inventory_all_summary— module-wide scan/software/hardware summary🔍
inventory_computer_details_summary— per-computer inventory summary🔍
inventory_filter_params— valid values for inventory filters🔍
inventory_hardware_list/inventory_software_list— all detected hardware/software🔍
inventory_installed_software_list— software installed on one computer🔍
inventory_licenses_list/inventory_license_software_list— license records and compliance🔍
inventory_prohibited_software_list— prohibited software and where it's installed🔍
inventory_scan_computers_list— per-computer inventory scan status🔍
inventory_software_metering_summary— metering rules with usage metrics🔍
inventory_computers_by_software/_by_hardware/_with_metering/_by_licensed_software/_by_license/_by_prohibited_software— computers matching a specific inventory entity✏️
inventory_scan_computers/inventory_scan_all_computers— trigger an asset scan (write-gated)
🔍
patch_summary— installed/missing/applicable counts and severity breakdown🔍
patch_all_patches_list/patch_all_patch_details— patch catalog and per-patch computer status🔍
patch_all_systems_list— systems with patch health status🔍
patch_scan_details— per-system patch scan status🔍
patch_system_report— every patch applicable to one computer🔍
patch_deployment_policies_list/patch_view_config— deployment templates and configurations🔍
patch_downloaded_patches_list/patch_supported_patches_list— downloaded binaries, supported catalog🔍
patch_approval_settings/patch_health_policy/patch_db_update_status— module settings and DB refresh status🔍
patch_apd_tasks_list— Automatic Patch Deployment tasks (source of thetask_namethe APD action tools need)
✏️
patch_approve/patch_unapprove/patch_decline— patch approval workflow✏️
patch_scan_computers/patch_scan_all_computers— trigger patch scans✏️
patch_install_on_all_systems/patch_install_on_specific_systems/patch_install_all_missing_on_systems— create/deploy install configurations🗑️
patch_uninstall— deploy an uninstall-patch configuration✏️
patch_download— stage patch binaries on the server without installing them✏️
patch_db_update— refresh the server's patch/vulnerability catalog✏️
apd_task_create/apd_task_modify/apd_task_suspend/apd_task_resume— Automatic Patch Deployment task lifecycle🗑️
apd_task_delete— permanently delete an APD task
🔍
threats_vulnerabilities_list— network-wide CVEs with severity/CVSS, exploit status🔍
threats_vulnerability_computers_detail— cursor-paged vulnerability-to-computer bulk export🔍
threats_patches_list— applicable patches from the threats module🔍
threats_server_misconfigurations_list/threats_system_misconfigurations_list— hardening findings🔍
threats_system_report(+_patches,_vulnerabilities,_server_misconfigurations,_system_misconfigurations) — per-system threat drill-downs
🔍
bitlocker_reports_list— drive-level encryption status🔍
bitlocker_recovery_key_details— recovery key records (key material excluded from default output; requiresraw: true)🔍
bitlocker_tpm_report— TPM presence/version details
🔍
dcm_device_audit_list/dcm_block_device_audit_list— device activity and blocked-device events🔍
dcm_device_summary_list— unique devices detected in the network🔍
dcm_computer_device_status_list/dcm_mac_computer_device_status_list— per-computer device control status🔍
dcm_device_exemption_list/dcm_device_type_exemption_list— temporary exemptions🔍
dcm_file_trace_list/dcm_file_shadow_list— file activity and shadow-copy operations
🔍
dlp_endpoint_activity_report— DLP activities on endpoints🔍
dlp_justification_report— user business justifications for overrides🔍
dlp_network_cbfp_report/dlp_network_dcfp_report— reported false positives🔍
dlp_network_rules_report/dlp_network_device_report/dlp_network_email_report/dlp_network_printer_report/dlp_network_usb_printer_report/dlp_network_product_report/dlp_network_web_domain_report— deployed DLP entities with custom-group associations
🔍
reports_query_reports_list/reports_query_report_data— SQL query reports and their rows🔍
reports_custom_reports_list/reports_custom_report_data— custom report views and their rows🔍
customgroup_list— custom groups with type and member counts🔍
server_properties— domains, custom groups, and branch offices managed by the server🔍
server_discover— login configuration: AD domains enabled, default domain, local-auth-only flag. The one endpoint needing no authentication, so it still answers when your token is wrong.
🔍
custom_column_data_types_list/custom_column_udt_length/custom_column_udt_name_exists— custom data type metadata🔍
custom_field_values_get/custom_field_metadata_list— per-resource custom field values and metadata✏️
custom_column_add/custom_column_modify/custom_column_value_modify/custom_column_data_type_create— write-gated field management✏️
custom_field_computer_update— update field values on one computer🗑️
custom_column_remove— delete a custom field and its stored values
(File-upload endpoints — FILE-type field uploads and bulk CSV import — are intentionally not implemented; they require multipart uploads outside this server's JSON-only HTTP client.)
🔍
dex_addon_info/dex_meta— DEX module status and configuration🔍
dex_device_experience/dex_device_experience_metrics— per-device scores and indicator breakdowns🔍
dex_latest_experience_scores— latest score for a profile🔍
dex_last_score_update_time/dex_next_score_update_time— score generation schedule
On-prem parity. Most of this surface is confirmed against ManageEngine's on-premise API reference: SoM, Inventory, Patch, Threats/Vulnerability, BitLocker, Device Control, DLP, and server properties/discovery all appear there.
Four groups are not in the on-prem reference and were built from the broader published spec — treat them as unverified until you check your own server's Admin → Integrations → API Explorer: DEX (
/intelligence/api/*), custom fields/columns (/dcapi/customColumn,/dcapi/customFields), query & custom reports (/dcapi/reports/*), and custom groups (/api/1.4/customgroup/getCGList). Absence from the docs isn't proof of absence from your build — ManageEngine states the published list is partial — but these are where a 404 is most likely.Conversely, several tools here are on-premise only and have no cloud equivalent:
patch_apd_tasks_list,patch_db_update,patch_download. Mobile Device Management has its own on-prem API that this server does not cover yet.
Working with results
Pagination: list tools accept
pageandpageLimit. Results include a note like "Showing 50 of 3210 total (page 1). 3160 more available — call again with page: 2." so the model knows how to continue.Curated fields: list responses are projected to the most useful fields by default. Pass
raw: trueto any list tool for the complete, unprojected records.Mutating tools: only exist when
ENDPOINT_CENTRAL_ENABLE_WRITE_TOOLS=true, and each call must includeconfirm: trueor it is refused with an explanation before any network request is made.
Security model
This server follows MCP security best practices; the design decisions in short:
Measure | What it does |
Read-only default | Write tools are not registered unless explicitly enabled — least privilege at the tool-surface level. |
Per-call confirm gate | Every mutating tool requires |
Tool annotations |
|
Token hygiene | The token is read once from the environment, used only for the |
RBAC-scoped account | Recommended setup binds the token to a dedicated least-privileged service account, bounding blast radius if it leaks. |
SSRF guard | HTTP-layer refuses absolute URLs/protocol-relative paths; tools may only call hardcoded relative API paths against the one configured host. Dynamic path segments are allowlist-validated. |
TLS verification always on | Internal CAs are supported via an additional trust anchor, never by disabling verification. |
No secrets in the repo |
|
Additional deployment recommendations:
Run the server on a host/network segment that is allowed to reach the Endpoint Central console anyway; the server initiates connections only to
ENDPOINT_CENTRAL_BASE_URL.Prefer the read-only default in day-to-day use; enable write tools only in sessions where remediation is intended, then turn them back off.
BitLocker recovery keys are secrets — the recovery-key tool keeps key material out of its default output; only request it when genuinely needed.
Review your MCP client's permission settings so destructive-annotated tools always prompt.
Troubleshooting
Symptom | Likely cause / fix |
Startup fails: | Set |
Server never starts: | The client can't resolve |
| Wrong base URL/port, firewall, or TLS failure. For internal CAs set |
| Token invalid or revoked — regenerate under Admin → Integrations → API Key Management. |
| The token's account lacks the RBAC role for that module — adjust in Admin → User Administration. |
A tool from the docs is missing | Write tools require |
| Stale |
Mutating call returns "requires confirm: true" | Working as intended — repeat the call with |
Command not found or spawn ENOENT
MCP clients launched from a desktop icon don't inherit your shell's PATH, so node or npx may not resolve even though they work in your terminal. This affects whichever command you name, so it isn't a reason to prefer one over the other. Use an absolute path to the binary:
which node # e.g. /home/you/.local/bin/node{ "command": "/home/you/.local/bin/node", "args": ["/abs/path/to/dist/index.js"] }If you use nvm, there's a second trap: npx can resolve to an older Node than the one you tested with. Point at the binary inside the version you want (~/.nvm/versions/node/v22.x.x/bin/…). This server needs Node ≥ 18.
Development
npm run typecheck # tsc --noEmit
npm run build # tsc -> dist/ (also runs automatically on npm install)
npm run dev # tsx src/index.ts
npm run test:smoke # stdio smoke test in both modes (no real server needed):
# verifies read-only mode exposes zero write tools, all tools
# carry annotations, the confirm gate fires before network I/O,
# and the token never leaks into error outputProject layout:
src/
index.ts # entrypoint: config check, McpServer + stdio transport
config.ts # env-var config (validated once, cached)
httpClient.ts # undici-based client: auth header, custom CA, SSRF guard
errors.ts # API error mapping + confirm-gate helper
shaping.ts # response projection + pagination notes
tools/
annotations.ts # shared READ_ONLY / WRITE / DESTRUCTIVE annotations
som.ts … # one module per API area, registered in tools/index.ts
spec/oas-dc.json # OpenAPI reference — not committed, see AGENTS.mdContributions should follow the conventions in AGENTS.md — notably: response shaping for every list tool, assertConfirmed + write-gating for every mutating tool, and relative-literal API paths only.
CI runs typecheck plus the smoke test on Node 18, 20, and 22 for every push and pull request.
The OpenAPI spec used as a development reference is not included in this repo — it is ManageEngine's proprietary document. See AGENTS.md for how to obtain it; nothing in the build or test suite requires it.
License
MIT © hdyrawan
This is an independent, unofficial integration. ManageEngine, Endpoint Central, and related marks are trademarks of Zoho Corporation, which does not endorse, sponsor, or support this project. Product names are used only to identify the API this server talks to.
Available Tools
86 toolsbitlocker_recovery_key_detailsBitLocker recovery key detailsARead-only
Retrieves BitLocker recovery key records (key protector ID, drive letter, computer, domain) for managed computers, filterable by key protector ID, computer name, or domain. SENSITIVE: this endpoint returns BitLocker recovery keys — secrets that unlock encrypted drives. Only use it when key retrieval is genuinely needed (e.g. recovering a locked-out drive), never for routine reporting. The default response deliberately omits the recovery_key field; set raw: true to expose the actual key material.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Set to true to include the recovery_key field (the actual BitLocker recovery password) in each record. Off by default so key material is never exposed unless genuinely required. | |
| compName | No | Filter by computer name. | |
| domainFilter | No | Filter by NetBIOS domain name. | |
| keyProtectorId | No | Filter to a single key protector by its key protector ID (GUID). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds critical context beyond the readOnlyHint annotation by warning that this endpoint returns sensitive secrets and explaining the default omission of the recovery_key field. It also discloses that setting raw: true exposes the actual key material, which is essential behavioral information for safe use.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences, each earning its place: the first states the core function and filters, the second warns about sensitivity and appropriate usage, and the third explains the default behavior and raw flag. It is front-loaded and free of unnecessary wording.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 4-parameter sensitive tool with no output schema, the description covers the returned fields, filters, and the critical raw flag behavior. It provides enough context for an agent to decide when to use it and how to invoke it correctly, including the security implications.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents all four parameters with descriptions, so the baseline is 3. The description adds value by explicitly naming the three filterable fields and providing extra context about the raw parameter—clarifying that it controls exposure of the actual key material and defaults to false.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Retrieves BitLocker recovery key records' specifying the exact resource and action, then details the fields returned (key protector ID, drive letter, computer, domain) and filter options. This clearly distinguishes it from sibling tools like bitlocker_tpm_report by focusing specifically on recovery key material.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use the tool ('Only use it when key retrieval is genuinely needed') and when not to ('never for routine reporting'), which is strong guidance. However, it stops short of naming specific alternative tools for routine reporting, so it does not fully satisfy the 'vs alternatives' criterion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
bitlocker_reports_listList drive-level BitLocker reportsARead-only
Retrieves drive-level BitLocker encryption details across managed computers: encryption status, protection status, encryption method, lock status, drive letter, and drive size per volume. Supports filtering by computer resource_id or domain.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each drive instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| residFilter | No | Filter to a specific computer by its resource_id (from som_computers_list). | |
| domainFilter | No | Filter by NetBIOS domain name. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds value by enumerating the returned fields, but it does not reveal additional behavioral traits such as pagination behavior, rate limits, or whether results are ordered. With annotations present, this is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, entirely focused and front-loaded. The first sentence states exactly what is retrieved, and the second sentence covers filtering. No redundant or filler content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description does a good job of listing the returned fields, which is essential for a report tool. It also mentions filtering options. However, it does not describe the return format (e.g., list, count, pagination) beyond the schema parameters. For a simple list tool with well-documented parameters, this is nearly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Since schema description coverage is 100%, the baseline is 3. The description mentions filtering by resource_id or domain but does not add significant meaning beyond what the schema already provides for each parameter. It does highlight the two filter options, which is a minor enhancement.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Retrieves') and identifies a precise resource ('drive-level BitLocker encryption details') with a list of concrete fields. It clearly distinguishes itself from siblings like bitlocker_recovery_key_details and bitlocker_tpm_report by focusing on drive-level encryption status and supporting filtering.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: it retrieves drive-level BitLocker details across managed computers and supports filtering by resource_id or domain. While it does not explicitly contrast with alternative tools, the field list and scope make its intended use clear. No exclusions are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
bitlocker_tpm_reportTPM reportARead-only
Retrieves Trusted Platform Module (TPM) details across managed computers: manufacturer, version, spec version, and whether the TPM is enabled, activated, and owned. Supports filtering by computer resource_id or domain.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each computer instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| residFilter | No | Filter to a specific computer by its resource_id (from som_computers_list). | |
| domainFilter | No | Filter by NetBIOS domain name. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is clear. The description adds that it retrieves specific TPM fields across computers, but does not disclose additional behavior like pagination behavior or permissions beyond what is implied by the read-only annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the core purpose and followed by the filtering scope. It contains zero wasteful words and is easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only report tool with annotations, the description covers the returned fields and filtering options. It does not explain pagination or the raw parameter, but those are documented in the schema, so the gap is minor.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents all five parameters. The description only restates filtering by resource_id or domain, which adds no new semantics beyond the schema's parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Retrieves') and resource ('TPM details across managed computers'), listing the fields returned. It is clearly distinct from siblings like bitlocker_recovery_key_details and bitlocker_reports_list because of the TPM focus, though it does not explicitly name alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions filtering by resource_id or domain, giving some usage context, but does not explicitly state when to use this tool versus other bitlocker-related tools or provide exclusion criteria. Usage is implied rather than explicitly directed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
custom_column_data_types_listList custom data typesARead-only
Retrieves the list of existing custom data type names defined for custom fields, and whether any custom data types exist at all. Useful before creating or updating custom fields.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds value by specifying the exact returned information: a list of custom data type names and a boolean indicating whether any exist. This is useful behavioral context, especially given the absence of an output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise: two sentences, front-loaded with the action verb 'Retrieves,' and every word adds value. It avoids repeating schema details and provides no unnecessary filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has zero parameters, no output schema, and helpful annotations, the description fully covers what is needed: what the tool does, when to use it, and what it returns. It is a complete and self-contained description for this simple list operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline score is 4 per the rubric. The schema shows no properties, and the description correctly implies that no inputs are needed, so no additional parameter semantics are required.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: retrieving existing custom data type names for custom fields and indicating whether any exist. This is a specific verb+resource combination that effectively distinguishes it from sibling tools like custom_column_udt_name_exists and custom_column_udt_length.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly notes the tool is 'Useful before creating or updating custom fields,' providing clear context for when to invoke it. It does not explicitly exclude alternatives or state when not to use it, but for a simple read-only list tool this is adequate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
custom_column_udt_lengthGet user data type lengthARead-only
Retrieves the maximum number of characters allowed for the user data type of a specific custom field.
| Name | Required | Description | Default |
|---|---|---|---|
| tableName | Yes | Backing table of the custom field: ManagedComputerCustomFields for fields created in the Computer view, InvSWCustomFields for fields created in the Software view, MspCustomerCustomFields for MSP customer fields. | |
| actualColumnName | Yes | The actual (internal) column name of the custom field, e.g. COL301 — obtain it from the columnName key returned by custom_field_metadata_list. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds some context about the 'maximum number of characters allowed,' but does not disclose return format, error behavior, or prerequisites beyond what the schema supplies. It meets the baseline but doesn't exceed it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, compact sentence that front-loads the verb and resource. It avoids wordiness, though it is fairly terse and could optionally include a note about needing the internal column name (which is already in the schema).
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description and schema together give a clear picture for a simple read-only lookup, and the return value (maximum character count) is implied. However, there is no output schema and no mention of edge cases like missing fields or invalid table names, leaving some gaps for an agent to fully invoke and interpret results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents both parameters with type, enum, and example. The description adds no additional parameter-level meaning, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'retrieves' and clearly defines the resource: 'the maximum number of characters allowed for the user data type of a specific custom field.' This distinguishes it from sibling tools that deal with existence checks or listing data types, though it doesn't explicitly name them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool (for a specific custom field's type length), but provides no explicit guidance on when to use it over alternatives like custom_column_udt_name_exists or custom_field_metadata_list. There are no exclusions or alternative recommendations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
custom_column_udt_name_existsCheck custom data type name existenceARead-only
Checks whether a custom (user) data type with the given name is already defined in the system.
| Name | Required | Description | Default |
|---|---|---|---|
| udtName | Yes | The name of the custom data type to check for existence. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is known. The description adds that this is a pure existence check, but does not disclose any additional behavioral traits such as return format, case sensitivity, or partial matching behavior. No contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, 18 words, front-loaded with the action. Every word earns its place; no fluff or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple 1-parameter predicate tool with read-only annotations, the description is adequate. It states what it checks and the target resource. It does not mention the return value, but the tool name and description strongly imply a boolean result; given the simplicity, this is acceptable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter udtName is fully described in the schema (100% coverage), with the description 'The name of the custom data type to check for existence.' The tool description adds no extra parameter semantics beyond this, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Checks whether') and clearly identifies the resource (custom user data type name existence). It distinguishes itself from sibling tools like custom_column_data_types_list (which lists types) and custom_column_udt_length (which returns length) by focusing on existence checking.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for verifying existence of a custom data type name before other operations, but it does not explicitly state when to use it vs alternatives or mention any exclusions. The context is clear from the phrasing 'is already defined in the system.'
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
custom_field_metadata_listList custom field metadata for a computerARead-only
Retrieves the custom field metadata linked to a specific computer: display name, actual column name (e.g. COL301), data type, max allowed size, input format, default and current values, and PII flag. Use this to discover the actualColumnName needed by the custom column modify/remove tools.
| Name | Required | Description | Default |
|---|---|---|---|
| resourceId | Yes | Numeric resource_id of the computer (from som_computers_list). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds useful behavioral context by enumerating the returned metadata fields and clarifying that it is linked to a specific computer. However, it does not disclose potential pitfalls like pagination, authorization, or error behavior, so the added value beyond annotations is moderate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, front-loaded with the primary function, and every clause adds value. It includes concrete examples (COL301) and a clear downstream application without any filler. This is a model of concise, informative tool documentation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only metadata retrieval tool with one parameter and full schema coverage, the description is nearly complete. It explains what data will be returned and why the tool matters for downstream operations. The absence of an output schema is mitigated by the explicit list of fields. It lacks only minor details like error conditions or pagination, which are less critical given the tool's narrow, read-only scope.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides 100% coverage for the single parameter resourceId, including a description that it is the numeric resource_id from som_computers_list. The tool description does not add further parameter-specific details beyond referring to a 'specific computer', so the schema carries the heavy lifting. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Retrieves' and identifies the exact resource: 'custom field metadata linked to a specific computer'. It lists the key data fields (display name, actual column name, data type, etc.), making the tool's function unmistakable. It also distinguishes itself from sibling tools by explaining its role in discovering actualColumnName for modify/remove tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use the tool: 'Use this to discover the actualColumnName needed by the custom column modify/remove tools.' This provides clear context for the tool's primary purpose. It does not mention alternatives or exclusions, but the explicit use case is strong enough for a 4.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
custom_field_values_getGet custom field values for a resourceARead-only
Retrieves the custom field values linked to a specific resource (owner, location, product number, shipping/expiry dates, notes, search tag, and any user-defined fields).
| Name | Required | Description | Default |
|---|---|---|---|
| resourceId | Yes | Numeric resource ID: a computer's resource_id (from som_computers_list) for computer-view fields, or a software_id (from the inventory software list) for software-view fields. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the agent knows it is a safe read operation. The description adds value by specifying the exact scope of the retrieved data (owner, location, product number, shipping/expiry dates, notes, search tag, user-defined fields), which goes beyond the annotation hints. No contradictions; the 'Retrieves' verb aligns with read-only behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that immediately states the verb and resource. It includes examples in parentheses without excess verbosity. Every word contributes to understanding the tool's function. No filler or redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (one parameter, no output schema, strong annotations), the description is reasonably complete. It covers what the tool retrieves and the resource type. It could optionally mention that the resource can be a computer or software, but this is already in the schema description. Overall, sufficient context for an agent without being verbose.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema description for resourceId is detailed, explaining it expects either a computer resource_id or a software_id. The tool description does not add any additional parameter semantics beyond 'specific resource', so with high schema coverage a baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Retrieves' and clearly identifies the resource: 'custom field values linked to a specific resource'. It lists example fields (owner, location, product number, etc.), making it distinct from sibling tools like custom_field_metadata_list which lists metadata, and custom_column_udt_name_exists which checks UDT names. This provides unambiguous purpose and distinguishes from likely alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage: when you need custom field values for a specific resource, such as a computer or software. It provides context by listing example field categories. However, it does not explicitly mention when not to use it or reference alternatives, but the context is clear enough for an agent to select it for retrieving field values rather than metadata or other report tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
customgroup_listList custom groupsARead-only
Retrieves all custom groups with their group ID, name, type (e.g. Computers), category (e.g. Static, Dynamic), associated domain, and creation/modification timestamps (epoch millis).
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return full unprojected group records instead of the curated default field set. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is clear. The description adds context that it returns 'all' custom groups (implying no filtering and possibly large result), plus the field set and epoch millis timestamps. However, it does not discuss pagination, performance, or the behavior of the 'raw' parameter beyond what the schema already states.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one sentence that is information-dense without redundancy. It front-loads the action ('Retrieves') and resource ('all custom groups') and packs the field list into a single clause. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with one optional parameter and no output schema, the description covers the essential return fields and their formats (e.g., epoch millis). It does not mention pagination or response envelope, but for this level of complexity the description is largely complete. Slight deduction for not specifying if all results are returned in one response or paginated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema fully describes the single optional 'raw' parameter (coverage 100%), so the baseline is 3. The description adds no parameter-specific meaning beyond what the schema provides, which is acceptable given the high coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves all custom groups and enumerates the exact fields returned (ID, name, type, category, domain, timestamps). The verb 'retrieves' is specific, and the resource 'custom groups' distinguishes it from sibling reporting tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage (when you need to list custom groups) from the verb and resource, but it does not explicitly state when not to use it or mention alternatives among the many sibling list/report tools. No exclusions are provided, so guidance remains at the implied level.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dcm_block_device_audit_listList blocked device auditARead-only
Retrieves all devices that were blocked across the network (Device Control Management): device type, vendor/product, serial number, user, computer, and insert/remove times. Supports filters for time period, computer, group, device type, OS platform, and domain.
| Name | Required | Description | Default |
|---|---|---|---|
| gid | No | Filter to a custom group of computers by its group ID (from the custom group list API). | |
| raw | No | Return full, unprojected records instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| dipId | No | Filter by device instance path. | |
| domain | No | Filter by NetBIOS domain name. | |
| period | No | Filter by time range: 0 this week, 1 this month, 2 this year, 3 last week, 4 last month, 5 last 2 months, 6 last 3 months, 7 last 6 months, 8 last 9 months, 9 last year. | |
| computer | No | Filter to a specific computer by its resource_id (from som_computers_list). | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| deviceType | No | Filter by device type: 2 biometric, 3 Bluetooth, 4 CD-ROM, 5 disk drive, 9 floppy disk, 19 image, 20 infrared, 21 keyboard, 24 modem, 26 mouse, 37 printer, 42 smart card reader, 46 tape drive, 49 WPD, 100 WPD Apple devices, 102 serial ports (COM), 103 parallel ports (LPT), 104 wireless adapters. | |
| osPlatform | No | Filter by OS platform: 1 Windows, 2 Mac. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile. The description adds useful context about the returned fields and filters, but does not disclose additional behaviors such as pagination limits, rate limits, or response structure. This is consistent with the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences: the first describes the tool's purpose and output fields, the second lists filters. Every word contributes value; no redundancy or filler. Perfectly front-loaded and concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 10 parameters, no required fields, and no output schema, the description provides a solid overview of the return fields and filter capabilities. It does not explicitly mention pagination or the 'raw' option, but those are documented in the schema, so the description is sufficiently complete for a read-only list tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema covers 100% of parameters with detailed descriptions, so the baseline is 3. The description repeats the filter names (time period, computer, group, device type, OS platform, domain) but adds no additional meaning or constraints beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it retrieves all devices blocked across the network (Device Control Management), listing the exact fields returned (device type, vendor/product, serial number, user, computer, insert/remove times). This distinguishes it from sibling tools like dcm_device_audit_list, which likely lists all device audits rather than blocked ones.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use this tool (when blocked device audit data is needed) and enumerates the supported filters. However, it does not explicitly state alternatives or when not to use it, which would elevate it to a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dcm_computer_device_status_listList Windows computer device statusARead-only
Retrieves per-computer device control status for all Windows computers: one record per computer with a status ID for each device class (disk drive, CD-ROM, WPD, Bluetooth, printer, etc.). Curated default omits legacy port classes; use raw: true for every device class.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return full, unprojected records instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, and the description adds useful behavioral context: it explains the curated default omits legacy port classes and the impact of 'raw: true'. This goes beyond the annotation safety profile without contradicting it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, both informative: the first gives the core purpose and output shape, the second clarifies the curated vs raw behavior. No wasted words, and the front-loaded main clause makes it easy to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This list tool has no output schema, so the description carries the burden of explaining return values. It does so partially (per-computer, one record, status ID per device class, example classes), which suffices for basic use but doesn't enumerate all possible fields or response paging details. Given the simplicity of the tool, this is adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema coverage, the schema already documents each parameter. The description adds specific meaning to the 'raw' parameter by explaining the curated default versus raw mode, which is valuable beyond the schema's generic 'full, unprojected records' description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('retrieves'), resource ('device control status'), and scope ('for all Windows computers'), and further details the output shape (one record per computer with a status ID for each device class). This clearly distinguishes it from sibling tools like dcm_mac_computer_device_status_list, which targets Mac computers.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: this is for Windows computers, and the 'raw: true' option is explicitly noted for retrieving every device class. However, it does not explicitly name alternatives or state when not to use this tool, though the sibling list implies the Mac counterpart for Mac devices.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dcm_device_audit_listList device activity auditARead-only
Retrieves all device activity events detected across the network (Device Control Management): device type, vendor/product, serial number, user, computer, insert/remove times, and whether access was blocked. Supports filters for time period, computer, group, device type, block status, OS platform, and domain.
| Name | Required | Description | Default |
|---|---|---|---|
| gid | No | Filter to a custom group of computers by its group ID (from the custom group list API). | |
| raw | No | Return full, unprojected records instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| dipId | No | Filter by device instance path. | |
| domain | No | Filter by NetBIOS domain name. | |
| period | No | Filter by time range: 0 this week, 1 this month, 2 this year, 3 last week, 4 last month, 5 last 2 months, 6 last 3 months, 7 last 6 months, 8 last 9 months, 9 last year. | |
| computer | No | Filter to a specific computer by its resource_id (from som_computers_list). | |
| isBlocked | No | Filter by block status: 0 allowed, 1 blocked. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| deviceType | No | Filter by device type: 2 biometric, 3 Bluetooth, 4 CD-ROM, 5 disk drive, 9 floppy disk, 19 image, 20 infrared, 21 keyboard, 24 modem, 26 mouse, 37 printer, 42 smart card reader, 46 tape drive, 49 WPD, 100 WPD Apple devices, 102 serial ports (COM), 103 parallel ports (LPT), 104 wireless adapters. | |
| osPlatform | No | Filter by OS platform: 1 Windows, 2 Mac. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, and the description adds context by specifying the network-wide scope and the types of events returned. However, it does not disclose behavioral aspects like pagination behavior or that the list may span multiple pages despite the 'all events' wording, leaving some transparency gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that states the main purpose first, then lists the content and filters. Every word contributes; there is no fluff or redundant restatement of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 11 parameters, no output schema, and no nested objects, the description covers the key return fields and filter options, making it clear what the tool does at a high level. It doesn't explicitly mention pagination defaults or response shape, but the schema covers the parameters and the annotations cover safety, so it is nearly complete. The only gap is the absence of an explicit note about paginated results, which is minor given the presence of page/pageLimit in the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers 100% of the 11 parameters with descriptions, so the baseline is 3. The description summarizes the filter categories (time period, computer, group, device type, block status, OS platform, domain) without adding details beyond the schema. It adds no new parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with a specific verb ('Retrieves') and resource ('device activity events') within a clear domain ('Device Control Management'), then enumerates the fields returned and the filter options. It distinguishes itself from sibling tools like dcm_block_device_audit_list by covering all events, not just blocked ones.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use it: when you need to retrieve device activity events with optional filters. However, it does not explicitly mention alternatives or exclusions (e.g., 'for blocked events only, use dcm_block_device_audit_list'). The context is clear but no direct comparison to sibling tools is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dcm_device_exemption_listList temporarily exempted devicesARead-only
Retrieves devices granted temporary exemptions from device control policies, with the policy, target computer/user, exemption window, and status. Supports filters for time period, OS platform, device type, exemption status, and domain.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return full, unprojected records instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| domain | No | Filter by NetBIOS domain name. | |
| period | No | Filter by time range: 0 this week, 1 this month, 2 this year, 3 last week, 4 last month, 5 last 2 months, 6 last 3 months, 7 last 6 months, 8 last 9 months, 9 last year. | |
| status | No | Filter by exemption status: 0 yet to apply, 1 awaiting schedule, 2 active, 3 expired. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| deviceType | No | Filter by device type: 2 biometric, 3 Bluetooth, 4 CD-ROM, 5 disk drive, 9 floppy disk, 19 image, 20 infrared, 21 keyboard, 24 modem, 26 mouse, 37 printer, 42 smart card reader, 46 tape drive, 49 WPD, 100 WPD Apple devices, 102 serial ports (COM), 103 parallel ports (LPT), 104 wireless adapters. | |
| osPlatform | No | Filter by OS platform: 1 Windows, 2 Mac. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already disclose readOnlyHint=true and destructiveHint=false, so the agent knows this is a safe read operation. The description adds value by detailing the content of the response (policy, target computer/user, exemption window, status) and the filtering capabilities, which goes beyond the basic safety profile. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core purpose and return fields. Every word earns its place; no redundant or vague phrasing. Excellent conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a list tool with 8 optional parameters, full schema descriptions, and read-only annotations, the description is complete: it states what is retrieved, the key result fields, and the available filters. Even without an output schema, the return field list gives a clear expectation of the response shape.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all 8 parameters are already fully documented with descriptions and enums. The description's mention of filters (time period, OS platform, device type, exemption status, domain) restates the schema's parameter names without adding new semantics. Baseline 3 is appropriate when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Retrieves') and clearly identifies the resource ('devices granted temporary exemptions from device control policies'). It also lists the key fields returned (policy, target computer/user, exemption window, status), which distinguishes it from sibling tools like dcm_device_type_exemption_list that focus on device types rather than individual devices.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description specifies the available filters (time period, OS platform, device type, exemption status, domain), implicitly telling the agent when to use this tool: when listing temporarily exempted devices with those filtering needs. It does not explicitly name alternatives or exclusions, but the context is clear enough given the sibling tool names.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dcm_device_summary_listList unique devices detectedARead-only
Retrieves the list of unique devices detected in the network (Device Control Management), with connection counts, last occurrence, and block status per device. Supports filters for OS platform, device type, and block status.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return full, unprojected records instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| isBlocked | No | Filter by block status: 0 allowed, 1 blocked. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| deviceType | No | Filter by device type: 2 biometric, 3 Bluetooth, 4 CD-ROM, 5 disk drive, 9 floppy disk, 19 image, 20 infrared, 21 keyboard, 24 modem, 26 mouse, 37 printer, 42 smart card reader, 46 tape drive, 49 WPD, 100 WPD Apple devices, 102 serial ports (COM), 103 parallel ports (LPT), 104 wireless adapters. | |
| osPlatform | No | Filter by OS platform: 1 Windows, 2 Mac. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds behavioral context by specifying the output fields (connection counts, last occurrence, block status) and supported filters, which goes beyond what annotations alone convey. It does not mention pagination or response structure, but the schema covers page/pageLimit.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the primary verb and resource, and every phrase adds value: scope, returned fields, and available filters. There is no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only summary list tool with no output schema, the description adequately covers the tool's purpose, key returned data, and filter options. It does not explicitly describe the response envelope (e.g., pagination metadata), but the schema and annotations fill in most gaps, making it reasonably complete for the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and each parameter already has a detailed description, including enums with values. The description only paraphrases the schema's filter parameters ('OS platform, device type, and block status') without adding new meaning or usage details, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Retrieves the list of unique devices detected in the network' with a specific verb and resource. It distinguishes from sibling DCM tools by emphasizing 'unique devices' and including connection counts, last occurrence, and block status, which are summary-level fields not mentioned in other tool names.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for getting a summary of unique devices, but it does not explicitly contrast with alternatives like dcm_device_audit_list or dcm_computer_device_status_list. No when-not-to-use guidance or sibling references are provided, leaving the agent to infer appropriate usage from the tool name and context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dcm_device_type_exemption_listList temporarily exempted device typesARead-only
Retrieves device types (whole classes, e.g. all disk drives) granted temporary exemptions from device control policies, with the policy, target computer/user, exemption window, and status. Supports filters for time period, OS platform, device type, exemption status, and domain.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return full, unprojected records instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| domain | No | Filter by NetBIOS domain name. | |
| period | No | Filter by time range: 0 this week, 1 this month, 2 this year, 3 last week, 4 last month, 5 last 2 months, 6 last 3 months, 7 last 6 months, 8 last 9 months, 9 last year. | |
| status | No | Filter by exemption status: 0 yet to apply, 1 awaiting schedule, 2 active, 3 expired. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| deviceType | No | Filter by device type: 2 biometric, 3 Bluetooth, 4 CD-ROM, 5 disk drive, 9 floppy disk, 19 image, 20 infrared, 21 keyboard, 24 modem, 26 mouse, 37 printer, 42 smart card reader, 46 tape drive, 49 WPD, 100 WPD Apple devices, 102 serial ports (COM), 103 parallel ports (LPT), 104 wireless adapters. | |
| osPlatform | No | Filter by OS platform: 1 Windows, 2 Mac. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safe-read nature. The description adds the fields returned (policy, target, window, status) but does not disclose other behavioral traits like pagination defaults, sorting, or permission requirements. This is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the core purpose and then lists the key filters. It is concise, information-dense, and free of fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having no output schema, the description provides a complete overview of what is returned (policy, target, window, status) and enumerates all five filter dimensions. The pagination parameters are already covered in the schema, so the description is sufficient for a read-only list tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already explains all 8 parameters. The description only restates filter names (time period, OS platform, device type, exemption status, domain) without adding new semantics or usage context beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Retrieves') and identifies the resource precisely: device types granted temporary exemptions. The parenthetical clarification ('whole classes, e.g. all disk drives') distinguishes it from the sibling tool dcm_device_exemption_list, which likely handles individual device exemptions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when this tool is appropriate by emphasizing device-type-level exemptions rather than individual devices. However, it does not explicitly name alternative tools or provide 'when-not-to-use' guidance, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dcm_file_shadow_listList file shadow operationsARead-only
Retrieves file shadow (mirror copy) operations performed for files transferred to removable devices: source file, shadow path, device, user, computer, and operation status. Supports filters for time period, computer, group, domain, shadow status, and last-N-days activity.
| Name | Required | Description | Default |
|---|---|---|---|
| gid | No | Filter to a custom group of computers by its group ID (from the custom group list API). | |
| raw | No | Return full, unprojected records instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| domain | No | Filter by NetBIOS domain name. | |
| period | No | Filter by time range: 0 this week, 1 this month, 2 this year, 3 last week, 4 last month, 5 last 2 months, 6 last 3 months, 7 last 6 months, 8 last 9 months, 9 last year. | |
| status | No | Filter by file shadow status: 1 yet to start, 2 excluded, 3 wait, 4 ready, 5 in progress, 6 success, 7 failed, 8 cancelled. | |
| computer | No | Filter to a specific computer by its resource_id (from som_computers_list). | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| numberOfDays | No | Only include activity from the last N days. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile. The description accurately describes a read-only retrieval operation without contradiction. It does not add extra behavioral context like pagination quirks or authorization requirements, but for a simple list tool this is adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is exactly two sentences: the first states the core purpose and returned fields, the second lists supported filters. It is front-loaded, uses no redundant words, and every phrase adds value without being verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description explicitly lists the returned fields (source file, shadow path, device, user, computer, status), which is essential. It also covers all filter dimensions supported by the parameters. It does not detail pagination or default behaviors, but those are documented in the schema, so the description is sufficiently complete for the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all parameters are already documented with detailed descriptions (e.g., period, status, pageLimit). The description's mention of 'filters for time period, computer, group, domain, shadow status, and last-N-days activity' maps directly to schema properties but adds no new meaning beyond grouping them. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Retrieves' and clearly identifies the resource as 'file shadow (mirror copy) operations' performed for files transferred to removable devices. It enumerates the returned fields and filters, making its purpose unambiguous and distinct from sibling tools like dcm_file_trace_list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly establishes the context for use: when you need to list shadow operations for removable-device transfers. It mentions available filters, giving practical guidance on narrowing queries. It does not explicitly contrast with alternatives, but its scope is evident; no exclusions are necessary given the siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dcm_file_trace_listList file activitiesARead-only
Retrieves file activities (create, open, modify, delete, rename, move, copy, read) detected on devices across the network: file name/size, event type, process, device, user, and computer. Supports filters for event type, file extension or extension group, block status, device instance path, time period, computer, group, and domain.
| Name | Required | Description | Default |
|---|---|---|---|
| gid | No | Filter to a custom group of computers by its group ID (from the custom group list API). | |
| raw | No | Return full, unprojected records instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| dipId | No | Filter by device instance path. | |
| event | No | Filter by file event type: 0 unknown, 1 create, 2 open, 3 delete, 4 rename, 5 modify, 6 read, 7 move, 8 copy. | |
| domain | No | Filter by NetBIOS domain name. | |
| period | No | Filter by time range: 0 this week, 1 this month, 2 this year, 3 last week, 4 last month, 5 last 2 months, 6 last 3 months, 7 last 6 months, 8 last 9 months, 9 last year. | |
| computer | No | Filter to a specific computer by its resource_id (from som_computers_list). | |
| fileExtn | No | Filter file activities by file extension, e.g. "pdf". | |
| isBlocked | No | Filter by block status: 0 allowed, 1 blocked. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| fileExtnGrp | No | Filter file activities by file extension group. | |
| numberOfDays | No | Only include activity from the last N days. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false; the description adds useful context about the content of returned records (file name/size, event type, process, device, user, computer) and the scope of data (across the network). It does not mention potential edge cases like empty results, but the annotation coverage lowers the burden.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences and about 40 words, front-loaded with the primary action and resource. Every clause adds information: the first sentence defines the data scope, and the second lists the filter options. No redundant words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Without an output schema, the description compensates by listing the returned fields (file name/size, event type, process, device, user, computer) and all the supported filter dimensions (event type, file extension/group, block status, device instance path, time period, computer, group, domain). This gives an agent a complete picture of what the tool returns and how to narrow it down.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All 13 parameters have descriptions in the schema, achieving 100% coverage, so the baseline is 3. The description simply summarizes the filter categories (event type, extension, block status, etc.) but does not add details beyond the schema's per-parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves file activities with a specific verb ('Retrieves') and resource, and enumerates the event types (create, open, modify, delete, rename, move, copy, read). It also lists the data fields returned, which distinguishes it from sibling tools like dcm_device_audit_list and dcm_file_shadow_list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use this tool (when you need file activity events across the network) and is clear on the scope. However, it does not explicitly name alternative tools or state when not to use it, so it misses the highest bar for explicit exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dcm_mac_computer_device_status_listList Mac computer device statusARead-only
Retrieves per-computer device control status for all Mac computers: one record per computer with a status ID for each device class (disk drive, CD-ROM, WPD, Bluetooth, printer, etc.).
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return full, unprojected records instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, and the description's 'Retrieves' aligns with that. The description adds useful behavioral context about the response structure (one record per computer, status ID per device class), which goes beyond the annotations without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that is front-loaded with the key action and resource. No wasted words, and it efficiently conveys the essential purpose and output shape.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the read-only nature, strong annotations, and fully described parameters, the description is largely complete. It explains the return granularity and device classes (with 'etc.' implying more). It lacks explicit pagination behavior, but that is covered by the schema parameters, so the description is adequate for this simple list tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for all three parameters (raw, page, pageLimit). The tool description does not add parameter-specific meaning, but the schema already provides adequate semantics, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves per-computer device control status specifically for Mac computers, with one record per computer and status IDs per device class. It distinguishes from the sibling dcm_computer_device_status_list by explicitly limiting to Mac computers.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The context is clear: use this tool when you need per-computer device control status for Mac computers. It does not explicitly name alternatives or exclusion criteria, but the 'for all Mac computers' phrasing implies its scope and differentiates it from similar siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dex_addon_infoDEX addon statusARead-only
Retrieves the Digital Employee Experience (DEX) addon module status and device counts: moduleStatus (0 disabled, 1 enabled, 2 selectively enabled), total managed devices, and how many devices DEX manages. Useful as a first check that DEX is licensed and active before calling the score tools.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds valuable context by explaining the meaning of moduleStatus values (0/1/2) and the distinction between total managed devices and DEX-managed devices, which goes beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with purpose, and each sentence adds value. It avoids redundancy and is appropriately sized for a simple read-only tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite lacking an output schema, the description covers the essential aspects: what the tool returns (status and device counts), how to interpret moduleStatus, and when to use it. This makes the tool self-contained and complete for its purpose.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. The description correctly focuses on output semantics rather than parameters, explaining the fields and their interpretation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves the DEX addon module status and device counts, with a specific verb and resource. It distinguishes itself from sibling score tools by positioning itself as a preliminary check.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use the tool: 'as a first check that DEX is licensed and active before calling the score tools.' This provides clear usage context and identifies alternatives (score tools) as subsequent steps.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dex_device_experienceDevice experience score and detailsARead-only
Retrieves the DEX experience overview for one device under a score profile: baseline and current experience scores, overall score health (0 poor, 1 average, 2 good, 3 unknown), OS name/version, device name, model, type, platform, last logged-on user, and when the score was last updated.
| Name | Required | Description | Default |
|---|---|---|---|
| scoreProfileId | Yes | Numeric DEX score profile ID. Obtain it from dex_meta (its lastVisitedProfileId field) or from the score profiles configured in the Endpoint Central DEX console. | |
| agentResourceId | Yes | Numeric resource_id of the target computer, from som_computers_list. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is known. The description adds value by enumerating the returned fields, including the score health enum values (0-3), which gives the agent expectations about output structure. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the action and resource, then lists the returned data without unnecessary words. It is concise and information-dense.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool with two well-documented parameters and no output schema, the description covers the key aspects: what it retrieves, the specific fields, and the score health semantics. It does not explain failure scenarios, but the annotations and schema provide sufficient context for invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema contains detailed descriptions for both parameters (scoreProfileId, agentResourceId), including how to obtain them. With 100% schema coverage, the description need not repeat this. The tool description adds minimal extra parameter context beyond the schema, so a baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description begins with a specific verb ('Retrieves') and states the exact resource: 'DEX experience overview for one device under a score profile'. It distinguishes from sibling tools by emphasizing 'one device', which contrasts with metrics or latest scores tools. The listed fields further clarify the scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly implies the tool is for a single device's experience overview, but it does not explicitly name alternatives or say when not to use it. Sibling tools like dex_device_experience_metrics exist, but no comparison is made. Usage context is present but not fully explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dex_device_experience_metricsDevice experience metric breakdownARead-only
Retrieves the indicator-wise DEX metric breakdown for one device under a score profile: for each indicator (e.g. Device Performance, Application Reliability) the individual metrics with their score, health (0 poor, 1 average, 2 good, 3 unknown), display name, and a human-readable summary line. Optionally restrict to only the metrics that currently have issues.
| Name | Required | Description | Default |
|---|---|---|---|
| filterType | No | Which metrics to list: "all" for every metric, or "metricsWithIssues" for only metrics with issues. Defaults to the server's behavior when omitted (all metrics). | |
| scoreProfileId | Yes | Numeric DEX score profile ID. Obtain it from dex_meta (its lastVisitedProfileId field) or from the score profiles configured in the Endpoint Central DEX console. | |
| agentResourceId | Yes | Numeric resource_id of the target computer, from som_computers_list. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds meaningful behavioral context: it explains the health scale (0 poor, 1 average, 2 good, 3 unknown) and that it can optionally restrict to metrics with issues, which goes beyond what annotations convey about the operation's nature.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences that front-load the main verb and object, then detail the return payload and optional filter. No filler words or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description clearly enumerates the returned fields (score, health with numeric mapping, display name, summary line) and the optional restriction. Given the tool's moderate complexity and annotations, this is sufficient for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema already provides rich parameter descriptions (source for scoreProfileId from dex_meta, agentResourceId from som_computers_list). The description only lightly touches on filterType via 'Optionally restrict to only the metrics that currently have issues,' but does not add substantial meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Retrieves the indicator-wise DEX metric breakdown for one device under a score profile', a specific verb+object+scope. It lists the exact contained data (individual metrics with score, health, display name, summary line), making its purpose unambiguous and distinct from summary-level DEX tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states the tool targets one device under a score profile and supports an optional 'metricsWithIssues' filter, giving clear context. However, it does not explicitly name alternative tools (e.g. dex_device_experience) or state when not to use it, though the scope is implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dex_last_score_update_timeLast score processing timeARead-only
Retrieves the most recent time the DEX experience score summary was generated. Useful for judging how fresh the scores returned by the other dex_* tools are.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds semantic context by clarifying that the timestamp represents when the score summary was generated, which is not obvious from the name or title alone. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no fluff. The first sentence states the action and resource, the second explains its practical purpose. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a simple metadata tool with no parameters, no output schema, and annotations that cover safety. The description fully explains what it returns and why it is useful, making it complete for its complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and the schema fully reflects this with an empty properties object. With 0 params, the baseline is 4; the description correctly avoids adding any parameter-specific details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Retrieves' and a precise resource: 'the most recent time the DEX experience score summary was generated.' This clearly distinguishes it from sibling tools like dex_next_score_update_time (future time) and dex_latest_experience_scores (the scores themselves).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states its use case: 'Useful for judging how fresh the scores returned by the other dex_* tools are.' This provides clear contextual guidance and implies these other tools are alternatives. It does not name specific alternatives, but the family reference is sufficient for the agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dex_latest_experience_scoresLatest experience score for a profileARead-only
Retrieves the most recent DEX experience score for a score profile: overall score, health (0 poor, 1 average, 2 good, 3 unknown), baseline score, change from the previous day, and per-category scores (Device Performance, Application Reliability, etc.). Optionally scope the score to a single device, a remote office, or a custom group.
| Name | Required | Description | Default |
|---|---|---|---|
| cgFilter | No | Optional: scope to one custom group by its group ID, from Endpoint Central's custom group listing (/api/1.4/customgroup/getCGList). | |
| resourceId | No | Optional: scope to one device by its resource_id, from som_computers_list. | |
| branchOffice | No | Optional: scope to one remote/branch office by its resource_id, from som_remote_offices_list. | |
| scoreProfileId | Yes | Numeric DEX score profile ID. Obtain it from dex_meta (its lastVisitedProfileId field) or from the score profiles configured in the Endpoint Central DEX console. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the description doesn't need to restate safety. It adds useful behavioral details: the health scale (0 poor, 1 average, 2 good, 3 unknown), inclusion of baseline and daily change, and per-category breakdowns. This goes beyond the annotations without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with a front-loaded purpose and no filler. The first sentence compactly lists return components, and the second adds optional scoping. Every sentence earns its place, and the structure is highly efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given there is no output schema, the description adequately covers return values (overall, health, baseline, change, per-category) and scoping options. It doesn't mention pagination or error handling, but for a single-latest-score tool this is acceptable. It could be a 5 if it explicitly distinguished from sibling DEX tools to aid selection.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents each parameter. The description adds semantic value by grouping the optional parameters as mutually exclusive scope choices ('a single device, a remote office, or a custom group'), which clarifies their relationship. It also reinforces that scoreProfileId is the required anchor.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Retrieves') and clearly identifies the resource ('latest DEX experience score for a score profile'), along with a detailed list of contents (overall score, health, baseline, change, per-category). While it doesn't explicitly distinguish from sibling tools like dex_device_experience, the 'latest' qualifier and field listing give a clear purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context (for retrieving the most recent score) and mentions optional scoping, but it doesn't explicitly state when to use this tool versus alternatives or provide exclusions. With sibling tools like dex_device_experience_metrics present, explicit differentiation would be helpful, but the implied usage is clear enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dex_metaDEX module configurationARead-only
Retrieves DEX module configuration and feature flags: ruleset ID, extension/chatbot/timeline/sentiment status, whether initial score data has been prepared, and lastVisitedProfileId — a score profile ID usable as scoreProfileId in the dex_device_experience, dex_device_experience_metrics, and dex_latest_experience_scores tools.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is known. The description adds value by listing the specific returned fields (ruleset ID, statuses, initial score prepared flag, lastVisitedProfileId) and explaining the cross-tool usability of that ID, which goes beyond the annotation-only information.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single dense sentence that front-loads the purpose and then lists all key output components. Each listed item adds meaning, and there is no filler, though the long enumeration makes it slightly less scannable than ideal.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no parameters and no output schema, the description is fully self-contained: it enumerates every return value and even explains how one return value (lastVisitedProfileId) can be used in sibling tools. Nothing more is needed to invoke or interpret this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, so the schema is trivially fully covered. Per the baseline rule for zero-parameter tools, the description doesn't need to convey parameter meaning, and it correctly provides no irrelevant parameter details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Retrieves') tied to a clear resource ('DEX module configuration and feature flags') and enumerates the exact items returned. It distinguishes itself from sibling DEX tools by focusing on configuration/feature flags and by explaining how lastVisitedProfileId is usable in the other DEX score tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly implies when this tool is relevant — when you need configuration flags or a score profile ID to pass to dex_device_experience, dex_device_experience_metrics, or dex_latest_experience_scores. It provides strong contextual guidance without explicitly naming alternatives or exclusions, which fits the 'clear context, no exclusions' level.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dex_next_score_update_timeNext score processing timeARead-only
Retrieves the scheduled time of the next DEX experience score summary generation — i.e. when the scores returned by the other dex_* tools will next be refreshed.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is known. The description adds useful context about what the time represents (when DEX scores refresh), but does not go further to disclose potential edge cases (e.g., what happens if no schedule exists). This is adequate but not rich beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the purpose and provides an explanatory clause. Every word earns its place, with no redundancy or unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (zero parameters, no output schema, and annotations covering safety), the description is complete. It tells the user exactly what information is retrieved and why it matters, leaving no significant ambiguity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4 per the rubric. The description does not need to add parameter semantics, and the schema is empty. No issues.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Retrieves') and identifies the resource ('scheduled time of the next DEX experience score summary generation'), and clarifies its relationship to other dex_* tools by noting when scores will be refreshed. This clearly distinguishes the tool from siblings like dex_last_score_update_time.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use the tool: when you need to know when DEX scores will next be refreshed. It implies usage but does not explicitly name alternative tools or state when not to use it, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dlp_endpoint_activity_reportDLP endpoint activity reportARead-only
Retrieves all DLP activities performed on endpoints: user, file path, boundary application/domain, Leak Prevention action taken (allowed/blocked/self override/reported false positive), and sensitivity classification details. Supports filtering by action and pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| actionFilter | No | Filter by Leak Prevention action performed: 0 allowed, 1 blocked, 2 self override, 3 reported false positive. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, and the description adds details about returned fields and supported filters. It does not contradict annotations and provides useful scope, though it omits details like response format or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the main purpose and key fields, then mentions filters. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite no output schema, the description lists the data fields returned (user, file path, action, sensitivity) and mentions filtering and pagination, which is complete for a read-only list tool. The schema covers parameter details, so nothing critical is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the description does not need to re-explain parameters. It briefly mentions 'filtering by action and pagination' but adds no new meaning beyond the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Retrieves') and names the resource ('DLP activities performed on endpoints'), listing the key fields. It clearly distinguishes from sibling tools like dlp_network_device_report by focusing on endpoint activities.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context that this tool is for endpoint DLP activities and mentions filtering and pagination. It does not explicitly compare with alternatives, but the word 'endpoints' and sibling naming imply when to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dlp_justification_reportDLP business justification reportARead-only
Retrieves business justification messages provided by endpoint users when overriding DLP restrictions, with the boundary type/value, event type, override comment, and event time. Supports filtering by justification message and pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| justificationMsg | No | Filter to records whose business justification message matches this text. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare readOnlyHint=true and destructiveHint=false, and the description confirms a read-only retrieval. It adds context about the source (endpoint users' override justifications) and the included fields, though it does not disclose pagination limits or matching behavior. The combination of annotations and description provides reasonable transparency without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loads the primary action, and avoids redundancy with the schema. It is efficiently worded with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only report tool with no output schema, the description adequately covers the purpose, key returned fields, filtering, and pagination. It doesn't clarify whether the justification message filter is exact/substring or the default ordering, leaving minor gaps, but the overall definition is sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All four parameters have schema descriptions, covering the pagination and filtering options at 100% coverage. The description reinforces that filtering by justification message and pagination are supported, but it does not add additional semantic detail beyond the schema, warranting the baseline score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as retrieving business justification messages for DLP overrides, listing the specific data fields (boundary type/value, event type, override comment, event time). This specific verb+resource distinguishes it from the many sibling DLP network/endpoint reports, which focus on different aspects.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for accessing DLP override justification data, but it does not explicitly state when to choose this over other DLP reports, nor does it mention any exclusions or alternatives. Context is limited to the tool's own capability rather than comparative guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dlp_network_cbfp_reportDLP perimeter false positives reportARead-only
Retrieves false positives reported by endpoints in the enterprise perimeter (containment boundaries), listing each boundary value (printer, domain, device, ...) with the number of endpoints that raised false positives against it. Supports filtering by boundary type and pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| boundaryType | No | Filter by boundary type: 1 storage devices, 5 network printers, 6 USB printers, 8 web domains, 16 email domains. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the operation as read-only and non-destructive. The description adds that the result is an aggregation (counts per boundary value) rather than raw events, and that it supports pagination and boundary-type filtering, providing context beyond simple read-only status.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences convey the tool's purpose, output structure, and capabilities. The first sentence front-loads the verb and resource; the second succinctly notes filtering and pagination. No filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description carries the burden of explaining return values; it does so by stating each row is a boundary value with the number of endpoints reporting false positives. Combined with annotations for safety and schema-covered parameters, the tool is fully specified for an agent to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All parameters are fully described in the input schema (100% coverage), so the description's mention of 'filtering by boundary type' adds no new detail beyond schema's enum explanations. It does not elaborate on pagination parameters, but schema already covers page/pageLimit defaults and caps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with the verb 'Retrieves' and specifies the exact resource: false positives reported by endpoints in the enterprise perimeter (containment boundaries). It clarifies the output structure (boundary value with endpoint count), which distinguishes it from sibling DLP reports that focus on specific boundary types or confirmed events.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description establishes when to use the tool: to get an aggregate view of false positives by boundary value across the enterprise perimeter. It notes filtering and pagination, but does not explicitly compare against sibling tools like dlp_network_dcfp_report or the per-type reports, so alternatives are not ruled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dlp_network_dcfp_reportDLP data rule false positives reportARead-only
Retrieves false positives reported by endpoints for data rule violations, listing each triggered DLP data rule with the number of endpoints that reported false positives against it. Supports filtering by rule class and pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| ruleClass | No | Filter by data rule class, e.g. "Finance", "PII", "Health", "Source code", "Custom rules". |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Detailed annotations already declare read-only/non-destructive behavior, so the bar for additional transparency is lower. The description adds useful behavioral nuance: results are grouped per triggered DLP data rule with endpoint counts, and it clarifies that filtering and pagination are available. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the core retrieval action and object, and every clause adds value: the aggregate nature, the filter, and pagination. No redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only report with four optional, well-documented parameters and no output schema, the description adequately conveys the response shape (list of rules with endpoint counts) and options. It could lightly note the default field set or the absence of per-endpoint details, but the given info is largely sufficient for tool selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All four parameters are fully described in the schema (100% coverage). The description's mention of 'filtering by rule class and pagination' maps to ruleClass and page/pageLimit but adds no semantic depth beyond what the schema already provides. It does not introduce param dependencies or special values beyond schema examples.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Retrieves false positives reported by endpoints for data rule violations' and clarifies it aggregates counts per rule. This clearly distinguishes it from adjacent DLP network reports (device, email, printer, etc.), which focus on different objects.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides clear context that this is an aggregated false-positive report for data rules and mentions filtering by rule class and pagination. However, it does not explicitly state when to use this over sibling reports or when not to use it, leaving use-case differentiation implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dlp_network_device_reportDLP network devices reportARead-only
Retrieves all hardware devices (by device instance path) known to DLP with their custom group association count. Supports pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile. The description adds useful behavioral context beyond that, including that it retrieves all devices and supports pagination. This is valuable for setting expectations about result size and retrieval pattern.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded, consisting of one clear sentence with a short second sentence about pagination. Every word adds value and there is no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (3 optional params, no output schema, read-only annotations), the description is fairly complete. It explains the core output (hardware devices with group counts) and pagination support. It does not detail return formats, but that is not required given the lack of output schema and the straightforward nature of the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all three parameters (raw, page, pageLimit) are adequately described in the schema. The description adds no extra parameter details, but per the baseline for high schema coverage, a score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool retrieves all hardware devices known to DLP, specifically by device instance path, and includes custom group association count. This is a specific verb+resource combination that distinguishes it from sibling tools like dlp_network_email_report or dlp_network_printer_report.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use for listing DLP hardware devices with group counts, but does not explicitly state when to use this tool over alternatives or mention any exclusions. It provides no explicit alternative guidance, but the purpose is clear enough to infer basic usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dlp_network_email_reportDLP email domains reportARead-only
Retrieves all email domains deployed in DLP policies across the network, with the number of custom groups each domain is associated with. Supports pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With annotations already declaring readOnlyHint=true and destructiveHint=false, the description adds value by specifying that the result is a paginated list and includes custom group counts per domain. It does not introduce any behavioral contradictions, and the read-only nature is consistent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one concise, front-loaded sentence that states the purpose and key output detail. Every word earns its place, with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only list report with no output schema, this description adequately conveys what will be returned (domains and custom group counts) and that pagination is available. Combined with the full schema and annotations, the agent has enough context to select and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema covers 100% of the 3 parameters (raw, page, pageLimit) with detailed descriptions, so the description doesn't need to repeat them. It only mentions pagination in general terms, which aligns with the page and pageLimit parameters, but adds no extra semantic beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the action ('Retrieves'), the resource ('all email domains deployed in DLP policies'), and the unique output aspect ('number of custom groups each domain is associated with'). It is easily distinguishable from sibling DLP network reports targeting devices, printers, products, rules, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context that this tool is for listing email domains in DLP policies, making it obvious when to select it over sibling DLP network reports. It does not explicitly state exclusions or alternative tools, but the domain-specific scope is sufficient guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dlp_network_printer_reportDLP network printers reportARead-only
Retrieves all network printers deployed in DLP policies, with the number of custom groups each printer is associated with. Supports pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the description's job is to add extra behavioral context. It adds that pagination is supported and that the output includes custom group counts per printer, which is useful beyond the annotation metadata.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that states the main function and output without any filler. It is concise and well-structured, earning the highest score.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only report with all-optional parameters and no output schema, the description sufficiently covers the tool's scope and pagination behavior. It could potentially note the distinction from USB printer reports, but the title and purpose clarity already handle that differentiation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All three parameters (raw, page, pageLimit) have descriptions in the schema, providing 100% coverage. The description adds minimal additional parameter meaning—it only mentions pagination, which is already described in the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves all network printers deployed in DLP policies and specifies the key output (number of custom groups per printer). This specific verb-resource combination distinguishes it from sibling reports like dlp_network_usb_printer_report, which target USB printers instead.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context—use this when you need network printers in DLP policies with custom group associations. It does not explicitly mention alternatives or exclusions, but the context is unambiguous enough to guide selection among similar report tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dlp_network_product_reportDLP enterprise applications reportARead-only
Retrieves all enterprise applications deployed in DLP policies across the network, with the number of custom groups each application is associated with. Supports pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds behavioral value by noting that pagination is supported and that the tool retrieves 'all' applications, implying potentially large datasets. It does not detail return format or edge cases, but with annotations present, this is moderate-to-good disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no redundancy. The first sentence states the primary purpose and data scope, the second adds the pagination detail. Both sentences earn their place, making it concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only list report with three optional parameters and no output schema, the description is complete. It specifies the data returned (enterprise applications, custom group counts), the scope (across the network), and pagination support. Given the low complexity and clear annotations, no additional detail seems necessary.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all three parameters (raw, page, pageLimit) are fully documented in the schema. The description adds no additional parameter-specific meaning beyond mentioning pagination, which aligns with the page/pageLimit parameters. This meets the baseline for full schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Retrieves all enterprise applications deployed in DLP policies across the network, with the number of custom groups each application is associated with.' This uses a specific verb ('retrieves') and resource ('enterprise applications deployed in DLP policies'), and it distinguishes this from its siblings (e.g., dlp_network_device_report, dlp_network_email_report) by the unique focus on applications.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context that this tool is for obtaining enterprise applications in DLP policies and their custom group counts. While it does not explicitly name alternative tools or exclusions, the scope is unambiguous, and the sibling list confirms this is one of several specialized DLP reports. This meets the 'clear context, no exclusions' level.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dlp_network_rules_reportDLP deployed rules reportARead-only
Retrieves all DLP data rules deployed in the network, with the number of custom groups each rule is associated with. Supports filtering by rule class and pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| ruleClass | No | Filter by data rule class, e.g. "Finance", "PII", "Health", "Source code", "Custom rules". |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is known. The description adds useful behavioral context: it returns 'all' rules, includes per-rule custom group counts, and supports filtering/pagination. This goes beyond the annotations without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the primary function, then adds the custom group count detail and the two key capabilities (filter, pagination). Every word earns its place; there is no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only listing tool with no output schema, the description covers the essential aspects: what is returned, the distinguishing aggregate (custom group count), and the available controls (filter and pagination). It does not enumerate return fields or edge cases, but none are required given the simplicity and good annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all four parameters well. The description's mention of 'filtering by rule class' and 'pagination' only restates what the schema provides, adding no extra meaning beyond the structured definitions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Retrieves') and resource ('all DLP data rules deployed in the network'), and adds the distinguishing detail of showing the number of custom groups per rule. This clearly sets it apart from sibling tools such as dlp_network_device_report or dlp_network_email_report.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clarifies scope (deployed network rules) and mentions filtering by rule class and pagination, which implies when to use it. However, it does not explicitly name alternatives or state exclusions, so guidance on when to use this tool versus the many other DLP/report siblings remains implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dlp_network_usb_printer_reportDLP USB printers reportARead-only
Retrieves all USB printers deployed in DLP policies (by device instance path), with the number of custom groups each USB printer is associated with. Supports pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds behavioral details: it returns results 'by device instance path', includes custom group counts, and supports pagination. These details help the agent understand the output shape and the need to page through results. It does not describe default page size or error conditions, but that is not expected given schema coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the core purpose. Every word earns its place: the first sentence states the resource and output composition, the second notes pagination. There is no redundant or vague language.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the moderate complexity (3 optional params, no output schema), the description is sufficiently complete. It explains the return content ('USB printers... with the number of custom groups') and pagination support. The lack of an explicit 'use this for USB, not network printers' note is a slight gap, but the name and description make that clear enough.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%: all three parameters (raw, page, pageLimit) have descriptions. The tool description adds 'Supports pagination', which reinforces the purpose of page/pageLimit but does not add syntax or format details beyond the schema. This aligns with the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Retrieves all USB printers deployed in DLP policies (by device instance path), with the number of custom groups each USB printer is associated with.' The verb 'Retrieves' and resource 'USB printers deployed in DLP policies' are specific. The parenthetical 'by device instance path' adds granularity, and the mention of custom group counts distinguishes it from sibling DLP reports (e.g., dlp_network_printer_report).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use the tool: when you need USB printers in DLP policies with custom group association counts. It supports pagination, which signals how to handle large result sets. However, it does not explicitly compare with alternatives like dlp_network_printer_report, relying on the name and title for differentiation. This is a minor gap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dlp_network_web_domain_reportDLP web domains reportARead-only
Retrieves all web domains deployed in DLP policies across the network, with the number of custom groups each domain is associated with. Supports pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/destructive safety, so the bar is lower. The description adds useful behavioral context beyond annotations: it returns all web domains, includes custom-group counts, and supports pagination. It does not contradict the read-only annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the main purpose and followed by the count detail and pagination note. No redundant or filler content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only report with well-documented schema and good annotations, the description is sufficient: it states what is returned, the aggregation included, and pagination support. A full output schema is absent, but the core return information is covered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with all three parameters (raw, page, pageLimit) described in detail. The description only mentions pagination, which aligns with page/pageLimit but adds no new semantics beyond the schema, so the baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Retrieves') and clearly identifies the resource ('all web domains deployed in DLP policies across the network') plus the key output ('number of custom groups each domain is associated with'). This distinguishes it from sibling DLP reports focused on devices, email, printers, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly conveys the use case: when you need a report of DLP web domains with custom-group association counts. It does not explicitly name alternatives or exclusions, but the context is clear enough to guide selection among the sibling DLP report tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inventory_all_summaryInventory overall summaryARead-only
Retrieves the overall Inventory module summary: scan/audit status counts, software counts (commercial, non-commercial, prohibited), license compliance summary, computers by OS, and warranty summary.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so safety is covered. The description adds valuable context by specifying exactly which summary sections are included, giving the agent a clear picture of the returned data. No contradictions found.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, well-organized sentence that front-loads the action and resource, then enumerates contents concisely with commas and conjunctions. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no parameters, no output schema, and a simple read-only summary tool, the description fully covers the tool's behavior and return content by listing all summary categories. There is nothing missing for an agent to use it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, so schema coverage is 100% and the description naturally needs no parameter details. Per the baseline for 0-parameter tools, this is a 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Retrieves' and the specific resource 'overall Inventory module summary', then enumerates the exact content categories (scan/audit counts, software counts, license compliance, OS computers, warranty). This distinguishes it from the many sibling inventory tools that focus on specific lists or details.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The word 'overall' establishes the tool as a high-level summary view, implying use when a broad inventory overview is needed rather than detailed per-computer or per-software data. It does not explicitly name alternatives or exclude cases, but the context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inventory_computer_details_summaryComputer inventory summaryARead-only
Retrieves the detailed inventory summary for one computer: asset counts, OS details, disk usage, hardware summary (model, processor, memory, serial number, warranty), and network adapters.
| Name | Required | Description | Default |
|---|---|---|---|
| resId | Yes | resource_id of the computer (from som_computers_list or inventory_scan_computers_list). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true, and the description's 'Retrieves' aligns with that. Beyond annotations, it adds valuable context by listing exactly what data categories are returned, helping the agent set expectations for the response. No contradiction or hidden side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the action and resource, then lists the included content. No filler or redundant phrasing; every element contributes to understanding what the tool returns.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only tool with one parameter and no output schema, the description is fairly complete: it specifies the input source and the output categories. It does not explain return format, but the enumeration compensates. Minor gaps around 'asset counts' detail, but overall sufficient for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides 100% coverage, including a description of resId as the resource_id from specific lists. The tool description itself adds no parameter-specific meaning, but the schema does the heavy lifting, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the verb 'Retrieves' and a specific resource: 'detailed inventory summary for one computer.' It enumerates the content categories (asset counts, OS details, disk usage, hardware summary, network adapters), which distinguishes it from sibling tools like inventory_all_summary that would cover all computers.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when you need a per-computer summary, and the parameter description tells where to get resId from (som_computers_list or inventory_scan_computers_list). However, it does not explicitly state exclusions or name alternatives, so an agent might not know when to prefer this over similar inventory tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inventory_computers_by_hardwareComputers with a specific hardwareARead-only
Retrieves the computers that have a specific hardware component (by hardware_id from inventory_hardware_list), with model, service tag, RAM, warranty, and computer details.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| hwId | Yes | hardware_id of the hardware component (from inventory_hardware_list). | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| domainFilter | No | Filter by the NetBIOS domain the computer is mapped to. | |
| customGroupFilter | No | Filter by custom group name. | |
| branchOfficeFilter | No | Filter by the remote/branch office the computer is mapped to. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds the output fields (model, service tag, RAM, warranty) but does not disclose pagination behavior or the effect of the 'raw' flag beyond what the schema already states. It provides some added context but not richly.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the primary action and includes only essential details: the resource, the key identifier, its source, and the expected output fields. No filler or redundant wording.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description compensates by explicitly naming the fields returned (model, service tag, RAM, warranty, computer details). Combined with fully described parameters and read-only annotations, this gives an agent enough context to invoke the tool correctly, though pagination defaults are only hinted in the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents all parameters. The description repeats the hwId source ('from inventory_hardware_list') but adds no new meaning beyond the schema, so it does not push above the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb ('Retrieves') and clearly identifies the resource (computers) filtered by a specific hardware component. It explicitly references the source (inventory_hardware_list) and lists returned fields, making it easy to distinguish from sibling tools like inventory_computers_by_software.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool—when you have a hardware_id from inventory_hardware_list—but it does not explicitly mention alternatives or state when not to use it. This is adequate but lacks the explicit comparison or exclusion that would make it a 4 or 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inventory_computers_by_licenseComputers under a software licenseARead-only
Retrieves the computers associated with a specific software license (by license_id from inventory_licenses_list), with the license name and computer details.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| licId | Yes | license_id of the software license (from inventory_licenses_list). | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| domainFilter | No | Filter by the NetBIOS domain the computer is mapped to. | |
| licenseFilter | No | Additional license_id filter (from inventory_licenses_list). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is known. The description adds that the result includes license name and computer details, which is useful, but does not disclose additional behaviors like pagination or filtering beyond what the schema already provides. This is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the action and resource. It includes the key input and output context without any redundant or filler words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (6 params, 1 required), the schema fully documents all parameters, and annotations cover safety. The description outlines the purpose and return content (license name and computer details). It is sufficiently complete for the agent to understand the tool's role, though it could mention pagination/filtering, but those are already in schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all six parameters are documented in the schema. The description echoes licId's origin but adds no new semantics beyond the schema. Baseline score of 3 is appropriate when schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Retrieves the computers associated with a specific software license'), specifies the resource (computers), and identifies the key parameter (license_id from inventory_licenses_list). It also contrasts with sibling tools by focusing on license ID lookup, which distinguishes it from inventory_computers_by_software or inventory_computers_by_licensed_software.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context: it is used when you have a license_id from inventory_licenses_list and want the associated computers. It does not explicitly list alternatives or when-not-to-use cases, but the reference to the prerequisite source is sufficient for this straightforward retrieval tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inventory_computers_by_licensed_softwareComputers with a licensed softwareARead-only
Retrieves the computers associated with a specific licensed software (by licensed software id from inventory_license_software_list), including which license each computer maps to.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| licSwId | Yes | software_id of the licensed software (from inventory_license_software_list). | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| domainFilter | No | Filter by the NetBIOS domain the computer is mapped to. | |
| licenseFilter | No | Filter to one license by its license_id (from inventory_licenses_list). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds that each computer's corresponding license is included in the result, which is useful behavioral context beyond basic read-only. It does not disclose pagination or filtering specifics, but those are in the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that conveys the core functionality and a key detail (license mapping). No unnecessary words or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has six parameters and no output schema, but the description plus annotations and schema adequately cover the operation. It clearly states the primary purpose and the license mapping detail, while pagination and filter behaviors are already documented in the schema. Sibling tools provide additional context for differentiation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all six parameters already have descriptions. The description references licSwId's source (inventory_license_software_list), but the schema already provides this, so no additional meaning is added. The mention of license mapping hints at licenseFilter but not explicitly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves computers for a specific licensed software, using a specific verb ('Retrieves') and resource. It also mentions the inclusion of license mapping, which distinguishes it from sibling tools like inventory_computers_by_software and inventory_computers_by_license.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description indicates the required parameter comes from inventory_license_software_list, providing clear context on the input source. However, it does not explicitly mention when to avoid this tool or name alternative sibling tools, so it lacks explicit exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inventory_computers_by_prohibited_softwareComputers with a prohibited softwareARead-only
Retrieves the computers on which a specific prohibited software (by software_id from inventory_prohibited_software_list) is detected, with install location and exception-request counts (approved, pending, rejected, not requested).
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| domainFilter | No | Filter by the NetBIOS domain the computer is mapped to. | |
| prohibitedSwId | Yes | software_id of the prohibited software (from inventory_prohibited_software_list). | |
| liveStatusFilter | No | Filter by computer live status: 1 live, 2 down, 3 unknown. | |
| customGroupFilter | No | Filter by custom group name. | |
| branchOfficeFilter | No | Filter by the remote/branch office the computer is mapped to. | |
| osCompatibilityFilter | No | Filter by OS architecture: "32-bit" or "64-bit". |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds valuable behavioral context by stating the result includes install location and exception-request counts, which is useful for understanding what the tool returns. It does not disclose additional behaviors like pagination defaults, but that is not required given the schema and annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, front-loaded with the main action, and includes only relevant details (source list and returned fields). No redundant wording.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only list tool with a well-covered schema and no output schema, the description provides enough context to select and invoke the tool: it names the source list for the key parameter and summarizes the return data. It does not enumerate all output fields, but given the tool complexity and sibling differentiation, this is adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 100% coverage with descriptions for all 9 parameters, so the baseline is 3. The description adds an important cross-reference that prohibitedSwId comes from inventory_prohibited_software_list, which helps the agent populate the required parameter correctly. This cross-reference goes beyond what the schema provides, warranting a 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'retrieves' with resource 'computers' and defines the scope as 'a specific prohibited software' identified by software_id from a named source list. It also lists the returned data (install location, exception-request counts), differentiating it from sibling tools like inventory_computers_by_software.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description indicates the tool is for prohibited-software detections and references inventory_prohibited_software_list as the source for software_id, giving clear context on when to use it. It does not explicitly name alternatives or exclusions, but the naming and the specific return fields strongly imply its purpose relative to sibling inventory_computers_by_* tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inventory_computers_by_softwareComputers with a specific softwareARead-only
Retrieves the computers on which a specific software (by software_id from inventory_software_list) is installed, with install date, version, and computer details.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| swId | Yes | software_id of the software (from inventory_software_list). | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| domainFilter | No | Filter by the NetBIOS domain the computer is mapped to. | |
| liveStatusFilter | No | Filter by computer live status: 1 live, 2 down, 3 unknown. | |
| customGroupFilter | No | Filter by custom group name. | |
| branchOfficeFilter | No | Filter by the remote/branch office the computer is mapped to. | |
| osCompatibilityFilter | No | Filter by OS architecture: "32-bit" or "64-bit". |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds context about the output (install date, version, computer details) and the link to inventory_software_list, but doesn't disclose pagination behavior, filtering defaults, or other non-obvious runtime characteristics. This is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is front-loaded with the action, contains no filler, and conveys purpose, key requirements, and output highlights in under 25 words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only inventory query with 9 parameters, the description gives the core purpose and key output fields, and the schema fills in filter parameter details. There is no output schema, but the description's mention of 'install date, version, and computer details' gives a reasonable expectation of the result set. It could be more explicit about pagination and the full list of computer details, but this is sufficient for an agent to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides descriptions for all 9 parameters (100% coverage), so the baseline is 3. The description also reinforces the meaning of swId by referencing its source (inventory_software_list), but adds no deeper semantic detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Retrieves' and clearly identifies the resource: computers with a specific software installed. It also references the source of the required parameter (software_id from inventory_software_list) and specifies output fields, distinguishing it from sibling inventory tools focused on hardware, licenses, or metering.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when you need computers running a particular software, and it points to a prerequisite source for the ID. However, it does not provide explicit when-to-use vs alternatives or exclusions; given the many sibling tools like inventory_computers_by_licensed_software and inventory_computers_by_prohibited_software, it fails to guide selection among overlapping tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inventory_computers_with_meteringComputers under a software metering ruleARead-only
Retrieves the computers tracked by a specific software metering rule (by app_definition_id from inventory_software_metering_summary), with per-computer usage: total run time, run count, and last used.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| swMeRuleId | Yes | Software metering rule id (app_definition_id, from inventory_software_metering_summary). | |
| domainFilter | No | Filter by the NetBIOS domain the computer is mapped to. | |
| customGroupFilter | No | Filter by custom group name. | |
| branchOfficeFilter | No | Filter by the remote/branch office the computer is mapped to. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the description is consistent with those. It adds useful behavioral context by specifying the exact per-computer usage data returned (total run time, run count, last used) and references the source of swMeRuleId, providing value beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the primary purpose and includes the key output fields without unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description provides enough context for a read-only listing tool: it identifies the required input, how to get it, and what output to expect. While pagination and filters are not mentioned in the description, they are well-documented in the schema, and the output fields are highlighted. This is adequate but not exhaustive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All 7 parameters have descriptions in the schema (100% coverage), so the baseline is 3. The description repeats the swMeRuleId source from the schema but does not add additional semantic meaning to the parameters beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves computers for a specific software metering rule and lists the per-computer usage metrics, distinguishing it from other inventory tools by referencing the metering rule context.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context by specifying that the tool is for a specific software metering rule and references how to obtain the rule ID from another tool. However, it does not explicitly name alternative tools or state when not to use it, so it earns a 4 rather than a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inventory_filter_paramsInventory filter parametersARead-only
Retrieves the valid values for inventory filters: OS names, software categories, software/hardware/computer manufacturers, and hardware types. Use these values with the filter inputs of other inventory tools.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safe read-only nature is handled. The description adds useful context by naming the exact categories of values it returns. It does not contradict annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler. The first sentence lists the contents; the second explains how to use the result. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only helper used to fetch filter values, the description is fully sufficient. It names the value types and explicitly links them to the filter inputs of related inventory tools, making the tool's role in the broader toolset clear.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and schema description coverage is 100%, so the baseline is 4. The description does not need to explain parameters and instead focuses on what the tool returns, which is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Retrieves') and clearly identifies the resource: valid values for inventory filters, listing concrete examples (OS names, software categories, manufacturers, hardware types). This distinguishes it from the many inventory report tools in the sibling list, making its purpose immediately clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states the intended usage: 'Use these values with the filter inputs of other inventory tools.' This gives clear context on when to call the tool, although it does not discuss when not to use it or mention alternatives (which are not really applicable here).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inventory_hardware_listList hardware inventoryARead-only
Retrieves all detected hardware components across the network with manufacturer, hardware type, and managed/network installation counts. Use inventory_filter_params for valid filter values.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| domainFilter | No | Filter by the NetBIOS domain the computer is mapped to. | |
| branchOfficeFilter | No | Filter by the remote/branch office the computer is mapped to. | |
| hardwareTypeFilter | No | Filter by hardware type, e.g. "Bios", "Processor", "Disk Drive" (values from inventory_filter_params). | |
| manufacturerFilter | No | Filter by hardware manufacturer name (values from inventory_filter_params). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate read-only and non-destructive behavior. The description adds that it returns all detected hardware and includes counts, but does not disclose pagination defaults or response shape beyond that. With annotations covering safety, the description adds some context but not a lot.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences that front-load the action and key output fields. No fluff, every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The absence of an output schema is mitigated by the description naming key fields (manufacturer, type, counts). The schema covers pagination and filtering. The pointer to inventory_filter_params fills a gap in filter value information, making the description sufficiently complete for a moderately complex list tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema fully documents all parameters. The description adds a pointer to inventory_filter_params for valid filter values, which is helpful but does not add significant semantic meaning beyond the schema's own descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves hardware components with manufacturer, hardware type, and counts, using a specific verb and resource. It distinguishes from siblings like inventory_all_summary (which likely summarizes) and inventory_computer_details_summary by focusing on hardware components across the network.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for listing hardware inventory but provides no explicit guidance on when to use this tool versus alternatives. It only points to inventory_filter_params for valid filter values, which is a helper reference, not a usage guideline for tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inventory_installed_software_listList software installed on a computerARead-only
Retrieves the software installed on a specific computer with version, manufacturer, category, install format, license/compliance status, and whether usage is prohibited.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| resId | Yes | resource_id of the computer (from som_computers_list or inventory_scan_computers_list). | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| accessTypeFilter | No | Filter by software access type: 0 not assigned, 1 allowed, 2 prohibited. | |
| licenseTypeFilter | No | Filter by license type: 0 unidentified, 1 commercial, 2 non-commercial. | |
| osCompatibilityFilter | No | Filter by OS architecture: "32-bit" or "64-bit". | |
| complianceStatusFilter | No | Filter by license compliance status: 0 under-licensed, 1 over-licensed, 2 in compliance, 3 expired, -1 not available. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the description is not required to restate safety. It adds context about the returned fields (version, manufacturer, license status, prohibited usage), which is useful. However, it does not disclose behavioral details like pagination behavior or filtering semantics beyond what the schema already provides.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that directly states the tool's purpose and output scope. There is no verbose or redundant content; every phrase adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only list tool with rich schema coverage and clear annotations, the description sufficiently conveys the core purpose and return fields. It does not explain pagination or filters, but the schema covers those details. The absence of an output schema is partially compensated by enumerating the returned attributes. Slightly more context about when to use this over sibling tools would improve completeness, but the essential information is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the input schema fully documents all 8 parameters. The description adds context about the output fields but does not add meaning beyond what the schema property descriptions already provide for parameters. Baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Retrieves') and clearly identifies the resource ('software installed on a specific computer') with a detailed list of returned attributes. It distinguishes itself from siblings like inventory_software_list and inventory_license_software_list by emphasizing the per-computer scope and inclusion of license/compliance/prohibited status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states what the tool does but provides no guidance on when to use it versus alternatives such as inventory_software_list or inventory_prohibited_software_list. There is no mention of scenarios where this tool is preferred, nor any exclusions or when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inventory_licenses_listList licenses of a softwareARead-only
Retrieves the licenses recorded for a specific software (by software_id) with license name, edition, copies, mapped computer count, purchase/expiry dates, and purchase details. License key and file-path fields are available via raw: true.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| swId | Yes | software_id of the licensed software (from inventory_license_software_list). | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is known. The description adds behavioral context by listing the curated default fields (license name, edition, copies, mapped computer count, purchase/expiry dates, purchase details) and noting that raw:true reveals license key and file-path fields. This goes beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences, front-loaded with the core purpose. The second sentence efficiently introduces the raw option without extra fluff. Every clause adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only list tool with 4 parameters (1 required) and no output schema, the description covers the purpose, key output fields, and the raw option. Combined with schema and annotations, this is sufficient. Pagination or error behavior are not described but are peripheral for this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds meaning by clarifying what the 'curated default field set' includes and what raw=true provides, which is not fully captured in the schema's generic 'full, unprojected record' for the raw parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Retrieves' with a concrete resource 'licenses' and clear scope 'for a specific software (by software_id)'. This distinguishes it from sibling tools like inventory_software_list or inventory_license_software_list, which focus on software rather than licenses.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage by stating 'by software_id', and the schema for swId explicitly references 'from inventory_license_software_list' as the source. This gives clear context for when to use the tool, but it does not explicitly name alternatives or exclusions, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inventory_license_software_listList licensed softwareARead-only
Retrieves all software that has license records, with total/installed/remaining copies, compliance status (under/over licensed, in compliance, expired), and network installation counts.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| complianceStatusFilter | No | Filter by license compliance status: 0 under-licensed, 1 over-licensed, 2 in compliance, 3 expired, -1 not available. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare read-only behavior, and the description adds meaningful context by specifying returned metrics (copies counts, compliance status, network installation counts) and the licensed-software scope. It does not contradict annotations, though it omits details like pagination behavior beyond schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the primary purpose and packs essential output fields into a concise structure. No filler or redundant wording is present.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only list tool with no output schema, the description provides a solid overview of the primary data returned: copies, compliance states, and network counts. It lacks explicit mention of default ordering or how it relates to sibling inventory queries, but the core context is sufficiently covered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so all four parameters are already documented with types, defaults, and enum labels. The description adds no new parameter-specific meanings; the compliance status mentions mirror the schema's enum descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Retrieves') and clearly defines the resource: software that has license records. It distinguishes this from sibling tools like inventory_licenses_list and inventory_software_list by emphasizing license-linked software and compliance-related computed fields.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use when license compliance information is needed, but it does not explicitly state when to use this tool versus alternatives such as inventory_licenses_list or inventory_software_list. No exclusions or alternative guidance are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inventory_prohibited_software_listList prohibited softwareBRead-only
Retrieves prohibited software detected across the network with installation counts, installer format (MSI/EXE), and whether silent uninstallation is supported.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| installerFormatFilter | No | Filter by installer format: "MSI" or "EXE". | |
| uninstallSupportFilter | No | Filter by uninstall support: "Yes" (can be uninstalled) or "No". |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare read-only and non-destructive behavior, so the description need not repeat that. It adds content details (installation counts, installer format, uninstall support) but does not disclose pagination behavior, ordering, or potential performance implications, which are not covered by annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that concisely states the purpose and key data fields. No redundant phrasing or filler words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only list tool with strong annotations and full schema coverage, the description is fairly complete. It mentions the core data returned and implicitly supports filtering via the format and uninstall fields. Missing details like pagination limitations are already in the schema, and no output schema exists, so the description need not explain return structure.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides 100% coverage for all five parameters, including enums for installer format and uninstall support. The description mentions these fields but does not add meaning beyond the schema. The pagination parameters are not described in the description, but the schema already handles them, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves prohibited software across the network with specific fields like installation counts, installer format, and uninstall support. It identifies the resource precisely and implies a focus on the software list itself, distinguishing from sibling 'inventory_computers_by_prohibited_software' which targets computers, though the distinction is not explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives. No mention of typical use cases, exclusions, or which sibling tools to prefer for related queries. The existence of filter parameters is implied but not communicated as usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inventory_scan_computers_listList computers with scan statusARead-only
Retrieves all inventory computers with their scan status (not done/failed/in progress/success), agent installation status, live status, and last successful scan time.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| resIdFilter | No | Filter to a specific computer by its resource_id. | |
| domainFilter | No | Filter by the NetBIOS domain the computer is mapped to. | |
| liveStatusFilter | No | Filter by computer live status: 1 live, 2 down, 3 unknown. | |
| scanStatusFilter | No | Filter by scan status: -1 not done, 0 failed, 1 in progress, 2 success. | |
| branchOfficeFilter | No | Filter by the remote/branch office the computer is mapped to. | |
| installStatusFilter | No | Filter by agent install status: 21 yet-to-install, 22 installed, 23 uninstalled, 24 yet-to-uninstall, 29 installation failure. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the core safety profile is clear. The description adds context about the returned dataset (scan status values, agent install status, live status, last successful scan time), but does not disclose potential volume or pagination behavior beyond what schema implies.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence that is front-loaded with the main action and includes useful parenthetical status values. No wasted words; title is appropriately specific.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only list tool with 9 optional parameters and no output schema, the description names the key output fields, while schema covers parameter semantics. It lacks an explicit statement about filtering/pagination behavior and raw projection, but these are available in parameter descriptions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%; every parameter already has a clear description and enum details. The tool description does not add meaning beyond the schema, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses specific verb 'Retrieves' and identifies resource 'inventory computers' plus returned fields (scan status, agent install status, live status, last successful scan time). It does not explicitly distinguish this from sibling tools like inventory_computer_details_summary or som_computers_list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives; the description simply states what it does. Given many sibling inventory/list tools, explicit when-to-use or exclusion notes would help.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inventory_software_listList software inventoryARead-only
Retrieves all software detected across the network with version, manufacturer, category, installation counts, license copies, and compliance status.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| domainFilter | No | Filter by the NetBIOS domain the computer is mapped to. | |
| accessTypeFilter | No | Filter by software access type: 0 not assigned, 1 allowed, 2 prohibited. | |
| licenseTypeFilter | No | Filter by license type: 0 unidentified, 1 commercial, 2 non-commercial. | |
| complianceStatusFilter | No | Filter by license compliance status: 0 under-licensed, 1 over-licensed, 2 in compliance, 3 expired, -1 not available. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint=true and destructiveHint=false, so the agent knows this is a safe read operation. The description adds that it retrieves software 'across the network' and lists the fields returned, which is useful scope context. However, it does not disclose behavioral traits like pagination behavior, potential large result sets, or any prerequisites. This is consistent with annotations, so it is not misleading, but it adds only modest context beyond the structured metadata.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that starts with the action verb 'Retrieves' and conveys the scope, resource, and key fields without redundancy. Every phrase adds value, and it is appropriately front-loaded with the primary action. This is a model of concise, structured tool documentation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is a read-only list operation with a comprehensive schema, strong annotations, and no output schema. The description adequately lists the return fields, which is important since no output schema exists. It does not explicitly mention pagination, but the schema's page/pageLimit parameters cover that. Given the tool's simplicity and the high schema coverage, the description is nearly complete, though it could have noted that results may be large or that filters are intended for narrowing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with all 7 parameters having detailed descriptions in the input schema. The tool description does not add any additional parameter meaning beyond what the schema already provides. Therefore, it receives the baseline score of 3 for parameter semantics, as the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Retrieves') and clearly identifies the resource ('all software detected across the network'). It lists key fields returned (version, manufacturer, category, installation counts, license copies, compliance status), which distinguishes it as a network-wide software inventory with compliance data. However, it does not explicitly differentiate from sibling tools like inventory_installed_software_list or inventory_license_software_list, so purpose clarity is strong but not maximally distinct.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The usage context is implied by the description: use this tool when you need a network-wide software inventory with compliance status. There is no explicit guidance about when not to use it or which alternative tool to prefer (e.g., inventory_installed_software_list for per-computer details). The schema's filters suggest usage for narrowing results, but the description itself does not clarify when to use this vs siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inventory_software_metering_summaryList software metering rulesARead-only
Retrieves all software metering rules with usage metrics across the network: total run time, run count, discovered installation count, and rule metadata. Use app_definition_id with inventory_computers_with_metering to see per-computer usage.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds meaningful behavioral context by disclosing the exact data returned (run time, run count, installation count) and that it covers 'all software metering rules' across the network. It does not contradict annotations and provides additional useful detail beyond them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences. The first front-loads the main purpose and output, the second provides relevant cross-tool guidance. No unnecessary words or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no output schema, so the description properly explains what is returned (usage metrics and metadata). It also clarifies the aggregate scope ('across the network') and directs users to the per-computer alternative. Combined with complete schema coverage and strong annotations, the description is fully sufficient for an agent to select and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with all three parameters (raw, page, pageLimit) fully described in the schema. The description does not add any parameter-specific information beyond what the schema already provides. Baseline 3 is appropriate because the schema carries the full burden of parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Retrieves all software metering rules with usage metrics across the network' and specifies the exact metrics returned (total run time, run count, discovered installation count, rule metadata). This distinguishes it from sibling tools like inventory_computers_with_metering by focusing on aggregate summary data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly provides an alternative tool: 'Use app_definition_id with inventory_computers_with_metering to see per-computer usage.' This tells the agent when to use a different tool, thereby implying when this tool is appropriate (for aggregate/network-level summaries). It gives clear context and a named alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patch_all_patch_detailsPer-computer status of one patchARead-only
Retrieves the installation status of a specific patch (by patch_id) on every applicable computer: which systems have it installed, which are missing it, and deployment remarks. Supports filtering and pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| patchId | Yes | patch_id of the patch to report on (required; from patch_all_patches_list or patch_supported_patches_list). | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| domainFilter | No | Filter by NetBIOS domain name (domain list is available from the desktop serverproperties API). | |
| platformFilter | No | Filter by OS platform: Windows, Mac, or Linux. | |
| severityFilter | No | Filter by patch severity: 0 Unrated (no severity assigned), 1 Low (minimal impact), 2 Moderate (average impact), 3 Important (significant impact), 4 Critical (high impact or security risk). | |
| customGroupFilter | No | Filter by custom group (list available from the desktop serverproperties API). | |
| patchStatusFilter | No | Filter by patch install status: 201 Installed (already installed), 202 Missing (not installed). | |
| branchOfficeFilter | No | Filter by remote/branch office name (list available from the desktop serverproperties API). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds behavioral detail beyond annotations by specifying the output content (installed/missing status, deployment remarks) and capabilities (filtering/pagination). No contradiction between description and annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the core purpose, then adds scope and capabilities. Every phrase earns its place: specific patch, applicable computers, installed/missing, deployment remarks, filtering, pagination. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only report tool with 10 parameters and no output schema, the description provides a solid high-level return summary (installed/missing, deployment remarks) and notes filtering/pagination. It doesn't enumerate all filter options, but the schema covers those. This is sufficient for an agent to select and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage, with detailed descriptions for all 10 parameters including enums, defaults, and usage notes (e.g., patchId references other list tools). The description only says 'Supports filtering,' adding no extra parameter semantics beyond what the schema already provides, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Retrieves the installation status of a specific patch (by patch_id) on every applicable computer' — a specific verb (retrieves) and resource (patch status per computer). It distinguishes itself from siblings by focusing on one patch across all computers, reinforced by the title 'Per-computer status of one patch' and contrasted with patch_all_patches_list which lists patches.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use this tool: when you need installation status of a specific patch across applicable computers. It doesn't explicitly name alternatives or state when not to use it, but the context is unambiguous enough to guide selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patch_all_patches_listList all applicable patchesARead-only
Retrieves the complete list of patches applicable to managed systems, with per-patch installed/missing/failed system counts, severity, approval status, and download status. Supports filtering and pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| patchId | No | Filter to the patch with this patch_id. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| bulletinId | No | Filter to patches with this bulletin ID, e.g. MS18-JAN9 or TU-058. | |
| domainFilter | No | Filter by NetBIOS domain name (domain list is available from the desktop serverproperties API). | |
| platformFilter | No | Filter by OS platform: Windows, Mac, or Linux. | |
| severityFilter | No | Filter by patch severity: 0 Unrated (no severity assigned), 1 Low (minimal impact), 2 Moderate (average impact), 3 Important (significant impact), 4 Critical (high impact or security risk). | |
| customGroupFilter | No | Filter by custom group (list available from the desktop serverproperties API). | |
| patchStatusFilter | No | Filter by patch install status: 201 Installed (already installed), 202 Missing (not installed). | |
| branchOfficeFilter | No | Filter by remote/branch office name (list available from the desktop serverproperties API). | |
| approvalStatusFilter | No | Filter by approval status: 211 Approved (approved for deployment), 0 Not Approved (approval pending), 212 Declined. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile. The description adds context about the returned data (counts, statuses) and supports filtering/pagination. However, it does not disclose details like default page size, server caps, or result formatting beyond what the schema provides.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tightly packed sentences, front-loaded with the core action ('Retrieves the complete list of patches') followed by the return fields and capabilities. No wasted words or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a list tool with 12 optional parameters and no output schema, the description sufficiently indicates what the tool returns (patches with counts/statuses) and its filtering/pagination capabilities. It does not mention default page size or enumerations, but the schema covers those. It is complete enough for agent selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage with detailed descriptions for all 12 parameters, so the baseline is 3. The description adds only general mention of 'filtering and pagination' without specifying parameter syntax or relationships. No additional semantics beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Retrieves the complete list of patches applicable to managed systems' – a specific verb and resource – and enumerates the key data fields (per-patch installed/missing/failed counts, severity, approval status, download status). This distinguishes it from sibling tools like patch_all_systems_list (systems, not patches) and patch_all_patch_details (single-patch details).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for obtaining a complete patch list with filtering/pagination, but provides no explicit when-to-use or alternatives. Sibling names like patch_summary or patch_downloaded_patches_list are not mentioned, so an agent must infer context. This is adequate but not explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patch_all_systems_listList systems with patch healthARead-only
Retrieves all managed systems with their patch health status (healthy/vulnerable/highly vulnerable), missing and installed patch counts by type and severity, and last scan/patch times. Supports filtering and pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| resId | No | Filter to the system with this resource_id. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| domainFilter | No | Filter by NetBIOS domain name (domain list is available from the desktop serverproperties API). | |
| healthFilter | No | Filter by system patch health: 0 Unknown (patch status not available), 1 Healthy (up-to-date), 2 Vulnerable (has missing patches), 3 Highly Vulnerable (has critical or high-risk missing patches). | |
| platformFilter | No | Filter by OS platform: Windows, Mac, or Linux. | |
| customGroupFilter | No | Filter by custom group (list available from the desktop serverproperties API). | |
| branchOfficeFilter | No | Filter by remote/branch office name (list available from the desktop serverproperties API). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark the operation as read-only and non-destructive, and the description aligns by stating 'Retrieves'. The description adds useful context about the scope ('all managed systems') and the specific data returned (health status categories, counts by type/severity, last scan/patch times), which goes beyond the structured annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences: the first states the main purpose and key data fields, the second mentions filtering and pagination. There is no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no output schema and 9 optional filters, the description covers the essential return values (health status, counts, times) and the scope. However, it omits the 'Unknown' health status category that appears in the healthFilter enum, and it doesn't enumerate the filter options beyond saying 'filtering'.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All 9 parameters have detailed descriptions in the schema, giving 100% schema description coverage. The description only mentions generic 'filtering and pagination' without adding parameter-specific context, so it contributes little beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Retrieves' and clearly identifies the resource as 'all managed systems' with patch health status, plus additional data like patch counts and scan times. This distinguishes it from sibling tools like patch_all_patches_list (which lists patches) and patch_system_report (which likely focuses on a single system).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no explicit guidance on when to use this tool versus alternatives such as patch_system_report or patch_summary. It does not mention exclusions, prerequisites, or recommended use cases, leaving the agent to infer.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patch_apd_tasks_listList Automatic Patch Deployment tasksARead-only
Retrieves all Automatic Patch Deployment (APD) tasks with their task name, ID, platform, target count, collection status, creator, and creation/modification times. Use this to discover the task_name values required by the APD suspend/resume/delete tools. On-premise only — this endpoint does not exist on Endpoint Central Cloud.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, which the description does not contradict. It adds context about the on-premise-only availability and the list of fields returned, providing useful behavioral context beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, front-loaded with the tool's purpose and key details, and includes only necessary information. It is efficient and well-structured, with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description compensates by listing the returned fields (task name, ID, platform, etc.). It also covers the key on-premise constraint and usage purpose. However, it does not explain pagination behavior in detail, but the schema already includes page/pageLimit parameters.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100%, so the three parameters (raw, page, pageLimit) are already fully described in the input schema. The description does not add additional meaning or context to the parameters, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it retrieves all Automatic Patch Deployment (APD) tasks and lists the specific fields returned. It distinguishes itself from sibling tools by explicitly linking to the APD suspend/resume/delete tools as a prerequisite for discovering task_name values.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit usage context: it is for discovering task_name values for APD suspend/resume/delete tools, and it notes the on-premise-only limitation. However, it does not explicitly state when not to use this tool or mention alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patch_approval_settingsPatch approval settingsARead-only
Retrieves the current patch approval settings — whether newly supported patches are approved automatically or require manual approval.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, which align with the description's 'Retrieves'. The description adds useful behavioral context by explaining exactly what setting is being retrieved (automatic vs manual approval), but does not go beyond that to discuss side effects or permissions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with the verb 'Retrieves' and the resource immediately following. No unnecessary words or filler, making it highly concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, no-parameter, read-only tool with strong annotations, the description fully explains the purpose and the semantics of the output. No additional context is needed to understand when or why to use this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so baseline is 4. The description adds semantic meaning by explaining what the returned setting represents, which exceeds the baseline and provides value beyond the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Retrieves' and clearly identifies the resource 'current patch approval settings'. It further clarifies the semantic distinction between automatic and manual approval, making it easy to distinguish from sibling patch-related tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implied usage context is clear: use when you need to check the current patch approval mode. However, the description does not explicitly mention alternatives or when-not-to-use scenarios, so it falls slightly short of a perfect guideline score.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patch_db_update_statusPatch DB update statusARead-only
Retrieves the status of the ongoing or most recent vulnerability/patch database update: last update status and time, next scheduled update, and whether automatic DB updates are disabled.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is known. The description adds extra context on exactly what status fields are returned (last update, next scheduled, automatic disable flag). No additional behavioral caveats are needed for a simple read-only status check.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the action ('Retrieves') and immediately lists the key output components. Every word adds value, with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only status tool, the description adequately covers what it returns. It mentions the main fields, though it could briefly note the response type or edge cases (e.g., if no update has ever occurred), but that may be inferred from the listed fields.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the description need not explain parameter semantics. The baseline of 4 applies because there are no parameters to document, and the description focuses on the output rather than inputs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the verb 'Retrieves' and the specific resource: the status of the ongoing or most recent vulnerability/patch database update. It enumerates the returned data (status, time, next scheduled update, automatic disable flag), which distinguishes it from sibling tools like patch_summary or patch_scan_details.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the use case (checking DB update status) but does not explicitly state when to use this tool versus alternatives or list any exclusions. No alternative tools are mentioned, but the narrow scope provides clear context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patch_deployment_policies_listList patch deployment policiesARead-only
Retrieves all patch deployment policies (deployment templates) configured in Endpoint Central, with their IDs, names, default flag, and creation/modification metadata. Supports pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, and the description adds value by detailing the fields returned and the support for pagination. This goes beyond what annotations provide, though it does not disclose default pagination behavior or response structure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences front-load the core purpose and key details. No fluff or redundancy; every word adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, annotations cover safety, and the schema explains all parameters. The description covers the essential return fields and pagination. It stops short of describing ordering or total count, but that is not critical. Overall, it is sufficiently complete for a list operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so all parameters are documented in the schema. The description mentions 'Supports pagination' but does not add substantive meaning beyond the existing parameter descriptions for page and pageLimit. This aligns with the baseline of 3 for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Retrieves' with the resource 'patch deployment policies (deployment templates)', clearly distinguishing it from sibling tools like patch_summary or patch_approval_settings. It also lists concrete return fields (IDs, names, default flag, creation/modification metadata), making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage by specifying what the tool retrieves, but it does not explicitly state when to use this tool over alternatives or provide exclusions. Given the context of similar patch management tools, this is adequate but lacks explicit guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patch_downloaded_patches_listList downloaded patchesARead-only
Retrieves the details of all patch binaries downloaded to the Endpoint Central server, including download status, time, size, and remarks. Supports pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description complements the readOnlyHint annotation by specifying the fields returned (download status, time, size, remarks) and the pagination behavior, adding value beyond the structured annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences front-load the primary action and resource, followed by a short note on pagination. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only list tool with a fully described schema, the description covers the essential output fields and pagination. It doesn't mention the default field set or 'raw' behavior, but those are in the schema, so it's sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and all three parameters (raw, page, pageLimit) have descriptions. The description only mentions pagination generically and adds no syntax details beyond the schema, warranting the baseline score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves details of patch binaries downloaded to the server, using a specific verb and resource. It distinguishes from sibling patch list tools by focusing on 'downloaded' patches.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context (use when needing details of downloaded patches) and notes pagination support, but it does not explicitly mention when not to use it or point to alternative sibling tools, making the guidance implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patch_health_policySystem health policyARead-only
Retrieves the configured system health policy: the missing-patch count thresholds per severity that classify a system as vulnerable or highly vulnerable, plus advanced settings (exclude third-party apps, consider only approved patches).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so no safety disclosure is needed. The description adds value by specifying the return contents: severity-based thresholds, vulnerable/highly vulnerable classification, and advanced settings. This goes beyond the bare annotations and sets expectations for what the response will contain.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single well-structured sentence, front-loaded with the verb. Every clause adds meaningful information about the policy being retrieved, with no wasted words or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a zero-parameter getter with no output schema, so the description carries full responsibility for explaining return values. It sufficiently enumerates the key components of the health policy (thresholds per severity, vulnerability classification, advanced settings), making the tool's behavior fully understood.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and the schema has no properties (100% coverage by default). Per the baseline for 0 parameters, a score of 4 is appropriate since there is no parameter burden for the description to carry.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Retrieves') and a specific resource ('configured system health policy'), then details the exact contents: missing-patch count thresholds per severity, vulnerability classification, and advanced settings. This clearly distinguishes the tool from sibling patch-related tools by naming the specific policy being fetched.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies clear usage: use this tool when you need the system health policy configuration. It does not explicitly compare to alternatives like patch_approval_settings or patch_view_config, but the dedicated getter nature and clear resource naming provide sufficient context without needing exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patch_scan_detailsList systems with patch scan statusARead-only
Retrieves all systems with their patch scan status (success/failed/in progress/not scanned), scan remarks, last scan times, agent details, and patch health. Supports filtering and pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| resId | No | Filter to the system with this resource_id. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| domainFilter | No | Filter by NetBIOS domain name (domain list is available from the desktop serverproperties API). | |
| healthFilter | No | Filter by system patch health: 0 Unknown (patch status not available), 1 Healthy (up-to-date), 2 Vulnerable (has missing patches), 3 Highly Vulnerable (has critical or high-risk missing patches). | |
| platformFilter | No | Filter by OS platform: Windows, Mac, or Linux. | |
| liveStatusFilter | No | Filter by agent live status: 1 Agent Live (running), 2 Agent Down (not responding). | |
| customGroupFilter | No | Filter by custom group (list available from the desktop serverproperties API). | |
| branchOfficeFilter | No | Filter by remote/branch office name (list available from the desktop serverproperties API). | |
| agentInstallationStatusFilter | No | Filter by agent installation status: 21 Not Installed, 22 Installed. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile. The description adds behavioral context by noting 'all systems' (broad scope) and support for filtering/pagination. However, it does not disclose potential performance implications of listing all systems, any rate limits, or that 'all systems' may require aggressive pagination. This is comparable to the get_calls example where annotations carry the safety burden and the description adds scope context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the primary action and resource. The first sentence enumerates the key output fields, and the second covers filtering/pagination. No redundant or irrelevant information. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (11 optional parameters, no output schema), the description gives a solid overview of what is returned and mentions pagination. It lacks explicit guidance on typical use cases (e.g., checking vulnerable systems) or caveats about large result sets, but it covers the essential data categories and is supported by detailed schema descriptions. This is a useful, complete-enough summary for an agent to select the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter (raw, page, resId, pageLimit, domainFilter, healthFilter, etc.) is already documented with its meaning and enums. The description only generically says 'Supports filtering and pagination' without adding new parameter-specific details. This matches the baseline of 3 where the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Retrieves' and identifies the exact resource (all systems with patch scan status). It lists the key output fields (scan status, remarks, last scan times, agent details, patch health) which distinguishes it from sibling tools like patch_all_systems_list or patch_system_report. The scope ('all systems') and mention of filtering/pagination further clarify the tool's role.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage (retrieving systems with patch scan details) but does not explicitly state when to use this tool versus alternatives. There is no 'when-not-to-use' or mention of alternates like patch_all_systems_list for broader system lists or patch_system_report for per-system detail. Sibling differentiation is left to the reader.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patch_summaryPatch module summaryARead-only
Retrieves the patch module summary: installed/missing/applicable patch counts, missing-patch severity breakdown, system health summary, scan summary, APD task summary, and vulnerability DB update status.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the description's 'Retrieves' is consistent. It adds context about the scope of data returned (e.g., severity breakdown, DB update status), which is useful, but it does not disclose any additional behavioral traits such as response size, performance, or auth requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence lists all key return components without fluff or repetition. It is both concise and information-dense, earning its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters and no output schema, the description provides a comprehensive list of returned content, which is sufficient for an agent to know what to expect. It could be more explicit about the response structure (e.g., single object vs. nested), but the enumeration covers the essentials.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the schema covers everything. Per the baseline, a score of 4 is appropriate; the description complements by specifying the categories of information returned, which aids interpretation of the output.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Retrieves') and resource ('patch module summary') and enumerates the exact contents (installed/missing/applicable counts, severity breakdown, etc.), making its purpose unmistakable and distinct from sibling tools like patch_scan_details or patch_system_report.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage by listing what the summary contains—an agent can infer to use it when such aggregate patch data is needed. However, it gives no explicit guidance on when to prefer this over sibling tools or any exclusions, leaving room for ambiguity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patch_supported_patches_listList supported patchesARead-only
Retrieves the catalog of all patches supported and manageable by Endpoint Central (not just those applicable to current systems), with severity, approval status, and download status. Supports filtering and pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| patchId | No | Filter to the patch with this patch_id. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| bulletinId | No | Filter to patches with this bulletin ID, e.g. MS18-JAN9 or TU-075. | |
| platformFilter | No | Filter by OS platform: Windows, Mac, or Linux. | |
| severityFilter | No | Filter by patch severity: 0 Unrated (no severity assigned), 1 Low (minimal impact), 2 Moderate (average impact), 3 Important (significant impact), 4 Critical (high impact or security risk). | |
| approvalStatusFilter | No | Filter by approval status: 211 Approved (approved for deployment), 0 Not Approved (approval pending), 212 Declined. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the description doesn't need to restate safety. It adds useful scope context (not just applicable-to-current-systems) and mentions filter/pagination capabilities, but doesn't disclose return format or any potential quirks. This is consistent with annotations and adds moderate value.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one substantive sentence plus a short second sentence on filtering/pagination. Every word adds value, is front-loaded with the core purpose, and avoids redundancy with schema details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only list tool with rich schema and no output schema, the description adequately conveys the catalog scope and key result fields (severity, approval, download status). It could briefly mention pagination defaults or response shape, but overall it is complete enough given the supporting schema and annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All 8 parameters have descriptive schema entries with full details on enums and meanings, so schema coverage is 100%. The description adds no additional parameter information, placing this at the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves the catalog of all patches supported and manageable by Endpoint Central, with specifics on severity, approval status, and download status. It also distinguishes scope by clarifying this is not just patches applicable to current systems, though it doesn't explicitly name sibling alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage context is implied: use this for the full supported patch catalog rather than system-specific patch lists. However, there are no explicit when-to-use or when-not-to-use instructions, and no alternatives are named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patch_system_reportPatch report for one systemARead-only
Retrieves every patch applicable to a specific computer (by resource_id) with its install status (installed/missing/failed), approval status, severity, deployment remarks, and install time. Supports filtering and pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| resId | Yes | resource_id of the computer to report on (required; from patch_all_systems_list or som_computers_list). | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| platformFilter | No | Filter by OS platform: Windows, Mac, or Linux. | |
| severityFilter | No | Filter by patch severity: 0 Unrated (no severity assigned), 1 Low (minimal impact), 2 Moderate (average impact), 3 Important (significant impact), 4 Critical (high impact or security risk). | |
| patchStatusFilter | No | Filter by patch install status: 201 Installed (already installed), 202 Missing (not installed). | |
| approvalStatusFilter | No | Filter by approval status: 211 Approved (approved for deployment), 0 Not Approved (approval pending), 212 Declined. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With annotations already declaring readOnlyHint=true and destructiveHint=false, the description need not restate safety. It adds useful behavioral context beyond annotations: returns a comprehensive set of patch attributes, supports filtering and pagination, and is scoped to a single resource_id. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences, front-loaded with the main action and result fields. It avoids redundant wording and earns its place with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (8 params, no output schema), the description adequately covers the primary purpose, key return fields, filtering, and pagination. The parameter details live in the schema, and the description sufficiently orients the agent on what the report contains. A small gap is not explicitly noting that resource_id is required, but the schema marks it required.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 8 parameters. The description adds minimal extra meaning by mentioning resource_id, filtering, and pagination, but does not enhance parameter semantics beyond what is in the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Retrieves' and the specific resource: 'every patch applicable to a specific computer (by resource_id)'. It enumerates the returned fields (install status, approval status, severity, etc.) which distinguishes it from sibling list/report tools that cover all systems or patches.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'for one system' and 'specific computer' implies this tool is for per-system patch details, but it does not explicitly state when to use this over alternatives or provide exclusions. No sibling tools are mentioned, so usage guidance is implicit rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patch_view_configList patch deployment configurationsARead-only
Retrieves all patch deployment configurations with their execution status and per-target success/failure/yet-to-apply counts. Supports filtering by execution status and pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each row instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| domainFilter | No | Filter by NetBIOS domain name (domain list is available from the desktop serverproperties API). | |
| branchOfficeFilter | No | Filter by remote/branch office name (list available from the desktop serverproperties API). | |
| configStatusFilter | No | Filter by configuration execution status: InProgress, Draft, Executed, Suspended, Deployed, RetryInProgress, or Expired. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare this as read-only and non-destructive. The description adds useful context about the returned data (status and per-target counts) and supported operations (filtering by status, pagination), but does not disclose additional behavioral traits like permission requirements or result limits. This is adequate but not exceptional.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the core purpose, and contains no filler. Every clause adds value: the first sentence defines what is retrieved and the output highlights, the second sentence covers filtering and pagination.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a list tool with six optional parameters and no output schema, the description gives a solid high-level understanding: it explains the key return elements and available operations. Combined with the thorough schema, the tool is sufficiently described, though it leaves some return structure details unstated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already fully documents every parameter. The description merely restates that filtering by execution status and pagination are supported, adding no new semantic detail beyond what the schema provides. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb ('Retrieves') and resource ('patch deployment configurations'), and adds unique scope by mentioning execution status and per-target counts. This distinguishes it from sibling patch tools like patch_deployment_policies_list, which likely focus on policies rather than status and counts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context that this tool lists patch deployment configurations with status/filtering, making it evident when to use it. However, it does not explicitly mention alternatives or when not to use this tool, stopping short of a perfect score.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
reports_custom_report_dataFetch custom report dataARead-only
Fetches the rows of a specific custom report by its view name (the viewName from reports_custom_reports_list). Columns and output size depend entirely on how the report was built, so prefer a small pageLimit on first call. Default output is condensed to columns, row values, and navigation info; raw: true returns the full table response.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full raw table response (column CSS, sort state, template config) instead of the condensed columns/rows/navigation view. | |
| crview | Yes | Custom report view name — the `viewName` of a report returned by reports_custom_reports_list (e.g. CRVIEW_1746706833342). | |
| pageLimit | No | Rows per page (API param _PL; server default 25, cap 500). Defaults to the server's configured default page size, clamped to 500. | |
| firstIndex | No | First row index to fetch, 1-based and inclusive (API param _FI). Increment by pageLimit to fetch the next page of rows. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds valuable behavior beyond that: output depends on report construction, default returns condensed columns/rows/navigation, and raw:true returns the full table. It does not contradict annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each earning its place: the first states purpose and source, the second gives practical size guidance, and the third explains output modes. No fluff, front-loaded with the key action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the burden of explaining return values, and it does: condensed columns/row values/navigation info, or full raw table when raw:true. It also covers output variability and pagination hints, making it complete for this tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds extra meaning by advising a small pageLimit for first calls and by clarifying that raw changes the output from condensed to full response, which goes beyond the schema's parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Fetches the rows of a specific custom report by its view name'. It clearly identifies the input source (viewName from reports_custom_reports_list), which distinguishes it from sibling tools like reports_query_report_data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives clear usage context: use the viewName from reports_custom_reports_list, prefer a small pageLimit on first call due to variable output size, and choose raw: true for the full response. However, it does not explicitly name alternatives or state when not to use this tool, so it falls just short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
reports_custom_reports_listList custom reportsARead-only
Retrieves all custom reports available to the API user with their report ID, label, owner, view name, description, and last-modified time. Use a report's viewName with reports_custom_report_data to fetch its rows.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full raw report-tree response instead of the flattened, curated record list. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds useful context about scope ('available to the API user') and the exact fields returned, which helps the agent understand what to expect. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler. The first sentence states the core action and result, and the second provides an actionable pointer to the related data tool. All content earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only list tool with one optional parameter and no output schema, the description covers the purpose, returned fields, and a clear next step. It is complete enough for an agent to use effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The sole parameter 'raw' is fully described in the input schema, so the agent has the necessary information. The description adds no extra parameter semantics, and with 100% schema coverage the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves all custom reports available to the API user and lists the specific fields returned (ID, label, owner, view name, description, last-modified time). It also distinguishes itself from the data-fetch sibling by directing the user to reports_custom_report_data for rows.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this is for listing reports and gives an explicit next step: use a report's viewName with reports_custom_report_data to fetch rows. It provides clear context but does not explicitly compare to other report list tools or state when not to use this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
reports_query_report_dataFetch query report dataARead-only
Fetches the rows and column metadata of a specific query report by its numeric report ID (from reports_query_reports_list). Rows are returned as-is: their shape and output size depend entirely on the report's underlying query, so prefer a small limit on first call.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max rows per response (server cap is 1000). Defaults to the server's configured default page size. | |
| reportId | Yes | Numeric query report ID — the `id` of a report returned by reports_query_reports_list. | |
| startIndex | No | Starting row index to fetch from. Increment by `limit` on each call to page through the report. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds valuable behavioral context: rows are returned as-is and output shape/size depend entirely on the underlying query, warning agents about potential large or variable responses. This goes beyond what annotations alone convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no wasted words. The first sentence states the core purpose and ID requirement; the second delivers the critical behavioral warning. Information is front-loaded and every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description compensates by explaining that rows are returned as-is and that output size varies, setting accurate expectations. It also implicitly covers pagination through the startIndex parameter in the schema. For a read-only report fetch with three well-documented parameters, this description is sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already provides complete descriptions for all three parameters (reportId, limit, startIndex), including the fact that reportId comes from reports_query_reports_list. The description itself adds little new parameter-specific meaning; it reinforces the reportId source and suggests a small limit, but this is more usage advice than semantic enrichment. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Fetches') and names the exact resource ('rows and column metadata of a specific query report'), which clearly distinguishes it from sibling tools like reports_query_reports_list (listing reports) and reports_custom_report_data (custom reports). It also identifies the ID source, making the purpose unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description correctly points to reports_query_reports_list as the source for the report ID and advises a small limit on first call, which is useful operational guidance. It does not explicitly state when not to use this tool (e.g., for custom report data), but the reference to 'query report' and the sibling naming make the context clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
reports_query_reports_listList query reportsARead-only
Retrieves all query reports defined in Endpoint Central with their report ID, label, owner, view name, description, and last-modified time. Use a report's id with reports_query_report_data to fetch its rows.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full raw report-tree response instead of the flattened, curated record list. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, establishing the safe read-only nature. The description adds useful behavioral detail by enumerating the standard response fields and indicating it returns all query reports (no filtering). It does not disclose potential edge cases like pagination, but given the simple scope, this is acceptable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no redundancy. The first sentence states exactly what the tool returns; the second provides a practical usage pointer. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description compensates by listing the exact fields returned. It also mentions the next step (using the ID with reports_query_report_data), making the tool's role in the workflow clear. The one optional boolean parameter is covered in the schema, so no additional details are needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter 'raw' is fully described in the schema (100% coverage), so the description does not need to repeat it. The description adds context about the standard curated output, but the raw parameter semantics are already covered by the schema, yielding the baseline score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves all query reports defined in Endpoint Central, listing the specific fields returned (report ID, label, owner, etc.). It also distinguishes itself from the sibling reports_query_report_data by explaining that the report ID is used with that tool to fetch rows, making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly guides the user to use this tool to list query reports and then use the retrieved ID with reports_query_report_data to fetch rows. This provides a clear when-to-use and points to the alternative tool, even though it does not enumerate all other report-related siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
server_discoverDiscover server authentication settingsARead-only
Retrieves the Endpoint Central server's login configuration: whether it accepts local authentication only, which Active Directory domains are enabled for authentication, and the default domain. Useful for confirming connectivity and identifying the AD domain a service account belongs to. This is the one endpoint that requires no authentication, so it also succeeds when the API token is invalid.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark this as read-only and non-destructive, but the description adds important behavioral context beyond that: it requires no authentication and succeeds even when the API token is invalid. This is exactly the kind of auth-related behavioral disclosure the rubric rewards, and it does not contradict any annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences with no fluff. The first sentence states the core purpose and return details, the second gives the use cases, and the third adds the crucial auth caveat. Every sentence earns its place, and the structure is front-loaded with the main verb and resource.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only tool with strong annotations, the description covers purpose, use cases, and an important behavioral edge case (token-invalid success). No output schema exists, but the description's clarity about what data is returned compensates sufficiently for this simple tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the input schema is empty and schema coverage is trivially 100%. The baseline score of 4 applies here; the description adds contextual meaning about what the tool returns rather than parameter details, which is appropriate when there are no parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb ('Retrieves') and names the exact resource ('Endpoint Central server's login configuration'), then enumerates the specific data returned: whether local authentication only is accepted, which AD domains are enabled, and the default domain. This clearly distinguishes it from sibling tools focused on reports, patches, and inventory.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It identifies clear use cases: confirming connectivity and identifying the AD domain for a service account. The note that this is the only unauthenticated endpoint gives a strong 'when to use this vs alternatives' signal, but it stops short of explicitly naming an alternative or saying when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
server_propertiesServer propertiesARead-only
Retrieves the Endpoint Central server's environment summary: the domains, custom group names, and branch offices it manages. Useful for discovering valid domain/branch-office/group values to use in other tools' filters.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so safety profile is covered. The description adds what data is returned but no additional behavioral traits (e.g., pagination, permissions, freshness). With annotations covering the main concerns, a 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the main purpose, and no wasted words. Every phrase adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple zero-parameter read-only tool, the description fully explains what the tool returns and why it's useful. No output schema is needed because the description names the key result categories.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so parameter semantics are trivially satisfied. The description appropriately focuses on output rather than inputs, earning the baseline 4 for no-param tools.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves the server's environment summary, listing specific contents (domains, custom group names, branch offices). This specific verb+resource distinguishes it from sibling report/inventory tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states the use case: discovering valid filter values for other tools. It does not mention exclusions or alternatives, but the context is clear enough for an agent to know when to invoke it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
som_computers_listList managed computersARead-only
Retrieves managed computers from Endpoint Central (SoM) with hostname, IP, OS, agent install status, live status, and branch office details. Supports filtering and pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each computer instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). Defaults to the server's configured default page size. | |
| fqdnFilter | No | Filter by fully qualified domain name, e.g. host.corp.example.com. | |
| residFilter | No | Filter to a specific computer by its resource_id. | |
| domainFilter | No | Filter by the NetBIOS domain the computer is mapped to. | |
| platformFilter | No | Filter by OS platform: 0 unknown, 1 Windows, 2 Mac, 3 Linux. | |
| liveStatusFilter | No | Filter by live status: 1 live, 2 down, 3 unknown. | |
| serviceTagFilter | No | Filter by the computer's unique service tag. | |
| agentContactFilter | No | Filter by how recently the agent last contacted the server. | |
| branchOfficeFilter | No | Filter by the remote/branch office the computer is mapped to. | |
| computerNameFilter | No | Filter by exact computer name. | |
| installStatusFilter | No | Filter by agent install status: 21 yet-to-install, 22 installed, 23 uninstalled, 29 install failure, 31 uninstall failure. | |
| searchComputerFilter | No | Filter to computer names containing this substring. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the agent knows this is a safe read operation. The description adds that it returns specific fields and supports filtering/pagination, but does not disclose additional behavioral traits such as default scope, output formatting, or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two clear sentences, front-loaded with the action and resource. No wasted words; every part contributes to understanding what the tool does.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Without an output schema, the description lists key returned fields and mentions filtering/pagination. It could clarify the difference between the curated default field set and the raw full record, but the schema's `raw` parameter hints at that. Overall, sufficient for a list tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema descriptions cover 100% of parameters with detailed explanations including enum meanings. The description adds minimal value beyond stating that filtering and pagination are supported, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies this as a retrieval operation for managed computers from SoM, listing specific fields returned. It is distinguishable from sibling inventory tools by its focus on managed computers and SoM context.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. The description implies it is the standard listing tool but does not name alternatives or exclusions, leaving the agent to infer from the tool name and context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
som_remote_offices_listList remote officesARead-only
Retrieves all configured remote/branch offices with their replication status, communication type, and distribution server details.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return full unprojected records instead of the curated field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap is 1000). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds the scope ('all configured') and data fields returned, which is useful but not extensive. It does not disclose pagination behavior, but that is also reflected in the schema parameters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that immediately identifies the action and the details returned. It is front-loaded with the verb 'Retrieves' and contains no filler or redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with no output schema, the description adequately explains what the tool returns. The pagination parameters are described in the schema, so they need not be restated. It could mention the 'raw' parameter nuance, but the schema covers that.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage for all three optional parameters (raw, page, pageLimit), so the description does not need to elaborate. It adds no additional meaning beyond the schema, which meets the baseline for fully documented parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves all configured remote/branch offices and specifies the key data attributes (replication status, communication type, distribution server details). This distinguishes it from any sibling tools, none of which appear to focus on remote offices.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the usage context: when you need a list of remote offices with their replication and communication details. However, it provides no explicit guidance on when to use this tool versus alternatives, nor does it mention any exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
som_summarySoM summaryARead-only
Retrieves the Scope of Management summary: total computers, agent installation counts, and live status breakdown across the network.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds value by stating the content of the summary (counts and live status), which helps the agent anticipate the response. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence, front-loaded with the verb 'Retrieves' and packed with the essential output details. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a no-parameter tool with no output schema, the description sufficiently covers what the tool returns. It doesn't specify exact status values or response format, but that is a minor gap for a summary tool of this simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, so the description has nothing to explain. The baseline score of 4 applies for no-parameter tools, and the description does not need to compensate for schema gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves the Scope of Management summary and enumerates the included data (total computers, agent counts, live status). This distinguishes it from sibling list tools like som_computers_list or inventory_all_summary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for high-level management overview and specifies exactly what data is returned. However, it does not explicitly mention alternatives or exclusions, so it falls short of full guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
threats_patches_listList applicable patches (threat view)ARead-only
Retrieves all patches applicable to managed systems from the threats module, with severity, KB/bulletin IDs, vendor, missing/installed/failed system counts, and approval status. Supports extensive filtering and pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each entry instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| cveIds | No | Filter by CVE ID, e.g. "CVE-2019-0981". | |
| patchId | No | Filter by patch ID — numeric ID or comma-separated list. | |
| kbNumber | No | Filter by Microsoft KB number (digits only, e.g. "2565063"). | |
| severity | No | Filter by patch severity. Known values: Critical, Important, Moderate, Low, Unrated (free string in the spec). | |
| pageLimit | No | Max records per page (server cap for this endpoint is 1000). | |
| patchName | No | Filter to patches whose name contains this text. | |
| patchSize | No | Filter by patch size in bytes (digits only). | |
| updateType | No | Filter by the type of patch (the spec's closed 'Applicable inputs' list). | |
| vendorName | No | Filter by vendor name, e.g. Microsoft, Adobe. | |
| patchStatus | No | Filter by patch status. Example value from the spec: "approved" (free string, no closed list documented). | |
| updatedTime | No | Filter by the patch's approved/updated time, as epoch milliseconds (e.g. "1704363395117"). | |
| platformName | No | Filter by platform, e.g. Windows, Mac, Linux. | |
| downloadStatus | No | Filter by the patch binary's download status on the server. | |
| patchUninstall | No | Filter by vendor uninstall support. Known values: "supported", "not supported". | |
| rebootRequired | No | Filter by the post-deployment reboot option configured for the patch. | |
| patchDescription | No | Filter to patches whose description contains this text. | |
| patchReleasedTime | No | Filter by the patch's release date, as epoch milliseconds (e.g. "1704363395117"). | |
| patchSupportedTime | No | Filter by the patch's support date, as epoch milliseconds (e.g. "1704363395117"). | |
| approvedUserFirstName | No | Filter by the first name of the user who approved the patch (the spec's own description for this parameter is a mislabeled copy of reboot_required). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish read-only and non-destructive behavior. The description adds useful context about scope ('applicable patches') and returned fields (severity, counts, approval status), but it does not describe pagination behavior, default ordering, or other nuances. This is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the action and resource, and lists key return fields efficiently. No redundancy or filler words; every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only list tool with no output schema, the description provides the key return fields, scope, and filtering/pagination capability. It does not explain defaults or edge cases, but the detailed schema covers parameters, making this sufficiently complete for agent invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with each of the 21 parameters individually described. The tool description only says 'extensive filtering' generically, adding no specific parameter-level meaning beyond what is already in the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Retrieves') and clearly identifies the resource ('patches applicable to managed systems') and context ('from the threats module'). It also lists key fields returned, which distinguishes it from sibling tools like patch_all_patches_list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly implies when to use this tool: when you need applicable patches from the threats module with filtering/pagination. However, it does not explicitly name alternatives or state when not to use it, so it does not fully meet the 'explicit when/when-not' threshold.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
threats_server_misconfigurations_listList web server misconfigurationsARead-only
Retrieves web-server hardening misconfigurations (e.g. Tomcat/IIS/Apache issues) detected across the network, with severity, category, affected-system counts, and resolution guidance. Supports filtering and pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each entry instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| category | No | Filter by category, e.g. "Session hijacking", "Default Contents". | |
| severity | No | Filter by severity. Known values: Critical, Important, Moderate, Low, Info (free string in the spec). | |
| pageLimit | No | Max records per page (server cap for this endpoint is 1000). | |
| resolution | No | Filter to misconfigurations whose resolution text contains this text. | |
| description | No | Filter to misconfigurations whose description contains this text. | |
| hardeningId | No | Filter by hardening ID — numeric ID or comma-separated list. | |
| updatedTime | No | Filter by the misconfiguration's last-updated time, as epoch milliseconds (e.g. "1704363395117"). | |
| hardeningName | No | Filter to misconfigurations whose hardening name contains this text. | |
| publishedTime | No | Filter by the misconfiguration's published time, as epoch milliseconds (e.g. "1704363395117"). | |
| osPlatformName | No | Filter by platform, e.g. Windows, Mac, Linux. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds value by specifying the returned fields (severity, category, affected-system counts, resolution guidance) and mentions filtering/pagination. It does not contradict annotations and offers enough behavioral context for a read-only list endpoint.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences, front-loaded with the primary purpose, followed by a brief mention of output fields and capabilities. Every word earns its place with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 12 parameters and no output schema, the description adequately covers the tool's purpose, output contents, and core capabilities. It doesn't detail response structure, but for a list endpoint that is acceptable. Sibling differentiation is clear from the name and description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the parameter descriptions fully document each field. The description's mention of 'filtering and pagination' is a high-level summary that adds no specific meaning beyond the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves web-server hardening misconfigurations, with explicit examples (Tomcat/IIS/Apache) and the scope ('detected across the network'). It distinguishes itself from sibling tools like threats_system_misconfigurations_list by focusing specifically on web-server issues.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context: use this to retrieve web-server hardening misconfigurations. It implies when to use but does not explicitly mention alternatives or when not to use, though the tool name and sibling list make the distinction evident.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
threats_system_misconfigurations_listList system misconfigurationsARead-only
Retrieves OS/system-level misconfigurations (e.g. firewall disabled, BitLocker off) detected across the network, with severity, category, fix availability, reversibility, and affected-system counts. Supports filtering and pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each entry instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| category | No | Filter by category, e.g. "Windows Firewall", "BitLocker Encryption". | |
| severity | No | Filter by severity. Known values: Critical, Important, Moderate, Low, Info (free string in the spec). | |
| solution | No | Filter by the documented solution text. | |
| pageLimit | No | Max records per page (server cap for this endpoint is 1000). | |
| osPlatform | No | Filter by platform, e.g. Windows, Mac, Linux. | |
| description | No | Filter to misconfigurations whose description contains this text. | |
| misconfigId | No | Filter by misconfiguration ID — numeric ID or comma-separated list. | |
| misconfigName | No | Filter to misconfigurations whose name contains this text. | |
| undoSupported | No | Filter by whether the fix is reversible (true) or not (false). | |
| rebootRequired | No | Filter by reboot option. Known values: "required", "not required", "autoreboot", "may require". | |
| fixAvailability | No | Filter by fix availability. Known values: "available", "not available". | |
| potentialImpact | No | Filter by whether fixing the misconfiguration carries a potential impact flag. | |
| postDeploymentIssues | No | Filter by known post-deployment impact of fixing, e.g. "No Impact". |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is known. The description adds valuable behavioral context: it returns network-wide detections, includes specific attributes (severity, category, fix availability, reversibility, affected-system counts), and supports filtering/pagination. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two well-structured sentences. The first front-loads the core action, scope, examples, and returned fields; the second notes filtering and pagination. Every word adds value with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite no output schema, the description enumerates the main returned fields and mentions filtering/pagination. All parameters are optional and fully documented in the schema, and the tool is a straightforward read-only list operation, so the description is sufficiently complete for an agent to use it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage, with each of the 15 parameters clearly documented (e.g., severity, misconfigId, rebootRequired). The description only mentions filtering/pagination generically, adding no detail beyond the schema, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool 'Retrieves OS/system-level misconfigurations' detected across the network, with concrete examples (firewall disabled, BitLocker off). It distinguishes from sibling tools like threats_server_misconfigurations_list by explicitly focusing on OS/system-level items.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use this tool: when you need system/OS-level misconfigurations with severity, category, fix availability, and counts. It does not explicitly name alternatives or exclusions, but the scope is unambiguous enough for an agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
threats_system_reportPer-system threat report (all threat types)ARead-only
Retrieves the combined per-computer threat report: each record is one system (resource_id) with its nested vulnerabilities, applicable patches, server misconfigurations, and system misconfigurations. Filter by resource ID to inspect specific systems.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each entry instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap for this endpoint is 500). | |
| resourceId | No | Filter by resource ID — a numeric ID or comma-separated list, e.g. "304" or "304,305". |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, covering safety. The description adds meaningful behavioral context beyond annotations by specifying that each record is one system and contains nested vulnerabilities, patches, and misconfigurations, and that resourceId filters to specific systems. It does not mention pagination behavior, but that is disclosed via schema parameters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler. The first sentence states the core purpose and output shape; the second explains filtering. All words earn their place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description adequately explains the return record structure (one per system, with nested threat data). The pagination parameters and server cap are documented in the schema, so not repeating them is fine. It is sufficiently complete for a read-only report tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All four parameters have descriptions in the schema (100% coverage), so the baseline is 3. The tool description adds only a general statement that resourceId filters to a specific system, which is already captured in the schema's parameter description. It does not add deeper semantics for raw, page, or pageLimit.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Retrieves') and clearly defines the resource: the combined per-computer threat report. It explicitly enumerates the four nested threat categories (vulnerabilities, applicable patches, server misconfigurations, system misconfigurations), which differentiates it from sibling tools like threats_vulnerabilities_list or threats_system_report_vulnerabilities.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description conveys when to use the tool: when a combined per-system view across all threat types is needed. It also mentions filtering by resource ID for specific systems. However, it does not explicitly name alternatives or state when not to use it (e.g., for a single threat type), though the 'combined' wording strongly implies this.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
threats_system_report_patchesPer-system patch detailsARead-only
Retrieves systems with their per-system patch details (status Missing/Failed/Installed, approval status, install errors, installed time). Each record is one system (resource_id) with a nested patches array. Supports extensive filtering and pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each entry instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| cveIds | No | Filter by CVE ID, e.g. "CVE-2019-0981". | |
| patchId | No | Filter by patch ID — numeric ID or comma-separated list. | |
| fqdnName | No | Filter by the system's fully qualified domain name. | |
| severity | No | Filter by patch severity. Known values: Critical, Important, Moderate, Low, Unrated. | |
| pageLimit | No | Max records per page (server cap for this endpoint is 500). | |
| patchName | No | Filter to systems having patches whose name contains this text. | |
| resourceId | No | Filter by resource ID — a numeric ID or comma-separated list, e.g. "304" or "304,305". | |
| updateType | No | Filter by the type of patch (the spec's closed 'Applicable inputs' list). | |
| vendorName | No | Filter by vendor name, e.g. Microsoft. | |
| patchStatus | No | Filter by per-system patch status: Missing, Failed, or Installed. | |
| platformName | No | Filter by platform, e.g. Windows, Mac, Linux. | |
| installedTime | No | Filter by the patch installation time, as epoch milliseconds (e.g. "1704363395117"). | |
| rebootRequired | No | Filter by the post-deployment reboot option configured for the patch. | |
| installErrorCode | No | Filter by the patch installation error code. | |
| patchDescription | No | Filter to patches whose description contains this text. | |
| patchReleasedTime | No | Filter by the patch's release date, as epoch milliseconds (e.g. "1704363395117"). | |
| patchApprovalStatus | No | Filter by patch approval status: Approved or Unapproved. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, and the description adds useful behavior beyond that: each record represents one system with a nested patches array, clarifying the response shape. It also notes support for extensive filtering and pagination, though it doesn't address auth, rate limits, or default pagination behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, front-loaded with the primary action 'Retrieves systems with their per-system patch details' and includes key qualifiers. Every sentence contributes meaningful information without redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the high parameter count (19) and no output schema, the description provides essential context about the response shape (nested patches per system) and key fields. It lacks details on default sorting, pagination limits, or error handling, but the schema covers parameters and annotations cover safety, making it complete enough for a filtered list tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents all 19 parameters. The description enumerates some key fields (status, approval status, install errors, installed time) but adds no new semantic detail beyond what the schema already provides. It doesn't compensate for any gaps because there are none.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves systems with per-system patch details, listing specific fields like status, approval status, install errors, and installed time. It distinguishes itself from sibling tools by emphasizing the per-system (resource_id) record structure with a nested patches array, though it doesn't explicitly name sibling alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage through its focus on per-system patch details and mention of extensive filtering and pagination, but it does not explicitly state when to use this tool vs alternatives like patch_system_report or threats_system_report. No exclusions or when-not-to-use guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
threats_system_report_server_misconfigurationsPer-system web server misconfiguration detailsARead-only
Retrieves systems with their per-system web-server misconfiguration instances (hardening ID, status, affected file path). Each record is one system (resource_id) with a nested servermisconfigurations array.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each entry instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| pageLimit | No | Max records per page (server cap for this endpoint is 500). | |
| resourceId | No | Filter by resource ID — a numeric ID or comma-separated list, e.g. "304" or "304,305". | |
| hardeningId | No | Filter by hardening ID — numeric ID or comma-separated list. | |
| updatedTime | No | Filter by the record's last-updated time, as epoch milliseconds (e.g. "1704363395117"). | |
| hardeningStatus | No | Filter by per-system hardening status, e.g. "open". |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is known. The description adds behavioral context by stating each record represents one system with a nested servermisconfigurations array and listing the included fields (hardening ID, status, affected file path), which helps the agent predict response shape. No additional behavioral details such as pagination defaults or filtering edge cases are disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences deliver the full purpose and record structure without extraneous detail. The title is also concise and aligns with the description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only report tool with no output schema, the description provides a clear model of the response: each record is a system with a nested array of misconfigurations. Pagination and filtering are left to the schema, which fully documents them, and the annotations cover safety. This is sufficient for the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema describes all 7 parameters with 100% coverage, including defaults and filtering semantics. The description does not add anything beyond the schema regarding parameter usage, so the baseline score applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses specific verb 'Retrieves' and names the resource: systems with per-system web-server misconfiguration instances, including field details. It explicitly mentions the nested servermisconfigurations array, which distinguishes it from sibling report tools like threats_system_report_system_misconfigurations. This is clear and well-scoped.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to choose this tool over sibling report tools, such as threats_system_report_system_misconfigurations or threats_server_misconfigurations_list. The description only states what the tool retrieves and leaves the usage decision to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
threats_system_report_system_misconfigurationsPer-system misconfiguration detailsARead-only
Retrieves systems with their per-system OS misconfiguration instances (misconfiguration ID, status, global GPO state). Each record is one system (resource_id) with a nested systemmisconfigurations array.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each entry instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| globalGpo | No | Filter by global GPO state for the misconfiguration, e.g. "applied", "not applied". | |
| pageLimit | No | Max records per page (server cap for this endpoint is 500). | |
| resourceId | No | Filter by resource ID — a numeric ID or comma-separated list, e.g. "304" or "304,305". | |
| misconfigId | No | Filter by misconfiguration ID — numeric ID or comma-separated list. | |
| updatedTime | No | Filter by the record's last-updated time, as epoch milliseconds (e.g. "1704363395117"). | |
| misconfigStatus | No | Filter by per-system misconfiguration status, e.g. "open". |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds valuable behavioral context beyond annotations by disclosing the nested array structure and the fact that each record represents one system (resource_id). This helps set expectations for the response shape, which is especially useful given no output schema is present.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the action and resource, and includes only necessary details about the record structure. Every sentence earns its place, with no redundant or vague wording.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 8 parameters, no output schema, and brief annotations, the description provides a useful but incomplete picture. It explains the row-level structure and a few fields, but does not clarify whether systems without misconfigurations are included, pagination behavior, or how this relates to sibling misconfiguration reports. It is adequate for a basic understanding but leaves gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with all 8 parameters fully described, so the baseline is 3. The description adds no parameter-specific guidance or additional semantics beyond what the schema already provides, but it does not need to since the schema is comprehensive.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Retrieves') with a clear resource ('systems with their per-system OS misconfiguration instances') and explicitly defines the record structure ('Each record is one system with a nested systemmisconfigurations array'). This distinguishes it from sibling tools like server misconfigurations or flat lists, making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use this tool—when needing per-system grouping of misconfigurations—but it does not explicitly name alternatives or state when not to use it. There is no direct comparison to siblings such as threats_system_misconfigurations_list, leaving the choice to the agent's inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
threats_system_report_vulnerabilitiesPer-system vulnerability detailsARead-only
Retrieves systems affected by known vulnerabilities. Each record is one system (resource_id) with a nested vulnerabilities array (vulnerability ID/name, severity, status, last-updated time). Supports filtering and pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each entry instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| severity | No | Filter by severity. Known values: Critical, Important, Moderate, Low. | |
| pageLimit | No | Max records per page (server cap for this endpoint is 500). | |
| resourceId | No | Filter by resource ID — a numeric ID or comma-separated list, e.g. "304" or "304,305". | |
| updatedTime | No | Filter by the record's last-updated time, as epoch milliseconds (e.g. "1704363395117"). | |
| vulnerabilityId | No | Filter by vulnerability ID — numeric ID or comma-separated list. | |
| vulnerabilityName | No | Filter to vulnerabilities whose name contains this text. | |
| vulnerabilityStatus | No | Filter by per-system vulnerability status, e.g. "open". |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, and the description ('Retrieves') is consistent with a safe read operation. The description adds useful context about the nested vulnerabilities array and pagination, but does not disclose other behavioral traits like rate limits or authorization requirements. Since annotations cover the safety profile, the added context earns a mid-range score.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the core purpose, and contains no filler. The second sentence explains the record structure and capabilities without redundancy, making it concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description compensates by explaining the record structure (system with nested vulnerabilities array, listing key fields). It covers the essential context for a filtered-list read-only tool with 9 optional parameters, though it does not detail the 'raw' projection behavior, which is left to the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema covers 100% of parameters with individual descriptions, so the baseline is 3. The description only repeats that filtering and pagination are supported, without adding meaning to specific parameters. No parameter semantics are enriched beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function with a specific verb ('Retrieves systems affected by known vulnerabilities') and identifies the resource and granularity ('Each record is one system with a nested vulnerabilities array'), distinguishing it from vulnerability-centric sibling tools like threats_vulnerability_computers_detail.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives such as threats_vulnerabilities_list or threats_system_report. It does not mention when not to use it or point to sibling tools, leaving the agent without explicit selection criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
threats_vulnerabilities_listList detected vulnerabilitiesARead-only
Retrieves the network-wide list of detected vulnerabilities with severity, CVE IDs, CVSS scores, exploit status, affected-system counts, and fixing-patch availability. Supports extensive filtering and pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each entry instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| cveIds | No | Filter by CVE ID, e.g. "CVE-2019-0981". | |
| patchId | No | Filter by fixing patch ID — numeric ID or comma-separated list. | |
| severity | No | Filter by vulnerability severity. Known values: Critical, Important, Moderate, Low (the spec models this as a free string, not a closed enum). | |
| solution | No | Filter by the solution/fix text (e.g. a patch file name). | |
| pageLimit | No | Max records per page (server cap for this endpoint is 1000). | |
| cvss2Score | No | Filter by CVSS 2.0 score (numeric). | |
| cvss3Score | No | Filter by CVSS 3.0 score (numeric). | |
| osPlatform | No | Filter by OS platform name, e.g. Windows, Mac, Linux. | |
| updatedTime | No | Filter by the vulnerability's last-updated time, as epoch milliseconds (e.g. "1704363395117"). | |
| exploitStatus | No | Filter by public exploit status. Known values: "available", "not available". | |
| publishedTime | No | Filter by the vulnerability's published time, as epoch milliseconds (e.g. "1704363395117"). | |
| supportedTime | No | Filter by the time support/detection for the vulnerability was added, as epoch milliseconds (e.g. "1704363395117"). | |
| rebootRequired | No | Filter by reboot behavior of the fix. Known values: "required", "not required", "autoreboot", "may require". | |
| vulnerabilityId | No | Filter by vulnerability ID — a numeric ID or comma-separated list, e.g. "24480" or "24480,25109". | |
| patchAvailability | No | Filter by whether a fixing patch exists. Known values: "available", "not available". | |
| vulnerabilityName | No | Filter to vulnerabilities whose name contains this text. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, and the description is consistent ('Retrieves'). Beyond that, the description adds useful behavioral context by listing the returned data fields (CVE IDs, CVSS scores, exploit status, patch availability) and noting pagination support, which helps set expectations without contradicting the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the core verb and resource, and avoids any redundant or filler content. Every clause adds information about the output or capabilities.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only list tool with 18 fully documented parameters and no output schema, the description sufficiently covers scope, return fields, filtering, and pagination. It could mention default ordering or explicit alternatives, but these are not critical given the schema and purpose clarity. The description is complete enough for an agent to select and invoke the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage for all 18 parameters, each with its own clear description. The tool description adds no additional parameter-level detail beyond the generic statement that it supports 'extensive filtering and pagination'. Since the schema does the heavy lifting, a baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool 'Retrieves the network-wide list of detected vulnerabilities' and enumerates the key fields returned (severity, CVE IDs, CVSS scores, exploit status, etc.). This distinguishes it from per-system vulnerability tools like threats_system_report_vulnerabilities and threats_vulnerability_computers_detail, which are sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context: this is a network-wide list endpoint with extensive filtering and pagination. It implies the tool is for broad vulnerability discovery rather than per-system detail, though it does not explicitly mention alternatives or exclusions. This meets the 'clear context, no exclusions' bar.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
threats_vulnerability_computers_detailDetailed vulnerability-computer mapping (bulk, cursor-paged)ARead-only
Retrieves the detailed vulnerability-to-computer mapping: every record pairs one computer with one vulnerability (resource, FQDN, IP, CVEs, CVSS, status). Built for bulk export and paginated by an opaque cursor: the first call needs no cursor; if the result says more data is available, call again passing the returned cursor. Requires Endpoint Central 11.3.2430.01+; not supported on Endpoint Central MSP.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return the full, unprojected record for each entry instead of the curated default field set. | |
| page | No | Page number to retrieve. Default is 1. | |
| cursor | No | Opaque base64 cursor returned in the previous call's metadata. Omit on the first call; pass the returned cursor unchanged to fetch the next batch. | |
| pageLimit | No | Max records per page (server cap for this endpoint is 10000). The server default for this bulk endpoint is 5000; this tool defaults to the configured page limit to keep responses readable. | |
| updatedTime | No | Epoch milliseconds; only vulnerability-computer records updated after this time are returned. Useful for incremental syncs. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, and the description complements them by adding behavioral context such as the cursor pagination mechanism ('the first call needs no cursor; if the result says more data is available, call again passing the returned cursor') and version/MSP restrictions. This is valuable beyond the annotations, though it does not describe error handling or output structure in detail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences long and front-loaded with the core purpose, followed by pagination behavior and requirements. Every sentence adds necessary information without redundancy or fluff, making it appropriately concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 5 parameters and no output schema, the description covers the essential operational context: the record structure, pagination flow, and environment requirements. It does not detail the response envelope (e.g., how cursor is returned), but given the lack of output schema, the description is reasonably complete for a bulk export tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with each parameter having a detailed description, so the description does not need to re-explain them. It does add a high-level overview of the pagination workflow and mentions the server cap, but this is largely redundant with the schema's own parameter descriptions. The description adds some context but not a significant semantic layer beyond the schema, hence the baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb and resource: 'Retrieves the detailed vulnerability-to-computer mapping' and lists the exact fields returned (resource, FQDN, IP, CVEs, CVSS, status). It also distinguishes itself as a bulk export endpoint, setting it apart from related tools like threats_vulnerabilities_list or threats_system_report_vulnerabilities.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for use: built for bulk export and paginated by an opaque cursor, with explicit instructions on the cursor flow. It includes a firm exclusion (not supported on Endpoint Central MSP) and a version requirement, which serves as a when-not. However, it does not explicitly compare alternatives or state when to prefer this over sibling tools, stopping short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
86 tool updates
v0.1.0- First observed
bitlocker_recovery_key_details - First observed
bitlocker_reports_list - First observed
bitlocker_tpm_report - First observed
custom_column_data_types_list - First observed
custom_column_udt_length - First observed
custom_column_udt_name_exists - First observed
custom_field_metadata_list - First observed
custom_field_values_get - First observed
customgroup_list - First observed
dcm_block_device_audit_list - First observed
dcm_computer_device_status_list - First observed
dcm_device_audit_list - First observed
dcm_device_exemption_list - First observed
dcm_device_summary_list - First observed
dcm_device_type_exemption_list - First observed
dcm_file_shadow_list - First observed
dcm_file_trace_list - First observed
dcm_mac_computer_device_status_list - First observed
dex_addon_info - First observed
dex_device_experience - First observed
dex_device_experience_metrics - First observed
dex_last_score_update_time - First observed
dex_latest_experience_scores - First observed
dex_meta - First observed
dex_next_score_update_time - First observed
dlp_endpoint_activity_report - First observed
dlp_justification_report - First observed
dlp_network_cbfp_report - First observed
dlp_network_dcfp_report - First observed
dlp_network_device_report - First observed
dlp_network_email_report - First observed
dlp_network_printer_report - First observed
dlp_network_product_report - First observed
dlp_network_rules_report - First observed
dlp_network_usb_printer_report - First observed
dlp_network_web_domain_report - First observed
inventory_all_summary - First observed
inventory_computer_details_summary - First observed
inventory_computers_by_hardware - First observed
inventory_computers_by_license - First observed
inventory_computers_by_licensed_software - First observed
inventory_computers_by_prohibited_software - First observed
inventory_computers_by_software - First observed
inventory_computers_with_metering - First observed
inventory_filter_params - First observed
inventory_hardware_list - First observed
inventory_installed_software_list - First observed
inventory_license_software_list - First observed
inventory_licenses_list - First observed
inventory_prohibited_software_list - First observed
inventory_scan_computers_list - First observed
inventory_software_list - First observed
inventory_software_metering_summary - First observed
patch_all_patch_details - First observed
patch_all_patches_list - First observed
patch_all_systems_list - First observed
patch_apd_tasks_list - First observed
patch_approval_settings - First observed
patch_db_update_status - First observed
patch_deployment_policies_list - First observed
patch_downloaded_patches_list - First observed
patch_health_policy - First observed
patch_scan_details - First observed
patch_summary - First observed
patch_supported_patches_list - First observed
patch_system_report - First observed
patch_view_config - First observed
reports_custom_report_data - First observed
reports_custom_reports_list - First observed
reports_query_report_data - First observed
reports_query_reports_list - First observed
server_discover - First observed
server_properties - First observed
som_computers_list - First observed
som_remote_offices_list - First observed
som_summary - First observed
threats_patches_list - First observed
threats_server_misconfigurations_list - First observed
threats_system_misconfigurations_list - First observed
threats_system_report - First observed
threats_system_report_patches - First observed
threats_system_report_server_misconfigurations - First observed
threats_system_report_system_misconfigurations - First observed
threats_system_report_vulnerabilities - First observed
threats_vulnerabilities_list - First observed
threats_vulnerability_computers_detail
TDQS
Scored across 86 tools
Most tools are clearly differentiated by module prefix and specific resource/action (e.g., patch_summary vs patch_scan_details vs patch_all_systems_list). A few near-duplicates like dcm_device_audit_list vs dcm_block_device_audit_list and multiple DLP report variants could cause hesitation, but descriptions clarify the distinct scopes.
The naming is uniformly snake_case and mostly follows a noun_prefix + action_pattern, but the action words vary inconsistently (list, report, summary, details, get, exists). For example, custom_field_values_get is verb-final while most others are noun-final, and dex_meta/server_properties have no verb at all. Naming is readable but not fully predictable.
With 86 tools, this is far beyond the threshold where an agent can efficiently select among them. Even for a broad enterprise management server, the sheer volume is overwhelming and the server would be better split into several focused MCP servers or consolidated.
The tool surface is almost entirely read-only: every tool retrieves or lists data, with no create, update, delete, or action tools (e.g., no patch deployment, policy change, or device exemption actions). This severely limits the server's usefulness for actual endpoint management, even though the read-side coverage is broad.
Maintenance
Related MCP Connectors
XFA's remote MCP server — query device posture, compliance, policies & CVEs. Read-only.
An MCP server that provides access to Testiny projects, test cases and test runs
Read-only MCP access to a documented IT fleet: state, changes, posture. 15 tools.
An MCP server that provides read access to your cloud storage providers, bank accounts and more.
Related MCP Servers
- AlicenseNot gradedqualityAmaintenanceAn MCP server for ConnectWise Manage PSA, enabling management of tickets, projects, contacts, billing, and service operations through ConnectWise Manage's API.22Apache 2.0
- AlicenseAqualityAmaintenanceAn MCP server for SuperOps PSA/RMM, enabling MSPs to manage tickets, assets, clients, and field technician operations through SuperOps's API.213Apache 2.0
- FlicenseNot gradedqualityBmaintenanceMCP server for ConnectSecure vulnerability management, exposing 285 read-only tools to query assets, vulnerabilities, Active Directory, and more via natural language.-
- FlicenseNot gradedqualityCmaintenanceMCP server for Check Point Harmony Endpoint that exposes policy, asset, vulnerability, quarantine, and remediation API methods as MCP tools, with per-request credential isolation and automatic two-step authentication.-