Skip to main content
Glama
Sign In
azure-query-mcp

azure-query-mcp

by kapetanios55
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Local

run_hunting_query

Read-onlyIdempotent

Execute a saved hunting query against a workspace to retrieve up to 1,000 rows for security investigation.

Instructions

Run one hunting query from list_hunting_queries against a workspace. Results are capped at 1,000 rows.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "workspaceId": "<workspaceId>",
      "queryId": "<queryId>"
    },
    "name": "run_hunting_query"
  }
}

Input Schema

NameRequiredDescriptionDefault
queryIdYesID from list_hunting_queries.
timespanNoISO 8601 duration back from now (P7D, PT12H), or an interval: start/end (2026-10-01T00:00:00Z/2026-10-02T00:00:00Z) or start/duration (2026-10-01T08:00:00Z/PT6H). Times need Z or an offset. Default P7D.P7D
workspaceIdYesWorkspace ID (GUID) or the workspace's full ARM resource ID; list_workspaces returns both.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv0.5.0

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

It explicitly states a key functional limitation ('Results are capped at 1,000 rows'), which is crucial behavioral information not found in the schema or annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The definition is highly concise. Both sentences serve distinct, high-value purposes: defining the action and stating the result limit.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that the annotations cover safety and the schema covers structure, this description provides all necessary operational context, including the critical row limit.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

While the schema defines the parameters, the description adds semantic context by clarifying that the `queryId` must originate from the list_hunting_queries tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the action (run a hunting query), the source (from list_hunting_queries), and the scope (against a workspace), making it distinct from other query tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It strongly implies a dependency on `list_hunting_queries` by referencing it, which provides necessary context for the agent before invocation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools