Skip to main content
Glama
josimarh

azure-mcp-pilot

by josimarh

graph_answer_identity_question

Read-onlyIdempotent

Answer natural-language identity questions by selecting the validated Microsoft Graph or Azure RBAC query and returning real tenant data on users, roles, permissions, MFA, and PIM.

Instructions

Interpreta uma pergunta de identidade em linguagem natural, escolhe a capability correta e executa a consulta de forma validada.

Use para perguntas abertas como:

  • "Quais usuários possuem Global Administrator?"

  • "Quais aplicações possuem Directory.ReadWrite.All?"

  • "Quem pode ativar Owner via PIM?"

Respeita a separação de fontes: Microsoft Graph para identidade/diretório e APIs Azure para Azure RBAC/recursos. Retorna erro explícito quando a capability não existe ou quando falta permissão. Nunca inventa chamadas Graph.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
limitNo
questionYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, and idempotentHint. The description adds beyond that: it explains that the tool selects a capability, validates the query, respects source separation, returns explicit errors for missing capability or permission, and never invents Graph calls. This is meaningful behavioral context, though it does not mention success return shape or limit handling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured: a front-loaded purpose sentence, a scannable list of example questions, and terse final sentences covering scope and error behavior. No wasted words, and the most important information appears first.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only natural-language query tool with no output schema, the description covers the essential invocation context: supported question types, source separation, validation behavior, and error semantics. The main gaps are the lack of an explicit success-return description and the absence of guidance on when to use sibling natural-language tools instead.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With schema description coverage at 0%, the description must compensate for missing parameter documentation. It enriches the 'question' parameter through natural-language examples and the statement that it handles open identity questions. However, it says nothing about 'limit', which has a default of 50 but whose semantics and behavior are left undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific behavior: it interprets a natural-language identity question, selects the correct capability, and executes a validated query. Concrete example questions clarify the intended resource and make the purpose easy to grasp. It does not explicitly differentiate from the many sibling natural-language query tools such as timeline_natural_language_query or iam_natural_language_query, so it stops just short of 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a clear context ('Use para perguntas abertas como...') and states the source-separation rule between Microsoft Graph and Azure APIs. However, it provides no exclusions or alternatives for when an agent should prefer a more specific sibling tool like pim_natural_language_query or iam_natural_language_query, leaving some usage boundary inference to the agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools