Tenable Identity Exposure MCP Server
The Tenable Identity Exposure MCP Server exposes the Tenable Identity Exposure (TIE) REST API as tools for LLM clients, enabling AI-driven Active Directory security monitoring, threat detection, and identity risk analysis.
Discover API Resources (
tie_catalog): List all available TIE API resources and their paths — recommended as a first step before using other tools.Raw API Access (
tie_request): Make direct HTTP calls (GET, POST, PUT, PATCH, DELETE) to any TIE API endpoint for maximum flexibility.Generic CRUD Operations (
tie_resource_action): Perform list, get, create, update, or delete operations on any TIE resource (directories, attacks, users, alerts, etc.).Unified Recent Activity Timeline (
tie_recent_activity): Get a merged, time-ordered view of both IoE (Indicator of Exposure) alerts and IoA (Indicator of Attack) attacks, enriched with deviance details.Security Profiles (
tie_profiles): List all security profiles, which are required to scope IoE/IoA queries.Security Scores (
tie_scores): Retrieve per-directory AD security scores reflecting outstanding IoE deviances.AD Topology (
tie_topology): View Active Directory topology including domains, forests, and trust relationships.IoA Attack Instances (
tie_attacks): Query attack instances scoped to an infrastructure, directory, hostname, or IP, with optional filtering by attack type, date range, and status.Alerts (
tie_alerts): List security alerts for a profile, with optional filtering by archived status.IoE Deviances (Time-Windowed) (
tie_deviances): Find AD objects with IoE deviances for a specific checker within a relative or absolute time window.IoE Deviances by Checker (
tie_deviances_by_checker): Retrieve full IoE deviances for a checker without a date filter, with optional expression-based filtering.IoE Deviances by Directory (
tie_deviances_by_directory): Retrieve full IoE deviances scoped to a specific directory without a date filter.AD Event Search (
tie_search_events): Search AD security events across one or more directories within a specified date range.AD Object Search (
tie_search_ad_objects): Search for Active Directory objects (users, computers, groups, OUs) by name or attribute, with optional type and directory filtering.Current User Identity (
tie_whoami): Retrieve the identity, roles, and permissions associated with the current API key.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Tenable Identity Exposure MCP Serverlist my security profiles"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Tenable Identity Exposure MCP Server
An MCP server exposing the Tenable Identity Exposure (TIE, formerly Tenable.ad) REST API as tools for LLM clients. Built on FastMCP from the official mcp SDK.
Verified end-to-end against a live TIE SaaS instance (v3.120.1).
⚠️ Disclaimer: This is not an officially supported Tenable project. It was built with assistance from Claude — treat its output as a starting point and validate responses against the Tenable console before acting on them.
Tools
Tool | Description |
| List available resources + the filter-expression grammar — call this first |
| Raw HTTP call to any endpoint ( |
| Generic CRUD ( |
| Unified IoE+IoA timeline for the last N hours (one call) |
| Resolve an AD object by name/identifier ( |
| Get one object's full attributes by |
| One-shot account exposures + privileges (resolve → deviances → key attrs) |
| List security profiles (IoE/IoA data is profile-scoped) |
| Per-directory security scores for a profile |
| AD topology (domains, forests, trusts) for a profile |
| IoA attack instances, slim by default ( |
| Counts by attack type + distinct source IPs/hosts/usernames over a window |
| Compact attack-type list (id, codeName, name, criticity, mitre) |
| Compact IoE checker list (no description blobs) |
| Alerts for a profile |
| IoE deviant AD objects for a checker within a time window |
| All active deviances in a few cursor-paginated calls |
| Full IoE deviances for a checker (no date filter) |
| Full IoE deviances for a directory (no date filter) |
| Search AD security events in a date range (slim + paginated) |
| Deprecated — delegates to |
| Current user identity, roles, permissions |
Response envelope
List-returning tools wrap their output in a consistent envelope so an empty result is never ambiguous:
{ "count": 0, "page": 1, "perPage": 25, "hasMore": false,
"appliedFilters": { "...": "..." }, "warnings": ["..."], "results": [] }Always check warnings — an unrecognized filter, a defaulted profile, or a
substring-vs-exact match is reported there rather than silently dropped.
Finding AD objects & filter grammar
There is no
GET /api/ad-objects?search=— the API rejects it. Resolve accounts withtie_find_ad_object(backed by the event stream, TIE's only server-side object-attribute search), then usetie_get_ad_objectfor full attributes.The filter
expressionused bytie_deviancesandtie_search_eventsis a predicate map:{"attributeName": "substring"}(case-insensitive contains), multiple keys ANDed, combined with{"AND":[…]}/{"OR":[…]}.{}matches all. The{"attribute","operator","value"}form silently matches nothing — the tools now warn when they see it.
Time windows, profiles, and token budget
Time-aware tools (
tie_recent_activity,tie_deviances,tie_attacks_aggregate) accept a relativehours=Nwindow or explicitdate_start/date_end. All timestamps are UTC.IoE/IoA data is profile-scoped. The API does not expose which profile your console has selected, so pass
profile_idexplicitly — usetie_profilesto list them. If omitted, tools default to profile1and add a warning towarnings.By default, deviance/object/attack results are slimmed (descriptions rendered, oversized values dropped, attack
vector.templateomitted). Passverbose=true(orinclude_template=truefor attacks) for the full raw payload.
Related MCP server: @beyondidentity/mcp
Configuration
Set via environment variables (or --tie-url / --tie-api-key flags):
Variable | Description |
| Base URL, e.g. |
| API key (TIE console → System → Configuration → API key) |
|
|
Auth uses the X-API-Key header.
Install & run
python -m venv .venv && . .venv/bin/activate
pip install -e .
cp .env.example .env # fill in TIE_URL and TIE_API_KEY
# stdio (Claude Desktop / Claude Code)
set -a; . ./.env; set +a
tenable-tie-mcp
# or network transports
tenable-tie-mcp --transport sse --port 8000
tenable-tie-mcp --transport http --port 8000Running with uv / uvx (alternative to a manual venv)
uv can manage the environment for you. uv is the
full tool; uvx (alias for uv tool run) runs a package in a throwaway env, like
npx. Both need uv installed (brew install uv).
# uv run: resolves deps from pyproject.toml into a managed .venv, then runs
uv run tenable-tie-mcp
# uvx: run ephemerally from the project path, nothing persisted
uvx --from . tenable-tie-mcpClaude Desktop / Claude Code config
Use the full path to the executable. Claude Desktop does not launch from your
shell, so it does not inherit your PATH — a bare tenable-tie-mcp will fail with
"command not found" unless the tool is on the system PATH (e.g. a pipx install).
For a venv install, point at the venv's launcher:
{
"mcpServers": {
"tenable-tie": {
"command": "/absolute/path/to/tenable-ie-mcp/.venv/bin/tenable-tie-mcp",
"env": {
"TIE_URL": "https://your-host.tenable.ad",
"TIE_API_KEY": "your-key"
}
}
}
}Find the exact path with echo "$PWD/.venv/bin/tenable-tie-mcp" from the project
root. See claude_desktop_config.sample.json for a complete example.
If you installed globally with
pipx install .(oruv tool install), the bare"command": "tenable-tie-mcp"works because it lands on the system PATH.
With uv (alternative)
Point command at the full path of uv (which uv, e.g. /opt/homebrew/bin/uv)
and let it manage the environment:
{
"mcpServers": {
"tenable-tie": {
"command": "/opt/homebrew/bin/uv",
"args": ["run", "--directory", "/absolute/path/to/tenable-ie-mcp", "tenable-tie-mcp"],
"env": {
"TIE_URL": "https://your-host.tenable.ad",
"TIE_API_KEY": "your-key"
}
}
}
}Docker
docker compose up --build # reads TIE_URL / TIE_API_KEY from environmentExample prompts
"Show me IoE and IoA activity in the last 12 hours." →
tie_recent_activity"Find the account SECURITYPEN and show its exposures and privileges." →
tie_account_report"Resolve the user administrator to its object id and DN." →
tie_find_ad_object"Which security profiles exist?" →
tie_profiles"List the monitored directories and their security scores."
"Show the latest IoA attacks against directory 8." →
tie_attacks"Which source hosts and accounts are behind attacks on directory 8?" →
tie_attacks_aggregate"What IoE deviances appeared for checker 15 in the last day?" →
tie_deviances"Show unread alerts for profile 2."
Notes
Every list tool returns the
{count, hasMore, appliedFilters, warnings, results}envelope — readwarnings(defaulted profile, unrecognized filter, truncation).profile_iddefaults to1when omitted, and the tool warns; pass it (orprofile_namewhere supported) to target your console's active profile.AD-object lookup is via
tie_find_ad_object/tie_get_ad_object; the flatGET /api/ad-objects/{id}and?search=routes do not work and are not used.Attacks must be scoped:
resource_type∈infrastructure|directory|hostname|ipandresource_valueis the id or name/ip.searchmatches source host/IP only — useactorto filter by the acting account in the attack vector.Non-JSON responses are returned as
{"content_type": ..., "text": ...}rather than crashing.Scoring and prioritization: TIE checkers carry a
remediationCost(easy / medium / hard) but no native asset-level severity score. If your workflow requires AES (Asset Exposure Score) or ACR (Asset Criticality Rating) — for example, to rank affected identities by business risk — connect your environment to Tenable One. Tenable One aggregates data across TIE, Tenable Vulnerability Management, and other sources to produce unified AES/ACR scores that can be surfaced here via the API.
Available Tools
15 toolstie_alertsA
List alerts for a security profile.
Args: profile_id: Security profile id (default 1). page: Page number (1-based). per_page: Results per page. archived: Optionally filter by archived status (True/False).
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | ||
| archived | No | ||
| per_page | No | ||
| profile_id | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It states that this is a listing operation, implying read-only, and describes pagination parameters. However, it does not disclose any response format, result ordering, or potential side effects beyond what can be inferred from 'list'.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise: a single-purpose sentence followed by a clean argument list. It is front-loaded with the action, and every line serves a purpose, covering all parameters without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
While the parameter documentation is clear, there is no output schema and the description does not mention what the returned alert objects contain. For a list tool, an agent needs to know the shape of the results to process them correctly, making the description incomplete in that respect.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has no property descriptions (0% coverage), but the description explicitly explains each parameter: profile_id, page, per_page, and archived. This fully compensates for the lack of schema descriptions and adds meaning beyond type/default information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'List alerts for a security profile' with a specific verb and resource. It distinguishes from sibling tools like tie_scores and tie_topology by focusing on alerts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: use this tool to list alerts filtered by profile, pagination, and archived status. It does not explicitly mention when not to use it or alternatives, but the purpose is sufficiently clear to guide selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tie_attacksA
List IoA attack instances for a resource within a profile.
The TIE API requires scoping attacks to a resource. For example, to see attacks against directory id 8: resource_type="directory", resource_value="8".
Args: resource_type: What resource_value refers to — infrastructure, directory, hostname, or ip. resource_value: The id (for infrastructure/directory) or name/ip value to scope to. profile_id: Security profile id (default 1). attack_type_ids: Optional list of attack type ids to filter (e.g. DCSync, Kerberoasting). date_start: Optional ISO 8601 start of date range. date_end: Optional ISO 8601 end of date range. include_closed: Include closed attacks (default False). limit: Max results (default 50). order: Sort order by date, "desc" (newest first) or "asc". search: Optional free-text search filter.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| order | No | desc | |
| search | No | ||
| date_end | No | ||
| date_start | No | ||
| profile_id | No | ||
| resource_type | Yes | ||
| include_closed | No | ||
| resource_value | Yes | ||
| attack_type_ids | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of explaining behavior. It discloses key defaults (include_closed=False, limit=50, order=desc) and explains the meaning of order and the requirement of resource scoping. It does not mention pagination, auth, or error behavior, but for a read-only list tool this is reasonable. It adds value beyond the schema by describing the effect of parameters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured: a one-sentence purpose, a brief context paragraph with an example, and a clean list of arguments. Every sentence adds value, and the front-loaded purpose makes it easy for an agent to quickly understand the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 10 parameters, no output schema, and no annotations, the description covers the necessary context thoroughly. It explains the required scoping, all parameters with defaults, and provides an example. It is complete enough for an agent to invoke the tool correctly without additional documentation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has no parameter descriptions (0% coverage), so the description fully compensates by explaining every parameter in the Args section. It clarifies resource_type values, resource_value meaning, attack_type_ids examples (DCSync, Kerberoasting), ISO 8601 for dates, and default values. This is essential and well done.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'List IoA attack instances for a resource within a profile.' This clearly states the tool's function and scope, and distinguishes it from sibling tools like tie_alerts or tie_search_events that target different data. The example further clarifies the intended use.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states that the TIE API requires scoping attacks to a resource and gives a concrete example with resource_type and resource_value. This provides clear context for when and how to use the tool. However, it does not explicitly mention alternatives or when not to use this tool, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tie_catalogA
List all available Tenable Identity Exposure API resources and their paths.
Call this first to discover what resources exist before using other tools.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of disclosing the tool's behavior. It clearly states that the tool lists resources and paths, and the instruction to call it first implies it is a safe, read-only discovery operation. The context signals also confirm no parameters are needed, reinforcing that it is a straightforward listing action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, consisting of two short sentences. The first sentence states the primary function, and the second provides usage guidance. Every word earns its place, and the information is front-loaded with the action and target.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (no parameters, no complex logic) and the presence of an output schema, the description fully covers what an agent needs to know. It explains what the tool returns (a list of resources and paths) and when to invoke it (first). The absence of side effects and the read-only nature are implied clearly enough for a catalog discovery tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and the input schema is an empty object, so there is no parameter information to clarify. The description correctly adds no parameter details because none exist. According to the rubric, a baseline of 4 is appropriate for 0-parameter tools.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'List' and identifies the resource as 'all available Tenable Identity Exposure API resources and their paths', which precisely states what the tool does. It also distinguishes itself from the sibling tools by framing itself as the discovery entry point, saying 'Call this first to discover what resources exist before using other tools.'
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use the tool: 'Call this first to discover what resources exist before using other tools.' This clearly indicates the intended usage context. However, it does not mention any exclusions or alternative scenarios, so it stops short of a perfect score.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tie_deviancesA
Find AD objects with IoE deviances for a checker within a time window.
This is the time-filterable deviance query (server-side dateStart/dateEnd via
the checker's ad-objects/search endpoint). Provide hours for a relative
window (e.g. hours=12) or explicit date_start/date_end. With neither, defaults
to the last 24h.
Args: checker_id: IoE checker id (see resource="checkers"). profile_id: Security profile id (default 1). Note: your console may use a non-default profile — call tie_profiles to list them. directory_ids: Restrict to these directory ids (default: all directories in scope). hours: Relative look-back window in hours (e.g. 12). Ignored if date_start given. date_start: Explicit ISO 8601 UTC start (e.g. "2026-07-07T16:00:00.000Z"). date_end: Explicit ISO 8601 UTC end (default: now). reasons: Optional reason ids to filter (see /api/profiles/{id}/checkers/{id}/reasons). show_ignored: Include deviances that are currently ignored (default False). page: Page number (1-based). per_page: Results per page. verbose: If False (default), truncate giant attribute values.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | ||
| hours | No | ||
| reasons | No | ||
| verbose | No | ||
| date_end | No | ||
| per_page | No | ||
| checker_id | Yes | ||
| date_start | No | ||
| profile_id | No | ||
| show_ignored | No | ||
| directory_ids | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It discloses server-side date filtering, defaults to the last 24h, truncation of attribute values when verbose=False, pagination behavior, and show_ignored semantics. It stops short of mentioning authentication, rate limits, or error handling, but for a read-only search tool it provides substantial behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a one-sentence summary, a clarifying note about time windows, and a bulleted Args list. It is longer due to 11 parameters, but each sentence and bullet is informative. A tighter wording (e.g., combining some defaults) could slightly improve it, but it is not bloated.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 11 parameters, no output schema, and no annotations, the description covers all parameters, defaults, and endpoint behavior. It mentions server-side execution and verbose truncation, which helps infer return shape, but it does not explicitly describe the response structure or error scenarios. Still, it is nearly complete for a list/query tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. The 'Args' section explains all 11 parameters with types, defaults, and formats (e.g., 'ISO 8601 UTC start', 'default: all directories in scope', 'ignored if date_start given'). This adds significant meaning beyond the schema's bare names and types.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Find AD objects with IoE deviances for a checker within a time window,' which is a specific verb + resource + scope statement. It clearly positions this as the time-filterable deviance query, distinguishing it from sibling tools like tie_deviances_by_checker, tie_deviances_bulk, and tie_deviances_by_directory.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly frames this as 'the time-filterable deviance query' and explains when to use hours vs. explicit date_start/date_end, implying this is the go-to for time-windowed deviance lookups. It also cross-references tie_profiles for profile selection, offering practical context, though it does not explicitly list exclusions or name alternative tools for other scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tie_deviances_by_checkerA
List IoE deviances for a given checker within a profile (full detail, no date filter).
For a time-bounded view use tie_deviances(hours=...) or tie_recent_activity instead.
The TIE API models this as a POST with a filter expression body; an empty
expression returns all deviances for the checker.
Args: checker_id: IoE checker id (see tie_resource_action resource="checkers"). profile_id: Security profile id (default 1). page: Page number (1-based). per_page: Results per page. expression: Optional filter expression object. Defaults to {} (no filter). verbose: If False (default), render descriptions and drop giant attribute values to save tokens. Set True for the full raw payload.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | ||
| verbose | No | ||
| per_page | No | ||
| checker_id | Yes | ||
| expression | No | ||
| profile_id | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Since annotations are absent, the description carries the full responsibility for behavioral disclosure. It reveals that the TIE API models this as a POST with a filter body, explains the effect of the verbose flag on token usage, and states the no-date-filter constraint. These insights go beyond what a simple 'list' would imply and are crucial for an agent to anticipate output size and API semantics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The opening sentence is concise and front-loaded, and the subsequent Args block is necessary given the schema lacks descriptions. While the text is a bit longer than minimal, every sentence earns its place—the POST body detail and verbose explanation are useful, not redundant. A slightly leaner formatting could tighten it, but it remains efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 6-parameter tool with no annotations and no output schema, the description covers all critical aspects: purpose, alternatives, parameter semantics, and even output verbosity control. It does not explicitly describe the return structure, but the phrase 'List IoE deviances' and the verbose flag sufficiently imply the output format. The description is complete enough for an agent to select and invoke this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description's Args block fully compensates by documenting all six parameters with meaningful details. It explains checker_id references the checkers resource, profile_id default, page and per_page pagination, expression as an optional filter object defaulting to {}, and verbose behavior. This adds far more value than the bare schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'List IoE deviances for a given checker within a profile (full detail, no date filter).' This clearly distinguishes the tool from siblings by explicitly noting the absence of a date filter, making it immediately obvious what the tool does and how it differs from tie_deviances or tie_recent_activity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly provides alternative tools for time-bounded queries: 'For a time-bounded view use tie_deviances(hours=...) or tie_recent_activity instead.' This gives clear when-to-use and when-not-to-use guidance, along with named alternatives. It also explains that an empty expression returns all deviances, further clarifying expected usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tie_deviances_by_directoryA
List IoE deviances for a specific directory (full detail, no date filter).
Args: infrastructure_id: Infrastructure (forest) id — see resource="infrastructures". directory_id: Directory id — see resource="directories". page: Page number (1-based). per_page: Results per page. verbose: If False (default), render descriptions and drop giant attribute values.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | ||
| verbose | No | ||
| per_page | No | ||
| directory_id | Yes | ||
| infrastructure_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden. It discloses that there is no date filter, that it returns full detail, and that verbose=False drops giant attribute values and renders descriptions – concrete behavior beyond the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A one-line summary is followed by a tidy Arg list with each parameter on its own line. No redundant filler; all lines add semantic value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
It covers the tool's purpose and all parameters, but since there is no output schema, it doesn't describe the shape of the returned deviance items or error handling. The absence of explicit alternative-tool guidance leaves a small gap in the overall context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The Args block explains all five parameters, including page being 1-based, per_page as results per page, verbose behavior, and pointers to resource schemas. Since the schema itself has no descriptions, this fully compensates.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'List IoE deviances for a specific directory', providing a clear verb and scoped resource. 'Full detail, no date filter' adds behavioral scope and differentiates it from siblings like tie_deviances and tie_deviances_by_checker.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It clearly states this is for a specific directory, which implies the primary use case. However, it doesn't explicitly name alternative tools or state when not to use it, so it misses exclusionary guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tie_profilesA
List security profiles (id + name).
IoE/IoA data is scoped to a profile. The console has a selected profile that the API does not expose, so pass the right profile_id explicitly to other tools.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the burden of behavioral disclosure. It goes beyond a simple list statement by explaining the data scoping relationship and the need for explicit profile_id, which is important context. Though it doesn't explicitly say 'read-only', the listing verb and context make the safe-read behavior clear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the core purpose, followed by essential context. Every sentence earns its place without redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless list tool with no output schema, the description fully covers the return fields (id+name), the reason the tool exists, and how to use the result. It tells the user exactly why they need this tool and what to do with the output, making it complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
This tool has zero parameters, so the baseline is 4. The description adds value by explaining the significance of profile_id that consumers of this tool will use, even though it doesn't need to describe any parameters for this tool itself.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists security profiles with their id and name. It provides a specific verb and resource, and it stands apart from sibling tools by being the only one focused on profiles, which are foundational for other operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains that IoE/IoA data is scoped to a profile and that the console's selected profile is not exposed via API, so users must pass the correct profile_id explicitly to other tools. This gives clear guidance on when to use this tool and how to apply its results.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tie_recent_activityA
Unified recent-activity timeline of IoE alerts and IoA attacks in one call.
Answers questions like "show me IoE/IoA in the last 12 hours". IoE is sourced from the profile's alert feed (time-ordered) and each in-window alert is enriched with its deviance detail (checker + rendered description). IoA is sourced from the attacks endpoint per directory. Results are merged and sorted newest-first. All timestamps are UTC.
Args: hours: Look-back window in hours (default 12). profile_id: Security profile id (default 1). See tie_profiles. include_ioe: Include IoE deviance alerts (default True). include_ioa: Include IoA attacks (default True). directory_ids: Restrict to these directory ids (default: all in scope). max_items: Cap on enriched items per category (default 50); truncation is reported. verbose: If False (default), attribute values are slimmed.
| Name | Required | Description | Default |
|---|---|---|---|
| hours | No | ||
| verbose | No | ||
| max_items | No | ||
| profile_id | No | ||
| include_ioa | No | ||
| include_ioe | No | ||
| directory_ids | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses that results are merged and sorted newest-first, timestamps are UTC, alerts are enriched, and truncation is reported. It does not explicitly state read-only behavior, but given the retrieval nature, it is sufficiently transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured: purpose first, then detailed explanation, then parameter list. Every sentence adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Although there is no output schema, the description sufficiently covers the tool's complex behavior (merging two sources, enrichment, truncation). It could be slightly more complete by hinting at the output structure, but it is adequate for an AI agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description provides all parameter meaning. Each parameter is explained with default values, behavior details (e.g., max_items truncation, verbose slimming), and context (profile_id defaults to 1, directory_ids restrict scope). This fully compensates for the lack of schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it provides a unified recent-activity timeline of IoE alerts and IoA attacks. It answers specific user questions and distinguishes from sibling tools like tie_alerts and tie_attacks by being a merged view.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly explains when to use this tool (for recent activity, merging both IoE and IoA). It implies that for separate feeds, tie_alerts or tie_attacks would be more appropriate, but does not provide explicit exclusions or alternative conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tie_requestA
Make a direct HTTP call to any Tenable Identity Exposure API endpoint.
Args: method: HTTP method (GET, POST, PUT, PATCH, DELETE). path: API path, e.g. "/api/directories" or "/api/attacks/123". params: Optional query string parameters as a dict. body: Optional request body as a dict (used with POST/PUT/PATCH).
Returns: Parsed JSON response from the TIE API.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | ||
| path | Yes | ||
| method | Yes | ||
| params | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden for behavioral disclosure. It only describes the basic function and parameters, omitting critical details like authentication, error handling, rate limits, and side effects. This is insufficient for a generic API call tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, using a structured Args/Returns format. Every sentence adds value without redundancy. No fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the 13 sibling tools for specific endpoints, the description lacks guidance on when to use this generic tool. It explains the return value (parsed JSON) but omits potential errors or pagination behavior. It is minimally adequate but not fully complete for the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaningful context to all four parameters (method, path, params, body) with clear explanations and examples, compensating for the 0% schema description coverage. However, it could provide more detail on path formatting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: making direct HTTP calls to any Tenable Identity Exposure API endpoint. It uses a specific verb and resource, and it is easily distinguishable from sibling tools which target specific endpoints.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for any endpoint but does not explicitly guide when to use this generic tool versus the dedicated sibling tools (e.g., tie_alerts, tie_attacks). No exclusions or alternatives are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tie_resource_actionB
Perform CRUD operations on a TIE resource.
Args: resource: Resource name from tie_catalog (e.g. "directories", "attacks", "users"). action: Operation — list, get, create, update, or delete. id: Resource ID for get/update/delete operations. body: Request body for create/update operations. params: Optional query parameters (e.g. pagination, filters).
Examples: List all directories: resource="directories", action="list" Get directory #5: resource="directories", action="get", id=5 List recent attacks: resource="attacks", action="list", params={"page": 1} Create a user: resource="users", action="create", body={...} Delete an alert: resource="alerts", action="delete", id=42
| Name | Required | Description | Default |
|---|---|---|---|
| id | No | ||
| body | No | ||
| action | No | list | |
| params | No | ||
| resource | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description must cover behavioral traits. It does not mention that create/update/delete are destructive, required permissions, or error handling. The example for delete lacks warning, and the impact of invalid resource names is omitted.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, well-structured with Args and Examples sections, and front-loads the purpose. Every sentence is informative, with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and multiple resource/action combinations, the description covers parameter usage thoroughly but lacks details on return format, error handling, and pagination specifics. It is adequate but incomplete for a generic CRUD tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema coverage, the description adds significant value by explaining each parameter (resource, action, id, body, params) with examples. It clarifies usage beyond the schema's type definitions, though the format for params is not fully detailed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool performs CRUD operations on TIE resources, with examples listing specific resources. It distinguishes from sibling tools which are resource-specific, but does not explicitly highlight its generic nature.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus siblings like tie_alerts or tie_attacks. The description provides examples but does not indicate prerequisites, context, or alternatives for specific resource operations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tie_scoresA
Get per-directory security scores for a profile.
Returns a list of {directoryId, score} reflecting the AD security posture (higher is better; scores reflect outstanding IoE deviances).
Args: profile_id: Security profile id (default 1).
| Name | Required | Description | Default |
|---|---|---|---|
| profile_id | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the burden of behavioral disclosure. It explains the return format as a list of {directoryId, score} and interprets the score direction ('higher is better; scores reflect outstanding IoE deviances'), which is valuable context. The verb 'Get' and 'Returns' imply a read-only operation, though it does not explicitly state side-effect freedom or error behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and well-structured: a purpose statement, a return-value explanation, and a parameter description. Every sentence earns its place with no unnecessary fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given one parameter, no output schema, and no annotations, the description covers the essential input and output semantics. It explains the returned list structure and score interpretation, making it nearly complete. It does not define 'IoE deviances' or cover pagination, but these may be domain-specific or irrelevant for this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. It adds the meaning 'Security profile id' and notes the default value, which the schema alone does not provide. This is adequate for the single parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Get per-directory security scores for a profile', specifying the verb, resource, and scope. It distinguishes this from sibling tools by focusing on scores rather than raw deviances or topology.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies it is used for retrieving a summary of security posture per directory, but it does not explicitly mention when to choose this over alternatives like tie_deviances_by_directory, nor does it state exclusions. The context is clear but no direct comparisons are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tie_search_ad_objectsA
Search Active Directory objects (users, computers, groups, OUs) by name or attribute.
Args: query: Search string to match against AD object names/attributes. directory_id: Restrict search to a specific directory. object_type: Filter by object type: "user", "computer", "group", "ou". page: Page number (1-based). per_page: Results per page.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | ||
| query | Yes | ||
| per_page | No | ||
| object_type | No | ||
| directory_id | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description does not disclose behavioral traits such as read-only nature, authentication requirements, rate limits, or side effects. For a search tool, stating it is read-only would be helpful but is missing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with a one-line purpose followed by a parameter list. It is well-structured and front-loaded, though it could be slightly more compact by omitting redundant wording in the parameter lines.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, and the description does not explain the return format, pagination behavior, or result fields. Given that the tool has pagination parameters (page, per_page), this omission reduces completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, but the tool description provides parameter descriptions in the 'Args' block (e.g., 'Search string to match against AD object names/attributes'). This adds meaning beyond the schema, though it could be more specific about what attributes are searched.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with a clear verb-resource statement: 'Search Active Directory objects (users, computers, groups, OUs) by name or attribute.' It explicitly lists the object types, which distinguishes it from other tie_ tools that deal with events, alerts, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states what the tool does but does not explicitly say when to use it versus alternatives. However, the sibling tools are all different (alerts, attacks, etc.), so the purpose implies usage context. Lacks explicit when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tie_search_eventsA
Search AD security events within a date range.
Args: directory_ids: One or more directory ids to search (see resource="directories"). date_start: ISO 8601 start of range, e.g. "2026-07-01T00:00:00.000Z". date_end: ISO 8601 end of range. profile_id: Security profile id (default 1). expression: Optional filter expression object. Defaults to {} (no filter). order: Optional ordering object, e.g. {"column": "date", "direction": "desc"}.
| Name | Required | Description | Default |
|---|---|---|---|
| order | No | ||
| date_end | Yes | ||
| date_start | Yes | ||
| expression | No | ||
| profile_id | No | ||
| directory_ids | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. However, it only states the action without mentioning whether the operation is read-only, requires special permissions, or has any side effects, pagination behavior, or output format. The term 'search' implies read-only, but it is not explicitly disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with a concise one-sentence purpose, followed by a well-structured Args list. Every line adds necessary detail, and there is no redundant or filler content. The structure is easy to parse and appropriately sized for the 6-parameter tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 6 parameters, no output schema, and no annotations. While the parameter documentation is complete, the description lacks any indication of the return value, response structure, or potential limitations like pagination. Given the absence of an output schema, this leaves a notable gap for an agent to understand what the tool actually returns.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The Args section thoroughly documents all six parameters, including formats (e.g., ISO 8601 for dates), defaults (e.g., profile_id default 1), and examples (e.g., ordering object). This fully compensates for the 0% schema description coverage, providing meaning beyond the bare type and title information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('Search'), resource ('AD security events'), and scope ('within a date range'). This distinguishes it from siblings like 'tie_search_ad_objects', which searches AD objects instead of events.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for searching security events but provides no explicit guidance on alternatives or when not to use. A clear context is present, but no exclusions or alternative tools are mentioned, leaving the agent to infer from the tool name and sibling list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tie_topologyA
Get the Active Directory topology (domains, forests, and trust relationships).
Args: profile_id: Security profile id (default 1).
| Name | Required | Description | Default |
|---|---|---|---|
| profile_id | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the full burden. It discloses the output scope (domains, forests, trust relationships) and the read-only nature is implied by 'Get', but it does not mention authentication, permissions, or return format details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: one purpose sentence followed by a single parameter definition. Every word adds value, and the key information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema or annotations, the description does a good job of stating what the tool returns (domains, forests, trust relationships). It lacks details on response structure or edge cases, but it is sufficient for a simple read-only topology query.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema only provides a type and default for profile_id. The description adds essential meaning by clarifying it is a 'Security profile id', compensating for the 0% schema description coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Get') and a clear resource ('Active Directory topology') with an explicit enumeration of the content (domains, forests, and trust relationships). This clearly distinguishes it from sibling tools like tie_search_ad_objects or tie_catalog.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for retrieving AD topology but provides no explicit guidance on when to use this tool versus alternatives. There are no exclusions or prerequisites mentioned, so the context is clear but not fully prescriptive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tie_whoamiA
Get the current user's identity, roles, and permissions (from the API key).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the burden of disclosing behavioral traits. It mentions that the data comes from the API key, which implies no separate login flow, and the verb 'Get' implies a safe read operation. However, it does not explicitly state that no state is modified or describe error handling for invalid keys, leaving some ambiguity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence that front-loads the action and resource. Every word earns its place, with no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple no-argument tool, the description is complete: it states the returned information (identity, roles, permissions) and the source (API key). No output schema exists, but the description sufficiently explains the return value's nature for the tool's low complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the schema already fully documents argument expectations. The description adds no parameter details but this is unnecessary; a baseline of 4 is appropriate since there are no parameters to compensate for.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function with a specific verb ('Get') and resource ('current user's identity, roles, and permissions'), distinguishing it from sibling tools which all focus on data listings, scoring, or actions rather than user context.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use this tool (to retrieve current user info) and notes the API key as the source, but does not explicitly mention alternatives or exclusions. Since no sibling tool serves this purpose, the guidance is adequate without being explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
15 tool updates
v0.1.0- First observed
tie_alerts - First observed
tie_attacks - First observed
tie_catalog - First observed
tie_deviances - First observed
tie_deviances_by_checker - First observed
tie_deviances_by_directory - First observed
tie_profiles - First observed
tie_recent_activity - First observed
tie_request - First observed
tie_resource_action - First observed
tie_scores - First observed
tie_search_ad_objects - First observed
tie_search_events - First observed
tie_topology - First observed
tie_whoami
TDQS
Scored across 15 tools
Most tools have clearly distinct purposes, but there is slight overlap among tie_deviances, tie_deviances_by_checker, and tie_deviances_by_directory. However, descriptions clarify that they differ by date filtering and scoping, so ambiguity is minimal.
All tools use the consistent 'tie_' prefix and follow snake_case naming. Naming patterns are predictable: nouns for entity listings (tie_alerts, tie_attacks) and verb_noun for search actions (tie_search_ad_objects). No mixed conventions.
15 tools is well-scoped for the Tenable Identity Exposure domain. Each tool covers a distinct aspect (alerts, attacks, deviances, profiles, search, topology) without unnecessary duplication or missing core functionality.
The tool set comprehensively covers the API surface: CRUD via tie_resource_action, specific queries for alerts, attacks, deviances, scores, topology, and search. The tie_recent_activity tool fills a gap by merging IoE and IoA timelines. No obvious missing operations.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Exposes FEDLIN's public security scanners as agent-callable tools over Streamable HTTP.
- mcpOAuthcom.vibgrate
Query your team's drift, vulnerability, and upgrade data from any AI assistant. OAuth 2.1, 51 tools.
Unified API to query AWS, GCP, Azure and generate Terraform/CLI execution kits for AI agents.
AI-callable tools for API mocking, testing, monitoring, security, and automation.
Related MCP Servers
- FlicenseAqualityDmaintenanceExposes the Timely.mn v3 time-attendance API as MCP tools for Claude and other clients, allowing queries for company-wide attendance, employee profiles, and attendance reports.4-
- AlicenseNot gradedqualityAmaintenanceEnables AI agents to directly manage Beyond Identity resources such as identities, groups, applications, SSO configurations, and credentials via natural language tool calls.16Apache 2.0
- FlicenseNot gradedqualityBmaintenanceExposes the TeamViewer Web API as MCP tools, enabling AI assistants to manage devices, users, groups, sessions, and more via natural language.-
- AlicenseAqualityCmaintenanceExposes Tenable security operations as MCP tools for AI-powered security workflows, enabling asset, vulnerability, scan, plugin, and tag management via natural language.17MIT