Skip to main content
Glama
Sign In
Forensics Utils MCP Server

Forensics Utils MCP Server

by jus1-c
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

firefox_decrypt_cookies_tool

Retrieve Firefox cookies as plaintext values from a profile path, optionally filtering by host and name, for forensic analysis.

Instructions

Return Firefox cookies as already-decrypted plaintext values. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release".

Firefox stores cookies plaintext in cookies.sqlite, so this tool provides parity with Chromium-style decrypt flows by normalizing plaintext values into a decrypt-oriented response.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "profile_path": "<profile_path>"
    },
    "name": "firefox_decrypt_cookies_tool"
  }
}

Input Schema

NameRequiredDescriptionDefault
hostNoOptional exact cookie host filter
nameNoOptional exact cookie name filter
limitNoMaximum number of cookie records to return
profile_pathYesAbsolute path to the Firefox profile directory

Output Schema

NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.0.0

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It honestly reveals that cookies are already plaintext and that the tool only normalizes values, not actually decrypting. It also supplies a typical profile path, adding context. This is good transparency for a simple read tool, though it could mention error behavior or pagination limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences with no filler. It front-loads the core purpose and then provides necessary context about the profile path and the tool's relationship to Chromium-style flows. Every phrase earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple, has an output schema (so return values are covered), and no annotations. The description explains the tool's purpose, the profile location, and its behavioral quirk (normalizing plaintext). It could mention that it reads from cookies.sqlite, but that is implied. Overall it is complete for an agent to select and invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds value by giving a concrete example for profile_path, the required parameter, which is not in the schema. The other parameters (host, name, limit) are adequately described in the schema, so the description need not repeat them. This extra context warrants a 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Return Firefox cookies as already-decrypted plaintext values.' This specific verb+resource+result distinguishes it from sibling tools like firefox_parse_cookies_tool (which likely returns raw stored data) and chromium_decrypt_cookies_tool (different browser). The mention of 'parity with Chromium-style decrypt flows' further clarifies its niche.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context by explaining that Firefox stores cookies plaintext and that this tool normalizes them into a decrypt-oriented response. It provides the typical profile path, which is practical guidance. However, it does not explicitly name alternatives or state when-not-to-use, so it stops short of full explicit exclusion.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools