Skip to main content
Glama
knethteo

Tenable Identity Exposure MCP Server

by knethteo

Tenable Identity Exposure MCP Server

An MCP server exposing the Tenable Identity Exposure (TIE, formerly Tenable.ad) REST API as tools for LLM clients. Built on FastMCP from the official mcp SDK.

Verified end-to-end against a live TIE SaaS instance (v3.120.1).

⚠️ Disclaimer: This is not an officially supported Tenable project. It was built with assistance from Claude — treat its output as a starting point and validate responses against the Tenable console before acting on them.

Tools

Tool

Description

tie_catalog

List available resources + the filter-expression grammar — call this first

tie_request

Raw HTTP call to any endpoint (method, path, params, body)

tie_resource_action

Generic CRUD (list/get/create/update/delete) on flat resources

tie_recent_activity

Unified IoE+IoA timeline for the last N hours (one call)

tie_find_ad_object

Resolve an AD object by name/identifier (by=sAMAccountName|cn|upn|dn|sid|guid)

tie_get_ad_object

Get one object's full attributes by directory_id + ad_object_id (the only working get-by-id)

tie_account_report

One-shot account exposures + privileges (resolve → deviances → key attrs)

tie_profiles

List security profiles (IoE/IoA data is profile-scoped)

tie_scores

Per-directory security scores for a profile

tie_topology

AD topology (domains, forests, trusts) for a profile

tie_attacks

IoA attack instances, slim by default (resource_type + resource_value; actor/include_template)

tie_attacks_aggregate

Counts by attack type + distinct source IPs/hosts/usernames over a window

tie_attack_types_summary

Compact attack-type list (id, codeName, name, criticity, mitre)

tie_checkers_summary

Compact IoE checker list (no description blobs)

tie_alerts

Alerts for a profile

tie_deviances

IoE deviant AD objects for a checker within a time window

tie_deviances_bulk

All active deviances in a few cursor-paginated calls

tie_deviances_by_checker

Full IoE deviances for a checker (no date filter)

tie_deviances_by_directory

Full IoE deviances for a directory (no date filter)

tie_search_events

Search AD security events in a date range (slim + paginated)

tie_search_ad_objects

Deprecated — delegates to tie_find_ad_object

tie_whoami

Current user identity, roles, permissions

Response envelope

List-returning tools wrap their output in a consistent envelope so an empty result is never ambiguous:

{ "count": 0, "page": 1, "perPage": 25, "hasMore": false,
  "appliedFilters": { "...": "..." }, "warnings": ["..."], "results": [] }

Always check warnings — an unrecognized filter, a defaulted profile, or a substring-vs-exact match is reported there rather than silently dropped.

Finding AD objects & filter grammar

  • There is no GET /api/ad-objects?search= — the API rejects it. Resolve accounts with tie_find_ad_object (backed by the event stream, TIE's only server-side object-attribute search), then use tie_get_ad_object for full attributes.

  • The filter expression used by tie_deviances and tie_search_events is a predicate map: {"attributeName": "substring"} (case-insensitive contains), multiple keys ANDed, combined with {"AND":[…]} / {"OR":[…]}. {} matches all. The {"attribute","operator","value"} form silently matches nothing — the tools now warn when they see it.

Time windows, profiles, and token budget

  • Time-aware tools (tie_recent_activity, tie_deviances, tie_attacks_aggregate) accept a relative hours=N window or explicit date_start/date_end. All timestamps are UTC.

  • IoE/IoA data is profile-scoped. The API does not expose which profile your console has selected, so pass profile_id explicitly — use tie_profiles to list them. If omitted, tools default to profile 1 and add a warning to warnings.

  • By default, deviance/object/attack results are slimmed (descriptions rendered, oversized values dropped, attack vector.template omitted). Pass verbose=true (or include_template=true for attacks) for the full raw payload.

Related MCP server: @beyondidentity/mcp

Configuration

Set via environment variables (or --tie-url / --tie-api-key flags):

Variable

Description

TIE_URL

Base URL, e.g. https://your-host.tenable.ad

TIE_API_KEY

API key (TIE console → System → Configuration → API key)

TIE_VERIFY_SSL

true (default) or false for self-signed certs

Auth uses the X-API-Key header.

Install & run

python -m venv .venv && . .venv/bin/activate
pip install -e .

cp .env.example .env   # fill in TIE_URL and TIE_API_KEY

# stdio (Claude Desktop / Claude Code)
set -a; . ./.env; set +a
tenable-tie-mcp

# or network transports
tenable-tie-mcp --transport sse --port 8000
tenable-tie-mcp --transport http --port 8000

Running with uv / uvx (alternative to a manual venv)

uv can manage the environment for you. uv is the full tool; uvx (alias for uv tool run) runs a package in a throwaway env, like npx. Both need uv installed (brew install uv).

# uv run: resolves deps from pyproject.toml into a managed .venv, then runs
uv run tenable-tie-mcp

# uvx: run ephemerally from the project path, nothing persisted
uvx --from . tenable-tie-mcp

Claude Desktop / Claude Code config

Use the full path to the executable. Claude Desktop does not launch from your shell, so it does not inherit your PATH — a bare tenable-tie-mcp will fail with "command not found" unless the tool is on the system PATH (e.g. a pipx install).

For a venv install, point at the venv's launcher:

{
  "mcpServers": {
    "tenable-tie": {
      "command": "/absolute/path/to/tenable-ie-mcp/.venv/bin/tenable-tie-mcp",
      "env": {
        "TIE_URL": "https://your-host.tenable.ad",
        "TIE_API_KEY": "your-key"
      }
    }
  }
}

Find the exact path with echo "$PWD/.venv/bin/tenable-tie-mcp" from the project root. See claude_desktop_config.sample.json for a complete example.

If you installed globally with pipx install . (or uv tool install), the bare "command": "tenable-tie-mcp" works because it lands on the system PATH.

With uv (alternative)

Point command at the full path of uv (which uv, e.g. /opt/homebrew/bin/uv) and let it manage the environment:

{
  "mcpServers": {
    "tenable-tie": {
      "command": "/opt/homebrew/bin/uv",
      "args": ["run", "--directory", "/absolute/path/to/tenable-ie-mcp", "tenable-tie-mcp"],
      "env": {
        "TIE_URL": "https://your-host.tenable.ad",
        "TIE_API_KEY": "your-key"
      }
    }
  }
}

Docker

docker compose up --build   # reads TIE_URL / TIE_API_KEY from environment

Example prompts

  • "Show me IoE and IoA activity in the last 12 hours." → tie_recent_activity

  • "Find the account SECURITYPEN and show its exposures and privileges." → tie_account_report

  • "Resolve the user administrator to its object id and DN." → tie_find_ad_object

  • "Which security profiles exist?" → tie_profiles

  • "List the monitored directories and their security scores."

  • "Show the latest IoA attacks against directory 8." → tie_attacks

  • "Which source hosts and accounts are behind attacks on directory 8?" → tie_attacks_aggregate

  • "What IoE deviances appeared for checker 15 in the last day?" → tie_deviances

  • "Show unread alerts for profile 2."

Notes

  • Every list tool returns the {count, hasMore, appliedFilters, warnings, results} envelope — read warnings (defaulted profile, unrecognized filter, truncation).

  • profile_id defaults to 1 when omitted, and the tool warns; pass it (or profile_name where supported) to target your console's active profile.

  • AD-object lookup is via tie_find_ad_object / tie_get_ad_object; the flat GET /api/ad-objects/{id} and ?search= routes do not work and are not used.

  • Attacks must be scoped: resource_typeinfrastructure|directory|hostname|ip and resource_value is the id or name/ip. search matches source host/IP only — use actor to filter by the acting account in the attack vector.

  • Non-JSON responses are returned as {"content_type": ..., "text": ...} rather than crashing.

  • Scoring and prioritization: TIE checkers carry a remediationCost (easy / medium / hard) but no native asset-level severity score. If your workflow requires AES (Asset Exposure Score) or ACR (Asset Criticality Rating) — for example, to rank affected identities by business risk — connect your environment to Tenable One. Tenable One aggregates data across TIE, Tenable Vulnerability Management, and other sources to produce unified AES/ACR scores that can be surfaced here via the API.

Available Tools

15 tools
tie_alertsA

List alerts for a security profile.

Args: profile_id: Security profile id (default 1). page: Page number (1-based). per_page: Results per page. archived: Optionally filter by archived status (True/False).

ParametersJSON Schema
NameRequiredDescriptionDefault
pageNo
archivedNo
per_pageNo
profile_idNo

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of behavioral disclosure. It states that this is a listing operation, implying read-only, and describes pagination parameters. However, it does not disclose any response format, result ordering, or potential side effects beyond what can be inferred from 'list'.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise: a single-purpose sentence followed by a clean argument list. It is front-loaded with the action, and every line serves a purpose, covering all parameters without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

While the parameter documentation is clear, there is no output schema and the description does not mention what the returned alert objects contain. For a list tool, an agent needs to know the shape of the results to process them correctly, making the description incomplete in that respect.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has no property descriptions (0% coverage), but the description explicitly explains each parameter: profile_id, page, per_page, and archived. This fully compensates for the lack of schema descriptions and adds meaning beyond type/default information.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'List alerts for a security profile' with a specific verb and resource. It distinguishes from sibling tools like tie_scores and tie_topology by focusing on alerts.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context: use this tool to list alerts filtered by profile, pagination, and archived status. It does not explicitly mention when not to use it or alternatives, but the purpose is sufficiently clear to guide selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tie_attacksA

List IoA attack instances for a resource within a profile.

The TIE API requires scoping attacks to a resource. For example, to see attacks against directory id 8: resource_type="directory", resource_value="8".

Args: resource_type: What resource_value refers to — infrastructure, directory, hostname, or ip. resource_value: The id (for infrastructure/directory) or name/ip value to scope to. profile_id: Security profile id (default 1). attack_type_ids: Optional list of attack type ids to filter (e.g. DCSync, Kerberoasting). date_start: Optional ISO 8601 start of date range. date_end: Optional ISO 8601 end of date range. include_closed: Include closed attacks (default False). limit: Max results (default 50). order: Sort order by date, "desc" (newest first) or "asc". search: Optional free-text search filter.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
orderNodesc
searchNo
date_endNo
date_startNo
profile_idNo
resource_typeYes
include_closedNo
resource_valueYes
attack_type_idsNo

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of explaining behavior. It discloses key defaults (include_closed=False, limit=50, order=desc) and explains the meaning of order and the requirement of resource scoping. It does not mention pagination, auth, or error behavior, but for a read-only list tool this is reasonable. It adds value beyond the schema by describing the effect of parameters.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured: a one-sentence purpose, a brief context paragraph with an example, and a clean list of arguments. Every sentence adds value, and the front-loaded purpose makes it easy for an agent to quickly understand the tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 10 parameters, no output schema, and no annotations, the description covers the necessary context thoroughly. It explains the required scoping, all parameters with defaults, and provides an example. It is complete enough for an agent to invoke the tool correctly without additional documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has no parameter descriptions (0% coverage), so the description fully compensates by explaining every parameter in the Args section. It clarifies resource_type values, resource_value meaning, attack_type_ids examples (DCSync, Kerberoasting), ISO 8601 for dates, and default values. This is essential and well done.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'List IoA attack instances for a resource within a profile.' This clearly states the tool's function and scope, and distinguishes it from sibling tools like tie_alerts or tie_search_events that target different data. The example further clarifies the intended use.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states that the TIE API requires scoping attacks to a resource and gives a concrete example with resource_type and resource_value. This provides clear context for when and how to use the tool. However, it does not explicitly mention alternatives or when not to use this tool, so it falls short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tie_catalogA

List all available Tenable Identity Exposure API resources and their paths.

Call this first to discover what resources exist before using other tools.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of disclosing the tool's behavior. It clearly states that the tool lists resources and paths, and the instruction to call it first implies it is a safe, read-only discovery operation. The context signals also confirm no parameters are needed, reinforcing that it is a straightforward listing action.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise, consisting of two short sentences. The first sentence states the primary function, and the second provides usage guidance. Every word earns its place, and the information is front-loaded with the action and target.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (no parameters, no complex logic) and the presence of an output schema, the description fully covers what an agent needs to know. It explains what the tool returns (a list of resources and paths) and when to invoke it (first). The absence of side effects and the read-only nature are implied clearly enough for a catalog discovery tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and the input schema is an empty object, so there is no parameter information to clarify. The description correctly adds no parameter details because none exist. According to the rubric, a baseline of 4 is appropriate for 0-parameter tools.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'List' and identifies the resource as 'all available Tenable Identity Exposure API resources and their paths', which precisely states what the tool does. It also distinguishes itself from the sibling tools by framing itself as the discovery entry point, saying 'Call this first to discover what resources exist before using other tools.'

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when to use the tool: 'Call this first to discover what resources exist before using other tools.' This clearly indicates the intended usage context. However, it does not mention any exclusions or alternative scenarios, so it stops short of a perfect score.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tie_deviancesA

Find AD objects with IoE deviances for a checker within a time window.

This is the time-filterable deviance query (server-side dateStart/dateEnd via the checker's ad-objects/search endpoint). Provide hours for a relative window (e.g. hours=12) or explicit date_start/date_end. With neither, defaults to the last 24h.

Args: checker_id: IoE checker id (see resource="checkers"). profile_id: Security profile id (default 1). Note: your console may use a non-default profile — call tie_profiles to list them. directory_ids: Restrict to these directory ids (default: all directories in scope). hours: Relative look-back window in hours (e.g. 12). Ignored if date_start given. date_start: Explicit ISO 8601 UTC start (e.g. "2026-07-07T16:00:00.000Z"). date_end: Explicit ISO 8601 UTC end (default: now). reasons: Optional reason ids to filter (see /api/profiles/{id}/checkers/{id}/reasons). show_ignored: Include deviances that are currently ignored (default False). page: Page number (1-based). per_page: Results per page. verbose: If False (default), truncate giant attribute values.

ParametersJSON Schema
NameRequiredDescriptionDefault
pageNo
hoursNo
reasonsNo
verboseNo
date_endNo
per_pageNo
checker_idYes
date_startNo
profile_idNo
show_ignoredNo
directory_idsNo

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It discloses server-side date filtering, defaults to the last 24h, truncation of attribute values when verbose=False, pagination behavior, and show_ignored semantics. It stops short of mentioning authentication, rate limits, or error handling, but for a read-only search tool it provides substantial behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a one-sentence summary, a clarifying note about time windows, and a bulleted Args list. It is longer due to 11 parameters, but each sentence and bullet is informative. A tighter wording (e.g., combining some defaults) could slightly improve it, but it is not bloated.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 11 parameters, no output schema, and no annotations, the description covers all parameters, defaults, and endpoint behavior. It mentions server-side execution and verbose truncation, which helps infer return shape, but it does not explicitly describe the response structure or error scenarios. Still, it is nearly complete for a list/query tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. The 'Args' section explains all 11 parameters with types, defaults, and formats (e.g., 'ISO 8601 UTC start', 'default: all directories in scope', 'ignored if date_start given'). This adds significant meaning beyond the schema's bare names and types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Find AD objects with IoE deviances for a checker within a time window,' which is a specific verb + resource + scope statement. It clearly positions this as the time-filterable deviance query, distinguishing it from sibling tools like tie_deviances_by_checker, tie_deviances_bulk, and tie_deviances_by_directory.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly frames this as 'the time-filterable deviance query' and explains when to use hours vs. explicit date_start/date_end, implying this is the go-to for time-windowed deviance lookups. It also cross-references tie_profiles for profile selection, offering practical context, though it does not explicitly list exclusions or name alternative tools for other scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tie_deviances_by_checkerA

List IoE deviances for a given checker within a profile (full detail, no date filter).

For a time-bounded view use tie_deviances(hours=...) or tie_recent_activity instead. The TIE API models this as a POST with a filter expression body; an empty expression returns all deviances for the checker.

Args: checker_id: IoE checker id (see tie_resource_action resource="checkers"). profile_id: Security profile id (default 1). page: Page number (1-based). per_page: Results per page. expression: Optional filter expression object. Defaults to {} (no filter). verbose: If False (default), render descriptions and drop giant attribute values to save tokens. Set True for the full raw payload.

ParametersJSON Schema
NameRequiredDescriptionDefault
pageNo
verboseNo
per_pageNo
checker_idYes
expressionNo
profile_idNo

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Since annotations are absent, the description carries the full responsibility for behavioral disclosure. It reveals that the TIE API models this as a POST with a filter body, explains the effect of the verbose flag on token usage, and states the no-date-filter constraint. These insights go beyond what a simple 'list' would imply and are crucial for an agent to anticipate output size and API semantics.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The opening sentence is concise and front-loaded, and the subsequent Args block is necessary given the schema lacks descriptions. While the text is a bit longer than minimal, every sentence earns its place—the POST body detail and verbose explanation are useful, not redundant. A slightly leaner formatting could tighten it, but it remains efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 6-parameter tool with no annotations and no output schema, the description covers all critical aspects: purpose, alternatives, parameter semantics, and even output verbosity control. It does not explicitly describe the return structure, but the phrase 'List IoE deviances' and the verbose flag sufficiently imply the output format. The description is complete enough for an agent to select and invoke this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description's Args block fully compensates by documenting all six parameters with meaningful details. It explains checker_id references the checkers resource, profile_id default, page and per_page pagination, expression as an optional filter object defaulting to {}, and verbose behavior. This adds far more value than the bare schema alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'List IoE deviances for a given checker within a profile (full detail, no date filter).' This clearly distinguishes the tool from siblings by explicitly noting the absence of a date filter, making it immediately obvious what the tool does and how it differs from tie_deviances or tie_recent_activity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly provides alternative tools for time-bounded queries: 'For a time-bounded view use tie_deviances(hours=...) or tie_recent_activity instead.' This gives clear when-to-use and when-not-to-use guidance, along with named alternatives. It also explains that an empty expression returns all deviances, further clarifying expected usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tie_deviances_by_directoryA

List IoE deviances for a specific directory (full detail, no date filter).

Args: infrastructure_id: Infrastructure (forest) id — see resource="infrastructures". directory_id: Directory id — see resource="directories". page: Page number (1-based). per_page: Results per page. verbose: If False (default), render descriptions and drop giant attribute values.

ParametersJSON Schema
NameRequiredDescriptionDefault
pageNo
verboseNo
per_pageNo
directory_idYes
infrastructure_idYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden. It discloses that there is no date filter, that it returns full detail, and that verbose=False drops giant attribute values and renders descriptions – concrete behavior beyond the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A one-line summary is followed by a tidy Arg list with each parameter on its own line. No redundant filler; all lines add semantic value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

It covers the tool's purpose and all parameters, but since there is no output schema, it doesn't describe the shape of the returned deviance items or error handling. The absence of explicit alternative-tool guidance leaves a small gap in the overall context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The Args block explains all five parameters, including page being 1-based, per_page as results per page, verbose behavior, and pointers to resource schemas. Since the schema itself has no descriptions, this fully compensates.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'List IoE deviances for a specific directory', providing a clear verb and scoped resource. 'Full detail, no date filter' adds behavioral scope and differentiates it from siblings like tie_deviances and tie_deviances_by_checker.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly states this is for a specific directory, which implies the primary use case. However, it doesn't explicitly name alternative tools or state when not to use it, so it misses exclusionary guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tie_profilesA

List security profiles (id + name).

IoE/IoA data is scoped to a profile. The console has a selected profile that the API does not expose, so pass the right profile_id explicitly to other tools.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the burden of behavioral disclosure. It goes beyond a simple list statement by explaining the data scoping relationship and the need for explicit profile_id, which is important context. Though it doesn't explicitly say 'read-only', the listing verb and context make the safe-read behavior clear.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the core purpose, followed by essential context. Every sentence earns its place without redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless list tool with no output schema, the description fully covers the return fields (id+name), the reason the tool exists, and how to use the result. It tells the user exactly why they need this tool and what to do with the output, making it complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

This tool has zero parameters, so the baseline is 4. The description adds value by explaining the significance of profile_id that consumers of this tool will use, even though it doesn't need to describe any parameters for this tool itself.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists security profiles with their id and name. It provides a specific verb and resource, and it stands apart from sibling tools by being the only one focused on profiles, which are foundational for other operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains that IoE/IoA data is scoped to a profile and that the console's selected profile is not exposed via API, so users must pass the correct profile_id explicitly to other tools. This gives clear guidance on when to use this tool and how to apply its results.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tie_recent_activityA

Unified recent-activity timeline of IoE alerts and IoA attacks in one call.

Answers questions like "show me IoE/IoA in the last 12 hours". IoE is sourced from the profile's alert feed (time-ordered) and each in-window alert is enriched with its deviance detail (checker + rendered description). IoA is sourced from the attacks endpoint per directory. Results are merged and sorted newest-first. All timestamps are UTC.

Args: hours: Look-back window in hours (default 12). profile_id: Security profile id (default 1). See tie_profiles. include_ioe: Include IoE deviance alerts (default True). include_ioa: Include IoA attacks (default True). directory_ids: Restrict to these directory ids (default: all in scope). max_items: Cap on enriched items per category (default 50); truncation is reported. verbose: If False (default), attribute values are slimmed.

ParametersJSON Schema
NameRequiredDescriptionDefault
hoursNo
verboseNo
max_itemsNo
profile_idNo
include_ioaNo
include_ioeNo
directory_idsNo

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses that results are merged and sorted newest-first, timestamps are UTC, alerts are enriched, and truncation is reported. It does not explicitly state read-only behavior, but given the retrieval nature, it is sufficiently transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured: purpose first, then detailed explanation, then parameter list. Every sentence adds value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Although there is no output schema, the description sufficiently covers the tool's complex behavior (merging two sources, enrichment, truncation). It could be slightly more complete by hinting at the output structure, but it is adequate for an AI agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description provides all parameter meaning. Each parameter is explained with default values, behavior details (e.g., max_items truncation, verbose slimming), and context (profile_id defaults to 1, directory_ids restrict scope). This fully compensates for the lack of schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it provides a unified recent-activity timeline of IoE alerts and IoA attacks. It answers specific user questions and distinguishes from sibling tools like tie_alerts and tie_attacks by being a merged view.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly explains when to use this tool (for recent activity, merging both IoE and IoA). It implies that for separate feeds, tie_alerts or tie_attacks would be more appropriate, but does not provide explicit exclusions or alternative conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tie_requestA

Make a direct HTTP call to any Tenable Identity Exposure API endpoint.

Args: method: HTTP method (GET, POST, PUT, PATCH, DELETE). path: API path, e.g. "/api/directories" or "/api/attacks/123". params: Optional query string parameters as a dict. body: Optional request body as a dict (used with POST/PUT/PATCH).

Returns: Parsed JSON response from the TIE API.

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyNo
pathYes
methodYes
paramsNo

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden for behavioral disclosure. It only describes the basic function and parameters, omitting critical details like authentication, error handling, rate limits, and side effects. This is insufficient for a generic API call tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise, using a structured Args/Returns format. Every sentence adds value without redundancy. No fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the 13 sibling tools for specific endpoints, the description lacks guidance on when to use this generic tool. It explains the return value (parsed JSON) but omits potential errors or pagination behavior. It is minimally adequate but not fully complete for the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds meaningful context to all four parameters (method, path, params, body) with clear explanations and examples, compensating for the 0% schema description coverage. However, it could provide more detail on path formatting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: making direct HTTP calls to any Tenable Identity Exposure API endpoint. It uses a specific verb and resource, and it is easily distinguishable from sibling tools which target specific endpoints.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for any endpoint but does not explicitly guide when to use this generic tool versus the dedicated sibling tools (e.g., tie_alerts, tie_attacks). No exclusions or alternatives are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tie_resource_actionB

Perform CRUD operations on a TIE resource.

Args: resource: Resource name from tie_catalog (e.g. "directories", "attacks", "users"). action: Operation — list, get, create, update, or delete. id: Resource ID for get/update/delete operations. body: Request body for create/update operations. params: Optional query parameters (e.g. pagination, filters).

Examples: List all directories: resource="directories", action="list" Get directory #5: resource="directories", action="get", id=5 List recent attacks: resource="attacks", action="list", params={"page": 1} Create a user: resource="users", action="create", body={...} Delete an alert: resource="alerts", action="delete", id=42

ParametersJSON Schema
NameRequiredDescriptionDefault
idNo
bodyNo
actionNolist
paramsNo
resourceYes

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description must cover behavioral traits. It does not mention that create/update/delete are destructive, required permissions, or error handling. The example for delete lacks warning, and the impact of invalid resource names is omitted.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, well-structured with Args and Examples sections, and front-loads the purpose. Every sentence is informative, with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and multiple resource/action combinations, the description covers parameter usage thoroughly but lacks details on return format, error handling, and pagination specifics. It is adequate but incomplete for a generic CRUD tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema coverage, the description adds significant value by explaining each parameter (resource, action, id, body, params) with examples. It clarifies usage beyond the schema's type definitions, though the format for params is not fully detailed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool performs CRUD operations on TIE resources, with examples listing specific resources. It distinguishes from sibling tools which are resource-specific, but does not explicitly highlight its generic nature.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus siblings like tie_alerts or tie_attacks. The description provides examples but does not indicate prerequisites, context, or alternatives for specific resource operations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tie_scoresA

Get per-directory security scores for a profile.

Returns a list of {directoryId, score} reflecting the AD security posture (higher is better; scores reflect outstanding IoE deviances).

Args: profile_id: Security profile id (default 1).

ParametersJSON Schema
NameRequiredDescriptionDefault
profile_idNo

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the burden of behavioral disclosure. It explains the return format as a list of {directoryId, score} and interprets the score direction ('higher is better; scores reflect outstanding IoE deviances'), which is valuable context. The verb 'Get' and 'Returns' imply a read-only operation, though it does not explicitly state side-effect freedom or error behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured: a purpose statement, a return-value explanation, and a parameter description. Every sentence earns its place with no unnecessary fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given one parameter, no output schema, and no annotations, the description covers the essential input and output semantics. It explains the returned list structure and score interpretation, making it nearly complete. It does not define 'IoE deviances' or cover pagination, but these may be domain-specific or irrelevant for this tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. It adds the meaning 'Security profile id' and notes the default value, which the schema alone does not provide. This is adequate for the single parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Get per-directory security scores for a profile', specifying the verb, resource, and scope. It distinguishes this from sibling tools by focusing on scores rather than raw deviances or topology.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies it is used for retrieving a summary of security posture per directory, but it does not explicitly mention when to choose this over alternatives like tie_deviances_by_directory, nor does it state exclusions. The context is clear but no direct comparisons are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tie_search_ad_objectsA

Search Active Directory objects (users, computers, groups, OUs) by name or attribute.

Args: query: Search string to match against AD object names/attributes. directory_id: Restrict search to a specific directory. object_type: Filter by object type: "user", "computer", "group", "ou". page: Page number (1-based). per_page: Results per page.

ParametersJSON Schema
NameRequiredDescriptionDefault
pageNo
queryYes
per_pageNo
object_typeNo
directory_idNo

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description does not disclose behavioral traits such as read-only nature, authentication requirements, rate limits, or side effects. For a search tool, stating it is read-only would be helpful but is missing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with a one-line purpose followed by a parameter list. It is well-structured and front-loaded, though it could be slightly more compact by omitting redundant wording in the parameter lines.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, and the description does not explain the return format, pagination behavior, or result fields. Given that the tool has pagination parameters (page, per_page), this omission reduces completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, but the tool description provides parameter descriptions in the 'Args' block (e.g., 'Search string to match against AD object names/attributes'). This adds meaning beyond the schema, though it could be more specific about what attributes are searched.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a clear verb-resource statement: 'Search Active Directory objects (users, computers, groups, OUs) by name or attribute.' It explicitly lists the object types, which distinguishes it from other tie_ tools that deal with events, alerts, etc.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states what the tool does but does not explicitly say when to use it versus alternatives. However, the sibling tools are all different (alerts, attacks, etc.), so the purpose implies usage context. Lacks explicit when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tie_search_eventsA

Search AD security events within a date range.

Args: directory_ids: One or more directory ids to search (see resource="directories"). date_start: ISO 8601 start of range, e.g. "2026-07-01T00:00:00.000Z". date_end: ISO 8601 end of range. profile_id: Security profile id (default 1). expression: Optional filter expression object. Defaults to {} (no filter). order: Optional ordering object, e.g. {"column": "date", "direction": "desc"}.

ParametersJSON Schema
NameRequiredDescriptionDefault
orderNo
date_endYes
date_startYes
expressionNo
profile_idNo
directory_idsYes

TDQS

A3.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. However, it only states the action without mentioning whether the operation is read-only, requires special permissions, or has any side effects, pagination behavior, or output format. The term 'search' implies read-only, but it is not explicitly disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with a concise one-sentence purpose, followed by a well-structured Args list. Every line adds necessary detail, and there is no redundant or filler content. The structure is easy to parse and appropriately sized for the 6-parameter tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 6 parameters, no output schema, and no annotations. While the parameter documentation is complete, the description lacks any indication of the return value, response structure, or potential limitations like pagination. Given the absence of an output schema, this leaves a notable gap for an agent to understand what the tool actually returns.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The Args section thoroughly documents all six parameters, including formats (e.g., ISO 8601 for dates), defaults (e.g., profile_id default 1), and examples (e.g., ordering object). This fully compensates for the 0% schema description coverage, providing meaning beyond the bare type and title information.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with a specific verb ('Search'), resource ('AD security events'), and scope ('within a date range'). This distinguishes it from siblings like 'tie_search_ad_objects', which searches AD objects instead of events.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for searching security events but provides no explicit guidance on alternatives or when not to use. A clear context is present, but no exclusions or alternative tools are mentioned, leaving the agent to infer from the tool name and sibling list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tie_topologyA

Get the Active Directory topology (domains, forests, and trust relationships).

Args: profile_id: Security profile id (default 1).

ParametersJSON Schema
NameRequiredDescriptionDefault
profile_idNo

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description carries the full burden. It discloses the output scope (domains, forests, trust relationships) and the read-only nature is implied by 'Get', but it does not mention authentication, permissions, or return format details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: one purpose sentence followed by a single parameter definition. Every word adds value, and the key information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema or annotations, the description does a good job of stating what the tool returns (domains, forests, trust relationships). It lacks details on response structure or edge cases, but it is sufficient for a simple read-only topology query.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema only provides a type and default for profile_id. The description adds essential meaning by clarifying it is a 'Security profile id', compensating for the 0% schema description coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Get') and a clear resource ('Active Directory topology') with an explicit enumeration of the content (domains, forests, and trust relationships). This clearly distinguishes it from sibling tools like tie_search_ad_objects or tie_catalog.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for retrieving AD topology but provides no explicit guidance on when to use this tool versus alternatives. There are no exclusions or prerequisites mentioned, so the context is clear but not fully prescriptive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tie_whoamiA

Get the current user's identity, roles, and permissions (from the API key).

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the burden of disclosing behavioral traits. It mentions that the data comes from the API key, which implies no separate login flow, and the verb 'Get' implies a safe read operation. However, it does not explicitly state that no state is modified or describe error handling for invalid keys, leaving some ambiguity.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, focused sentence that front-loads the action and resource. Every word earns its place, with no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple no-argument tool, the description is complete: it states the returned information (identity, roles, permissions) and the source (API key). No output schema exists, but the description sufficiently explains the return value's nature for the tool's low complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the schema already fully documents argument expectations. The description adds no parameter details but this is unnecessary; a baseline of 4 is appropriate since there are no parameters to compensate for.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function with a specific verb ('Get') and resource ('current user's identity, roles, and permissions'), distinguishing it from sibling tools which all focus on data listings, scoring, or actions rather than user context.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use this tool (to retrieve current user info) and notes the API key as the source, but does not explicitly mention alternatives or exclusions. Since no sibling tool serves this purpose, the guidance is adequate without being explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 15 tool updatesv0.1.0
    • First observedtie_alerts
    • First observedtie_attacks
    • First observedtie_catalog
    • First observedtie_deviances
    • First observedtie_deviances_by_checker
    • First observedtie_deviances_by_directory
    • First observedtie_profiles
    • First observedtie_recent_activity
    • First observedtie_request
    • First observedtie_resource_action
    • First observedtie_scores
    • First observedtie_search_ad_objects
    • First observedtie_search_events
    • First observedtie_topology
    • First observedtie_whoami

TDQS

A4/5.0

Scored across 15 tools

Disambiguation4/5

Most tools have clearly distinct purposes, but there is slight overlap among tie_deviances, tie_deviances_by_checker, and tie_deviances_by_directory. However, descriptions clarify that they differ by date filtering and scoping, so ambiguity is minimal.

Naming Consistency5/5

All tools use the consistent 'tie_' prefix and follow snake_case naming. Naming patterns are predictable: nouns for entity listings (tie_alerts, tie_attacks) and verb_noun for search actions (tie_search_ad_objects). No mixed conventions.

Tool Count5/5

15 tools is well-scoped for the Tenable Identity Exposure domain. Each tool covers a distinct aspect (alerts, attacks, deviances, profiles, search, topology) without unnecessary duplication or missing core functionality.

Completeness5/5

The tool set comprehensively covers the API surface: CRUD via tie_resource_action, specific queries for alerts, attacks, deviances, scores, topology, and search. The tie_recent_activity tool fills a gap by merging IoE and IoA timelines. No obvious missing operations.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • F
    license
    A
    quality
    D
    maintenance
    Exposes the Timely.mn v3 time-attendance API as MCP tools for Claude and other clients, allowing queries for company-wide attendance, employee profiles, and attendance reports.
    4
    -
  • A
    license
    Not graded
    quality
    A
    maintenance
    Enables AI agents to directly manage Beyond Identity resources such as identities, groups, applications, SSO configurations, and credentials via natural language tool calls.
    16
    Apache 2.0
  • F
    license
    Not graded
    quality
    B
    maintenance
    Exposes the TeamViewer Web API as MCP tools, enabling AI assistants to manage devices, users, groups, sessions, and more via natural language.
    -
  • A
    license
    A
    quality
    C
    maintenance
    Exposes Tenable security operations as MCP tools for AI-powered security workflows, enabling asset, vulnerability, scan, plugin, and tag management via natural language.
    17
    MIT