Skip to main content
Glama
Sign In
nagameTW

mcp-server-malcolm

by nagameTW
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

Reverse-resolve an IP

arkime_reverse_dns
Read-only

Resolve an IP address to its PTR hostname using Arkime to name external hosts a session contacted, making 198.51.100.1 readable as a domain.

Instructions

Resolve one IP address to its PTR hostname, using Arkime's resolver.

    Use this to put a name on an external address a session talked to —
    `idf-rtr.example.com` says more than `198.51.100.1`. For internal
    assets, malcolm_netbox_lookup gives a far richer answer than a PTR
    record.

    This is a live outbound PTR query leaving the Malcolm deployment now,
    not a read of the capture: it answers `dns.google` for 8.8.8.8 whether
    or not that name appears anywhere in the capture. So it reports DNS today
    rather than the traffic, and resolving an address an adversary controls
    can signal your interest to them. For the names the capture itself
    observed, search event.dataset=dns with malcolm_search instead. Return
    fields, and what resolved:false means, are in the output schema.

Input Schema

NameRequiredDescriptionDefault
ipYesOne IPv4 or IPv6 address to reverse-resolve, e.g. "8.8.8.8". Not a hostname, not a CIDR range.

Output Schema

NameRequiredDescriptionDefault
resultYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv1.0.2

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations: it discloses that this is a live outbound PTR query leaving the deployment rather than a capture read, that it reports DNS today rather than traffic, and the opsec risk that resolving an adversary-controlled address can signal interest to them. The annotations only say readOnly/openWorld; the description tells the agent what openWorld actually means here.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action and then the routing/risk context, with each sentence doing work. It is on the long side, but there is little that is purely decorative.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema covers return fields and resolved:false, so the description needn't explain returns. Combined with the alternative routing and the live-query caveat, an agent has everything needed to call this correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the schema already documents the single ip parameter fully (IPv4/IPv6, not hostname, not CIDR). The description adds no parameter-level detail, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (resolve) and resource (one IP to PTR hostname) and names the mechanism (Arkime's resolver). It also distinguishes itself from siblings by contrasting with malcolm_netbox_lookup and malcolm_search.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit when-to-use: naming an external address a session talked to. Explicit alternative routing: malcolm_netbox_lookup for internal assets, malcolm_search with event.dataset=dns for capture-observed names. Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools