Skip to main content
Glama
legionultramax

Harris HawkEye MCP

art_coverage_report

Batch-validate detection coverage across MITRE techniques using Atomic Red Team tests. Identifies missing detection rules and returns a prioritized coverage matrix for threat actor validation or coverage audits.

Instructions

Batch validation of detection coverage across multiple MITRE techniques using Atomic Red Team tests. For each technique, checks if ART tests exist and if detection rules are present. Returns an overall coverage matrix, prioritized gaps, and per-technique status. Use for threat actor profile validation or coverage audits.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
technique_idsYesArray of MITRE technique IDs to validate (e.g., ["T1059.001", "T1547.001", "T1505.003"])

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. First observedv1.0.0

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and does a solid job: it discloses the operational behavior (checks for ART test existence and detection rule presence per technique) and the return artifacts (coverage matrix, prioritized gaps, per-technique status). It implies a read-only report operation, though it does not explicitly confirm read-only status or clarify whether prior coverage data ingestion is required.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded, with the core purpose in the first clause and the output list and use cases following. There is minor redundancy between 'Batch validation of detection coverage' and 'For each technique, checks if ART tests exist and if detection rules are present,' but each sentence still earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with no output schema and no annotations, the description is reasonably complete: it covers inputs, mechanism, return values, and use cases. The main gaps are the lack of guidance on choosing among the many overlapping coverage/ART siblings and no mention of dependencies or edge-case behavior for invalid technique IDs.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3 and the schema already documents technique_ids with format examples. The description's 'batch... across multiple MITRE techniques' reinforces the plural/array intent but adds no new syntax, format, or constraint information beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb (batch validates), a resource (detection coverage across MITRE techniques), and a method (Atomic Red Team tests), then spells out the exact checks performed and outputs produced. It clearly differentiates from siblings like art_validate_technique (singular) and generic analyze_coverage by emphasizing batch validation across multiple techniques.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use the tool ('threat actor profile validation or coverage audits'), giving clear context rather than leaving it implied. However, it does not name alternatives or exclusion conditions, which matters given the crowded sibling field of analyze_coverage, identify_gaps, coverage_gaps_detail, and art_validate_technique that an agent could confuse this with.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/legionultramax/Detection-Engineering-MCP'

If you have feedback or need assistance with the MCP directory API, please join our Discord server