Skip to main content
Glama

esedb_tables

List tables in ESE databases (SRUDB.dat, Windows.edb, WebCacheV01.dat, ntds.dit) for forensic inspection of disk images.

Instructions

List tables of an ESE database (SRUDB.dat, Windows.edb, WebCacheV01.dat, ntds.dit).

Input Schema

NameRequiredDescriptionDefault
refNo
partNo
imageNo
local_pathNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden and discloses almost nothing: it does not say the operation is read-only, whether it requires the DB to be extracted/available locally, or what happens on an invalid or encrypted database. Naming the recognized ESE file formats is the only implicit signal that this is a non-destructive inspection step.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler; the artifact examples are compact and informative. It is efficient, though the space saved is spent on nothing that compensates for missing operational guidance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool exposing four alternative source-selection parameters with no annotations and no output schema, the description leaves the agent unable to determine which parameter to supply or what the result looks like. Incomplete relative to the tool's actual complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All four parameters (ref, part, image, local_path) have 0% schema description coverage and are not addressed at all in the description, so an agent gets no help on how to point the tool at a database. The parenthetical file names give only a weak hint about what local_path/ref would reference.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (List) and resource (tables of an ESE database) and grounds it with concrete artifacts (SRUDB.dat, Windows.edb, WebCacheV01.dat, ntds.dit). It does not, however, distinguish itself from the obvious sibling esedb_dump (dump contents) or from the analogous sqlite_tables, so an agent must infer the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance, no mention of being a prerequisite step for esedb_dump, and no stated exclusions versus sqlite_tables. Usage is only implied by the verb 'List'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.