Skip to main content
Glama
nagameTW

mcp-server-malcolm

by nagameTW
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

List saved Arkime value lists

arkime_shortcuts
Read-only

List Arkime named value lists (IOC sets) and what each contains so you can reference an existing $name in an expression before writing it.

Instructions

List Arkime's named value lists (IOC sets) and what each one contains.

    A shortcut is a named list of IPs, strings or numbers that an expression
    can reference as `$name` instead of spelling every value out. Use this
    before writing an expression so you reference a list that exists and
    know what is in it. For saved queries rather than value lists use
    arkime_views, for scheduled queries that stamp their own tags use
    arkime_crons, and to add a list of your own use arkime_create_shortcut
    (needs the arkime-view write class).

    Arkime scopes shortcuts by owner and role the same way it scopes views:
    its API filters the list by the requesting user and that user's roles,
    so this shows what the configured account can see, not everything on the
    server, and a name an expression then rejects as unknown may simply
    belong to someone else. That is Arkime's documented API behaviour rather
    than something measured here: Malcolm v26.07.1 ships no shortcut, so an
    empty list is the expected answer on a fresh deployment.
    Field meanings are in the output schema; use_in_expression is the token
    to paste, already spelled correctly.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
limitNoMax shortcuts to return.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
resultYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed2 schema fields changedv1.2.0
    • addedOutput schema / $defs / ShortcutList / properties / total
      Added value: +{
+  "title": "Total",
+  "type": "integer"
+}
    • changedOutput schema / $defs / ShortcutList / required
      Previous value: -[
-  "count",
-  "shortcuts"
-]New value: +[
+  "count",
+  "total",
+  "shortcuts"
+]
  2. Addedv1.0.2

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare the generic read-only/open-world profile, but the description adds non-obvious behaviour: results are owner/role scoped by the requesting user, so the list is a visibility view rather than a server inventory, and an unknown name may belong to someone else. It also sets expectations that an empty list is normal on a fresh deployment, which prevents a false 'nothing configured' conclusion.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core instruction and the sibling routing are front-loaded in the first two sentences, and the rest is genuinely useful scoping caveat rather than filler. It runs long across multiple paragraphs, and the meta-note about 'documented API behaviour rather than something measured here' is slightly self-referential, keeping it just below a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists and the description correctly delegates field meanings to it while flagging use_in_expression as the meaningful token. Combined with the scope semantics, empty-deployment expectation, and alternative-tool routing, nothing material is missing for an agent to call this correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is a single optional 'limit' parameter fully documented in the schema (100% coverage), and the description adds no syntax or default detail beyond it. Baseline 3 applies when the schema already carries the parameter burden; it does note that use_in_expression is the paste-ready token, which is a small nudge toward the output rather than the input.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List Arkime's named value lists (IOC sets)') and immediately clarifies what each entry contains. It then distinguishes itself from the closest siblings (arkime_views, arkime_crons, arkime_create_shortcut), so an agent can route correctly without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says when to use it ('Use this before writing an expression so you reference a list that exists') and names three alternatives with the condition that selects each: views for saved queries, crons for scheduled queries, arkime_create_shortcut to add one (including the required write class). This is near-complete when/alternative guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools