Skip to main content
Glama
Sign In
operant-mcp

operant-mcp

Official
by operantlabs
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Local

cloudtrail_find_anomalies

Detect security anomalies in CloudTrail logs by identifying non-AWS IP addresses, unusual API calls, role assumptions, and data exfiltration indicators through automated log analysis.

Instructions

Find anomalies in CloudTrail logs: non-AWS IPs, unusual API calls, role assumptions.

Returns: {"non_aws_ips": [str], "unusual_events": [str], "role_assumptions": [str], "data_exfil_indicators": [str]}.

Side effects: Read-only file analysis.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "log_dir": "<log_dir>"
    },
    "name": "cloudtrail_find_anomalies"
  }
}

Input Schema

NameRequiredDescriptionDefault
log_dirYesDirectory containing CloudTrail JSON log files

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.0.0

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It successfully adds valuable context: it specifies the return format with detailed keys, explicitly states 'Read-only file analysis' (indicating no destructive operations), and mentions it analyzes files in a directory. However, it doesn't cover error conditions, performance characteristics, or authentication requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is appropriately concise with three sentences that each serve distinct purposes: stating the tool's function, specifying the return format, and declaring side effects. It's front-loaded with the core purpose. Minor improvement could be made by integrating the return format more naturally into the first sentence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity (anomaly detection in logs), no annotations, no output schema, and 100% schema coverage, the description does a reasonably complete job. It explains what the tool does, what it returns, and its safety profile. However, it lacks information about error handling, performance expectations, and how it differs from the sibling 'cloudtrail_analyze' tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% (the single parameter 'log_dir' has a clear description in the schema). The tool description doesn't add any additional parameter information beyond what's already in the schema. According to guidelines, when schema coverage is high (>80%), the baseline score is 3 even with no param info in the description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Find anomalies in CloudTrail logs' with specific examples (non-AWS IPs, unusual API calls, role assumptions). It uses a specific verb ('Find') and resource ('CloudTrail logs'), but doesn't explicitly differentiate from sibling 'cloudtrail_analyze' which might have overlapping functionality.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided about when to use this tool versus alternatives. The description doesn't mention the sibling 'cloudtrail_analyze' tool or explain what distinguishes this anomaly-finding tool from general CloudTrail analysis. There's no context about prerequisites or when-not-to-use scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools