cribl-mcp
크리블 MCP 서버
Cribl API와 AI의 상호작용을 가능하게 하는 MCP(모델 컨텍스트 프로토콜) 서버입니다.
이 서버를 사용하면 AI 클라이언트가 표준화된 MCP 툴을 사용하여 Cribl 배포에서 데이터 작업을 검색하고 호출할 수 있습니다.
자세한 내용은 docs/ 디렉토리를 참조하세요. 문서 파일 목록은 다음과 같습니다.
README.md(이 파일): 가장 높은 수준의 소개, 빠른 시작 지침, 매우 기본적인 예제 및 docs 디렉토리에 대한 링크를 제공합니다.docs/configuration.md: 구성에 필요한 환경 변수에 중점을 두고 인증 모드를 설명합니다. 순전히 설정에 관한 내용입니다.docs/usage.md: npx 또는 로컬 개발 명령을 통해 서버를 실행하는 방법과 MCP 클라이언트를 구성하여 서버에 연결하는 방법을 중점적으로 설명합니다. 도구를 호출하는 개념적인 예시를 제공합니다.docs/overview.md: README 파일과 특정 구성/사용법 문서 사이에 위치합니다. 서버가 제공하는 인증 관련 기능을 자세히 설명하고, 가장 중요한 것은 사용 가능한 도구와 해당 도구의 매개변수/출력, 그리고 향후 도구에 대한 자세한 참조 가이드를 제공한다는 점입니다.
시작하기
로컬에 설치하여 실행하거나 npx 통해 즉시 실행할 수 있습니다. npx 사용하면 Git, 종속성 또는 기타 빌드 도구를 설치할 필요가 없습니다. 두 가지 경우 모두 Node.js 16 이상 버전이 설치되어 있어야 합니다.
필수 조건
이 서버를 실행하려면 다음 사항을 확인하세요.
Node.js가 설치되어 있습니다(버전 16 이상 권장)
인터넷 접속이 가능합니다(npm에서 MCP 서버 패키지를 가져오기 위해)
https://nodejs.org 에서 Node.js를 설치할 수 있습니다.
설정을 확인하려면:
지엑스피1
npx 로 빠르게 시작하기
CRIBL_BASE_URL=https://your.cribl.cloud.instance CRIBL_AUTH_TYPE=cloud CRIBL_CLIENT_ID=abc123 CRIBL_CLIENT_SECRET=secret npx @pebbletek/cribl-mcp참고: npx 실행하려면 서버가 성공적으로 연결될 수 있도록 필수 환경 변수(예: CRIBL_BASE_URL 및 인증 세부 정보)를 사용자 환경에서 설정하거나 명령줄에 직접 전달해야 합니다.
MCP 클라이언트에 맞는 JSON과 필수 변수를 포함한 고급 npx 사용 구성에 대해서는 docs/usage.md 참조하세요.
지역 개발
코드 베이스를 저장할 상위 폴더로 이동합니다(복제하면 해당 폴더가 생성됩니다). 저장소를 복제합니다.
git clone https://github.com/pebbletek/cribl-mcp.git cd cribl-mcp종속성 설치:
npm install.env.example파일을 복사하고 필요한 값을 채웁니다.cp .env.example .envmcp 서버를 실행, 빌드 및 시작하려면 usage.md > 로컬 개발을 참조하세요.
환경 변수와 인증에 대한 자세한 내용은 docs/configuration.md 참조하고, 서버 실행에 대한 자세한 내용은 docs/usage.md 참조하세요.
Related MCP server: splunk-mcp-server
사용 가능한 도구
이 서버는 다음을 포함하여 Cribl과 상호 작용할 수 있는 도구를 제공합니다.
작업자 그룹/차량 목록
파이프라인 구성 가져오기/설정
소스 구성 가져오기
작업자 그룹 다시 시작
시스템 메트릭 쿼리(필터링 포함)
자세한 목록과 사용 지침은 docs/usage.md 참조하세요.
예시 사용(프롬프트)
MCP 클라이언트(예: Claude Desktop )를 통해 연결하면 사용 가능한 도구를 활용하는 자연어 프롬프트를 사용하여 Cribl 인스턴스와 상호 작용할 수 있습니다. 다음은 몇 가지 예입니다.
프롬프트:
what sources are we ingesting?
(MCP 클라이언트가 도구에 액세스할 수 있도록 허용해야 합니다)응답은 다음과 같습니다.
수집된 소스에 대한 질문에 답변드리자면, Cribl Stream 환경에서 사용 가능한 데이터 소스를 확인해 보겠습니다.
<Cribl(로컬)의 cribl_getSources에서 결과 보기>또한 Cribl Stream 환경에 어떤 파이프라인이 구성되어 있는지 확인해 보겠습니다.
<Cribl(로컬)의 cribl_getPipelines에서 결과 보기>귀하의 Cribl Stream 환경에서 검색한 정보를 기반으로 귀하가 수집하는 소스는 다음과 같습니다.
활성 데이터 소스
Cribl Stream 인스턴스에는 여러 개의 구성된 데이터 소스가 있으며, 주요 데이터 소스는 다음과 같습니다.HTTP/HTTPS 소스:
HTTP 소스(포트 10080)
크리블 HTTP(포트 10200)
Splunk HEC(포트 8088)...<기타>
파이프라인 구성
사용자 환경에는 특정 데이터 유형을 처리하기 위해 구성된 여러 파이프라인도 있습니다.Cisco ASA 이벤트 - Cisco ASA 보안 로그 필터링 및 샘플링
Cisco eStreamer 데이터 - Cisco eStreamer 데이터를 처리합니다.
Palo Alto 교통 이벤트 - Palo Alto 교통 로그 필터 및 샘플
Windows 이벤트 로그 - Windows 보안 이벤트 로그를 처리합니다.
이러한 파이프라인은 Cisco ASA 방화벽, Cisco eStreamer(Firepower/FTD 장치에서 발생할 가능성이 높음), Palo Alto Networks 방화벽 및 Windows 보안 이벤트에서 네트워크 보안 로그를 수집하고 있음을 나타냅니다.
특정 소스나 파이프라인 구성에 대한 더 자세한 정보를 원하십니까?
프롬프트:
what functions are processing the palo alto traffic?응답:
"Palo Alto 트래픽을 처리하는 기능을 더 자세히 살펴보겠습니다.
<Cribl(로컬)에서 cribl_getPipelineConfig의 결과 보기>다음은 Cribl Stream 환경에서 Palo Alto 트래픽 데이터가 처리되는 방식에 대한 자세한 분석입니다.
팔로 알토 교통 파이프라인 기능
1. 초기 필터(Eval):필터: sourcetype!='pan:traffic'
설명: 소스 유형이 'pan'이 아닌 모든 이벤트를 단락(건너뜁니다)합니다.
이는 최종 기능으로 설정됩니다. 즉, 조건이 참이면 해당 이벤트에 대한 처리가 중지됩니다.
2. 필드 추출(정규식 추출):
정규식 패턴 매칭을 사용하여 원시 이벤트에서 여러 주요 필드를 추출합니다.
__log_subtype: 로그가 시작/종료 레코드인지 식별합니다.
__src_zone 및 __dest_zone: 소스 및 대상 보안 영역
__transport: 전송 프로토콜
__action: 수행된 작업(허용, 거부 등)
__bytes_in: 수신된 바이트
3. 이벤트 필터링(삭제):
필터: __log_subtype=='start'
설명: 로그 하위 유형이 '시작'인 모든 이벤트를 삭제합니다.
근거(주석에서): "log_subtype=start 이벤트는 종종 잘못된 앱 할당을 포함하므로 삭제하세요. Log_subtype=end에 더 많은 정보가 들어 있습니다."
등."
프롬프트:
please update the pipeline to include start events as well as end events.응답:
"Palo Alto 트래픽 파이프라인을 업데이트하여 "시작" 및 "종료" 이벤트를 모두 포함하도록 구성을 수정하겠습니다. 다음과 같이 변경해 보겠습니다.
<Cribl(로컬)에서 cribl_getPipelineConfig의 결과 보기>이제 삭제 기능을 비활성화하고 주석을 업데이트하여 "시작" 및 "종료" 이벤트를 모두 유지하도록 파이프라인 구성을 업데이트하겠습니다.
<Cribl(로컬)의 cribl_setPipelineConfig에서 결과 보기>이제 이러한 변경 사항을 적용하기 위해 작업자 그룹을 다시 시작해 보겠습니다. <Cribl(로컬)의 cribl_restartWorkerGroup에서 결과 보기>
Palo Alto 트래픽 파이프라인이 "시작" 및 "종료" 이벤트를 모두 포함하도록 성공적으로 업데이트되었습니다. 수정한 내용은 다음과 같습니다.
삭제 기능 비활성화:
__log_subtype=='start' 이벤트를 필터링하는 기능이 비활성화되었습니다.
이는 이제 "시작" 및 "종료" 세션 이벤트가 모두 처리됨을 의미합니다.
댓글을 업데이트했습니다:
"시작" 이벤트가 삭제된 이유를 설명하는 주석을 이제 완전한 트래픽 가시성을 위해 두 이벤트 유형이 모두 유지된다는 내용으로 변경했습니다.
작업자 그룹을 다시 시작했습니다.
Cribl Stream 작업자 그룹을 다시 시작하여 변경 사항을 적용했습니다.
업데이트된 파이프라인은 이제 Palo Alto 방화벽의 "시작" 및 "종료" 이벤트를 모두 처리하여 트래픽 세션의 시작부터 완료까지 완벽한 가시성을 제공합니다. 다음을 포함한 다른 모든 처리 기능은 그대로 유지됩니다.
주요 트래픽 속성에 대한 필드 추출
0바이트 트래픽 및 신뢰할 수 있는 영역 트래픽에 대한 샘플링
신뢰할 수 없는 날짜 필드 제거
이제 Palo Alto 트래픽 데이터에는 샘플링 규칙의 효율성 이점이 유지되는 동시에 네트워크 연결의 전체 수명 주기가 포함됩니다.
특허
MIT
Available Tools
10 toolscribl_commitPipelineA
Commits staged pipeline config changes to version control with a message. Returns detailed commit information including branch, commit ID, and summary of changed files.
| Name | Required | Description | Default |
|---|---|---|---|
| message | Yes | The commit message. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full burden. It mentions returning commit information but does not disclose side effects, permissions required, or whether the operation is reversible. For a write operation, more behavioral context would be beneficial.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description consists of two concise sentences. The first sentence communicates the primary action and context, the second details the return value. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, no output schema, no annotations), the description covers the essential aspects: what it does and what it returns. It could mention constraints like requiring a non-empty message (schema enforces minLength) but is largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage with a single parameter 'message' described as 'The commit message.' The description repeats 'with a message' but adds no additional meaning beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action 'Commits' and the resource 'staged pipeline config changes to version control'. It effectively distinguishes from sibling tools like cribl_deployPipeline or cribl_setPipelineConfig by specifying the commit operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for committing staged changes but does not explicitly state when to use this tool versus alternatives like cribl_deployPipeline. However, the purpose is clear enough for an agent to infer context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cribl_deployPipelineB
Deploys a specific committed configuration version to a worker group. Returns the list of ConfigGroup objects Cribl provides.
| Name | Required | Description | Default |
|---|---|---|---|
| groupName | No | Optional: The name of the Worker Group/Fleet. If omitted, defaults to attempting to use Cribl Stream and if only one group exists for Stream, it will use that sole group. | |
| version | Yes | The commit ID (version) to deploy. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavioral traits. It mentions return type but does not state whether deployment is destructive (overwrites existing), requires specific permissions, triggers restarts, or handles rollbacks. Lack of side-effect details limits agent understanding.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler. Front-loaded with action and return type. Efficient for a simple tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with only 2 parameters and no output schema, the description covers the core action and return. Could mention error conditions (e.g., invalid version or group), but overall sufficient for the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the description adds no extra meaning beyond what's in the schema. The description restates 'committed version' and 'worker group' but doesn't clarify format, constraints, or defaults beyond schema. Adequate but not enhanced.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states verb ('Deploys'), resource ('committed configuration version to a worker group'), and return value ('list of ConfigGroup objects'). Distinct from siblings like cribl_commitPipeline (commits) and cribl_getPipelineConfig (retrieves).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives like cribl_setPipelineConfig or cribl_restartWorkerGroup. Does not mention prerequisites (e.g., need a committed version) or conditions where deployment might fail.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cribl_getPipelineConfigB
Retrieves full configuration JSON for a specified pipeline in a worker group.
| Name | Required | Description | Default |
|---|---|---|---|
| groupName | No | Optional: The name of the Worker Group/Fleet. If omitted, defaults to attempting to use Cribl Stream and if only one group exists for Stream, it will use that sole group. | |
| pipelineId | Yes | The ID of the pipeline to retrieve configuration for. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must fully disclose behavioral traits. It states the operation is a retrieval, but omits details about potential errors (e.g., missing pipeline or group), performance implications, or authorization requirements. The limited transparency leaves the agent underinformed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-formed sentence that front-loads the core action. Every word is necessary; there is no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with two parameters and no annotations or output schema, the description is minimally adequate. It states the resource and action but lacks details on return format (beyond 'JSON'), error handling, or integration with sibling tools. It does not fully preempt common agent questions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the description adds minimal value beyond the parameter descriptions. It clarifies the return format ('full configuration JSON') but does not elaborate on parameter semantics beyond what the schema already provides. Baseline at 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Retrieves') and clearly identifies the resource ('full configuration JSON for a specified pipeline in a worker group'). It distinguishes itself from siblings like 'cribl_getPipelines' by focusing on the full configuration of a single pipeline.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives, such as 'cribl_getPipelines' for listing pipelines, or 'cribl_setPipelineConfig' for updates. No prerequisites or contextual cues are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cribl_getPipelinesB
Fetches pipeline definitions in a specified worker group.
| Name | Required | Description | Default |
|---|---|---|---|
| groupName | No | Optional: The name of the Worker Group/Fleet. If omitted, defaults to attempting to use Cribl Stream and if only one group exists for Stream, it will use that sole group. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description should disclose behavioral traits. It states it fetches data (implying read-only) but does not explicitly confirm safety, idempotence, or any side effects. No mention of permissions or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that front-loads the core purpose without any fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description should hint at return format or content, but it does not. It also does not clarify how this differs from similar sibling tools, leaving the agent with incomplete context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the schema already explains the parameter well. The tool description adds no additional semantics beyond what is in the schema, so baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (fetches), resource (pipeline definitions), and context (in a specified worker group), distinguishing it from sibling tools like cribl_getPipelineConfig which retrieves config, not definitions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide any guidance on when to use this tool versus alternatives like cribl_getPipelineConfig or cribl_getSources, nor does it mention prerequisites or context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cribl_getSourcesA
Fetches source configurations in a specified worker group.
| Name | Required | Description | Default |
|---|---|---|---|
| groupName | No | Optional: The name of the Worker Group/Fleet. If omitted, defaults to attempting to use Cribl Stream and if only one group exists for Stream, it will use that sole group. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must convey behavioral traits. 'Fetches' implies a read-only operation with no side effects, but this is not explicitly stated. The description does disclose the default behavior when groupName is omitted, adding some transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two sentences covering purpose and parameter behavior without any fluff. Every word is necessary.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has low complexity (one optional parameter, no nested objects, no output schema), but the description does not mention the return format or error cases. It provides enough context for basic usage but omits details about what 'source configurations' entails.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers the parameter at 100%, but the description adds value beyond the schema's description by explaining the default behavior when groupName is omitted, including the fallback logic for Cribl Stream groups.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Fetches'), the resource ('source configurations'), and the scope ('in a specified worker group'). It distinguishes itself from sibling tools like cribl_getPipelines or cribl_setPipelineConfig, which deal with pipelines.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explicitly state when to use this tool versus alternatives. However, the context of fetching source configurations is clear, and the optional parameter's default behavior is explained, which helps the agent decide if a worker group is needed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cribl_getSystemMetricsA
Retrieves system metrics from the Cribl deployment. IMPORTANT: To avoid excessively large responses, please use the optional parameters (filterExpr, metricNameFilter, earliest, latest, numBuckets, wp) to narrow down your query whenever possible. If no parameters are provided, the server will default to fetching only the most recent data bucket (numBuckets=1) to prevent performance issues.
| Name | Required | Description | Default |
|---|---|---|---|
| filterExpr | No | Optional: A JS expression to filter metrics (e.g., "model.pipeline === 'test'" or "host == 'myhost'"). | |
| metricNameFilter | No | Optional: Regex or array of metric names (e.g.,limit to "pipe.*" , "total.in_bytes", or "os.cpu.perc,os.mem.*"). | |
| earliest | No | Optional: Start time for the query (e.g., '-15m', '2023-10-26T10:00:00Z'). | |
| latest | No | Optional: End time for the query (e.g., 'now', '2023-10-26T10:15:00Z'). | |
| numBuckets | No | Optional: The number of time buckets for aggregation. | |
| wp | No | Optional: Worker process filter. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description carries the full burden. It discloses the default behavior (fetches only most recent bucket if no params) and warns about large responses, adding behavioral context beyond the input schema. It doesn't cover all traits (e.g., rate limits) but is sufficient for a simple read operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact with two short paragraphs. The first sentence states the purpose, followed by a highlighted IMPORTANT note and a default behavior explanation. Every sentence adds value with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, the description is adequate but incomplete. It covers the critical performance warning and default behavior, but doesn't describe the return format, data structure, or how to interpret metrics, leaving some gaps for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% parameter description coverage, providing detailed explanations for each parameter. The description only lists the parameter names without adding new meaning, so it meets the baseline of 3 without exceeding schema contributions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Retrieves system metrics from the Cribl deployment' with a specific verb and resource. It distinguishes itself from sibling tools, which are about pipeline configuration, worker groups, etc., by being the only metrics retrieval tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly advises using optional parameters to narrow queries and explains the default behavior (numBuckets=1) to prevent performance issues. This provides clear context for when to use the tool, though it doesn't compare with sibling tools explicitly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cribl_listWorkerGroupsA
Lists available worker groups in the Cribl deployment, optionally filtered by product type (stream, edge, search, or all).
| Name | Required | Description | Default |
|---|---|---|---|
| productType | No | Filter groups by product type (stream, edge, search, all). Defaults to stream. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description bears full responsibility for behavioral disclosure. It states the action but fails to mention any behavioral traits such as rate limits, authentication requirements, the format of the returned data, or behavior when no groups are available. The description is minimal and does not go beyond the basic action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the main action and includes the key optional feature. Every word is necessary, and there is no redundancy or extraneous information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one optional parameter, no output schema, no annotations), the description is largely complete. It conveys the core functionality and the filter option. However, it does not specify the output format or any edge cases, which would be beneficial for an agent but not critical for this straightforward listing tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage, documenting the single parameter with enum and description. The description adds the phrase 'optionally filtered by product type (stream, edge, search, or all)', which reinforces the schema's content and clarifies optionality. However, the added value is marginal, placing it at the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool lists available worker groups in the Cribl deployment, with an optional filter by product type. The verb 'list' and resource 'worker groups' are specific, and the filtering option is mentioned, distinguishing it from sibling tools that deal with pipelines, sources, or metrics.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when needing to view worker groups, but provides no explicit guidance on when to use this tool versus alternatives, nor any exclusions or prerequisites. With no sibling tools performing the same function, the context is clear, but explicit guidelines are missing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cribl_restartWorkerGroupB
Restarts all workers within the default or specified worker group.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description fails to disclose behavioral traits such as whether a restart disrupts ongoing operations, requires authentication, or is reversible. The description is minimal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence of 10 words, efficiently stating the tool's purpose with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no annotations or output schema, the description should provide more context. It fails to explain how to specify a worker group (conflicting with the schema), what the default group is, or what occurs after restarting. Incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With zero parameters in the input schema, the description does not need to add parameter details. The baseline for 0 parameters is 4, and the description does not contradict that (though it implies a parameter for worker group selection).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('restarts') and the resource ('all workers within the default or specified worker group'), distinguishing it from sibling tools that focus on pipelines, sources, or metrics.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions a 'specified worker group' but the input schema has no parameters to select one, creating ambiguity. No guidance is given on when to use this tool versus alternatives like cribl_listWorkerGroups or other restart mechanisms.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cribl_setPipelineConfigB
Applies a new configuration payload to a specified pipeline in a worker group.
| Name | Required | Description | Default |
|---|---|---|---|
| groupName | No | Optional: The name of the Worker Group/Fleet. If omitted, defaults to attempting to use Cribl Stream and if only one group exists for Stream, it will use that sole group. | |
| pipelineId | Yes | The ID of the pipeline to set configuration for. | |
| config | Yes | Pipeline configuration payload to validate. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full burden. It describes a write operation but lacks details on validation, error handling, immediacy of effect, or required permissions. The minimal description does not adequately compensate for missing annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the action and resource. Every word contributes to clarity with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has three parameters, nested objects, and no output schema, the description is too minimal. It omits return values, error scenarios, and prerequisites, leaving an agent underinformed for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All parameters have descriptions in the input schema (100% coverage), so the description does not need to repeat them. However, the description adds no additional meaning beyond the schema, such as constraints or usage nuances.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (applies) and the resource (new configuration payload to a specified pipeline in a worker group). This distinctly sets it apart from sibling tools like cribl_getPipelineConfig (retrieval) or cribl_deployPipeline (deployment).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for applying configuration but does not explicitly state when to use this tool instead of alternatives like cribl_commitPipeline or cribl_deployPipeline. No when-not-to-use guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cribl_versionControlA
Detects if version control (git) is enabled on the Cribl instance and whether a remote repository URL is configured.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden for behavioral disclosure. It states the tool 'detects' enabling of version control and remote URL configuration, indicating a read-only, non-destructive operation. It adds context beyond the tool name but does not detail error cases or return format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is clear, front-loaded, and contains no unnecessary words. Every word contributes to the tool's purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (no parameters, no output schema), the description fully captures what the tool does: detecting two specific aspects of version control. It is complete for its intended use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, so the description has no need to add parameter semantics. According to guidelines, baseline is 4 for zero parameters, and the description does not detract from this.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'detects' and clearly identifies the resource (version control status on Cribl instance). It distinguishes from sibling tools which focus on pipelines, sources, etc., none of which cover version control detection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for checking git status, but does not explicitly state when to use this tool versus alternatives or provide exclusions. Given the sibling list, there are no direct alternatives, so the context is clear but guidelines are not explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
10 tool updates
v0.1.12- Added
cribl_commitPipeline - Added
cribl_deployPipeline - Added
cribl_getPipelineConfig - Added
cribl_getPipelines - Added
cribl_getSources - Added
cribl_getSystemMetrics - Added
cribl_listWorkerGroups - Added
cribl_restartWorkerGroup - Added
cribl_setPipelineConfig - Added
cribl_versionControl
TDQS
Scored across 10 tools
Each tool targets a distinct action and resource: commit, deploy, get config, get list, sources, metrics, worker groups, restart, set config, version control. No overlapping purposes.
All tools follow a consistent 'cribl_verbNoun' pattern with camelCase (e.g., cribl_commitPipeline, cribl_getPipelines). Even 'cribl_versionControl' fits the pattern as a noun-based verb.
10 tools is well-scoped for a Cribl configuration and deployment server. It covers essential operations without being overwhelming or too sparse.
The tool set covers core pipeline lifecycle (get, set, commit, deploy), sources, worker groups, metrics, and version control. Missing are delete pipeline and potentially more granular worker group details, but the surface is solid for common use cases.
Maintenance
Related MCP Connectors
An MCP server that provides an API to LLMs to manage their JumpCloud resources.
MCP server that lets AI assistants use all OneSchema features exposed via the public API.
Model Context Protocol server for the Apideck Unified API. Connect any MCP-compatible agent framework to 100+ accounting systems, HRIS platforms, file storage providers, and more through one integration. More information https://www.apideck.com/mcp-server
MCP server unifying ERPs, CRMs, APIs and knowledge base for Claude, ChatGPT and Gemini.
Related MCP Servers
- AlicenseAqualityDmaintenanceA community MCP server for Cisco Secure Access that exposes the Secure Access REST API to AI clients as a curated catalog of tools for Admin, Deployments, Investigate, Policies, and Reports.421Apache 2.0
- FlicenseBqualityDmaintenanceA lightweight, extensible MCP server for Splunk Enterprise that enables secure, async, chat-based interaction with Splunk data via Claude Desktop or any MCP-compatible agent.71-
- AlicenseCqualityCmaintenanceMCP server for OpenHAB v5+ that exposes the entire REST API as tools for AI models, enabling complete control over items, things, rules, persistence, and semantic model.257MIT
- FlicenseAqualityDmaintenanceA Model Context Protocol (MCP) server that exposes the Rancher Manager v2.x API to LLM clients.113-