Skip to main content
Glama

grep_files

Starts a background search of file contents in forensic disk images by path regex and terms; poll the job result for matches.

Instructions

Background job: search file CONTENT (UTF-8 and UTF-16LE) of files whose path matches path_regex. Poll job_result.

Input Schema

NameRequiredDescriptionDefault
partNo
imageYes
regexNo
termsYes
max_hitsNo
encodingsNo
max_filesNo
path_regexNo.
ignore_caseNo
max_file_mbNo
include_deletedNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It usefully discloses that this is asynchronous ("Background job") and must be polled via job_result, plus which encodings are searched. It does not mention result caps/truncation behavior or permission/scope constraints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with the core scope front-loaded and the async workflow instruction last. No filler, though it is arguably too terse for an 11-parameter tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An 11-parameter background-job tool with no annotations and no output schema needs far more than two sentences. The description neither covers the tuning parameters nor explains the shape of the job result the agent is told to poll.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 11 parameters, so the description must compensate and largely does not. It explains path_regex and implies terms/encodings, but max_hits, max_files, max_file_mb, include_deleted, part, image, regex, and ignore_case are all undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: search file CONTENT of files whose path matches path_regex. It also flags the background-job nature and encodings covered. It stops short of explicitly differentiating from the close siblings grep_file and grep_unallocated, which an agent must infer.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"Poll job_result" gives a concrete follow-up instruction for the async workflow, which is genuinely useful. However, there is no guidance on when to choose this over grep_file, grep_unallocated, find, or strings, so selection among the grep family is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.