Skip to main content
Glama

Cribl MCP Server

Ein Model Context Protocol (MCP)-Server, der KI-Interaktionen mit der Cribl-API ermöglicht.

Dieser Server ermöglicht es KI-Clients, mithilfe standardisierter MCP-Tools Datenoperationen aus einer Cribl-Bereitstellung zu erkennen und aufzurufen.

Ausführliche Dokumentation finden Sie im Verzeichnis docs/ . Hier ist eine Übersicht der Dokumentationsdateien:

  • README.md (diese Datei): Bietet eine Einführung auf höchster Ebene, Schnellstartanweisungen, sehr einfache Beispiele und Links zum Dokumentenverzeichnis.

  • docs/configuration.md : Konzentriert sich speziell auf die für die Konfiguration benötigten Umgebungsvariablen und erklärt die Authentifizierungsmodi. Es geht ausschließlich um die Einrichtung.

  • docs/usage.md : Konzentriert sich auf die Ausführung des Servers (über npx oder lokale Entwicklungsbefehle) und die Konfiguration eines MCP-Clients für die Verbindung mit dem Server. Es enthält konzeptionelle Beispiele für den Aufruf der Tools.

  • docs/overview.md : Befindet sich zwischen der README-Datei und den spezifischen Konfigurations-/Nutzungsdokumenten. Es beschreibt detailliert, was der Server in Bezug auf die Authentifizierung bietet und bietet vor allem ein ausführliches Referenzhandbuch zu den verfügbaren Tools und ihren spezifischen Parametern/Ausgaben sowie zu zukünftigen Tools.

Erste Schritte

Sie können es entweder lokal installieren und ausführen oder direkt über npx ausführen. npx erspart Ihnen die Installation von Git, Abhängigkeiten oder Build-Tools. Für beide Szenarien benötigen Sie Node ab Version 16:

Voraussetzungen

Um diesen Server auszuführen, stellen Sie Folgendes sicher:

  • Node.js ist installiert (Version 16 oder höher empfohlen)

  • Internetzugang ist verfügbar (um das MCP-Serverpaket von npm abzurufen)

Sie können Node.js von https://nodejs.org installieren.

So überprüfen Sie Ihr Setup:

node -v
npx -v

Schnellstart mit npx

CRIBL_BASE_URL=https://your.cribl.cloud.instance CRIBL_AUTH_TYPE=cloud CRIBL_CLIENT_ID=abc123 CRIBL_CLIENT_SECRET=secret npx @pebbletek/cribl-mcp

Hinweis: Zum Ausführen npx müssen wichtige Umgebungsvariablen (wie CRIBL_BASE_URL und Authentifizierungsdetails) entweder in Ihrer Umgebung festgelegt oder direkt in der Befehlszeile übergeben werden, damit der Server erfolgreich eine Verbindung herstellen kann.

Informationen zur erweiterten npx Nutzungskonfiguration, einschließlich relevantem JSON für Ihren MCP-Client und erforderlichen Variablen, finden Sie unter docs/usage.md

Lokale Entwicklung

  1. Navigieren Sie zu einem übergeordneten Ordner, in dem Sie die Codebasis speichern möchten (durch Klonen wird der enthaltene Ordner erstellt). Klonen Sie das Repository:

    git clone https://github.com/pebbletek/cribl-mcp.git
    cd cribl-mcp
  2. Installieren Sie Abhängigkeiten:

    npm install
  3. Kopieren Sie die Datei .env.example und füllen Sie die erforderlichen Werte aus:

    cp .env.example .env
  4. Informationen zum Ausführen, Erstellen und Starten des MCP-Servers finden Sie unter usage.md > Lokale Entwicklung

Weitere Informationen zu Umgebungsvariablen und Authentifizierung finden Sie docs/configuration.md und Informationen zum Ausführen des Servers docs/usage.md .

Related MCP server: splunk-mcp-server

Verfügbare Tools

Dieser Server bietet Tools zur Interaktion mit Cribl, darunter:

  • Auflisten von Arbeitergruppen/Flotten

  • Abrufen/Festlegen von Pipeline-Konfigurationen

  • Quellkonfigurationen abrufen

  • Neustarten von Worker-Gruppen

  • Abfragen von Systemmetriken (mit Filterung)

Eine ausführliche Liste und Gebrauchsanweisungen finden Sie unter docs/usage.md .

Beispielverwendung (Eingabeaufforderungen)

Sobald Sie über einen MCP-Client (wie Claude Desktop ) verbunden sind, können Sie mit Ihrer Cribl-Instanz über natürliche Spracheingaben interagieren, die die verfügbaren Tools nutzen. Hier sind einige Beispiele:

  • Eingabeaufforderung: what sources are we ingesting?
    (Sie müssen dem MCP-Client Zugriff auf das Tool gewähren)

    • Die Antwort wird etwa so aussehen:
      „Um Ihre Frage zu aufgenommenen Quellen zu beantworten, lassen Sie mich die verfügbaren Datenquellen in Ihrer Cribl Stream-Umgebung überprüfen.
      <Ergebnis von cribl_getSources von Cribl anzeigen (lokal)>

      Lassen Sie mich auch überprüfen, welche Pipelines in Ihrer Cribl Stream-Umgebung konfiguriert sind:
      <Ergebnis von cribl_getPipelines von Cribl anzeigen (lokal)>

      Basierend auf den Informationen, die ich aus Ihrer Cribl Stream-Umgebung abgerufen habe, sind hier die Quellen, die Sie aufnehmen:
      Aktive Datenquellen
      Ihre Cribl Stream-Instanz verfügt über mehrere konfigurierte Datenquellen, von denen die folgenden besonders hervorzuheben sind:

      1. HTTP/HTTPS-Quellen:
        HTTP-Quelle (Port 10080)
        Cribl HTTP (Port 10200)
        Splunk HEC (Port 8088) …

      2. <usw.>

      Pipeline-Konfigurationen
      In Ihrer Umgebung sind außerdem mehrere Pipelines für die Verarbeitung bestimmter Datentypen konfiguriert:

      1. Cisco ASA-Ereignisse – Filtert und prüft Cisco ASA-Sicherheitsprotokolle

      2. Cisco eStreamer-Daten – Verarbeitet Cisco eStreamer-Daten

      3. Verkehrsereignisse in Palo Alto – Filtert und prüft Verkehrsprotokolle in Palo Alto

      4. Windows-Ereignisprotokolle – Verarbeitet Windows-Sicherheitsereignisprotokolle

      Diese Pipelines deuten darauf hin, dass Sie Netzwerksicherheitsprotokolle von Cisco ASA-Firewalls, Cisco eStreamer (wahrscheinlich von Firepower/FTD-Geräten), Palo Alto Networks-Firewalls und Windows-Sicherheitsereignissen aufnehmen.
      Möchten Sie ausführlichere Informationen zu einer bestimmten Quelle oder Pipeline-Konfiguration?"

  • Eingabeaufforderung: what functions are processing the palo alto traffic?

    • Antwort:
      „Lassen Sie mich die Funktionen, die den Verkehr in Palo Alto verarbeiten, genauer untersuchen:
      <Ergebnis von cribl_getPipelineConfig von Cribl anzeigen (lokal)>

      Hier ist eine detaillierte Aufschlüsselung, wie die Verkehrsdaten von Palo Alto in Ihrer Cribl Stream-Umgebung verarbeitet werden:
      Palo Alto Traffic Pipeline-Funktionen
      1. Erstfilter (Eval):

      • Filter: Quelltyp!='pan:traffic'

      • Beschreibung: Überspringt alle Ereignisse, die NICHT vom Quelltyp „pan“ sind.

      • Dies wird als letzte Funktion festgelegt, d. h., wenn die Bedingung erfüllt ist, wird die Verarbeitung für dieses Ereignis gestoppt.

      2. Feldextraktion (Regex-Extrakt):

      • Extrahiert mithilfe des Regex-Mustervergleichs mehrere Schlüsselfelder aus dem Rohereignis:

        • __log_subtype: Gibt an, ob das Protokoll ein Start-/Enddatensatz ist

        • __src_zone und __dest_zone: Quell- und Zielsicherheitszonen

        • __transport: Transportprotokoll

        • __action: Durchgeführte Aktion (Zulassen, Verweigern usw.)

        • __bytes_in: Empfangene Bytes

      3. Ereignisse filtern (Drop):

      • Filter: __log_subtype=='start'

      • Beschreibung: Löscht alle Ereignisse mit dem Protokolluntertyp „Start“.

      • Begründung (aus dem Kommentar): „Ereignisse vom Typ log_subtype=start löschen, da sie häufig eine falsche App-Zuweisung aufweisen. Log_subtype=end enthält bessere Informationen.“

      • usw."

  • Eingabeaufforderung: please update the pipeline to include start events as well as end events.

    • Antwort:
      Ich aktualisiere die Palo Alto-Datenverkehrspipeline, um sowohl Start- als auch Endereignisse einzubeziehen. Dazu ändere ich die Konfiguration. Ich nehme diese Änderung für Sie vor:
      <Ergebnis von cribl_getPipelineConfig von Cribl anzeigen (lokal)>

      Jetzt aktualisiere ich die Pipeline-Konfiguration, um sowohl „Start“- als auch „End“-Ereignisse beizubehalten, indem ich die Drop-Funktion deaktiviere und die Kommentare aktualisiere:
      <Ergebnis von cribl_setPipelineConfig von Cribl anzeigen (lokal)>

      Starten wir nun die Worker-Gruppe neu, um diese Änderungen anzuwenden: <Ergebnis von cribl_restartWorkerGroup von Cribl anzeigen (lokal)>

      Die Palo Alto-Verkehrspipeline wurde erfolgreich aktualisiert und umfasst nun sowohl „Start“- als auch „End“-Ereignisse. Folgendes habe ich geändert:

      1. Die Drop-Funktion wurde deaktiviert:

        • Die Funktion, die __log_subtype=='start'-Ereignisse herausfilterte, wurde deaktiviert

        • Dies bedeutet, dass nun sowohl die Sitzungsereignisse „Start“ als auch „Ende“ verarbeitet werden.

      2. Kommentar aktualisiert:

        • Der Kommentar wurde von der Erklärung, warum „Start“-Ereignisse gelöscht wurden, in den Hinweis geändert, dass beide Ereignistypen nun für eine vollständige Verkehrstransparenz beibehalten werden.

      3. Die Worker-Gruppe wurde neu gestartet:

        • Die Änderungen wurden durch einen Neustart der Cribl Stream-Arbeitsgruppe übernommen.

      Die aktualisierte Pipeline verarbeitet nun sowohl Start- als auch Endereignisse Ihrer Palo Alto-Firewalls und bietet Ihnen so vollständige Transparenz über den Sitzungsverkehr vom Beginn bis zum Ende. Alle anderen Verarbeitungsfunktionen bleiben erhalten, darunter:

      • Feldextraktion für wichtige Verkehrsattribute

      • Sampling für Null-Byte-Verkehr und vertrauenswürdigen Zonenverkehr

      • Entfernung unzuverlässiger Datumsfelder

      Ihre Verkehrsdaten von Palo Alto umfassen jetzt den gesamten Lebenszyklus von Netzwerkverbindungen, wobei die Effizienzvorteile der Sampling-Regeln weiterhin erhalten bleiben.

Lizenz

MIT

Available Tools

10 tools
cribl_commitPipelineA

Commits staged pipeline config changes to version control with a message. Returns detailed commit information including branch, commit ID, and summary of changed files.

ParametersJSON Schema
NameRequiredDescriptionDefault
messageYesThe commit message.

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden. It mentions returning commit information but does not disclose side effects, permissions required, or whether the operation is reversible. For a write operation, more behavioral context would be beneficial.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description consists of two concise sentences. The first sentence communicates the primary action and context, the second details the return value. No unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, no output schema, no annotations), the description covers the essential aspects: what it does and what it returns. It could mention constraints like requiring a non-empty message (schema enforces minLength) but is largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage with a single parameter 'message' described as 'The commit message.' The description repeats 'with a message' but adds no additional meaning beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action 'Commits' and the resource 'staged pipeline config changes to version control'. It effectively distinguishes from sibling tools like cribl_deployPipeline or cribl_setPipelineConfig by specifying the commit operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for committing staged changes but does not explicitly state when to use this tool versus alternatives like cribl_deployPipeline. However, the purpose is clear enough for an agent to infer context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cribl_deployPipelineB

Deploys a specific committed configuration version to a worker group. Returns the list of ConfigGroup objects Cribl provides.

ParametersJSON Schema
NameRequiredDescriptionDefault
groupNameNoOptional: The name of the Worker Group/Fleet. If omitted, defaults to attempting to use Cribl Stream and if only one group exists for Stream, it will use that sole group.
versionYesThe commit ID (version) to deploy.

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behavioral traits. It mentions return type but does not state whether deployment is destructive (overwrites existing), requires specific permissions, triggers restarts, or handles rollbacks. Lack of side-effect details limits agent understanding.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no filler. Front-loaded with action and return type. Efficient for a simple tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with only 2 parameters and no output schema, the description covers the core action and return. Could mention error conditions (e.g., invalid version or group), but overall sufficient for the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the description adds no extra meaning beyond what's in the schema. The description restates 'committed version' and 'worker group' but doesn't clarify format, constraints, or defaults beyond schema. Adequate but not enhanced.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states verb ('Deploys'), resource ('committed configuration version to a worker group'), and return value ('list of ConfigGroup objects'). Distinct from siblings like cribl_commitPipeline (commits) and cribl_getPipelineConfig (retrieves).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives like cribl_setPipelineConfig or cribl_restartWorkerGroup. Does not mention prerequisites (e.g., need a committed version) or conditions where deployment might fail.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cribl_getPipelineConfigB

Retrieves full configuration JSON for a specified pipeline in a worker group.

ParametersJSON Schema
NameRequiredDescriptionDefault
groupNameNoOptional: The name of the Worker Group/Fleet. If omitted, defaults to attempting to use Cribl Stream and if only one group exists for Stream, it will use that sole group.
pipelineIdYesThe ID of the pipeline to retrieve configuration for.

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must fully disclose behavioral traits. It states the operation is a retrieval, but omits details about potential errors (e.g., missing pipeline or group), performance implications, or authorization requirements. The limited transparency leaves the agent underinformed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-formed sentence that front-loads the core action. Every word is necessary; there is no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with two parameters and no annotations or output schema, the description is minimally adequate. It states the resource and action but lacks details on return format (beyond 'JSON'), error handling, or integration with sibling tools. It does not fully preempt common agent questions.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the description adds minimal value beyond the parameter descriptions. It clarifies the return format ('full configuration JSON') but does not elaborate on parameter semantics beyond what the schema already provides. Baseline at 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Retrieves') and clearly identifies the resource ('full configuration JSON for a specified pipeline in a worker group'). It distinguishes itself from siblings like 'cribl_getPipelines' by focusing on the full configuration of a single pipeline.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives, such as 'cribl_getPipelines' for listing pipelines, or 'cribl_setPipelineConfig' for updates. No prerequisites or contextual cues are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cribl_getPipelinesB

Fetches pipeline definitions in a specified worker group.

ParametersJSON Schema
NameRequiredDescriptionDefault
groupNameNoOptional: The name of the Worker Group/Fleet. If omitted, defaults to attempting to use Cribl Stream and if only one group exists for Stream, it will use that sole group.

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description should disclose behavioral traits. It states it fetches data (implying read-only) but does not explicitly confirm safety, idempotence, or any side effects. No mention of permissions or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that front-loads the core purpose without any fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description should hint at return format or content, but it does not. It also does not clarify how this differs from similar sibling tools, leaving the agent with incomplete context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the schema already explains the parameter well. The tool description adds no additional semantics beyond what is in the schema, so baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (fetches), resource (pipeline definitions), and context (in a specified worker group), distinguishing it from sibling tools like cribl_getPipelineConfig which retrieves config, not definitions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide any guidance on when to use this tool versus alternatives like cribl_getPipelineConfig or cribl_getSources, nor does it mention prerequisites or context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cribl_getSourcesA

Fetches source configurations in a specified worker group.

ParametersJSON Schema
NameRequiredDescriptionDefault
groupNameNoOptional: The name of the Worker Group/Fleet. If omitted, defaults to attempting to use Cribl Stream and if only one group exists for Stream, it will use that sole group.

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must convey behavioral traits. 'Fetches' implies a read-only operation with no side effects, but this is not explicitly stated. The description does disclose the default behavior when groupName is omitted, adding some transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: two sentences covering purpose and parameter behavior without any fluff. Every word is necessary.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has low complexity (one optional parameter, no nested objects, no output schema), but the description does not mention the return format or error cases. It provides enough context for basic usage but omits details about what 'source configurations' entails.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers the parameter at 100%, but the description adds value beyond the schema's description by explaining the default behavior when groupName is omitted, including the fallback logic for Cribl Stream groups.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Fetches'), the resource ('source configurations'), and the scope ('in a specified worker group'). It distinguishes itself from sibling tools like cribl_getPipelines or cribl_setPipelineConfig, which deal with pipelines.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not explicitly state when to use this tool versus alternatives. However, the context of fetching source configurations is clear, and the optional parameter's default behavior is explained, which helps the agent decide if a worker group is needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cribl_getSystemMetricsA

Retrieves system metrics from the Cribl deployment. IMPORTANT: To avoid excessively large responses, please use the optional parameters (filterExpr, metricNameFilter, earliest, latest, numBuckets, wp) to narrow down your query whenever possible. If no parameters are provided, the server will default to fetching only the most recent data bucket (numBuckets=1) to prevent performance issues.

ParametersJSON Schema
NameRequiredDescriptionDefault
filterExprNoOptional: A JS expression to filter metrics (e.g., "model.pipeline === 'test'" or "host == 'myhost'").
metricNameFilterNoOptional: Regex or array of metric names (e.g.,limit to "pipe.*" , "total.in_bytes", or "os.cpu.perc,os.mem.*").
earliestNoOptional: Start time for the query (e.g., '-15m', '2023-10-26T10:00:00Z').
latestNoOptional: End time for the query (e.g., 'now', '2023-10-26T10:15:00Z').
numBucketsNoOptional: The number of time buckets for aggregation.
wpNoOptional: Worker process filter.

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description carries the full burden. It discloses the default behavior (fetches only most recent bucket if no params) and warns about large responses, adding behavioral context beyond the input schema. It doesn't cover all traits (e.g., rate limits) but is sufficient for a simple read operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact with two short paragraphs. The first sentence states the purpose, followed by a highlighted IMPORTANT note and a default behavior explanation. Every sentence adds value with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and no annotations, the description is adequate but incomplete. It covers the critical performance warning and default behavior, but doesn't describe the return format, data structure, or how to interpret metrics, leaving some gaps for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% parameter description coverage, providing detailed explanations for each parameter. The description only lists the parameter names without adding new meaning, so it meets the baseline of 3 without exceeding schema contributions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Retrieves system metrics from the Cribl deployment' with a specific verb and resource. It distinguishes itself from sibling tools, which are about pipeline configuration, worker groups, etc., by being the only metrics retrieval tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly advises using optional parameters to narrow queries and explains the default behavior (numBuckets=1) to prevent performance issues. This provides clear context for when to use the tool, though it doesn't compare with sibling tools explicitly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cribl_listWorkerGroupsA

Lists available worker groups in the Cribl deployment, optionally filtered by product type (stream, edge, search, or all).

ParametersJSON Schema
NameRequiredDescriptionDefault
productTypeNoFilter groups by product type (stream, edge, search, all). Defaults to stream.

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full responsibility for behavioral disclosure. It states the action but fails to mention any behavioral traits such as rate limits, authentication requirements, the format of the returned data, or behavior when no groups are available. The description is minimal and does not go beyond the basic action.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that front-loads the main action and includes the key optional feature. Every word is necessary, and there is no redundancy or extraneous information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one optional parameter, no output schema, no annotations), the description is largely complete. It conveys the core functionality and the filter option. However, it does not specify the output format or any edge cases, which would be beneficial for an agent but not critical for this straightforward listing tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage, documenting the single parameter with enum and description. The description adds the phrase 'optionally filtered by product type (stream, edge, search, or all)', which reinforces the schema's content and clarifies optionality. However, the added value is marginal, placing it at the baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool lists available worker groups in the Cribl deployment, with an optional filter by product type. The verb 'list' and resource 'worker groups' are specific, and the filtering option is mentioned, distinguishing it from sibling tools that deal with pipelines, sources, or metrics.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when needing to view worker groups, but provides no explicit guidance on when to use this tool versus alternatives, nor any exclusions or prerequisites. With no sibling tools performing the same function, the context is clear, but explicit guidelines are missing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cribl_restartWorkerGroupB

Restarts all workers within the default or specified worker group.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description fails to disclose behavioral traits such as whether a restart disrupts ongoing operations, requires authentication, or is reversible. The description is minimal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, clear sentence of 10 words, efficiently stating the tool's purpose with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no annotations or output schema, the description should provide more context. It fails to explain how to specify a worker group (conflicting with the schema), what the default group is, or what occurs after restarting. Incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With zero parameters in the input schema, the description does not need to add parameter details. The baseline for 0 parameters is 4, and the description does not contradict that (though it implies a parameter for worker group selection).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('restarts') and the resource ('all workers within the default or specified worker group'), distinguishing it from sibling tools that focus on pipelines, sources, or metrics.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions a 'specified worker group' but the input schema has no parameters to select one, creating ambiguity. No guidance is given on when to use this tool versus alternatives like cribl_listWorkerGroups or other restart mechanisms.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cribl_setPipelineConfigB

Applies a new configuration payload to a specified pipeline in a worker group.

ParametersJSON Schema
NameRequiredDescriptionDefault
groupNameNoOptional: The name of the Worker Group/Fleet. If omitted, defaults to attempting to use Cribl Stream and if only one group exists for Stream, it will use that sole group.
pipelineIdYesThe ID of the pipeline to set configuration for.
configYesPipeline configuration payload to validate.

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden. It describes a write operation but lacks details on validation, error handling, immediacy of effect, or required permissions. The minimal description does not adequately compensate for missing annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that front-loads the action and resource. Every word contributes to clarity with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has three parameters, nested objects, and no output schema, the description is too minimal. It omits return values, error scenarios, and prerequisites, leaving an agent underinformed for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All parameters have descriptions in the input schema (100% coverage), so the description does not need to repeat them. However, the description adds no additional meaning beyond the schema, such as constraints or usage nuances.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (applies) and the resource (new configuration payload to a specified pipeline in a worker group). This distinctly sets it apart from sibling tools like cribl_getPipelineConfig (retrieval) or cribl_deployPipeline (deployment).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for applying configuration but does not explicitly state when to use this tool instead of alternatives like cribl_commitPipeline or cribl_deployPipeline. No when-not-to-use guidance is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cribl_versionControlA

Detects if version control (git) is enabled on the Cribl instance and whether a remote repository URL is configured.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden for behavioral disclosure. It states the tool 'detects' enabling of version control and remote URL configuration, indicating a read-only, non-destructive operation. It adds context beyond the tool name but does not detail error cases or return format.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that is clear, front-loaded, and contains no unnecessary words. Every word contributes to the tool's purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity of the tool (no parameters, no output schema), the description fully captures what the tool does: detecting two specific aspects of version control. It is complete for its intended use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameters, so the description has no need to add parameter semantics. According to guidelines, baseline is 4 for zero parameters, and the description does not detract from this.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'detects' and clearly identifies the resource (version control status on Cribl instance). It distinguishes from sibling tools which focus on pipelines, sources, etc., none of which cover version control detection.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for checking git status, but does not explicitly state when to use this tool versus alternatives or provide exclusions. Given the sibling list, there are no direct alternatives, so the context is clear but guidelines are not explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 10 tool updatesv0.1.12
    • Addedcribl_commitPipeline
    • Addedcribl_deployPipeline
    • Addedcribl_getPipelineConfig
    • Addedcribl_getPipelines
    • Addedcribl_getSources
    • Addedcribl_getSystemMetrics
    • Addedcribl_listWorkerGroups
    • Addedcribl_restartWorkerGroup
    • Addedcribl_setPipelineConfig
    • Addedcribl_versionControl

TDQS

A3.9/5.0

Scored across 10 tools

Disambiguation5/5

Each tool targets a distinct action and resource: commit, deploy, get config, get list, sources, metrics, worker groups, restart, set config, version control. No overlapping purposes.

Naming Consistency5/5

All tools follow a consistent 'cribl_verbNoun' pattern with camelCase (e.g., cribl_commitPipeline, cribl_getPipelines). Even 'cribl_versionControl' fits the pattern as a noun-based verb.

Tool Count5/5

10 tools is well-scoped for a Cribl configuration and deployment server. It covers essential operations without being overwhelming or too sparse.

Completeness4/5

The tool set covers core pipeline lifecycle (get, set, commit, deploy), sources, worker groups, metrics, and version control. Missing are delete pipeline and potentially more granular worker group details, but the surface is solid for common use cases.

Maintenance

ActivityInactive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers