Graylog MCP Server

get_saved_search

Execute a saved search by name, with optional overrides for time range, pagination, and page size to adjust the query at runtime.

Instructions

Load and execute a saved search by name. Optional overrides can be provided to adjust the search at execution time.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "name": "<name>"
    },
    "name": "get_saved_search"
  }
}

Input Schema

Name	Required	Description
`to`	No	Override the saved end time
`from`	No	Override the saved start time
`name`	Yes	The name of the saved search to execute
`page`	No	Page number (starts at 1). Default: 1
`pageSize`	No	Override the saved page size
`timeRange`	No	Override the saved time range (e.g., '1h', '2d')

Schema Changelog

Changes observed during successful MCP inspections.

First observedv2.3.0Aug 10, 2026

TDQS

B3.4/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions that overrides can adjust the search at execution time, but does not explain whether the operation is read-only, what the return format is, whether it has side effects, or any permission/rate-limit considerations. This is a significant gap for a tool that executes a search.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that front-loads the primary action ('Load and execute a saved search') and then mentions overrides. There is no wasted wording, and it is appropriately sized for a straightforward tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and no annotations, the description should at least indicate what the tool returns (e.g., matching results) and any execution nuances. It only says 'load and execute' and mentions overrides, leaving the agent to infer the output format, pagination behavior, and failure modes. This is incomplete for a tool with six parameters and no structured output definition.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already documents all six parameters with 100% coverage, so the baseline is 3. The description adds that parameters are optional overrides that adjust the search at execution time, but it does not provide syntax or format details beyond what the schema already includes.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool loads and executes a saved search by name, which is a specific verb-resource pair. It is distinguished from sibling tools like list_saved_searches, save_search, and delete_saved_search, which handle listing, saving, and deleting respectively.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this tool is used when you have a saved search name and want to run it, but it does not explicitly mention when not to use it or suggest alternatives like search_events for ad-hoc queries. The guidance is implicit rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.