Skip to main content
Glama
jgstew

bigfix-root-mcp

by jgstew

bigfix-root-mcp

A minimal, read-only MCP server around the besapi library, exposing the HCL BigFix root server REST API to MCP clients. Built on FastMCP 4 (stateless). Session relevance is evaluated with bigfix-remote-session-relevance (see Session relevance); every other REST call goes through besapi.

Focus: session relevance queries (data the server already has) and client fast query (live questions answered by BigFix agents), plus a few read-only helpers.

Strongly recommend using the official BigFix Platform MCP server instead: https://help.hcl-software.com/bigfix/11.0/platform/Platform/MCP/c_introduction.html

The capabilities of this MCP server are intentionally limited, where as the official one is not.

Tools

Tool

Purpose

session_relevance_query

Evaluate session relevance on the root server; returns the JSON envelope (result, count, plural, type, evaltime_ms).

analyze_relevance

Statically analyze a relevance expression offline - parse, types, dialect, unknown inspectors with suggestions, complexity. Never evaluates it.

search_inspectors

Fuzzy-search the offline inspector reference by name or phrase.

search_relevance_docs

Search a local, offline index of relevance documentation and worked examples (needs BIGFIX_KNOWLEDGE_INDEX; answers available: false with how to enable it when unset). Never contacts BigFix.

search_reference_fixlets

Search a local index of your own existing fixlets and analyses (built from a directory or a git repository: relevance, analysis properties and action script templates), with the habits counted across them (needs BIGFIX_FIXLET_INDEX; answers available: false when unset; how to build it: docs/reference-fixlets.md). Company content: read-only, bounded, and every result names its source and when it was read. Never contacts BigFix.

client_query_submit

Submit a client fast query, return its query_id immediately.

client_query_results

Fetch current (cumulative) results for a query ID; safe to call repeatedly.

client_query

Submit + poll in one call with progress notifications; stops on expected count reached, results stable, or timeout.

get_server_info

Root server version info (/api/serverinfo).

list_sites

Sites visible to the configured operator.

get_computer_group

Look up a group by name - requires an explicit site_path.

get_operator

Look up a console operator by name.

get_dashboard_variable

Read a dashboard datastore variable.

whoami

Configured user/root server, main-operator status, write-gate state; connectivity smoke test.

api_get

Read-only escape hatch: GET any /api/ path (try help for discovery).

get_computer

One computer's full record (/api/computer/{id}).

find_computers

Find computers by case-insensitive name substring.

applicable_fixlets

Content currently relevant to one computer.

get_action / get_action_status

An action's definition, and its per-computer execution state.

list_actions

Actions visible to the configured operator.

find_content

Search fixlets/tasks/analyses/baselines by name across sites; resolves the site_path needed by get_content.

get_content

One fixlet, task, analysis or baseline by site path and ID.

list_operators / list_roles

Console operators and roles (master operator only).

validate_bes_xml

Validate BES XML against the BigFix schemas. No server call.

Relevance analysis (advisory)

The relevance-taking tools statically analyze their relevance with bigfix-relevance-analyzer before sending it (dialect pinned per tool). The analysis is advisory only: even a query the analyzer rejects still goes to the server, because the analyzer's inspector table is a snapshot - an unknown inspector there may still exist on the live server. When there are findings, the response carries an analysis key (findings, suggestions, dialect mismatch); a clean query adds nothing. Server-side relevance errors gain a Static analysis: appendix with the findings and did-you-mean suggestions, so a typo'd inspector is a one-round-trip fix.

qna fast evaluation

Registered by default; absent when every target source is disabled - see qna evaluation.

Tool

Purpose

qna_eval_client_relevance

Evaluate client relevance with the qna binary on containers or inventory hosts (every inventory host when none is named) - about a second per warm run. Never touches the BigFix deployment.

qna_list_targets

List the inventory targets, which inventory file is in use, whether auto-discovery may run, and whether container images are allowed.

qna_discover_targets

Find qna targets that work on the server's host and add them to ~/.bigfix/remote_clients.toml, like the CLI's --auto-discovery. Registered only with the default inventory.

Write tools (opt-in)

Absent unless BIGFIX_ALLOW_WRITES is set - see Writes.

Tool

Purpose

stop_action

Stop an in-flight action (POST /api/action/{id}/stop).

set_dashboard_variable

Set a dashboard datastore variable.

import_bes_content

Create/update custom content in a site. Does not deploy it.

Result bounding

Every tool that can return an unbounded payload is windowed and says so. List-shaped tools take limit/offset and report returned, total_available and truncated; blob-shaped tools report truncated and total_chars, and drop an oversized payload rather than cut it into something that looks complete.

This is not optional politeness: BigFix relevance has no row-limiting operator (first, firsts, items, elements are all undefined), so bounding the response is the only way to bound a result. find_content on the reference deployment matches 12,395 fixlets.

Related MCP server: MSSQL-MCP

Resources and prompts

Relevance is the hard part, so the server ships reference material clients can pull on demand rather than repeating it in every tool description:

Resource

Contents

bigfix://relevance/session-cookbook

Session relevance that works - every expression verified against a live root server - plus the operators that don't exist.

bigfix://relevance/client-cookbook

Client (fast query) relevance, targeting forms, reading cumulative results.

bigfix://relevance/authoring-guide

Rules that prevent most relevance errors, the common error messages with their usual causes, and how applicability clauses combine. Every example is checked with the analyzer.

bigfix://relevance/client-idioms

Documented client-relevance patterns for files, registry, applications, services, OS, versions, text and WMI. Every example is checked with the analyzer.

bigfix://guide/tools

Which tool answers which question, how to read bounded responses, what operator scope means.

bigfix://relevance/reference/dialects

Client versus session relevance: where each is evaluated, which one a tool expects.

bigfix://relevance/reference/client-relevance

Client relevance language reference (from bigfix-relevance-analyzer).

bigfix://relevance/reference/session-relevance

Session relevance language reference (from bigfix-relevance-analyzer).

Prompts: diagnose_computer, patch_status, find_stale_agents, troubleshoot_relevance, write_relevance, write_actionscript, write_fixlet.

write_relevance(goal, dialect) walks a model through writing relevance: look it up with search_relevance_docs (and search_reference_fixlets, for similar existing content), check names with search_inspectors, draft, analyze_relevance, evaluate with a bounded query, and report only what was verified. If BIGFIX_RELEVANCE_CONVENTIONS names a markdown file, its text is added as house conventions (how your team treats proxy agents, guard idioms, and so on; HTML comments in the file are for people and are not sent). Two starting points are tracked: corpus/conventions.md, an editable default (it excludes proxy agent contexts) that you can point the variable at as it is or copy and edit, and the commented template docs/relevance-conventions.example.md.

write_actionscript(goal, platform) does the same for an action script: look up the commands in the indexed action script documentation, find a similar script as a template with search_reference_fixlets (role='actionscript'), draft, check every {...} relevance substitution with analyze_relevance, and report what was checked. A script can be checked but not run, so it never says one works, never invents a download URL or checksum, and never puts a credential in a script. write_fixlet(goal, platform) joins the two: applicability relevance and an action script that agree with each other, assembled as BES XML and checked offline with validate_bes_xml. It does not import or deploy anything.

Relevance errors also carry a cause hint: the server recognizes the common failure shapes (a non-existent limiting operator, client relevance in a session query, singular-vs-plural) and appends what to do instead, so a bad expression is a retry rather than a dead end.

Client fast query semantics

Client queries are answered by live agents: results accumulate at /api/clientqueryresults/{id} over seconds to minutes as clients report in, and there is no completion flag. The client_query tool polls with three termination heuristics (reported in stop_reason):

  1. expected_count_reached - as many distinct computers reported as targeted;

  2. results_stable - no new computers for stable_polls consecutive polls;

  3. timeout - partial results at timeout are a normal outcome (offline agents never report), not an error.

For long waits, use client_query_submit then client_query_results repeatedly instead of a single blocking call.

The knowledge base: adding sources and regenerating the indexes

The server can search two local indexes. Both are optional, offline and read-only, and both are built by tools in this repository, not downloaded.

Index

Built from

Tool that reads it

Variable

File

Documentation

Web pages, PDFs and git repositories of public documentation, plus any private documents you list

search_relevance_docs

BIGFIX_KNOWLEDGE_INDEX

corpus/index/relevance.sqlite

Reference fixlets

.bes files in a directory or a git repository: your own existing content

search_reference_fixlets

BIGFIX_FIXLET_INDEX

corpus/index/fixlets.sqlite

Everything the tools download, convert or build lives under corpus/ and is ignored by git (see corpus/README.md). Public availability is not permission to redistribute: only add sources you are cleared to use, and note that the reference fixlet index holds your own company content, so never commit, package or share it. Neither index is shipped: each user builds both on their own machine from the source lists. The documentation index can hold private documents too, so the same applies to it.

Run every command from the repository root. uv sync installs the development group, which includes pypdf, needed only to read PDFs. Use uv run python -m ..., or plain python -m ... with the project environment active. Every step has a --dry-run that changes nothing: use it first.

Quick start: build both indexes from a fresh clone

These commands build both indexes from the committed source lists (corpus/GIT_SOURCES.csv and corpus/MANIFEST.csv), then register the server with Claude Code. Run them from the root of the clone:

uv sync                                           # the dev group, including pypdf
uv run python -m tools.ingest.gitsource           # the pinned documentation repositories
uv run python -m tools.ingest.fetch               # the URL sources, each checked by SHA-256
uv run python -m tools.ingest.build               # writes corpus/index/relevance.sqlite
uv run python -m tools.ingest.fixletbuild --all   # writes corpus/index/fixlets.sqlite

claude mcp add bigfix-root --scope user \
  -e BIGFIX_KNOWLEDGE_INDEX="$PWD/corpus/index/relevance.sqlite" \
  -e BIGFIX_FIXLET_INDEX="$PWD/corpus/index/fixlets.sqlite" \
  -e BIGFIX_RELEVANCE_CONVENTIONS="$PWD/corpus/conventions.md" \
  -- uv run --project "$PWD" bigfix-root-mcp
  • Run the server from the checkout (uv run --project), not with uvx bigfix-root-mcp: the published package does not have the index tools and prompts in this branch. Use absolute paths; on Windows write them out in full.

  • BIGFIX_RELEVANCE_CONVENTIONS is optional. It loads the committed default conventions, which you can edit.

  • The search tools and prompts work without a BigFix connection. The other tools also need BES_ROOT_SERVER, BES_USER_NAME and BES_PASSWORD, or a ~/besapi.conf (see Configuration).

  • fixletbuild does not need the downloads, so it can run while fetch is running.

  • fetch waits between requests to one host, so it is the slow step. If an upstream page has changed since its hash was committed, fetch downloads it and records the new hash in corpus/MANIFEST.csv, which then shows as modified in git. That is expected: keep the change, or commit it to move the pin.

A run on 2026-10-26 (Windows, one machine) took about 14 minutes for fetch, about a minute each for build and fixletbuild, and seconds for the rest. It gave a documentation index of 10,341 chunks and 1,206 examples from 422 sources (2 of the 420 URL sources had changed upstream), and a reference index of 22,324 rows from bigfix/CommunityContent and bigfix/content. Your own sources, and any other repositories, come from corpus/local-sources.csv, which is not in the clone; add them as described below and build again.

Add to the documentation index

To add

Edit

Then run

A web page (a URL)

a row in corpus/MANIFEST.csv

fetch, then build

A PDF (a URL)

a row in corpus/MANIFEST.csv

fetch, then build

A git repository of documentation

a row in corpus/GIT_SOURCES.csv

gitsource, then build

A URL (web page or PDF). Add one row to corpus/MANIFEST.csv. The columns are id, path, source_url, title, retrieved_on, license, bigfix_version, dialect, sha256, notes:

my-guide,,https://example.com/docs/my-guide.pdf,My Guide,,Public; use covered by sign-off,11.0,client,,added 2026-10-24
  • id is a short name (letters, digits, ., _, -). dialect is session, client or both; blank means unknown. Leave path, retrieved_on and sha256 blank: the fetch step fills them in and records the file's SHA-256, so a later change upstream shows as a manifest diff.

  • Supported types are .pdf, .html/.htm and .md/.markdown/.txt. The stored file name takes its extension from the URL. A page whose URL has no .html extension would be stored as .bin and skipped, so put my-page.html in the path column yourself.

  • Fetching honours robots.txt, waits between requests to one host and caps response size. It only fetches http and https.

python -m tools.ingest.fetch --dry-run     # download and report, write nothing
python -m tools.ingest.fetch               # fetch, record hashes in MANIFEST.csv
python -m tools.ingest.fetch --only my-guide

A git repository. Add one row to corpus/GIT_SOURCES.csv. The columns are id, repo_url, branch, commit, subpath, license, pinned_on, notes. The commit must be a full 40-character SHA and subpath must name the folder to read, so every build uses the same bytes. Find the commit with git ls-remote <repo_url> <branch>:

my-docs,https://github.com/example/docs.git,main,0123456789abcdef0123456789abcdef01234567,site/pages,Apache-2.0,2026-10-24,pinned today

To read two folders of one repository, add two rows with different ids and the same commit. To update a source, change its commit and run the steps again.

python -m tools.ingest.gitsource --dry-run
python -m tools.ingest.gitsource

A private document (a PDF, HTML, markdown or text file that must stay local). Add a file row to the untracked corpus/local-sources.csv, the same private list the fixlet index reads; only the documentation index uses file rows. The file is read in place on every build and its SHA-256 is recorded; only its file name is stored as its origin:

team-doc,file,C:/path/to/guide.pdf,,,,team,private; read in place

Regenerate the documentation index. The index is rebuilt from scratch from every row, so this is also how you pick up a change or remove a source (delete its row first):

python -m tools.ingest.build --dry-run     # converts and scans, writes nothing
python -m tools.ingest.build               # writes corpus/index/relevance.sqlite

The report lists each source's files, chunks and examples. It also scans for credentials and refuses to write the index if it finds a high-confidence one (exit code 3); a known false positive can be allowed in corpus/SCAN_ALLOW.csv with a reason. Point BIGFIX_KNOWLEDGE_INDEX at the file. It is read on every call, so a rebuilt index is used without restarting the server.

Add to the reference fixlet index

To add

Edit

Then run

A directory of .bes files (a fixlet path)

a row in corpus/local-sources.csv (private)

fixlets, then fixletbuild

A private git repository of .bes files

a row in corpus/local-sources.csv (private)

fixlets, then fixletbuild

A public git repository of .bes files

a row in corpus/GIT_SOURCES.csv with content set to fixlets

fixlets, then fixletbuild

There are two source lists. Private sources go in corpus/local-sources.csv, which is ignored by git because a company path or an internal repository URL is itself internal. Public sources go in the tracked corpus/GIT_SOURCES.csv, the same list the documentation index uses, pinned to a commit. Its optional content column says which index a row feeds (docs, the default, fixlets, or docs+fixlets) and its optional group column names the group. fixletbuild --all reads both lists. Copy the template for the private list and edit it:

cp docs/local-sources.example.csv corpus/local-sources.csv

The columns of local-sources.csv are id, kind, location, branch, commit, subpath, group, notes:

team-fixlets,dir,C:/path/to/bes-files,,,,team,a working tree
team-repo,git,https://git.example.com/org/repo.git,main,,content/fixlets,team,internal repository

A public repository goes in corpus/GIT_SOURCES.csv with a full 40-character commit, a subpath (. for the whole repository), and the two optional columns:

public-repo,https://github.com/example/public-content,,0123456789abcdef0123456789abcdef01234567,.,MIT,2026-10-26,example content,fixlets,reference
  • A directory is read in place and never modified. Every .bes file under it is found, in any letter case. Links and junctions are not followed. A dir row may also name one .bes file (with no subpath), to add a single item without the rest of its folder.

  • A git repository is checked out under corpus/raw/fixlets/<id>/. A blank commit means the branch tip at the moment it is read; the commit is recorded. Put a full SHA there to read exactly the same content again. Use https (git must be able to sign in without a prompt; a password in a URL is refused) or, with --allow-scheme ssh, an ssh URL.

  • group decides what is counted together. The habits the index reports are counted per group and never pooled, so give your own sources one group and other people's content another. A source with no group counts alone.

python -m tools.ingest.fixlets --source team-fixlets --dry-run   # check one source
python -m tools.ingest.fixlets --source team-fixlets             # read it, record when
python -m tools.ingest.fixletbuild --all --dry-run               # analyse every listed source
python -m tools.ingest.fixletbuild --all                         # write corpus/index/fixlets.sqlite

For a one-off, skip the list: python -m tools.ingest.fixlets --dir PATH or --git URL [--branch B] [--commit SHA] [--subpath P].

The index is built from all the sources you name at once and rebuilt from scratch, so always build with --all (or repeat --source). It holds three kinds of row: applicability relevance of fixlets and tasks, analysis properties, and action scripts, each stored as a template with its relevance substitutions listed separately. It also counts the habits that recur, per group and platform. A credential found in relevance, a description or a script is left out and reported by file and rule, never by value. Point BIGFIX_FIXLET_INDEX at the file. The step-by-step guide, with a worked example for each kind of source, is docs/reference-fixlets.md.

Check and keep it current

  • Ask for something the sources cover. search_relevance_docs answers with chunks and examples; search_reference_fixlets answers with results and conventions. Either answers available: false with the reason and how to enable it when its variable is unset, its file is missing, or the index was built by a different version. A version mismatch means rebuild.

  • Rebuild whenever a source changes. Every real read of a reference source appends to corpus/index/fixlet-reads.jsonl: when it was read (UTC), the commit (git), a fingerprint of the files and counts.

  • To judge answers fairly, set BIGFIX_FIXLET_HOLDOUT to the item ids a question came from; they are removed, with their action scripts, from every search.

  • The write prompts that use these indexes are write_relevance, write_actionscript and write_fixlet (above). Team rules belong in BIGFIX_RELEVANCE_CONVENTIONS, not in the indexes.

Configuration

Environment variables win over config files:

Setting

Env var / [besapi] config key

Default

Root server URL

BES_ROOT_SERVER (e.g. https://bes.example.com:52311)

-

REST operator

BES_USER_NAME

-

Password

BES_PASSWORD

-

Write tools

BIGFIX_ALLOW_WRITES: true to register them

off

TLS verification

BES_SSL_VERIFY: tofu, false, true, or a CA bundle path. tofu (or unset) pins self-signed certs on first use for session relevance only; besapi treats it as false. See Safety and design notes

unset (tofu)

qna inventory

BIGFIX_QNA_INVENTORY: path to a remote_clients.toml, or 0 for none (see qna evaluation)

~/.bigfix/remote_clients.toml, then the all-users config dir

qna auto-discovery

BIGFIX_QNA_AUTO_DISCOVERY: 0 to never discover hosts, on first run or when asked

on

qna containers

BIGFIX_QNA_CONTAINERS: 0 to forbid container-image targets

on

Knowledge index

BIGFIX_KNOWLEDGE_INDEX: path to the relevance.sqlite built by python -m tools.ingest.build (see docs/knowledge-retrieval-plan.md). Read-only; read on every call, so a rebuilt index is picked up without a restart. An index and a server must agree on the schema version, and a mismatch is reported (rebuild the index, or restart after upgrading the server)

unset (search_relevance_docs reports it is unavailable)

Reference fixlet index

BIGFIX_FIXLET_INDEX: path to the fixlets.sqlite built by python -m tools.ingest.fixletbuild from the sources in the untracked corpus/local-sources.csv (template: docs/local-sources.example.csv) and the public rows of corpus/GIT_SOURCES.csv. Step-by-step build instructions for a directory, a backup export and a git repository (the public jgstew/bigfix-content, as the example of reading an internal one) are in docs/reference-fixlets.md. Company content, so it is never tracked or packaged. Read-only; read on every call. Optional BIGFIX_FIXLET_HOLDOUT (comma-separated item ids) removes those items from every search, for evaluations.

Relevance conventions

BIGFIX_RELEVANCE_CONVENTIONS: path to a markdown file of your team's relevance conventions, added to the write_relevance prompt as instructions. Read on every call; capped at 64 KB (8,000 characters reach the prompt); set but unreadable is reported in the prompt, not ignored

unset (no conventions)

Transport

BIGFIX_MCP_TRANSPORT: stdio or http (streamable HTTP on 127.0.0.1:8000/mcp, banner on). No auth layer of its own - put authentication in front before binding beyond localhost.

stdio

Config files are searched in besapi's order: /etc/besapi.conf, ~/besapi.conf, ~/.besapi.conf, ./besapi.conf - same [besapi] section format as besapi/bescli, so an existing config just works. Prefer keeping credentials in ~/besapi.conf over MCP client config files.

Example MCP client config (see .mcp.json):

{
  "mcpServers": {
    "bigfix-root": {
      "command": "uvx",
      "args": ["bigfix-root-mcp"]
    }
  }
}

Install / run

Published on PyPI. Requires Python 3.11+.

With uv (preferred)

No install step - uvx fetches and runs it in a throwaway environment, which is also what the MCP client configuration above uses:

uvx bigfix-root-mcp

To keep it on PATH instead, as a managed tool:

uv tool install bigfix-root-mcp
bigfix-root-mcp

With pip

pip install bigfix-root-mcp
bigfix-root-mcp               # or: python -m bigfix_root_mcp

From a checkout

uv 0.12+ required:

uv sync
uv run bigfix-root-mcp        # or: uv run python -m bigfix_root_mcp

Verifying a download

Every release since v0.1.3 also attaches the wheel and sdist with a SHA256SUMS.txt, checkable with sha256sum -c SHA256SUMS.txt.

Smoke test against a live root server with MCP Inspector:

npx @modelcontextprotocol/inspector bigfix-root-mcp

then call whoami, session_relevance_query with number of bes computers, and client_query targeting a known computer ID.

Operator scope

Every result is limited to what the configured REST operator can see. Only a master operator has full visibility; a regular operator can never be certain its view is complete, and cannot distinguish "does not exist" from "outside my scope". So number of bes computers returning 35 means 35 computers visible to this operator - a lower bound, not the BigFix total.

whoami reports is_main_operator for exactly this reason: check it before treating any result as the full state of BigFix. The tool descriptions carry this caveat so LLM clients don't overstate scoped results.

Safety and design notes

  • Read-only by default: with BIGFIX_ALLOW_WRITES unset, only read tools are registered - the write tools do not exist as far as any client can tell. One nuance: submitting a client query does create a query object server-side, but agents only evaluate relevance against it - no managed-endpoint state changes.

  • Client fast query is a powerful read. client_query with target_all evaluates arbitrary client relevance on every agent the operator can see, and the BigFix agent runs as SYSTEM/root. That can read file contents, registry values and process lists fleet-wide, and the results come back in the tool response. Scope the configured operator to the smallest useful set of computers; whoami.is_main_operator tells you which you have.

  • Explicit site paths: this server never uses besapi's mutable "current site path" connection state (set_current_site_path / get_current_site_path - a bescli convenience); tools that need a site take a required site_path parameter.

  • Stdout hygiene: stdout belongs to the MCP stdio transport; all logging goes to stderr, and config loading avoids besapi helpers that print.

  • TLS: with BES_SSL_VERIFY unset (or tofu), session relevance trusts on first use: a CA-valid certificate is used as is, a self-signed one (the BigFix default) is pinned on first contact in ~/.bigfix/.remote_session_known_certs.toml - shared with the bigfix-remote-session-relevance CLI - and a different certificate later is refused before any credentials are sent. Remove the entry (or run bigfix-remote-session-relevance --forget-cert HOST:PORT) once a legitimately changed certificate is verified out of band. The besapi tools have no pinning and stay unverified in that mode, matching besapi. An explicit false turns verification off for both; true (honouring REQUESTS_CA_BUNDLE / CURL_CA_BUNDLE) or a CA bundle path verifies both and pins nothing - use one of those for anything beyond a lab. HTTPS_PROXY / NO_PROXY are honoured by the besapi tools only; session relevance connects directly.

  • Generic BigFix logic here is written to be upstreamed into besapi - see docs/besapi-proposals.md.

Session relevance

session_relevance_query, find_computers and find_content evaluate through the REST backend of bigfix-remote-session-relevance, using the same connection settings as everything else (env vars or besapi.conf); its own ~/.bigfix config, certificate pinning and deployment discovery are not used. The reason is the root server's behaviour when it can reach a BigFix Explorer: it forwards /api/query to Explorer, which rejects besapi's double-encoded form post with "This expression contained a character which is not allowed" - in practice any query containing a space. The library sends a JSON body first and falls back to besapi's form encoding only when the server answers "no reachable BigFix Explorer", so both setups evaluate the query exactly as written.

qna evaluation

bigfix-remote-client-relevance is a base dependency, so qna_eval_client_relevance / qna_list_targets are registered by default; they are absent only when both target sources are off (BIGFIX_QNA_INVENTORY=0 and BIGFIX_QNA_CONTAINERS=0). The [qna] extra still exists so older install commands keep working, but adds nothing. It evaluates client relevance with the BigFix qna binary on lab targets in about a second per warm run - the fast half of the feedback loop next to the advisory analysis.

What it is not: qna runs on the target machine, not through the BigFix deployment. No operator scope, no site subscriptions, no client settings - inspectors that depend on deployment state will differ from client_query. Iterate here, confirm on real agents with client_query. (The package's Fast Query transport is an upstream stub; this server does not expose it.)

Targets are deliberately constrained:

  • Container images (ubuntu:22.04, ...) may be passed by the caller; needs docker or podman on the server host. First use of an image is slow (agent artifact download + derived image build); later runs are ~1s. Set BIGFIX_QNA_CONTAINERS=0 to forbid these.

  • Inventory hosts come only from a remote_clients.toml on the server (the package's inventory format: ssh/local/container/online_evaluator entries). BIGFIX_QNA_INVENTORY names one; unset, the server uses the same default as the package's CLI: ~/.bigfix/remote_clients.toml, then the all-users config directory (/Library/Application Support/bigfix, /etc/xdg/bigfix, C:\ProgramData\bigfix). Unlike the CLI it never reads ./remote_clients.toml, since an MCP server's working directory is wherever its client launched it. BIGFIX_QNA_INVENTORY=0 turns the inventory off. The MCP client can pick entries by name but can never supply ssh hosts, users, or become flags of its own. qna_list_targets shows the file in use.

  • No targets named means every inventory host, as with the CLI (qna only reads), up to 20 per run. An online_evaluator entry sends the client relevance to developer.bigfix.com, so name targets explicitly to keep a query off it.

  • Auto-discovery: the package's non-interactive discovery probes local qna, a downloaded qna (cached by the package), the container engine's images and developer.bigfix.com, then adds what works to ~/.bigfix/remote_clients.toml; it can take minutes. Runs are one at a time. It is refused while the inventory in use is another file (the all-users one, say), because the new ~/.bigfix file would hide it. As with the CLI, it runs by itself only on a first run: one that names no targets when no inventory file exists. Once the file exists, even with no hosts, it runs only when the qna_discover_targets tool is called (the CLI's --auto-discovery). With a BIGFIX_QNA_INVENTORY path (that file is the admin's) or BIGFIX_QNA_AUTO_DISCOVERY=0 it never runs and that tool is not registered. It never uses the interactive SSH discovery and never prompts. When a qna_eval_client_relevance run finds no targets (an empty inventory, a name missing from an empty one) or returns no result rows at all, the error or the payload's hint suggests qna_discover_targets. Error rows count as results. If discovery ran in the last 15 minutes, it says what that run added and where to add hosts by hand instead.

Security notes: qna executes on the targets; the controller downloads BigFix agent artifacts from support.bigfix.com (SHA256-verified against the release site's sums) on first use of a version, so the server host makes outbound requests; every run, and every auto-discovery, leaves a BIGFIX QNA audit line on stderr.

Writes

Set BIGFIX_ALLOW_WRITES=true to register the three write tools. The flag controls registration, so with it off there is nothing to call.

Two guardrails apply to all of them:

  • dry_run defaults to true. The response describes the call that would be made and nothing is sent. A write only happens on an explicit dry_run=false.

  • Every attempt is audit-logged to stderr as one BIGFIX WRITE line with the operator, target, dry-run flag and outcome.

The set is limited on purpose to operations whose blast radius is reversible or nil. import_bes_content creates content; it does not run it - a fixlet imported this way does nothing until somebody deploys an action against it in the console.

Not implemented, and not to be added without their own design round: deploying actions (POST /api/actions), any DELETE, creating sites or operators, and file upload. Deploying an action is arbitrary code execution as root across the fleet, which is a different category of risk from anything here.

Documentation

Doc

Contents

client-query.md

Client fast query protocol reference: endpoints, payloads, live-captured result schema, termination heuristics and their tradeoffs.

besapi-notes.md

besapi behaviors this wrapper depends on or works around (error surfacing, connection lifecycle, return shapes, site-path state).

design-decisions.md

Why the server is shaped this way, plus FastMCP 4 beta specifics.

besapi-proposals.md

Proposed upstream besapi changes that would let this project shrink.

rest-endpoints.md

Live-verified REST paths, site-path rules, and relevance findings (including the operators that don't exist).

security-review.md

Threat model and findings for the tool surface.

Development

Requires Python 3.11+ and uv 0.12+. uv sync creates .venv from the committed uv.lock and installs the dev dependency group; no manual venv or pip install -e step.

uv sync
uv run pytest

Linting, formatting, type checking and the packaging checks all run through pre-commit (ruff, mypy, bandit, slyp, zizmor, and the uv lock/build checks). Install both hook types - some checks are deliberately deferred to pre-push because they are too slow to want on every commit:

uv run pre-commit install --hook-type pre-commit --hook-type pre-push

Useful invocations:

uv run pre-commit run --all-files                    # the commit-stage hooks
uv run pre-commit run --all-files --hook-stage manual  # everything, as CI runs it

Tests run entirely offline against a scripted fake BESConnection, including in-memory end-to-end MCP calls via fastmcp.Client.

Available Tools

27 tools
analyze_relevanceAnalyze RelevanceA

Statically analyze a relevance expression WITHOUT evaluating it anywhere.

Offline and instant: checks that the expression parses (with a positioned error when it does not), infers types, classifies the dialect (session vs client), flags inspectors no reference dump defines, finds unbound 'it', and scores complexity/evaluation cost. Use it to validate a query before session_relevance_query or client_query, or to understand a relevance error after one.

Advisory: the inspector table is a snapshot, so an unknown inspector is a warning (the live server may still know it), and a clean report does not guarantee the server will accept the query.

NameRequiredDescriptionDefault
dialectNoPin the dialect: 'session' (root server) or 'client' (agent). Default: classify automatically from the text.
platformNoNarrow client inspector lookups to one platform, e.g. 'windows', 'macos', 'ubuntu'.
relevanceYesRelevance expression to analyze. It is never evaluated.
include_sexprNoInclude the parsed tree as an S-expression.

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so well: it declares the operation is offline and instant, guarantees the expression is never evaluated, and discloses the advisory nature of the inspector snapshot plus the fact that a clean report does not guarantee server acceptance. These are non-obvious behavioral caveats an agent needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core purpose, then behavior, then usage routing, then caveats. The bullet-style clauses (parse checks, type inference, dialect classification, unbound 'it', complexity scoring) are dense but each earns its place by telling the agent what the report contains.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and the description still covers the operational profile and limitations an agent must know to interpret results correctly. Nothing needed to call or correctly trust the tool is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all four parameters are already documented, and the description does not add syntax or format detail beyond them. It reinforces concepts like dialect classification and inspector lookups, but that information is already present in the schema, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Statically analyze a relevance expression') and immediately scopes it with 'WITHOUT evaluating it anywhere', which is the exact distinction that separates it from session_relevance_query and client_query. An agent can identify the tool's role without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly names when to use it ('to validate a query before session_relevance_query or client_query, or to understand a relevance error after one'), naming the exact sibling tools and the pre/post conditions. Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

api_getApi GetA

Read-only escape hatch: GET any BigFix REST API path under /api/.

GET is non-mutating across the BigFix REST API. Use path 'help' to discover available endpoints. Response text is capped at max_chars; total_chars reports the full length.

NameRequiredDescriptionDefault
pathYesRelative REST API path under /api/, e.g. 'help', 'computers', 'sites', 'computer/123'. Query strings allowed.
max_charsNoMax characters of response text (default 50000).

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the safety profile itself and does so clearly by stating GET is non-mutating across the BigFix REST API. It also discloses response truncation via max_chars and total_chars, though it omits auth, rate-limit, and error behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short, front-loaded with the core purpose, and every sentence adds operational value. There is no redundant restatement of the tool name or schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a generic REST escape hatch with an output schema, it covers purpose, safety, discovery, and truncation adequately. It is slightly thin on endpoint-dependent auth and error semantics, but the output schema reduces the need to describe return values.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3, but the description adds useful meaning by explaining that max_chars caps response text and total_chars reports full length. The path parameter's relative /api/ format and examples are already well covered by the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: GET any BigFix REST API path under /api/. The phrase "read-only escape hatch" clearly frames it as a generic fallback relative to the many dedicated sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It establishes the tool as an escape hatch and recommends path 'help' for discovering endpoints. However, it does not explicitly say when to prefer the many purpose-built sibling tools or when not to use this generic endpoint.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

applicable_fixletsApplicable FixletsA

Content currently relevant to one computer (/api/computer/{id}/fixlets).

This is the patch/compliance question: what BigFix currently considers applicable to that machine.

NameRequiredDescriptionDefault
computer_idYesBigFix computer ID.

Output Schema

NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden, and it does convey that the result is a point-in-time, machine-scoped applicability computation. But it says nothing about read-only safety, permission requirements, result volume/pagination, or how freshness is determined, so the disclosure is only partial for a mutation-free query whose semantics matter.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the core meaning before the clarifying framing. The API path and the second sentence slightly overlap in restating scope, but nothing is wasted or padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and the single required parameter is schema-documented. What remains missing is routing guidance versus the many similarly-named relevance/query siblings, which keeps it from a 5.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only one parameter, and the schema already documents computer_id as the 'BigFix computer ID' at 100% coverage. The description adds no extra meaning about how to obtain that ID or what happens if it is unknown, so this sits at the baseline for schema-covered params.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific resource (fixlets/content applicable) scoped to one computer, and the parenthetical API path reinforces it. It also distances itself from relevance-query siblings by framing the answer as 'the patch/compliance question: what BigFix currently considers applicable to that machine.' It does not explicitly name the sibling it differs from, so it stops short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'This is the patch/compliance question' implies the intended use case, which is better than nothing. However, it never tells the agent when to pick this over close siblings like session_relevance_query, qna_eval_client_relevance, or find_content, nor does it state prerequisites such as the computer needing to exist or report in.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

client_queryClient QueryA

Submit a BigFix client (fast) query and wait for results, polling until done or timeout. Targeting: set exactly one of target_all, target_computer_ids, target_computer_names, or target_relevance (client relevance evaluated on each agent to decide applicability). Targeting is limited to the configured operator's scope, so target_all means all computers this operator can see, not necessarily all computers in BigFix.

NameRequiredDescriptionDefault
limitNoMax rows to return (default 500). The response reports total_available and truncated.
offsetNoRow offset, for paging through results.
query_textYesClient relevance to evaluate on each targeted agent.
target_allNoTarget all computers.
stable_pollsNoStop after this many consecutive polls with no new computers reporting (once at least one has).
expected_countNoStop once this many computers reported. Defaults to the targeted computer count when knowable.
timeout_secondsNoMax seconds to wait (1-600).
target_relevanceNoClient relevance targeting expression.
target_computer_idsNoTarget these BigFix computer IDs.
poll_interval_secondsNoSeconds between polls (min 2).
target_computer_namesNoTarget these computer names.

Output Schema

NameRequiredDescription

No output parameters

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral burden and does well: it discloses synchronous polling behavior, termination via timeout or result-completion, and the non-obvious scope caveat that target_all means all computers the operator can see rather than all BigFix computers. It omits permission/auth requirements and any rate-limit or load implications.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tightly packed sentences with the action and the targeting rules front-loaded; every clause (polling, mutual exclusivity, operator scope) earns its place. Slightly dense but no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and the 11 parameters are fully documented in the schema. The description covers the remaining high-value gaps (targeting exclusivity, operator-scope semantics, polling termination), leaving only the when-vs-siblings routing unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents each parameter and a baseline of 3 applies. The description adds meaning beyond the schema by stating the target_* parameters are mutually exclusive and that target_relevance is evaluated per-agent, steering correct selection rather than just repeating field docs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource ('Submit a BigFix client (fast) query and wait for results') and clarifies the synchronous-with-polling nature of the call. It implies differentiation from async siblings (client_query_submit/client_query_results) by noting it waits, but never names those alternatives explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a concrete usage constraint for targeting ('set exactly one of target_all, target_computer_ids, target_computer_names, or target_relevance'), which is real guidance. However, it never says when to prefer this tool over the sibling polling tools (client_query_submit/client_query_results) or session_relevance_query, leaving the main selection decision to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

client_query_resultsClient Query ResultsA

Fetch current results for a previously submitted client fast query.

Results are cumulative and there is no completion flag: safe and cheap to call repeatedly until reported_count stops growing or the expected number of computers have reported.

reported_count and result_row_count always describe the full result set; the returned rows are windowed by limit/offset.

NameRequiredDescriptionDefault
limitNoMax rows to return (default 500). The response reports total_available and truncated.
offsetNoRow offset, for paging through results.
query_idYesQuery ID returned by client_query_submit.

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses that results are cumulative, that there is no completion flag, that repeated calls are safe and cheap, and how windowing interacts with the totals. It omits error behavior (e.g. invalid/expired query_id) and retention limits, which keeps it below 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, each earning its place: purpose, polling strategy, and pagination semantics. Front-loaded with the core action and free of filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists so return shape need not be restated, and the description still covers the polling and pagination model well. What is missing for a polling tool – failure/expiry behavior on a stale query_id and any refresh cadence – is minor but leaves it slightly incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds genuine meaning beyond the schema by explaining that reported_count/result_row_count reflect the full result set while rows are windowed by limit/offset – a semantic distinction the schemas do not state. That clarifying relationship lifts it above baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a precise verb and resource ('Fetch current results for a previously submitted client fast query') and clearly positions itself as the read side of the submit/read pair, distinguishing it from client_query_submit. It does not contrast itself with the other query-ish sibling (client_query) or name it, so differentiation is good but not exhaustive.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit usage pattern: call repeatedly until reported_count stops growing or the expected number of computers report, which is real when-to-use guidance. It stops short of naming alternatives or the condition under which a different tool (e.g. client_query) should be preferred.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

client_query_submitClient Query SubmitA

Submit a BigFix client (fast) query. Targeting: set exactly one of target_all, target_computer_ids, target_computer_names, or target_relevance (client relevance evaluated on each agent to decide applicability). Targeting is limited to the configured operator's scope, so target_all means all computers this operator can see, not necessarily all computers in BigFix.

NameRequiredDescriptionDefault
query_textYesClient relevance to evaluate on each targeted agent.
target_allNoTarget all computers.
target_relevanceNoClient relevance targeting expression.
target_computer_idsNoTarget these BigFix computer IDs.
target_computer_namesNoTarget these computer names.

Output Schema

NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

There are no annotations, so the description carries the full behavioral burden; it does add one valuable non-obvious fact — that targeting is bounded by the operator's scope, so target_all is not global. It omits the submission lifecycle entirely (whether this is asynchronous, whether results must be fetched via client_query_results, request limits), which is significant for a 'submit' tool with no annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the action, then targeting rules, then the scope caveat — a sensible ordering with no filler. Slightly dense and repetitive ('Targeting:' followed by two sentences that both restate the same framing).

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, and the targeting model is well covered. What is missing is the operational context: how results are retrieved (the client_query_results sibling is never referenced), and whether the call is synchronous or queued, which is material for a submit-style tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds meaning the schema cannot express: mutual exclusivity among the four targeting parameters, and the semantics of target_relevance as 'client relevance evaluated on each agent to decide applicability.' It does not clarify the target_all default-vs-mutual-exclusion interplay with the schema defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Submit a BigFix client (fast) query,' which tells an agent exactly what happens. However, it never distinguishes this from the sibling tools client_query, client_query_results, or qna_eval_client_relevance, so the agent cannot tell from the description alone which of these closely-named operations to pick.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a concrete structural rule ('set exactly one of target_all, target_computer_ids, target_computer_names, or target_relevance'), which is genuine when-to-use guidance. It does not say when to prefer this tool over client_query/session_relevance_query/xml or what the caller should do after submitting, so usage context is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

find_computersFind ComputersA

Find computers whose name contains a substring.

Returns (name, id, last report time) rows. The search term cannot contain a double quote - BigFix relevance string literals have no escape for one.

NameRequiredDescriptionDefault
limitNoMax rows to return (default 500). The response reports total_available and truncated.
offsetNoRow offset, for paging through results.
name_containsYesCase-insensitive substring of the computer name.

Output Schema

NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It does disclose the returned row shape (name, id, last report time) and a non-obvious failure mode (double quotes are illegal in BigFix relevance literals), which is real added value, but says nothing about permissions, cost, or whether the search is case-insensitive at the server level.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, the core behavior front-loaded, then the return shape and the constraint. No filler and nothing buried.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists and the schema documents limit/offset including truncation behavior, so the description need not explain paging. For a simple 3-parameter read tool it is essentially complete, with only the lack of alternative-tool routing as a gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, and the description adds meaning beyond the schema by explaining the double-quote restriction on name_contains and by stating the column set returned for each match. It does not expand on limit/offset, but those are already fully documented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource plus the matching rule: "Find computers whose name contains a substring." That clearly separates it from the singular get_computer/get_computer_group siblings, though no sibling is named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance and no routing to alternatives such as get_computer (exact lookup) or find_content. The only usage-adjacent statement is a hard constraint on the search term, which is a limitation rather than guidance about choosing this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

find_contentFind ContentA

Search content by name across every site the operator can see.

Returns rows of {name, id, site_name, site_path} - site_path is what get_content needs. It is null when the site name is ambiguous (two sites of different types sharing a display name), with the options listed under site_path_candidates rather than guessed at.

The search term cannot contain a double quote.

NameRequiredDescriptionDefault
kindYesOne of: fixlet, task, analysis, baseline.
limitNoMax rows to return (default 500). The response reports total_available and truncated.
offsetNoRow offset, for paging through results.
name_containsYesCase-insensitive substring of the content name.

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden and does well: it discloses the row shape, the null-site_path ambiguity case with the site_path_candidates fallback, and the forbidden double-quote character. It does not state read-only/safety posture, permission scoping beyond "operator can see," or rate/result-size limits (left to the schema's limit/offset and total_available).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four short sentences, front-loaded with the action and scope, then the return shape, then the edge case, then the input constraint. No filler, and the ambiguity note ("rather than guessed at") clarifies behavior rather than padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Output schema exists, so return values need not be spelled out, and annotations are absent but the operation is obviously a read. The description covers the search-then-fetch workflow, the ambiguity path, and the input constraint. Minor gaps: no mention of what happens on zero results or how the default 500-row cap interacts with total_available/truncated beyond the schema text.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3, but the description adds real semantics beyond the schema: the double-quote restriction on the search term and the cross-tool meaning of site_path (the value get_content requires, or null when ambiguous). limit/offset and kind are left entirely to their schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource plus its scope: "Search content by name across every site the operator can see." The `kind` enum in the schema plus the name-substring framing separates it cleanly from siblings like find_computers, list_sites, and get_content — and it explicitly frames get_content as the follow-up call.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The usage flow is clear: search here to obtain `id` + `site_path`, which is exactly what get_content consumes. It also explains when the result is unusable (site_path null on ambiguous site names). It gives no explicit negative guidance about when not to use it versus siblings such as search_inspectors or list_sites, but the context is unambiguous for the intended task.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_actionGet ActionC

Get an action's definition from /api/action/{id}.

NameRequiredDescriptionDefault
action_idYesBigFix action ID.

Output Schema

NameRequiredDescription

No output parameters

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It implies a read via 'Get' and cites the underlying endpoint, but says nothing about permissions, error behavior, or whether the definition is live vs cached.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One short, front-loaded sentence with no filler. It is appropriately sized, though extremely sparse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return values need no explanation, and a single-parameter read tool is simple. Still, the absence of any annotation or usage framing leaves the safety and routing story thin.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the single action_id parameter is documented there as a BigFix action ID. The description's '/api/action/{id}' phrasing only restates that id is a path parameter, adding little beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb (Get) and resource (an action's definition), so the purpose is clear. It does not distinguish this from siblings such as get_action_status or list_actions, leaving the agent to infer the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to use this tool versus get_action_status, list_actions, or get_content. Usage is only implied by the noun 'definition'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_action_statusGet Action StatusA

Get an action's per-computer execution state (/api/action/{id}/status).

The "did my change actually work" tool. Status is scoped to the computers the configured operator can see.

NameRequiredDescriptionDefault
action_idYesBigFix action ID.

Output Schema

NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It does disclose a meaningful authorization constraint ('Status is scoped to the computers the configured operator can see') and the underlying endpoint, but it never explicitly states this is a read-only operation or how per-computer state is aggregated, leaving gaps for a no-annotation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences: purpose first, then a memorable usage framing, then the scoping caveat. Front-loaded and waste-free, though the quoted framing sentence is more colloquial than informative.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and the description covers purpose, the operator-visibility scoping, and a usage cue. With no annotations, a bit more behavioral detail (read-only confirmation, per-computer result shape) would round it out.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and there is a single parameter, so the schema already documents action_id as a 'BigFix action ID.' The description's endpoint path ('/api/action/{id}/status') loosely ties {id} to action_id but adds no format or sourcing detail beyond the schema. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource ('Get an action's per-computer execution state') and pins the scope to per-computer state, which differentiates it from the sibling get_action (action-level metadata). It doesn't name get_action/list_actions explicitly, so differentiation is implied rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The framing 'The "did my change actually work" tool' gives real usage context (post-deployment verification). However, it never states when NOT to use this tool or routes the agent to the obvious alternatives (get_action, list_actions), so routing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_computerGet ComputerA

Get one computer's full record from /api/computer/{id}.

Includes the reported properties BigFix holds for that computer. Use find_computers first if you only know part of the name.

NameRequiredDescriptionDefault
computer_idYesBigFix computer ID.

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the behavioral burden. It discloses the read endpoint and that the response contains the reported properties BigFix holds, implying a safe read, but says nothing about permissions, error behavior when the ID is unknown, or whether the record can be stale — gaps that matter for a lookup tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences: the action, what the payload contains, and the fallback guidance. Front-loaded with the core operation and free of filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description need not explain return fields, and it correctly focuses on identifying the record and the fallback path. It is nearly complete, missing only edge-case behavior (invalid/unknown ID, permission requirements).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and there is only one parameter, so the schema already documents computer_id as the BigFix computer ID. The description reinforces this via the /api/computer/{id} path but adds no new format or constraint detail beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ('Get one computer's full record') and pins the exact endpoint /api/computer/{id}, so the agent knows precisely what the tool returns. It also implicitly separates itself from find_computers by framing this as a single-record fetch keyed by ID.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit routing rule: 'Use find_computers first if you only know part of the name,' naming the alternative sibling and the condition that selects it. It stops short of stating when not to use this tool (e.g., bulk retrieval), so it is clear but not exhaustive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_computer_groupGet Computer GroupA

Look up a computer group by name within an explicit site path.

Implemented against /api/computergroups/{site_path} directly rather than besapi's get_computergroup, which routes through the mutable "current site path" connection state this server avoids.

NameRequiredDescriptionDefault
site_pathYesSite path containing the group, e.g. 'master', 'custom/MySite', 'operator/SomeOperator'.
group_nameYesName of the computer group.

Output Schema

NameRequiredDescription

No output parameters

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose a real behavioral trait: it queries /api/computergroups/{site_path} directly and deliberately avoids besapi's mutable 'current site path' connection state, implying a stateless, side-effect-free read that requires the caller to supply the path. It does not cover permissions, error behavior, or missing-group handling, so it is good but not complete.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with the core operation front-loaded; nothing is redundant. The second sentence is longer than needed for the point it makes (why besapi's helper is bypassed) but it does earn its place as rationale rather than filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, and both required params are fully documented. The remaining gap is behavioral: with no annotations, the description could state that this is a read-only operation and what happens on a nonexistent group, but it is otherwise sufficient to call the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters are already documented, including site_path format examples ('master', 'custom/MySite'). The description reinforces the 'by name / explicit path' semantics but adds no syntax or format detail beyond the schema, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (look up) and resource (computer group) plus the scoping constraint (by name, within an explicit site path). An agent can distinguish this from siblings like get_computer, find_computers, and get_content without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the retrieval context (named group under an explicit path) but never states when to use this versus alternatives such as get_computer or find_computers, nor any prerequisites. The second sentence explains an implementation choice rather than usage guidance, leaving routing to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_contentGet ContentB

Get one fixlet, task, analysis or baseline by site path and ID.

NameRequiredDescriptionDefault
kindYesOne of: fixlet, task, analysis, baseline.
site_pathYesSite path containing the content, e.g. 'master', 'custom/MySite', 'operator/SomeOperator'.
content_idYesContent ID within the site.

Output Schema

NameRequiredDescription

No output parameters

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. 'Get' implies a read, but there is no disclosure of permissions required, error/not-found behavior, or any operational constraint. It adds nothing behavioral beyond what the schema implies.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single tight sentence, front-loaded with the verb and resource, with zero filler. Nothing needs trimming or reordering.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values needn't be explained, and this is a simple 3-param lookup. Still, with no annotations and no usage/behavioral guidance, the definition is only minimally complete for an agent deciding between this and find_content.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all three parameters are already documented in the schema, and the description merely restates the path-and-ID lookup. Baseline 3 applies when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (Get) and resource (fixlet, task, analysis, baseline) plus the lookup keys (site path and ID). This is clear, but it never contrasts itself with the sibling find_content, so an agent must infer the direct-lookup-vs-search distinction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the retrieval mechanism: call it when you have a site path and content ID. But there is no explicit when-to-use/when-not framing and no mention of find_content as the alternative for search-based retrieval, leaving routing to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_dashboard_variableGet Dashboard VariableB

Read a BigFix dashboard datastore variable value (read-only).

NameRequiredDescriptionDefault
var_nameYesDashboard variable name.
dashboard_nameYesDashboard name.

Output Schema

NameRequiredDescription

No output parameters

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry the behavioral burden; it does disclose the key safety trait ("read-only"), which is valuable. However, it says nothing about authentication requirements, whether the dashboard must exist, or error behavior for missing variables, leaving gaps for a tool with zero annotation coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single short sentence with the action and resource front-loaded and no filler. Every element earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and both required parameters are covered by the schema. The description is nearly complete for a simple read tool, with only minor gaps around auth and failure modes.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters (dashboard_name, var_name) are already documented in the schema. The description adds no format, casing, or lookup semantics beyond what the schema provides, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ("Read") and resource ("BigFix dashboard datastore variable value"), so the agent knows exactly what it retrieves. It does not differentiate from any sibling, though none of the listed siblings covers dashboard datastore variables, so the ambiguity risk is low.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus alternatives such as get_content or api_get, nor any prerequisite or context conditions. The only usage signal is the parenthetical "read-only", which describes behavior rather than when to call it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_operatorGet OperatorA

Look up a BigFix operator (console user) by name.

NameRequiredDescriptionDefault
user_nameYesBigFix operator user name.

Output Schema

NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden, yet 'look up' plus a unique name key already conveys read-only, single-entity semantics. It still omits permission requirements, behavior when the operator is not found, and whether the lookup is case-sensitive. Adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence with zero filler, front-loaded with the verb and resource. Nothing to trim and nothing buried.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and there is only one parameter. What is missing is the relationship to list_operators, which an agent choosing between the two would need. Minimum viable but visibly thin.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the single user_name parameter is already documented. The description's 'by name' adds no syntax, format, or matching detail beyond the schema. Baseline 3 applies when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (look up) and resource (BigFix operator / console user) and narrows scope to a single record by name. The parenthetical disambiguates 'operator' as a console user, which is genuinely useful domain context. It does not explicitly contrast itself with the sibling list_operators, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'By name' implies single-record retrieval and implicitly contrasts with list_operators, but the description never names that alternative or states when to prefer one over the other. No prerequisites or conditions are given. Usage is inferable rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_server_infoGet Server InfoB

Get BigFix root server info (version, etc) from /api/serverinfo.

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription

No output parameters

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It discloses the endpoint path (/api/serverinfo), which implies a read, but says nothing about authentication requirements, permissions, rate limits, or side effects. For a no-annotation tool this is a meaningful gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single short sentence that front-loads the verb and resource with zero filler. Nothing could be removed without losing information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is a trivial zero-parameter getter and an output schema exists, so return values need not be described. The only shortfall is the absence of any auth or context note, which is minor for this operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing for the description to clarify; the baseline of 4 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Get BigFix root server info (version, etc)') and names the underlying endpoint, so an agent knows exactly what it retrieves. It does not explicitly differentiate itself from the generic sibling 'api_get', but the domain-specific framing makes the intent clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to use this tool versus alternatives such as api_get, whoami, or the other server-metadata siblings. The agent must infer usage entirely from the name and description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_actionsList ActionsB

List actions visible to the configured operator (/api/actions).

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription

No output parameters

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It does disclose one meaningful trait — results are scoped to the configured operator's visibility — but says nothing about pagination, result volume, ordering, or read-only safety, leaving most behavioral questions unanswered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence with zero filler; the scope constraint and endpoint are packed into one clause and nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, and the parameterless schema is trivially complete. However, with no annotations and no usage guidance, an agent still lacks the safety profile and routing cues needed to confidently choose this over get_action.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing for the description to clarify beyond the schema; baseline 4 applies. The endpoint reference adds no parameter meaning but no parameter gaps exist either.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (List) and resource (actions) plus a scope qualifier ('visible to the configured operator') and even the backing endpoint. It is distinguishable from the sibling get_action (singular fetch), though it does not explicitly call out that distinction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance and no mention of alternatives such as get_action or get_action_status. The agent must infer that this is the enumeration tool and the others are detail/status tools purely from names.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_operatorsList OperatorsA

List console operators visible to the configured operator.

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It does disclose that results are scoped by the configured operator's visibility, which is useful. However, it does not state read-only safety, permission requirements, or other operational traits beyond the implicit 'List' verb.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence with no filler. Every phrase contributes: the action, the resource, and the visibility scope.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the zero-parameter schema and the presence of an output schema, the description covers enough for an agent to understand the tool's basic behavior. It does not need to explain return values, but it could be more complete by clarifying when this list is preferable to alternatives.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing for the description to document. The baseline for a zero-parameter tool is 4, and the description appropriately avoids describing nonexistent arguments.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'List console operators.' It also adds scope with 'visible to the configured operator,' which helps distinguish it from a single-operator tool like get_operator. It does not, however, explicitly differentiate itself from sibling list tools such as list_roles.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit guidance on when to use this tool versus get_operator, whoami, or other listing tools. The implied usage is simply that it lists operators, but no conditions, prerequisites, or alternatives are named.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_rolesList RolesB

List BigFix roles visible to the configured operator.

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription

No output parameters

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It does disclose one real trait beyond the name: results are filtered to what the configured operator can see, which matters for interpreting an empty or short list. It says nothing about ordering, size limits, or pagination, and offers no explicit read-only confirmation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler, and the scoping constraint is placed before any potential alternative would be. It is efficient, though arguably too terse given that no usage or behavioral detail follows.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a simple, zero-parameter read tool with an output schema, so return-value documentation is not needed and the description need not carry much weight. What it says is sufficient to invoke correctly; only the absence of any usage routing and the lack of annotations keep it from being fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing for the description to clarify; the schema's empty object is self-explanatory. Baseline 4 applies per the zero-parameter rule.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (List) and resource (BigFix roles), plus a meaningful scope qualifier: only roles visible to the configured operator. That scope distinguishes it conceptually from siblings like list_operators and list_sites, though those siblings are never named. Clear enough to act on, but no explicit sibling differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance, no prerequisites, and no named alternative. An agent must infer from the name alone that this is the enumeration path for roles versus get_operator or whoami. The visibility qualifier hints at permission scoping but is not framed as usage advice.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_sitesList SitesA

List all sites visible to the configured operator.

Returns {"data": , "truncated": ..., "total_chars": ...}. A deployment subscribed to many external content sites can produce a large listing; when it exceeds the size cap, data is null and note says so rather than handing back a half-cut structure that looks complete.

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full disclosure burden and does substantial work: it discloses the size-cap truncation behavior, that data becomes null with an explanatory note, and that the operator's visibility scope governs results. It still omits read-only confirmation and whether any pagination or auth is required.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the purpose well, but the second sentence restates the exact return envelope keys even though an output schema already exists, which is partially redundant. The truncation rationale is worth keeping; the key enumeration is not.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given an output schema exists, the description need not explain return values, and it correctly focuses on the non-obvious truncation edge case and the visibility scope. The main gap is tying this tool to the broader site/content sibling set.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the schema has nothing to document and the description has nothing to compensate for. Baseline for a no-parameter tool applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a clear verb+resource ('List all sites') and adds the scoping qualifier 'visible to the configured operator'. It does not distinguish itself from siblings like find_content or get_content, which an agent might otherwise confuse with a site lookup.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this versus alternatives such as find_content or list_operators, and no prerequisites or exclusions. Usage is only implied by the tool name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

qna_discover_targetsQna Discover TargetsA

Find qna targets that work on the server's host and add them to the inventory, like the bigfix-remote-client-relevance CLI's --auto-discovery. Evaluates nothing.

Probes this host's qna, a downloaded qna, the container engine's images and developer.bigfix.com, then adds what works and is not already listed to ~/.bigfix/remote_clients.toml. Never uses SSH discovery and never prompts. Slow: it can take minutes. Use it when qna_list_targets shows no (or too few) inventory hosts; a run of qna_eval_client_relevance naming no targets only discovers by itself when no inventory file exists yet.

Returns path (the inventory written), added (new host names) and inventory (every target now listed).

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so well: it discloses the exact side effect (writes new hosts to ~/.bigfix/remote_clients.toml), the probe sources, the negative constraints (never uses SSH discovery, never prompts), and the performance cost (can take minutes). Nothing about mutation behavior is left to inference.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the core action, then layers mechanism, constraints, performance, and usage guidance in short declarative sentences. Every clause earns its place, including the CLI analogy and the 'Evaluates nothing' caveat.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Although an output schema exists and return values need not be explained, the description still names the returned fields (path, added, inventory). Combined with the side-effect, performance, and usage detail, an agent has everything needed to call this correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing for the description to disambiguate beyond what the empty schema already conveys. Baseline 4 applies for a parameterless tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb sequence (find/probe and add) over a specific resource (qna targets on the server's host) and names the concrete side effect against ~/.bigfix/remote_clients.toml. It is clearly distinguishable from siblings like qna_list_targets and qna_eval_client_relevance.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit triggering conditions: use when qna_list_targets shows no or too few inventory hosts, and clarifies the edge case that qna_eval_client_relevance only self-discovers when no inventory file exists. Names both alternative tools and the condition that selects this one.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

qna_eval_client_relevanceQna Eval Client RelevanceA

Evaluate CLIENT relevance with the BigFix qna tool - a fast feedback loop that never touches the BigFix deployment.

qna runs on lab targets (containers or admin-inventoried hosts), NOT on managed BigFix endpoints: results reflect each target machine only. There is no operator scope, no site subscriptions and no client settings, so inspectors that depend on deployment state will differ from what client_query returns. Iterate on relevance syntax and inspector behavior here, then confirm on real agents with client_query.

With no inventory_targets or container_images, it runs on every inventory host (qna only reads). An online_evaluator inventory host sends the client relevance to developer.bigfix.com; name targets to keep a query off it. When no inventory file exists yet (qna_list_targets: auto_discovery_pending), such a run first discovers what works on the server's host and records it in ~/.bigfix/remote_clients.toml; once the file exists, discovery runs only through qna_discover_targets. The payload's auto_discovery says what was added. A discovering run can take minutes.

Per-target failures come back as result rows with error_kind ('relevance', 'qna', 'bootstrap', 'transport', 'resolve'), never as a tool error. ok_count and target_count describe the whole run; the rows are windowed by limit/offset.

NameRequiredDescriptionDefault
limitNoMax rows to return (default 500). The response reports total_available and truncated.
offsetNoRow offset, for paging through results.
relevanceYesClient relevance to evaluate with qna on each target.
qna_versionNoBigFix agent/qna version to provision on targets, e.g. '11.0'. Required for plain container images (they have no qna baked in); the first use of a version downloads and caches it.
timeout_secondsNoPer-target timeout (1-300).
container_imagesNoContainer images to evaluate in, e.g. 'ubuntu:22.04'. The first use of an image is slow (agent artifact download + derived image build); later runs are about a second.
inventory_targetsNoNames from the server's qna inventory (see qna_list_targets). Leave both this and container_images empty to run on every inventory host.

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so richly: qna runs on lab targets not managed endpoints, no operator scope/site subscriptions/client settings, results differ from client_query for deployment-dependent inspectors, and an online_evaluator host receives the query. It also discloses error handling (per-target failures come as rows with error_kind, never tool errors), timing (discovering run can take minutes, first image use is slow), and the auto_discovery payload.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Dense multi-paragraph text, but front-loaded with purpose and behavior. Nearly every sentence carries operational information, though it could be tightened slightly; the structure is logical rather than padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Complex 7-parameter tool with an output schema, and the description still covers the essential subtleties an agent needs: lab-vs-endpoint semantics, empty-target defaults, discovery behavior, and row-based error reporting. Nothing critical for correct invocation appears missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3; the description adds value beyond the schema by explaining the default when both target parameters are empty (runs on every inventory host) and the consequence of naming targets (keeping a query off the online_evaluator host). It reiterates some schema content but the empty-parameter semantics are a genuine addition.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Evaluate CLIENT relevance with the BigFix qna tool') and immediately frames it as a fast lab feedback loop distinct from real deployment queries. Explicitly contrasts with client_query ('then confirm on real agents with client_query'), giving clear sibling differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit workflow: iterate on relevance syntax here, then confirm with client_query. Also documents the default behavior when inventory_targets/container_images are empty (runs on every inventory host), when to name targets to keep a query off the online_evaluator host, and when discovery vs. qna_discover_targets applies.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

qna_list_targetsQna List TargetsA

List targets available to qna_eval_client_relevance.

inventory_path is the inventory file in use: BIGFIX_QNA_INVENTORY when the server sets it, else the default search (~/.bigfix/remote_clients.toml, then the all-users config directory); null when none was found. A run that names no targets uses every inventory host. auto_discovery says whether qna_discover_targets is available (it probes local qna, container images and developer.bigfix.com, and adds what works to ~/.bigfix/remote_clients.toml); auto_discovery_pending says no inventory file exists yet, so the next run naming no targets discovers first without being asked. containers_allowed says whether arbitrary container image names may be passed as targets. Listing never probes or writes anything.

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden and discloses the key side-effect profile: 'Listing never probes or writes anything.' It also explains auto_discovery_pending and discovery behavior on the next run, though it does not discuss permissions or output size.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose is front-loaded in the first sentence, and the remaining text is dense with useful behavioral context. It is somewhat long and explains output fields despite an output schema existing, but the sentences generally carry explanatory value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter listing tool with an output schema, the definition is complete: it explains the resource, the inventory source, discovery implications, container target policy, and that listing has no probing or writing side effects.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there are no parameter semantics to document. The baseline for zero parameters is 4, and nothing in the description contradicts or obscures that.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'List targets available to qna_eval_client_relevance.' It also names related siblings such as qna_discover_targets and clarifies the inventory context, so the agent can distinguish this tool from nearby qna tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly relates the tool to qna_eval_client_relevance and explains that calling a run without named targets uses every inventory host or triggers discovery when no inventory exists. It names qna_discover_targets as a related alternative, though it does not give an explicit 'call this instead of that when...' rule.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_inspectorsSearch InspectorsA

Search the BigFix inspector reference (offline snapshot; no server call).

Fuzzy: returns exact, prefix and near-miss matches with signatures, result types and the dialect each inspector exists in. Use it before writing a query, or after an 'is not defined' error to find the right name. Snapshot caveat: absence here does not prove absence on the live server.

NameRequiredDescriptionDefault
kindNoFilter by inspector kind: 'property', 'cast', 'binary-operator' or 'unary-operator'.
limitNoMax matches to return (1-25).
queryYesInspector name or phrase, e.g. 'registry key', 'bes computers'.
dialectNo'session' or 'client' to filter; default searches both.

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so well: it discloses the offline/snapshot nature (no server call), the fuzzy match semantics, what is returned (signatures, result types, dialects), and an important reliability caveat that absence in the snapshot does not prove absence on the live server. These are exactly the behavioral traits an agent could not infer from the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences: identification and scope first, matching behavior and use-case triggers second, the snapshot caveat last. Zero filler and the most decision-relevant facts are front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool exposes an output schema, so return-value detail is correctly omitted. Given a 4-parameter read-only lookup, the description covers identity, matching semantics, usage triggers and the snapshot limitation — nothing an agent needs to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so kind, limit, query and dialect are already documented in structured data. The description's only marginal contribution is that results include 'the dialect each inspector exists in', which loosely relates to the dialect filter, but it adds no syntax or semantics beyond the schema. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Search the BigFix inspector reference') and immediately scopes it as an 'offline snapshot; no server call', which cleanly separates it from live-query siblings like analyze_relevance or client_query. It also characterizes the matching behavior (exact, prefix, near-miss) so the agent knows what kind of lookup this is before opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives two concrete trigger conditions: 'before writing a query' and 'after an is not defined error'. That is clear when-to-use guidance. It stops short of naming competitor tools (e.g. list_operators, get_operator) or stating when not to use it, so it lands at 4 rather than 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

session_relevance_querySession Relevance QueryA

Evaluate a BigFix session relevance query on the root server.

Session relevance queries data the server already has (computers, fixlets, actions, sites, operators...) with no client round-trip. Examples: 'number of bes computers', '(name of it, id of it) of bes computers whose (now - last report time of it < 1 * day)'.

There is no way to limit rows in the relevance itself - 'first', 'firsts', 'items' and 'elements' are all undefined operators on a BigFix root server. Use the limit/offset parameters instead; the response reports total_available and truncated. Note the server still evaluates the whole query, so limit bounds the response, not the work.

Returns the server's JSON envelope: {"result": [...], "plural": ..., "type": ..., "evaltime_ms": ...} (plus "count" when the server sends it) and bounding metadata.

Results are evaluated within the configured operator's scope. Unless whoami reports is_main_operator, counts and lists are a lower bound on what exists - report them as visible to this operator, not as the complete state of BigFix.

NameRequiredDescriptionDefault
limitNoMax rows to return (default 500). The response reports total_available and truncated.
offsetNoRow offset, for paging through results.
relevanceYesA BigFix session relevance expression to evaluate.

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden and discharges it well: it discloses the absence of row-limiting relevance operators, that limit bounds the response not the work, and that results are scoped to the configured operator so counts are a lower bound unless is_main_operator. This is exactly the behavioral context an agent needs before trusting the output.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the purpose and example, then sequences the paging caveat and result-scope warning. It is somewhat long with four paragraphs, but each carries distinct operational information; only minor tightening is possible.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a no-annotation, 3-param query tool, the description covers the query domain, paging semantics, response envelope, and the critical operator-scope caveat. Even though an output schema exists, the surrounding caveats make the definition complete for correct invocation and interpretation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents limit/offset/relevance, putting the baseline at 3. The description adds genuine meaning beyond the schema by explaining why limit/offset are necessary (the relevance operators are undefined) and clarifying that limit constrains the response rather than the evaluation work.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Evaluate a BigFix session relevance query on the root server') and immediately distinguishes it from client-side siblings by noting 'no client round-trip'. An agent can separate this from client_query/client_query_submit without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explains the context in which this applies (server-side data: computers, fixlets, actions, sites) and gives concrete usage guidance for paging (use limit/offset). It doesn't explicitly name the sibling to use for client-side evaluation, relying on the 'no client round-trip' phrase to imply the contrast.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

validate_bes_xmlValidate Bes XmlA

Validate BES XML against the BigFix schemas.

Makes no server call.

Use before asking anyone to import content: it catches malformed or non-conforming XML locally instead of as a REST error.

NameRequiredDescriptionDefault
bes_xmlYesBES XML document to check.

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations present the description must carry the behavioral burden, and it does the key part: 'Makes no server call' tells the agent this is a purely local, side-effect-free operation requiring no server auth. It also frames the failure mode (malformed/non-conforming XML). Return format is left to the existing output schema, which is acceptable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short lines: purpose, a crucial behavioral note, and the usage trigger. Front-loaded, no filler, every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-input, local validation tool with an output schema and no annotations, the description covers what it does, when to invoke it, and its non-networked nature. Nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

One parameter at 100% schema description coverage, so the schema already documents 'bes_xml' fully. The description adds no syntax, format, or size guidance beyond what the schema provides, making the baseline 3 correct.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a precise verb ('Validate') and resource ('BES XML') plus the standard it validates against ('the BigFix schemas'). No sibling tool performs validation, so it is trivially distinguishable from the get_/list_/find_ family.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit timing ('Use before asking anyone to import content') and a concrete rationale (catches malformed XML locally instead of as a REST error). It does not name alternatives or when-not-to-use, but no sibling overlaps this function, so that gap is minor.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

whoamiWhoamiA

Show the configured connection: user, root server, main operator status.

writes_enabled says whether the gated write tools are registered in this process; when false they are absent from the tool list entirely.

Cheap connectivity and permission smoke test. is_main_operator tells you whether results from the other tools can be treated as the full state of BigFix (master operator) or only as this operator's scoped view, which may be incomplete in ways this operator cannot detect.

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it explains that writes_enabled indicates whether gated write tools are registered at all, and that is_main_operator determines whether other tools' results are complete BigFix state or a scoped view. That is meaningful behavioral context beyond a trivial identity call, though it says nothing about auth requirements or failure modes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose is front-loaded in the first sentence, followed by focused explanations of two non-obvious fields. It is slightly verbose but every sentence adds real information, so nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be enumerated, and the description still clarifies the two fields whose semantics an agent would otherwise misread. For a zero-parameter diagnostic tool, nothing needed to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is no parameter semantics to document and the baseline of 4 applies. The description instead adds meaning to the returned fields (writes_enabled, is_main_operator), which is a plus rather than a gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Show the configured connection') and enumerates exactly what it returns: user, root server, main operator status. This is clearly distinguishable from get_server_info or list_operators, though it never names a sibling explicitly, which keeps it short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Cheap connectivity and permission smoke test' gives a clear usage context for when to reach for this tool. It does not state when-not to use it or point at alternatives, so it falls short of the explicit routing a 5 requires.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 20 tool updatesv1.2.0
    • Addedanalyze_relevance
    • Changedapi_get1 field changed
      • addedInput schema / properties / max_chars
        Added value: +{
        +  "anyOf": [
        +    {
        +      "type": "integer"
        +    },
        +    {
        +      "type": "null"
        +    }
        +  ],
        +  "default": null,
        +  "description": "Max characters of response text (default 50000)."
        +}
    • Addedapplicable_fixlets
    • Changedclient_query2 fields changed
      • addedInput schema / properties / limit
        Added value: +{
        +  "anyOf": [
        +    {
        +      "type": "integer"
        +    },
        +    {
        +      "type": "null"
        +    }
        +  ],
        +  "default": null,
        +  "description": "Max rows to return (default 500). The response reports total_available and truncated."
        +}
      • addedInput schema / properties / offset
        Added value: +{
        +  "default": 0,
        +  "description": "Row offset, for paging through results.",
        +  "type": "integer"
        +}
    • Changedclient_query_results2 fields changed
      • addedInput schema / properties / limit
        Added value: +{
        +  "anyOf": [
        +    {
        +      "type": "integer"
        +    },
        +    {
        +      "type": "null"
        +    }
        +  ],
        +  "default": null,
        +  "description": "Max rows to return (default 500). The response reports total_available and truncated."
        +}
      • addedInput schema / properties / offset
        Added value: +{
        +  "default": 0,
        +  "description": "Row offset, for paging through results.",
        +  "type": "integer"
        +}
    • Addedfind_computers
    • Addedfind_content
    • Addedget_action
    • Addedget_action_status
    • Addedget_computer
    • Addedget_content
    • Addedlist_actions
    • Addedlist_operators
    • Addedlist_roles
    • Addedqna_discover_targets
    • Addedqna_eval_client_relevance
    • Addedqna_list_targets
    • Addedsearch_inspectors
    • Changedsession_relevance_query2 fields changed
      • addedInput schema / properties / limit
        Added value: +{
        +  "anyOf": [
        +    {
        +      "type": "integer"
        +    },
        +    {
        +      "type": "null"
        +    }
        +  ],
        +  "default": null,
        +  "description": "Max rows to return (default 500). The response reports total_available and truncated."
        +}
      • addedInput schema / properties / offset
        Added value: +{
        +  "default": 0,
        +  "description": "Row offset, for paging through results.",
        +  "type": "integer"
        +}
    • Addedvalidate_bes_xml
  2. 11 tool updatesv0.1.0
    • First observedapi_get
    • First observedclient_query
    • First observedclient_query_results
    • First observedclient_query_submit
    • First observedget_computer_group
    • First observedget_dashboard_variable
    • First observedget_operator
    • First observedget_server_info
    • First observedlist_sites
    • First observedsession_relevance_query
    • First observedwhoami

TDQS

B3.4/5.0

Scored across 27 tools

Disambiguation4/5

Most tools target a clearly distinct resource or operation (get/list/find content, computers, actions, operators, sites, qna). The main overlaps are the relevance-evaluation trio (session_relevance_query, client_query/qna_eval_client_relevance) and the client_query wrapper versus client_query_submit/client_query_results, but the descriptions explain scope and targeting differences well enough to select correctly.

Naming Consistency3/5

Many names follow a verb_noun or qna_verb_noun pattern, but the set mixes verb-first (get_content, list_operators, find_computers) with noun-phrase names (client_query, session_relevance_query, applicable_fixlets, whoami) and noun_verb order in api_get. It remains readable thanks to clear domain prefixes, but it is not a single predictable convention.

Tool Count3/5

27 tools is heavy for a single MCP server and sits above the usually comfortable 3-15 range. The BigFix root-server domain is broad (content, computers, actions, relevance, qna, server info), so most tools map to distinct subdomains, but the count is still at the borderline-heavy end.

Completeness3/5

Read coverage is fairly strong: content, operators/roles, computers, actions, sites, server info, relevance evaluation, and a read-only API escape hatch are all present. However, the surface omits action lifecycle operations (take/stop/delete action) and content import/deployment, and api_get is explicitly read-only, so the toolset cannot complete the primary BigFix management workflows.

Maintenance

ActivityActive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    D
    maintenance
    A read-only MCP server for InvGate Asset Management, enabling natural language queries for assets, people, computers, servers, software, and API health.
    12
    3 npm
    1
    MIT
  • A
    license
    A
    quality
    C
    maintenance
    Security-first, read-only MCP server for Microsoft SQL Server, enabling safe natural-language querying of databases.
    5
    4 npm
    MIT
  • A
    license
    A
    quality
    D
    maintenance
    A read-only MCP server that enables AI assistants to query ServiceNow instances—incidents, changes, users, CMDB—with malformed query linting and injection protection.
    7
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    A read-only MCP server that enables natural language querying of DSpace 7+ repositories via the REST API, allowing users to search, retrieve items, and analyze repository data.
    28 PyPI
    2
    MIT