Skip to main content
Glama

Search log decoders

wazuh_list_decoders
Read-onlyIdempotent

Search decoders to inspect how raw logs are parsed into fields. Use when alert fields are missing or incorrect to diagnose parsing issues.

Instructions

Search the decoders that parse raw logs into fields. Use this when an alert's fields look wrong or absent, to see how a log source is being parsed.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
limitNo
offsetNo
searchNoFree-text substring match.
statusNo
filenameNoDecoder file name.
decoder_namesNoSpecific decoder names, e.g. ['sshd'].

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnlyHint, idempotentHint, and destructiveHint, so the description does not need to repeat these. The description adds no extra behavioral detail (e.g., side effects, auth requirements), but it is fully consistent with the annotations. Given the lower bar when annotations are present, a score of 3 is appropriate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences with no redundant information. It states the main function and the primary use case, making it easy to parse and directly informative.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The output schema is present, so the description doesn't need to explain return values. The purpose and use case are clear, and the parameter descriptions (though partial) cover the key filters. The description provides sufficient context for an agent to decide when and how to invoke the tool, though it could mention pagination or filtering behavior, which is already implied by the parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50% (3 of 6 parameters have descriptions). The descriptions for search, filename, and decoder_names add meaningful context, but limit, offset, and status lack explicit descriptions. The covered parameters are the most domain-specific, but the overall coverage is only partial, so a mid-range score is justified.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'search' and clearly identifies the resource as 'decoders' that parse raw logs into fields. It also states the intended use case (when alert fields look wrong or absent), which makes the purpose unambiguous and distinguishes it from the listed sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use the tool ('when an alert's fields look wrong or absent') and explains the benefit (see how a log source is being parsed). It does not explicitly mention when not to use it, but the context of sibling tools provides adequate differentiation, so a strong score is warranted.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.