Skip to main content
Glama
luiacuaniello

PerspectiveGraph

by luiacuaniello
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Go
Hybrid

list_attack_paths

Read-onlyIdempotent

List ranked attack paths from internet exposure to sensitive assets, ordered by triage priority. Use it to direct remediation to the routes that need attention first.

Instructions

List the ranked routes from internet exposure to a sensitive asset, highest triage priority first. score is the modelled end-to-end exploit probability and priority (0-100, banded P1/P2/P3) is the triage order that also weighs corroboration and target sensitivity. IMPORTANT: these probabilities are expert estimates, not measurements calibrated against real outcomes - call get_score_trust before presenting any of them as a probability, and prefer the ranking over the absolute values. It returns one page: when nextOffset is not null more routes exist, and passing it as offset returns the next ones. Routes an analyst has suppressed are listed too, marked suppressed.

Input Schema

NameRequiredDescriptionDefault
appNoRestrict to one application, by a name from get_posture's `applications`: a repository slug or the value of a cloud resource's `app` tag, e.g. 'payments-api'. The match is exact, and a name the environment does not know returns nothing. Omit for the whole environment.
limitNoHow many routes to return, priority-first.
offsetNoHow many routes to skip from the top of the ranking: the `nextOffset` of the previous page. Leave it out for the first page.

Output Schema

NameRequiredDescriptionDefault
offsetYesHow many routes were skipped before this page.
nextOffsetYesPass as `offset` for the next page. Null when this page is the last.
attackPathsYesThe routes, highest priority first.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed3 schema fields changedv1.38.1
    • changedInput schema / properties / app / description
      Previous value: -"Optional application scope; omit for the whole environment."New value: +"Restrict to one application, by a name from get_posture's `applications`: a repository slug or the value of a cloud resource's `app` tag, e.g. 'payments-api'. The match is exact, and a name the environment does not know returns nothing. Omit for the whole environment."
    • addedInput schema / properties / offset
      Added value: +{
+  "default": 0,
+  "description": "How many routes to skip from the top of the ranking: the `nextOffset` of the previous page. Leave it out for the first page.",
+  "minimum": 0,
+  "type": "integer"
+}
    • changedOutput schema / (root)
      Previous value: -nullNew value: +{
+  "properties": {
+    "attackPaths": {
+      "description": "The routes, highest priority first.",
+      "items": {
+        "properties": {
+          "confidenceLabel": {
+            "description": "How far the score can be trusted given where its hop probabilities came from: high, medium or low.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "correlatedHops": {
+            "description": "True when two or more hops rest on the same kind of evidence, a concrete reason they may not be independent.",
+            "type": [
+              "boolean",
+              "null"
+            ]
+          },
+          "id": {
+            "description": "Stable id of the route. Pass it to explain_attack_path.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "nodes": {
+            "description": "The assets the route passes through, entry point first, target last.",
+            "items": {
+              "properties": {
+                "crownJewel": {
+                  "description": "True for a sensitive asset.",
+                  "type": [
+                    "boolean",
+                    "null"
+                  ]
+                },
+                "internetExposed": {
+                  "description": "True for an entry point reachable from the internet.",
+                  "type": [
+                    "boolean",
+                    "null"
+                  ]
+                },
+                "label": {
+                  "description": "Asset type, e.g. LoadBalancer, Container, IAM_Role, Bucket, CVE.",
+                  "type": [
+                    "string",
+                    "null"
+                  ]
+                },
+                "name": {
+                  "description": "Asset name.",
+                  "type": [
+                    "string",
+                    "null"
+                  ]
+                }
+              },
+              "type": [
+                "object",
+                "null"
+              ]
+            },
+            "type": [
+              "array",
+              "null"
+            ]
+          },
+          "priority": {
+            "description": "Triage priority, 0-100: the score blended with corroboration, target sensitivity and how many routes share the entry point. This is the order of the list.",
+            "type": [
+              "number",
+              "null"
+            ]
+          },
+          "priorityFactors": {
+            "description": "The reasons behind the priority, human-readable.",
+            "items": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "type": [
+              "array",
+              "null"
+            ]
+          },
+          "priorityLabel": {
+            "description": "Priority band: P1, P2 or P3. P1 is what to fix first.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "priorityReason": {
+            "description": "One sentence saying why the route is in its band, when a fact put it there (a runtime alert, a known-exploited weakness); null when the blended number did.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "runtimeConfirmed": {
+            "description": "True when a runtime alert sits on the route.",
+            "type": [
+              "boolean",
+              "null"
+            ]
+          },
+          "score": {
+            "description": "End-to-end probability that an attacker completes the route, 0-1. A modelled estimate, not a measured rate: see get_score_trust.",
+            "type": [
+              "number",
+              "null"
+            ]
+          },
+          "scoreUpperBound": {
+            "description": "The score if the hops fail or succeed together rather than independently: the weakest hop's probability. The truth lies between score and this.",
+            "type": [
+              "number",
+              "null"
+            ]
+          },
+          "suppressed": {
+            "description": "True when an analyst has triaged the route off the board (accepted risk, false positive). It still exists, but do not present it as open work.",
+            "type": [
+              "boolean",
+              "null"
+            ]
+          }
+        },
+        "type": [
+          "object",
+          "null"
+        ]
+      },
+      "type": [
+        "array",
+        "null"
+      ]
+    },
+    "nextOffset": {
+      "description": "Pass as `offset` for the next page. Null when this page is the last.",
+      "type": [
+        "integer",
+        "null"
+      ]
+    },
+    "offset": {
+      "description": "How many routes were skipped before this page.",
+      "type": "integer"
+    }
+  },
+  "required": [
+    "attackPaths",
+    "offset",
+    "nextOffset"
+  ],
+  "type": "object"
+}
  2. First observed

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish read-only, idempotent, non-destructive, closed-world behavior, and the description adds substantial context on top: the probabilities are expert estimates rather than calibrated measurements, suppressed routes are still returned but flagged, and results are paginated one page at a time. This is exactly the kind of trust caveat an agent needs before quoting numbers.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action and triage ordering, then layers the caveats. Every sentence is informative, though the explanation of score/priority overlaps with what the output schema will already convey, making it slightly denser than strictly necessary.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only ranked-list tool with an output schema, the description covers everything an agent needs: ranking semantics, the trust caveat with a named prerequisite tool, pagination mechanics, and the suppressed-route edge case. Nothing material is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so app, limit, and offset are already fully documented in the schema, making 3 the correct baseline. The description adds a useful link between the returned nextOffset and the offset parameter, but contributes no new per-parameter semantics beyond what the schema states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource with scope: 'List the ranked routes from internet exposure to a sensitive asset, highest triage priority first.' An agent immediately knows this is a ranked enumeration of attack paths. It does not, however, explicitly distinguish itself from close siblings like explain_attack_path or routes_to_target, both of which sound like they operate over the same routes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete operational guidance: call get_score_trust before presenting the probabilities, prefer the ranking over absolute values, and use nextOffset/offset to page. It also covers the suppression case. It stops short of saying when to choose this tool over routes_to_target or explain_attack_path, so alternative-selection guidance is incomplete.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools