Skip to main content
Glama
Sign In
Panther MCP Server

Panther MCP Server

Official
by panther-labs
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

bulk_update_alerts

DestructiveIdempotent

Update multiple alerts simultaneously by modifying status, assignee, or adding comments to streamline security incident management workflows.

Instructions

Bulk update multiple alerts with status, assignee, and/or comment changes.

This tool allows you to efficiently update multiple alerts at once by setting their status, assignee, and adding a comment. At least one of status, assignee_id, or comment must be provided.

Returns: Dict containing: - success: Boolean indicating overall success - results: Dict with operation results: - status_updates: List of alert IDs successfully updated with new status - assignee_updates: List of alert IDs successfully updated with new assignee - comments_added: List of alert IDs that successfully received comments - failed_operations: List of failed operations with error details - summary: Dict with counts of successful and failed operations - message: Error message if unsuccessful

Permissions:{'all_of': ['Manage Alerts']}

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "alert_ids": "<alert_ids>"
    },
    "name": "bulk_update_alerts"
  }
}

Input Schema

NameRequiredDescriptionDefault
alert_idsYesList of alert IDs to update (maximum 25)
statusNoOptional new status for the alerts
assignee_idNoOptional ID of the user to assign the alerts to
commentNoOptional comment to add to all alerts

Output Schema

NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv1.0.0

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate idempotentHint=true and destructiveHint=true, which the description aligns with by describing updates. The description adds valuable context beyond annotations: it specifies the maximum alert count (25), details the return structure, and mentions required permissions ('Manage Alerts'), enhancing behavioral understanding without contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loaded with the core purpose, followed by usage details and return values. It is appropriately sized with no redundant sentences, though the return value section is detailed but necessary for clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (bulk updates with destructive potential), the description is complete: it covers purpose, usage constraints, permissions, return structure, and parameter requirements. With annotations and an output schema present, it provides all necessary context for effective tool invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 100% schema description coverage, the schema fully documents all parameters. The description adds minimal semantic value beyond the schema, such as noting that at least one update field is required, but does not provide additional syntax or format details. This meets the baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('bulk update multiple alerts') and resources ('alerts'), distinguishing it from siblings like 'update_alert_assignee' or 'update_alert_status' by emphasizing bulk operations. It explicitly lists the fields that can be updated (status, assignee, comment).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use this tool ('efficiently update multiple alerts at once') and specifies that at least one update field must be provided. However, it does not explicitly mention when to use alternatives like individual update tools or exclusions, though the bulk nature implies it's for batch operations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools