Skip to main content
Glama
Microsoft Active Directory MCP Server

Microsoft Active Directory MCP Server

by nks1097

ad_get_nested_group_membership

Retrieves all nested group memberships for a specified Active Directory identity to audit access and review permissions.

Instructions

[Groups & Members] [READ] Consultar associacao recursiva a grupos.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "identity": "<identity>"
    },
    "name": "ad_get_nested_group_membership"
  }
}

Input Schema

NameRequiredDescriptionDefault
identityYes
correlation_idNo

Output Schema

NameRequiredDescriptionDefault
resultYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.0.0

TDQS

C2.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden, and it discloses only that the operation is a read via the '[READ]' tag. It says nothing about recursion depth limits, whether the call can be expensive on large directories, required permissions, or what happens when the identity cannot be resolved — all significant for a recursive LDAP traversal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The single line is front-loaded with useful category and mode tags and contains no filler. Its brevity, however, comes at the cost of under-specification rather than efficient communication — the sentence is short but incomplete.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, but with zero annotations and 0% schema coverage the description should compensate with identity format, recursion semantics and usage context. It supplies none of these, leaving the definition inadequate for a tool whose whole purpose hinges on how recursion is applied.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must explain the parameters and it does not. The required 'identity' parameter is left entirely undefined (DN? sAMAccountName? GUID?) and 'correlation_id' is never mentioned, leaving an agent to guess the accepted format from tool-name convention alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The tag '[Groups & Members]' plus the verb 'Consultar' and object 'associação recursiva a grupos' identify a read of recursive group relationships, which is more than a restatement of the name. However, it is ambiguous about direction — whether it returns nested groups a principal belongs to, or nested members inside a group — which matters given siblings like ad_get_user_groups, ad_list_group_members and ad_get_group. It does not differentiate itself from those siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description offers no when-to-use guidance and names no alternatives, despite several adjacent tools (ad_get_user_groups, ad_list_group_members) that an agent could easily confuse with this one. Only the '[READ]' tag hints at context; nothing states prerequisites such as needing a resolved identity or a connected domain.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools