Skip to main content
Glama
Sign In
nagameTW

mcp-server-malcolm

by nagameTW
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

List saved Arkime value lists

arkime_shortcuts
Read-only

List Arkime's named shortcut lists and their contents before writing an expression, so you reference a list that exists as $name instead of spelling values out.

Instructions

List Arkime's named value lists (IOC sets) and what each one contains.

    A shortcut is a named list of IPs, strings or numbers that an expression
    can reference as `$name` instead of spelling every value out. Use this
    before writing an expression so you reference a list that exists and
    know what is in it. For saved queries rather than value lists use
    arkime_views, for scheduled queries that stamp their own tags use
    arkime_crons, and to add a list of your own use arkime_create_shortcut
    (needs the arkime-view write class).

    Arkime scopes shortcuts by owner and role the same way it scopes views:
    its API filters the list by the requesting user and that user's roles,
    so this shows what the configured account can see, not everything on the
    server, and a name an expression then rejects as unknown may simply
    belong to someone else. That is Arkime's documented API behaviour.
    Malcolm ships no shortcut, so an empty list is the expected answer on a
    fresh deployment.
    Field meanings are in the output schema; use_in_expression is the token
    to paste, already spelled correctly.

Input Schema

NameRequiredDescriptionDefault
limitNoMax shortcuts to return.

Output Schema

NameRequiredDescriptionDefault
resultYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed2 schema fields changedv1.2.0
    • addedOutput schema / $defs / ShortcutList / properties / total
      Added value: +{
+  "title": "Total",
+  "type": "integer"
+}
    • changedOutput schema / $defs / ShortcutList / required
      Previous value: -[
-  "count",
-  "shortcuts"
-]New value: +[
+  "count",
+  "total",
+  "shortcuts"
+]
  2. Addedv1.0.2

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only cover the safety profile (readOnly, non-destructive, open world); the description adds substantial behavior beyond it: the server filters shortcuts by requesting user and that user's roles, so the result is scoped to the configured account rather than the whole server, and a name rejected as unknown may belong to another user. It also sets the expectation that an empty list is normal on a fresh Malcolm deployment.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the purpose, then routing, then scoping caveats, then a pointer to the output schema. Every paragraph carries distinct information, though the owner/role explanation runs long and the 'That is Arkime's documented API behaviour' aside could be trimmed without losing meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, and the description correctly defers field meanings to it while flagging the one field an agent actually needs ('use_in_expression is the token to paste, already spelled correctly'). Combined with the routing rules and the empty-result expectation, nothing needed to call or interpret this tool is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is a single parameter (limit) and schema coverage is 100%, so the schema already carries the semantics ('Max shortcuts to return.' with a 1-500 range). The description adds nothing parameter-specific, which is the expected baseline when the schema does the work.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List Arkime's named value lists (IOC sets)') and immediately defines what a shortcut is in operational terms ($name reference token). It also names the sibling tools it is not (arkime_views, arkime_crons, arkime_create_shortcut), so an agent can distinguish it without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit routing: 'Use this before writing an expression so you reference a list that exists', then 'For saved queries rather than value lists use arkime_views, for scheduled queries... arkime_crons, and to add a list of your own use arkime_create_shortcut (needs the arkime-view write class)'. Both when-to-use and when-to-use-something-else are stated, with the prerequisite write class called out.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools