Skip to main content
Glama

Servidor Cribl MCP

Un servidor de Protocolo de Contexto de Modelo (MCP) que permite interacciones de IA con la API de Cribl.

Este servidor permite a los clientes de IA descubrir e invocar operaciones de datos desde una implementación de Cribl, utilizando herramientas MCP estandarizadas.

Para obtener documentación detallada, consulte el directorio docs/ . A continuación, se detalla la documentación:

  • README.md (este archivo): proporciona la introducción de más alto nivel, instrucciones de inicio rápido, ejemplos muy básicos y enlaces al directorio de documentos.

  • docs/configuration.md : Se centra específicamente en las variables de entorno necesarias para la configuración y explica los modos de autenticación. Se centra exclusivamente en la configuración.

  • docs/usage.md : Se centra en cómo ejecutar el servidor (mediante npx o comandos de desarrollo locales) y cómo configurar un cliente MCP para conectarse a él. Proporciona ejemplos conceptuales sobre cómo invocar las herramientas.

  • docs/overview.md : Se encuentra entre el README y la documentación específica de configuración y uso. Detalla lo que ofrece el servidor en términos de autenticación y, sobre todo, proporciona una guía de referencia detallada sobre las herramientas disponibles, sus parámetros y resultados específicos, así como las herramientas futuras.

Empezando

Puedes instalar y ejecutar localmente o ejecutarlo instantáneamente mediante npx . npx te ahorra la instalación de Git, dependencias o herramientas de compilación. En ambos casos, es necesario tener instalada una versión de node posterior a la 16.

Prerrequisitos

Para ejecutar este servidor asegúrese de lo siguiente:

  • Node.js está instalado (se recomienda la versión 16 o posterior)

  • Hay acceso a Internet disponible (para obtener el paquete del servidor MCP desde npm)

Puedes instalar Node.js desde https://nodejs.org .

Para verificar su configuración:

node -v
npx -v

Inicio rápido con npx

CRIBL_BASE_URL=https://your.cribl.cloud.instance CRIBL_AUTH_TYPE=cloud CRIBL_CLIENT_ID=abc123 CRIBL_CLIENT_SECRET=secret npx @pebbletek/cribl-mcp

Nota: para ejecutar npx es necesario configurar variables de entorno esenciales (como CRIBL_BASE_URL y detalles de autenticación) en su entorno o pasarlas directamente en la línea de comando para que el servidor se conecte exitosamente.

Consulte docs/usage.md para obtener una configuración de uso avanzada npx , incluido JSON relevante para su cliente MCP y las variables requeridas.

Desarrollo local

  1. Busque la carpeta principal donde almacenará el código base (la clonación creará la carpeta contenedora). Clone el repositorio:

    git clone https://github.com/pebbletek/cribl-mcp.git
    cd cribl-mcp
  2. Instalar dependencias:

    npm install
  3. Copie el archivo .env.example y complete los valores requeridos:

    cp .env.example .env
  4. Consulte usage.md > Desarrollo local para ejecutar, compilar e iniciar el servidor mcp

Consulte docs/configuration.md para obtener detalles sobre las variables de entorno y la autenticación, y docs/usage.md para ejecutar el servidor.

Related MCP server: splunk-mcp-server

Herramientas disponibles

Este servidor proporciona herramientas para interactuar con Cribl, incluyendo:

  • Listado de grupos de trabajadores/flotas

  • Obtener/Configurar configuraciones de pipeline

  • Obtener configuraciones de origen

  • Reinicio de grupos de trabajadores

  • Consulta de métricas del sistema (con filtrado)

Para obtener una lista detallada e instrucciones de uso, consulte docs/usage.md .

Ejemplo de uso (Indicaciones)

Una vez conectado a través de un cliente MCP (como Claude Desktop ), puede interactuar con su instancia de Cribl mediante indicaciones en lenguaje natural que aprovechan las herramientas disponibles. A continuación, se muestran algunos ejemplos:

  • Pregunta: what sources are we ingesting?
    (necesitará permitir que el cliente MCP acceda a la herramienta)

    • La respuesta será algo como:
      "Para responder a su pregunta sobre las fuentes ingeridas, permítame verificar las fuentes de datos disponibles en su entorno Cribl Stream.
      <Ver resultado de cribl_getSources de Cribl (local)>

      Permítame también verificar qué canalizaciones están configuradas en su entorno Cribl Stream:
      <Ver resultado de cribl_getPipelines desde Cribl (local)>

      Según la información que he recuperado de su entorno Cribl Stream, estas son las fuentes que está ingiriendo:
      Fuentes de datos activas
      Su instancia de Cribl Stream tiene varias fuentes de datos configuradas, entre las que se destacan las siguientes:

      1. Fuentes HTTP/HTTPS:
        Fuente HTTP (puerto 10080)
        Cribl HTTP (puerto 10200)
        Splunk HEC (puerto 8088)...

      2. <etc.>

      Configuraciones de tuberías
      Su entorno también tiene varias canalizaciones configuradas para procesar tipos de datos específicos:

      1. Eventos de Cisco ASA: filtros y ejemplos de registros de seguridad de Cisco ASA

      2. Datos de Cisco eStreamer: procesa datos de Cisco eStreamer

      3. Eventos de tráfico de Palo Alto: filtros y ejemplos de registros de tráfico de Palo Alto

      4. Registros de eventos de Windows: procesa los registros de eventos de seguridad de Windows

      Estas canalizaciones sugieren que está ingiriendo registros de seguridad de red de firewalls Cisco ASA, Cisco eStreamer (probablemente de dispositivos Firepower/FTD), firewalls de Palo Alto Networks y eventos de seguridad de Windows.
      ¿Desea obtener información más detallada sobre alguna configuración de fuente o canalización específica?"

  • Pregunta: what functions are processing the palo alto traffic?

    • Respuesta:
      Permítanme examinar con más detalle las funciones que procesan el tráfico de Palo Alto:
      <Ver resultado de cribl_getPipelineConfig desde Cribl (local)>

      A continuación se muestra un desglose detallado de cómo se procesan los datos de tráfico de Palo Alto en su entorno de Cribl Stream:
      Funciones del canal de tráfico de Palo Alto
      1. Filtro inicial (Eval):

      • Filtro: sourcetype!='pan:traffic'

      • Descripción: Cortocircuita (omite) todos los eventos que NO sean del tipo de fuente 'pan'

      • Esto se establece como una función final, lo que significa que si la condición es verdadera, el procesamiento se detiene para ese evento.

      2. Extracción de campo (Extracción de expresiones regulares):

      • Extrae varios campos clave del evento sin procesar utilizando la coincidencia de patrones de expresiones regulares:

        • __log_subtype: Identifica si el registro es un registro de inicio/fin

        • __src_zone y __dest_zone: Zonas de seguridad de origen y destino

        • __transport: Protocolo de transporte

        • __acción: Acción realizada (permitir, denegar, etc.)

        • __bytes_in: Bytes recibidos

      3. Filtrado de eventos (eliminar):

      • Filtro: __log_subtype=='start'

      • Descripción: Elimina todos los eventos con el subtipo de registro 'inicio'

      • Justificación (del comentario): "Eliminar eventos de log_subtype=start ya que a menudo tienen una asignación de aplicación incorrecta. Log_subtype=end contiene mejor información".

      • etc."

  • Aviso: please update the pipeline to include start events as well as end events.

    • Respuesta:
      Actualizaré el flujo de tráfico de Palo Alto para incluir los eventos de inicio y fin modificando la configuración. Permítanme realizar este cambio:
      <Ver resultado de cribl_getPipelineConfig desde Cribl (local)>

      Ahora actualizaré la configuración de la canalización para mantener los eventos de "inicio" y "fin" deshabilitando la función de eliminación y actualizando los comentarios:
      <Ver resultado de cribl_setPipelineConfig desde Cribl (local)>

      Ahora reiniciemos el grupo de trabajadores para aplicar estos cambios: <Ver resultado de cribl_restartWorkerGroup desde Cribl (local)>

      El flujo de tráfico de Palo Alto se ha actualizado correctamente para incluir los eventos de inicio y fin. Esto es lo que modifiqué:

      1. Se deshabilitó la función Drop:

        • Se ha deshabilitado la función que filtraba los eventos __log_subtype=='start'

        • Esto significa que ahora se procesarán los eventos de "inicio" y "fin" de sesión.

      2. Comentario actualizado:

        • Se modificó el comentario de explicar por qué se descartaban los eventos de "inicio" a indicar que ahora se conservan ambos tipos de eventos para una visibilidad completa del tráfico.

      3. Se reinició el grupo de trabajadores:

        • Se aplicaron los cambios reiniciando el grupo de trabajadores de Cribl Stream

      El flujo de trabajo actualizado procesará ahora los eventos de inicio y fin desde sus firewalls de Palo Alto, lo que le ofrece visibilidad completa de las sesiones de tráfico desde su inicio hasta su finalización. Todas las demás funciones de procesamiento se mantienen, incluyendo:

      • Extracción de campos para atributos de tráfico clave

      • Muestreo de tráfico de cero bytes y tráfico de zona confiable

      • Eliminación de campos de fecha no confiables

      "Los datos de tráfico de Palo Alto ahora incluirán el ciclo de vida completo de las conexiones de red y, al mismo tiempo, mantendrán los beneficios de eficiencia de las reglas de muestreo".

Licencia

Instituto Tecnológico de Massachusetts (MIT)

Available Tools

10 tools
cribl_commitPipelineA

Commits staged pipeline config changes to version control with a message. Returns detailed commit information including branch, commit ID, and summary of changed files.

ParametersJSON Schema
NameRequiredDescriptionDefault
messageYesThe commit message.

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden. It mentions returning commit information but does not disclose side effects, permissions required, or whether the operation is reversible. For a write operation, more behavioral context would be beneficial.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description consists of two concise sentences. The first sentence communicates the primary action and context, the second details the return value. No unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, no output schema, no annotations), the description covers the essential aspects: what it does and what it returns. It could mention constraints like requiring a non-empty message (schema enforces minLength) but is largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage with a single parameter 'message' described as 'The commit message.' The description repeats 'with a message' but adds no additional meaning beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action 'Commits' and the resource 'staged pipeline config changes to version control'. It effectively distinguishes from sibling tools like cribl_deployPipeline or cribl_setPipelineConfig by specifying the commit operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for committing staged changes but does not explicitly state when to use this tool versus alternatives like cribl_deployPipeline. However, the purpose is clear enough for an agent to infer context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cribl_deployPipelineB

Deploys a specific committed configuration version to a worker group. Returns the list of ConfigGroup objects Cribl provides.

ParametersJSON Schema
NameRequiredDescriptionDefault
groupNameNoOptional: The name of the Worker Group/Fleet. If omitted, defaults to attempting to use Cribl Stream and if only one group exists for Stream, it will use that sole group.
versionYesThe commit ID (version) to deploy.

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behavioral traits. It mentions return type but does not state whether deployment is destructive (overwrites existing), requires specific permissions, triggers restarts, or handles rollbacks. Lack of side-effect details limits agent understanding.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no filler. Front-loaded with action and return type. Efficient for a simple tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with only 2 parameters and no output schema, the description covers the core action and return. Could mention error conditions (e.g., invalid version or group), but overall sufficient for the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the description adds no extra meaning beyond what's in the schema. The description restates 'committed version' and 'worker group' but doesn't clarify format, constraints, or defaults beyond schema. Adequate but not enhanced.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states verb ('Deploys'), resource ('committed configuration version to a worker group'), and return value ('list of ConfigGroup objects'). Distinct from siblings like cribl_commitPipeline (commits) and cribl_getPipelineConfig (retrieves).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives like cribl_setPipelineConfig or cribl_restartWorkerGroup. Does not mention prerequisites (e.g., need a committed version) or conditions where deployment might fail.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cribl_getPipelineConfigB

Retrieves full configuration JSON for a specified pipeline in a worker group.

ParametersJSON Schema
NameRequiredDescriptionDefault
groupNameNoOptional: The name of the Worker Group/Fleet. If omitted, defaults to attempting to use Cribl Stream and if only one group exists for Stream, it will use that sole group.
pipelineIdYesThe ID of the pipeline to retrieve configuration for.

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must fully disclose behavioral traits. It states the operation is a retrieval, but omits details about potential errors (e.g., missing pipeline or group), performance implications, or authorization requirements. The limited transparency leaves the agent underinformed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-formed sentence that front-loads the core action. Every word is necessary; there is no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with two parameters and no annotations or output schema, the description is minimally adequate. It states the resource and action but lacks details on return format (beyond 'JSON'), error handling, or integration with sibling tools. It does not fully preempt common agent questions.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the description adds minimal value beyond the parameter descriptions. It clarifies the return format ('full configuration JSON') but does not elaborate on parameter semantics beyond what the schema already provides. Baseline at 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Retrieves') and clearly identifies the resource ('full configuration JSON for a specified pipeline in a worker group'). It distinguishes itself from siblings like 'cribl_getPipelines' by focusing on the full configuration of a single pipeline.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives, such as 'cribl_getPipelines' for listing pipelines, or 'cribl_setPipelineConfig' for updates. No prerequisites or contextual cues are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cribl_getPipelinesB

Fetches pipeline definitions in a specified worker group.

ParametersJSON Schema
NameRequiredDescriptionDefault
groupNameNoOptional: The name of the Worker Group/Fleet. If omitted, defaults to attempting to use Cribl Stream and if only one group exists for Stream, it will use that sole group.

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description should disclose behavioral traits. It states it fetches data (implying read-only) but does not explicitly confirm safety, idempotence, or any side effects. No mention of permissions or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that front-loads the core purpose without any fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description should hint at return format or content, but it does not. It also does not clarify how this differs from similar sibling tools, leaving the agent with incomplete context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the schema already explains the parameter well. The tool description adds no additional semantics beyond what is in the schema, so baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (fetches), resource (pipeline definitions), and context (in a specified worker group), distinguishing it from sibling tools like cribl_getPipelineConfig which retrieves config, not definitions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide any guidance on when to use this tool versus alternatives like cribl_getPipelineConfig or cribl_getSources, nor does it mention prerequisites or context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cribl_getSourcesA

Fetches source configurations in a specified worker group.

ParametersJSON Schema
NameRequiredDescriptionDefault
groupNameNoOptional: The name of the Worker Group/Fleet. If omitted, defaults to attempting to use Cribl Stream and if only one group exists for Stream, it will use that sole group.

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must convey behavioral traits. 'Fetches' implies a read-only operation with no side effects, but this is not explicitly stated. The description does disclose the default behavior when groupName is omitted, adding some transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: two sentences covering purpose and parameter behavior without any fluff. Every word is necessary.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has low complexity (one optional parameter, no nested objects, no output schema), but the description does not mention the return format or error cases. It provides enough context for basic usage but omits details about what 'source configurations' entails.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers the parameter at 100%, but the description adds value beyond the schema's description by explaining the default behavior when groupName is omitted, including the fallback logic for Cribl Stream groups.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Fetches'), the resource ('source configurations'), and the scope ('in a specified worker group'). It distinguishes itself from sibling tools like cribl_getPipelines or cribl_setPipelineConfig, which deal with pipelines.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not explicitly state when to use this tool versus alternatives. However, the context of fetching source configurations is clear, and the optional parameter's default behavior is explained, which helps the agent decide if a worker group is needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cribl_getSystemMetricsA

Retrieves system metrics from the Cribl deployment. IMPORTANT: To avoid excessively large responses, please use the optional parameters (filterExpr, metricNameFilter, earliest, latest, numBuckets, wp) to narrow down your query whenever possible. If no parameters are provided, the server will default to fetching only the most recent data bucket (numBuckets=1) to prevent performance issues.

ParametersJSON Schema
NameRequiredDescriptionDefault
filterExprNoOptional: A JS expression to filter metrics (e.g., "model.pipeline === 'test'" or "host == 'myhost'").
metricNameFilterNoOptional: Regex or array of metric names (e.g.,limit to "pipe.*" , "total.in_bytes", or "os.cpu.perc,os.mem.*").
earliestNoOptional: Start time for the query (e.g., '-15m', '2023-10-26T10:00:00Z').
latestNoOptional: End time for the query (e.g., 'now', '2023-10-26T10:15:00Z').
numBucketsNoOptional: The number of time buckets for aggregation.
wpNoOptional: Worker process filter.

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description carries the full burden. It discloses the default behavior (fetches only most recent bucket if no params) and warns about large responses, adding behavioral context beyond the input schema. It doesn't cover all traits (e.g., rate limits) but is sufficient for a simple read operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact with two short paragraphs. The first sentence states the purpose, followed by a highlighted IMPORTANT note and a default behavior explanation. Every sentence adds value with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and no annotations, the description is adequate but incomplete. It covers the critical performance warning and default behavior, but doesn't describe the return format, data structure, or how to interpret metrics, leaving some gaps for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% parameter description coverage, providing detailed explanations for each parameter. The description only lists the parameter names without adding new meaning, so it meets the baseline of 3 without exceeding schema contributions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Retrieves system metrics from the Cribl deployment' with a specific verb and resource. It distinguishes itself from sibling tools, which are about pipeline configuration, worker groups, etc., by being the only metrics retrieval tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly advises using optional parameters to narrow queries and explains the default behavior (numBuckets=1) to prevent performance issues. This provides clear context for when to use the tool, though it doesn't compare with sibling tools explicitly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cribl_listWorkerGroupsA

Lists available worker groups in the Cribl deployment, optionally filtered by product type (stream, edge, search, or all).

ParametersJSON Schema
NameRequiredDescriptionDefault
productTypeNoFilter groups by product type (stream, edge, search, all). Defaults to stream.

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full responsibility for behavioral disclosure. It states the action but fails to mention any behavioral traits such as rate limits, authentication requirements, the format of the returned data, or behavior when no groups are available. The description is minimal and does not go beyond the basic action.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that front-loads the main action and includes the key optional feature. Every word is necessary, and there is no redundancy or extraneous information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one optional parameter, no output schema, no annotations), the description is largely complete. It conveys the core functionality and the filter option. However, it does not specify the output format or any edge cases, which would be beneficial for an agent but not critical for this straightforward listing tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage, documenting the single parameter with enum and description. The description adds the phrase 'optionally filtered by product type (stream, edge, search, or all)', which reinforces the schema's content and clarifies optionality. However, the added value is marginal, placing it at the baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool lists available worker groups in the Cribl deployment, with an optional filter by product type. The verb 'list' and resource 'worker groups' are specific, and the filtering option is mentioned, distinguishing it from sibling tools that deal with pipelines, sources, or metrics.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when needing to view worker groups, but provides no explicit guidance on when to use this tool versus alternatives, nor any exclusions or prerequisites. With no sibling tools performing the same function, the context is clear, but explicit guidelines are missing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cribl_restartWorkerGroupB

Restarts all workers within the default or specified worker group.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description fails to disclose behavioral traits such as whether a restart disrupts ongoing operations, requires authentication, or is reversible. The description is minimal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, clear sentence of 10 words, efficiently stating the tool's purpose with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no annotations or output schema, the description should provide more context. It fails to explain how to specify a worker group (conflicting with the schema), what the default group is, or what occurs after restarting. Incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With zero parameters in the input schema, the description does not need to add parameter details. The baseline for 0 parameters is 4, and the description does not contradict that (though it implies a parameter for worker group selection).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('restarts') and the resource ('all workers within the default or specified worker group'), distinguishing it from sibling tools that focus on pipelines, sources, or metrics.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions a 'specified worker group' but the input schema has no parameters to select one, creating ambiguity. No guidance is given on when to use this tool versus alternatives like cribl_listWorkerGroups or other restart mechanisms.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cribl_setPipelineConfigB

Applies a new configuration payload to a specified pipeline in a worker group.

ParametersJSON Schema
NameRequiredDescriptionDefault
groupNameNoOptional: The name of the Worker Group/Fleet. If omitted, defaults to attempting to use Cribl Stream and if only one group exists for Stream, it will use that sole group.
pipelineIdYesThe ID of the pipeline to set configuration for.
configYesPipeline configuration payload to validate.

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden. It describes a write operation but lacks details on validation, error handling, immediacy of effect, or required permissions. The minimal description does not adequately compensate for missing annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that front-loads the action and resource. Every word contributes to clarity with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has three parameters, nested objects, and no output schema, the description is too minimal. It omits return values, error scenarios, and prerequisites, leaving an agent underinformed for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All parameters have descriptions in the input schema (100% coverage), so the description does not need to repeat them. However, the description adds no additional meaning beyond the schema, such as constraints or usage nuances.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (applies) and the resource (new configuration payload to a specified pipeline in a worker group). This distinctly sets it apart from sibling tools like cribl_getPipelineConfig (retrieval) or cribl_deployPipeline (deployment).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for applying configuration but does not explicitly state when to use this tool instead of alternatives like cribl_commitPipeline or cribl_deployPipeline. No when-not-to-use guidance is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cribl_versionControlA

Detects if version control (git) is enabled on the Cribl instance and whether a remote repository URL is configured.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden for behavioral disclosure. It states the tool 'detects' enabling of version control and remote URL configuration, indicating a read-only, non-destructive operation. It adds context beyond the tool name but does not detail error cases or return format.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that is clear, front-loaded, and contains no unnecessary words. Every word contributes to the tool's purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity of the tool (no parameters, no output schema), the description fully captures what the tool does: detecting two specific aspects of version control. It is complete for its intended use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameters, so the description has no need to add parameter semantics. According to guidelines, baseline is 4 for zero parameters, and the description does not detract from this.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'detects' and clearly identifies the resource (version control status on Cribl instance). It distinguishes from sibling tools which focus on pipelines, sources, etc., none of which cover version control detection.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for checking git status, but does not explicitly state when to use this tool versus alternatives or provide exclusions. Given the sibling list, there are no direct alternatives, so the context is clear but guidelines are not explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 10 tool updatesv0.1.12
    • Addedcribl_commitPipeline
    • Addedcribl_deployPipeline
    • Addedcribl_getPipelineConfig
    • Addedcribl_getPipelines
    • Addedcribl_getSources
    • Addedcribl_getSystemMetrics
    • Addedcribl_listWorkerGroups
    • Addedcribl_restartWorkerGroup
    • Addedcribl_setPipelineConfig
    • Addedcribl_versionControl

TDQS

A3.9/5.0

Scored across 10 tools

Disambiguation5/5

Each tool targets a distinct action and resource: commit, deploy, get config, get list, sources, metrics, worker groups, restart, set config, version control. No overlapping purposes.

Naming Consistency5/5

All tools follow a consistent 'cribl_verbNoun' pattern with camelCase (e.g., cribl_commitPipeline, cribl_getPipelines). Even 'cribl_versionControl' fits the pattern as a noun-based verb.

Tool Count5/5

10 tools is well-scoped for a Cribl configuration and deployment server. It covers essential operations without being overwhelming or too sparse.

Completeness4/5

The tool set covers core pipeline lifecycle (get, set, commit, deploy), sources, worker groups, metrics, and version control. Missing are delete pipeline and potentially more granular worker group details, but the surface is solid for common use cases.

Maintenance

ActivityInactive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers