Skip to main content
Glama
josimarh

azure-mcp-pilot

by josimarh

list_application_provenance

Read-onlyIdempotent

Classify and count Microsoft Entra ID app registrations by origin—tenant-created, Microsoft first-party, third-party, or managed identity—using appOwnerOrganizationId for authoritative auditing.

Instructions

Diferencia app registrations criadas por usuários no seu tenant das aplicações nativas da Microsoft (first-party) e de apps de terceiros consentidos.

Classificação baseada em appOwnerOrganizationId (sinal autoritativo do diretório), não em heurística de nome.

'provenance' aceita: all, tenant (criadas no seu tenant), microsoft (nativas), thirdparty (terceiros), managedidentity.

Use para perguntas como:

  • "Quais aplicações foram criadas pelos usuários?"

  • "Qual a diferença entre app registrations próprias e nativas?"

  • "Quantas aplicações são nativas da Microsoft?"

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
limitNo
provenanceNoall
include_managed_identitiesNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnly/idempotent/non-destructive, so the safety profile is covered. The description adds real behavioral value by disclosing that classification is derived from appOwnerOrganizationId rather than name heuristics, which is a non-obvious implementation trait. It says nothing about result size, pagination, or how the limit default of 100 behaves.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the purpose, then the classification signal, then the parameter values, then example questions — a logical order with no filler. The example-question block is slightly verbose but directly aids tool selection, so it earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description should ideally sketch the return shape, and two of three parameters remain undocumented. It is adequate for a read-only listing tool because provenance semantics are explained, but the limit/include_managed_identities gap and absent return-format hint leave real holes.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the burden. It fully documents the provenance parameter semantics (all, tenant, microsoft, thirdparty, managedidentity), but says nothing about limit or include_managed_identities, leaving two of three parameters unexplained. Partial compensation, not full.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource — listing app registrations classified by provenance — and names the authoritative signal used (appOwnerOrganizationId) as well as the four provenance classes. An agent can tell this apart from siblings like summarize_application_provenance or list_applications_without_owners without reading any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Three concrete example questions make the intended use case unambiguous, and the enumeration of accepted provenance values tells the agent what scoping options exist. It stops short of naming an explicit alternative tool or a when-not-to-use condition, so it is clear context rather than full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools