Skip to main content
Glama

Сервер Cribl MCP

Сервер протокола контекста модели (MCP), который обеспечивает взаимодействие ИИ с API Cribl.

Этот сервер позволяет клиентам ИИ обнаруживать и вызывать операции с данными из развертывания Cribl, используя стандартизированный инструментарий MCP.

Подробную документацию см. в каталоге docs/ . Вот разбивка файлов документации:

  • README.md (этот файл): содержит введение самого высокого уровня, краткие инструкции по началу работы, очень простые примеры и ссылки на каталог документов.

  • docs/configuration.md : Особое внимание уделено переменным среды, необходимым для конфигурации, и объясняет режимы аутентификации. Это чисто о настройке.

  • docs/usage.md : Сосредоточен на том, как запустить сервер (через npx или локальные команды разработки) и как настроить клиент MCP для подключения к нему. Он предоставляет концептуальные примеры вызова инструментов.

  • docs/overview.md : Находится между README и конкретными документами конфигурации/использования. Он подробно описывает, что сервер предлагает в плане аутентификации и, что самое важное, предоставляет подробное справочное руководство по доступным инструментам и их конкретным параметрам/выходам, а также будущим инструментам.

Начиная

Вы можете либо установить и запустить локально, либо выполнить мгновенно через npx . npx избавит вас от необходимости устанавливать Git, зависимости или любые инструменты сборки. Оба сценария требуют, чтобы у вас был установлен node более поздней версии, чем 16:

Предпосылки

Для запуска этого сервера убедитесь в следующем:

  • Установлен Node.js (рекомендуется версия 16 или более поздняя)

  • Доступ в Интернет возможен (для загрузки пакета сервера MCP из npm)

Установить Node.js можно с https://nodejs.org .

Чтобы проверить настройки:

node -v
npx -v

Быстрый старт с npx

CRIBL_BASE_URL=https://your.cribl.cloud.instance CRIBL_AUTH_TYPE=cloud CRIBL_CLIENT_ID=abc123 CRIBL_CLIENT_SECRET=secret npx @pebbletek/cribl-mcp

Примечание: для запуска npx необходимо задать основные переменные среды (например, CRIBL_BASE_URL и данные аутентификации) в вашей среде или передать их непосредственно в командной строке для успешного подключения к серверу.

Дополнительные сведения о настройке расширенного использования npx , включая соответствующий JSON для вашего клиента MCP и необходимые переменные, см. на docs/usage.md

Местное развитие

  1. Перейдите в папку высокого уровня, где вы будете хранить базу кода (клонирование создаст содержащую папку). Клонируйте репозиторий:

    git clone https://github.com/pebbletek/cribl-mcp.git
    cd cribl-mcp
  2. Установить зависимости:

    npm install
  3. Скопируйте файл .env.example и заполните необходимые значения:

    cp .env.example .env
  4. См. usage.md > Локальная разработка для запуска, сборки и запуска сервера mcp.

Подробную информацию о переменных среды и аутентификации см. docs/configuration.md , а информацию о запуске сервера — docs/usage.md .

Related MCP server: splunk-mcp-server

Доступные инструменты

Этот сервер предоставляет инструменты для взаимодействия с Cribl, в том числе:

  • Список рабочих групп/флотов

  • Получение/настройка конфигураций конвейера

  • Получение исходных конфигураций

  • Перезапуск рабочих групп

  • Запрос системных показателей (с фильтрацией)

Подробный список и инструкции по использованию см. на docs/usage.md .

Пример использования (подсказки)

После подключения через клиент MCP (например, Claude Desktop ) вы можете взаимодействовать с экземпляром Cribl, используя подсказки на естественном языке, которые используют доступные инструменты. Вот несколько примеров:

  • Подскажите: what sources are we ingesting?
    (вам необходимо разрешить клиенту MCP доступ к инструменту)

    • Ответ будет примерно таким:
      «Чтобы ответить на ваш вопрос о принимаемых источниках, позвольте мне проверить доступные источники данных в вашей среде Cribl Stream.
      <Просмотреть результат cribl_getSources из Cribl (локальный)>

      Позвольте мне также проверить, какие конвейеры настроены в вашей среде Cribl Stream:
      <Просмотреть результат cribl_getPipelines из Cribl (локально)>

      На основе информации, которую я извлек из вашей среды Cribl Stream, вот источники, которые вы используете:
      Активные источники данных
      Ваш экземпляр Cribl Stream имеет несколько настроенных источников данных, среди которых следует отметить следующие:

      1. Источники HTTP/HTTPS:
        Источник HTTP (порт 10080)
        Cribl HTTP (порт 10200)
        Splunk HEC (порт 8088)...

      2. <и т.д.>

      Конфигурации трубопровода
      В вашей среде также имеется несколько конвейеров, настроенных для обработки определенных типов данных:

      1. События Cisco ASA — Фильтры и образцы журналов безопасности Cisco ASA

      2. Данные Cisco eStreamer — обрабатывает данные Cisco eStreamer.

      3. События дорожного движения в Пало-Альто - Фильтры и образцы Журналы дорожного движения в Пало-Альто

      4. Журналы событий Windows — обрабатывает журналы событий безопасности Windows.

      Эти конвейеры предполагают, что вы принимаете журналы сетевой безопасности с межсетевых экранов Cisco ASA, Cisco eStreamer (вероятно, с устройств Firepower/FTD), межсетевых экранов Palo Alto Networks и событий безопасности Windows.
      Хотите ли вы получить более подробную информацию о каком-либо конкретном источнике или конфигурации трубопровода?

  • Подскажите: what functions are processing the palo alto traffic?

    • Ответ:
      «Позвольте мне более подробно рассмотреть функции, обрабатывающие трафик Пало-Альто:
      <Просмотреть результат cribl_getPipelineConfig из Cribl (локально)>

      Ниже приведено подробное описание того, как данные о дорожном движении в Пало-Альто обрабатываются в вашей среде Cribl Stream:
      Функции транспортного трубопровода Пало-Альто
      1. Начальный фильтр (Eval):

      • Фильтр: sourcetype!='pan:traffic'

      • Описание: Замыкает (пропускает) все события, которые НЕ имеют тип источника 'pan'.

      • Это устанавливается как конечная функция, то есть если условие истинно, обработка этого события останавливается.

      2. Извлечение полей (извлечение регулярных выражений):

      • Извлекает несколько ключевых полей из необработанного события, используя сопоставление шаблонов регулярных выражений:

        • __log_subtype: определяет, является ли журнал начальной/конечной записью.

        • __src_zone и __dest_zone: Зоны безопасности источника и назначения

        • __transport: Транспортный протокол

        • __действие: Предпринятое действие (разрешить, запретить и т. д.)

        • __bytes_in: Получено байтов

      3. Фильтрация событий (отбрасывание):

      • Фильтр: __log_subtype=='start'

      • Описание: Удаляет все события с подтипом журнала «старт».

      • Обоснование (из комментария): «Отбросьте события log_subtype=start, поскольку они часто имеют неправильное назначение приложения. Log_subtype=end содержат более точную информацию».

      • и т. д."

  • Подсказка: please update the pipeline to include start events as well as end events.

    • Ответ:
      «Я обновлю транспортный конвейер Пало-Альто, включив в него события «старт» и «конец», изменив конфигурацию. Позвольте мне внести для вас это изменение:
      <Просмотреть результат cribl_getPipelineConfig из Cribl (локально)>

      Теперь я обновлю конфигурацию конвейера, чтобы сохранить события «start» и «end», отключив функцию сброса и обновив комментарии:
      <Просмотр результата cribl_setPipelineConfig из Cribl (локально)>

      Теперь перезапустим рабочую группу, чтобы применить эти изменения: <Просмотреть результат cribl_restartWorkerGroup из Cribl (local)>

      Транспортный конвейер Palo Alto был успешно обновлен, чтобы включить как "стартовые", так и "конечные" события. Вот что я изменил:

      1. Отключена функция сброса:

        • Функция, которая отфильтровывала события __log_subtype=='start', была отключена.

        • Это означает, что теперь будут обрабатываться как события «начала», так и «конца» сеанса.

      2. Обновил комментарий:

        • Изменен комментарий с объяснения того, почему события «старт» были удалены, на указание того, что оба типа событий теперь сохраняются для полной видимости трафика.

      3. Перезапустил рабочую группу:

        • Применил изменения, перезапустив рабочую группу Cribl Stream.

      Обновленный конвейер теперь будет обрабатывать как события "старт", так и события "конец" с ваших межсетевых экранов Palo Alto, предоставляя вам полную видимость сеансов трафика от начала до завершения. Все остальные функции обработки остаются на месте, включая:

      • Извлечение полей для ключевых атрибутов трафика

      • Выборка для трафика с нулевым байтом и трафика доверенной зоны

      • Удаление ненадежных полей дат

      Ваши данные о трафике в Пало-Альто теперь будут включать полный жизненный цикл сетевых подключений, сохраняя при этом преимущества эффективности правил выборки».

Лицензия

Массачусетский технологический институт

Available Tools

10 tools
cribl_commitPipelineA

Commits staged pipeline config changes to version control with a message. Returns detailed commit information including branch, commit ID, and summary of changed files.

ParametersJSON Schema
NameRequiredDescriptionDefault
messageYesThe commit message.

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden. It mentions returning commit information but does not disclose side effects, permissions required, or whether the operation is reversible. For a write operation, more behavioral context would be beneficial.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description consists of two concise sentences. The first sentence communicates the primary action and context, the second details the return value. No unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, no output schema, no annotations), the description covers the essential aspects: what it does and what it returns. It could mention constraints like requiring a non-empty message (schema enforces minLength) but is largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage with a single parameter 'message' described as 'The commit message.' The description repeats 'with a message' but adds no additional meaning beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action 'Commits' and the resource 'staged pipeline config changes to version control'. It effectively distinguishes from sibling tools like cribl_deployPipeline or cribl_setPipelineConfig by specifying the commit operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for committing staged changes but does not explicitly state when to use this tool versus alternatives like cribl_deployPipeline. However, the purpose is clear enough for an agent to infer context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cribl_deployPipelineB

Deploys a specific committed configuration version to a worker group. Returns the list of ConfigGroup objects Cribl provides.

ParametersJSON Schema
NameRequiredDescriptionDefault
groupNameNoOptional: The name of the Worker Group/Fleet. If omitted, defaults to attempting to use Cribl Stream and if only one group exists for Stream, it will use that sole group.
versionYesThe commit ID (version) to deploy.

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behavioral traits. It mentions return type but does not state whether deployment is destructive (overwrites existing), requires specific permissions, triggers restarts, or handles rollbacks. Lack of side-effect details limits agent understanding.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no filler. Front-loaded with action and return type. Efficient for a simple tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with only 2 parameters and no output schema, the description covers the core action and return. Could mention error conditions (e.g., invalid version or group), but overall sufficient for the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the description adds no extra meaning beyond what's in the schema. The description restates 'committed version' and 'worker group' but doesn't clarify format, constraints, or defaults beyond schema. Adequate but not enhanced.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states verb ('Deploys'), resource ('committed configuration version to a worker group'), and return value ('list of ConfigGroup objects'). Distinct from siblings like cribl_commitPipeline (commits) and cribl_getPipelineConfig (retrieves).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives like cribl_setPipelineConfig or cribl_restartWorkerGroup. Does not mention prerequisites (e.g., need a committed version) or conditions where deployment might fail.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cribl_getPipelineConfigB

Retrieves full configuration JSON for a specified pipeline in a worker group.

ParametersJSON Schema
NameRequiredDescriptionDefault
groupNameNoOptional: The name of the Worker Group/Fleet. If omitted, defaults to attempting to use Cribl Stream and if only one group exists for Stream, it will use that sole group.
pipelineIdYesThe ID of the pipeline to retrieve configuration for.

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must fully disclose behavioral traits. It states the operation is a retrieval, but omits details about potential errors (e.g., missing pipeline or group), performance implications, or authorization requirements. The limited transparency leaves the agent underinformed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-formed sentence that front-loads the core action. Every word is necessary; there is no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with two parameters and no annotations or output schema, the description is minimally adequate. It states the resource and action but lacks details on return format (beyond 'JSON'), error handling, or integration with sibling tools. It does not fully preempt common agent questions.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the description adds minimal value beyond the parameter descriptions. It clarifies the return format ('full configuration JSON') but does not elaborate on parameter semantics beyond what the schema already provides. Baseline at 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Retrieves') and clearly identifies the resource ('full configuration JSON for a specified pipeline in a worker group'). It distinguishes itself from siblings like 'cribl_getPipelines' by focusing on the full configuration of a single pipeline.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives, such as 'cribl_getPipelines' for listing pipelines, or 'cribl_setPipelineConfig' for updates. No prerequisites or contextual cues are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cribl_getPipelinesB

Fetches pipeline definitions in a specified worker group.

ParametersJSON Schema
NameRequiredDescriptionDefault
groupNameNoOptional: The name of the Worker Group/Fleet. If omitted, defaults to attempting to use Cribl Stream and if only one group exists for Stream, it will use that sole group.

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description should disclose behavioral traits. It states it fetches data (implying read-only) but does not explicitly confirm safety, idempotence, or any side effects. No mention of permissions or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that front-loads the core purpose without any fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description should hint at return format or content, but it does not. It also does not clarify how this differs from similar sibling tools, leaving the agent with incomplete context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the schema already explains the parameter well. The tool description adds no additional semantics beyond what is in the schema, so baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (fetches), resource (pipeline definitions), and context (in a specified worker group), distinguishing it from sibling tools like cribl_getPipelineConfig which retrieves config, not definitions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide any guidance on when to use this tool versus alternatives like cribl_getPipelineConfig or cribl_getSources, nor does it mention prerequisites or context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cribl_getSourcesA

Fetches source configurations in a specified worker group.

ParametersJSON Schema
NameRequiredDescriptionDefault
groupNameNoOptional: The name of the Worker Group/Fleet. If omitted, defaults to attempting to use Cribl Stream and if only one group exists for Stream, it will use that sole group.

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must convey behavioral traits. 'Fetches' implies a read-only operation with no side effects, but this is not explicitly stated. The description does disclose the default behavior when groupName is omitted, adding some transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: two sentences covering purpose and parameter behavior without any fluff. Every word is necessary.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has low complexity (one optional parameter, no nested objects, no output schema), but the description does not mention the return format or error cases. It provides enough context for basic usage but omits details about what 'source configurations' entails.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers the parameter at 100%, but the description adds value beyond the schema's description by explaining the default behavior when groupName is omitted, including the fallback logic for Cribl Stream groups.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Fetches'), the resource ('source configurations'), and the scope ('in a specified worker group'). It distinguishes itself from sibling tools like cribl_getPipelines or cribl_setPipelineConfig, which deal with pipelines.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not explicitly state when to use this tool versus alternatives. However, the context of fetching source configurations is clear, and the optional parameter's default behavior is explained, which helps the agent decide if a worker group is needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cribl_getSystemMetricsA

Retrieves system metrics from the Cribl deployment. IMPORTANT: To avoid excessively large responses, please use the optional parameters (filterExpr, metricNameFilter, earliest, latest, numBuckets, wp) to narrow down your query whenever possible. If no parameters are provided, the server will default to fetching only the most recent data bucket (numBuckets=1) to prevent performance issues.

ParametersJSON Schema
NameRequiredDescriptionDefault
filterExprNoOptional: A JS expression to filter metrics (e.g., "model.pipeline === 'test'" or "host == 'myhost'").
metricNameFilterNoOptional: Regex or array of metric names (e.g.,limit to "pipe.*" , "total.in_bytes", or "os.cpu.perc,os.mem.*").
earliestNoOptional: Start time for the query (e.g., '-15m', '2023-10-26T10:00:00Z').
latestNoOptional: End time for the query (e.g., 'now', '2023-10-26T10:15:00Z').
numBucketsNoOptional: The number of time buckets for aggregation.
wpNoOptional: Worker process filter.

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description carries the full burden. It discloses the default behavior (fetches only most recent bucket if no params) and warns about large responses, adding behavioral context beyond the input schema. It doesn't cover all traits (e.g., rate limits) but is sufficient for a simple read operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact with two short paragraphs. The first sentence states the purpose, followed by a highlighted IMPORTANT note and a default behavior explanation. Every sentence adds value with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and no annotations, the description is adequate but incomplete. It covers the critical performance warning and default behavior, but doesn't describe the return format, data structure, or how to interpret metrics, leaving some gaps for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% parameter description coverage, providing detailed explanations for each parameter. The description only lists the parameter names without adding new meaning, so it meets the baseline of 3 without exceeding schema contributions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Retrieves system metrics from the Cribl deployment' with a specific verb and resource. It distinguishes itself from sibling tools, which are about pipeline configuration, worker groups, etc., by being the only metrics retrieval tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly advises using optional parameters to narrow queries and explains the default behavior (numBuckets=1) to prevent performance issues. This provides clear context for when to use the tool, though it doesn't compare with sibling tools explicitly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cribl_listWorkerGroupsA

Lists available worker groups in the Cribl deployment, optionally filtered by product type (stream, edge, search, or all).

ParametersJSON Schema
NameRequiredDescriptionDefault
productTypeNoFilter groups by product type (stream, edge, search, all). Defaults to stream.

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full responsibility for behavioral disclosure. It states the action but fails to mention any behavioral traits such as rate limits, authentication requirements, the format of the returned data, or behavior when no groups are available. The description is minimal and does not go beyond the basic action.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that front-loads the main action and includes the key optional feature. Every word is necessary, and there is no redundancy or extraneous information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one optional parameter, no output schema, no annotations), the description is largely complete. It conveys the core functionality and the filter option. However, it does not specify the output format or any edge cases, which would be beneficial for an agent but not critical for this straightforward listing tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage, documenting the single parameter with enum and description. The description adds the phrase 'optionally filtered by product type (stream, edge, search, or all)', which reinforces the schema's content and clarifies optionality. However, the added value is marginal, placing it at the baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool lists available worker groups in the Cribl deployment, with an optional filter by product type. The verb 'list' and resource 'worker groups' are specific, and the filtering option is mentioned, distinguishing it from sibling tools that deal with pipelines, sources, or metrics.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when needing to view worker groups, but provides no explicit guidance on when to use this tool versus alternatives, nor any exclusions or prerequisites. With no sibling tools performing the same function, the context is clear, but explicit guidelines are missing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cribl_restartWorkerGroupB

Restarts all workers within the default or specified worker group.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description fails to disclose behavioral traits such as whether a restart disrupts ongoing operations, requires authentication, or is reversible. The description is minimal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, clear sentence of 10 words, efficiently stating the tool's purpose with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no annotations or output schema, the description should provide more context. It fails to explain how to specify a worker group (conflicting with the schema), what the default group is, or what occurs after restarting. Incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With zero parameters in the input schema, the description does not need to add parameter details. The baseline for 0 parameters is 4, and the description does not contradict that (though it implies a parameter for worker group selection).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('restarts') and the resource ('all workers within the default or specified worker group'), distinguishing it from sibling tools that focus on pipelines, sources, or metrics.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions a 'specified worker group' but the input schema has no parameters to select one, creating ambiguity. No guidance is given on when to use this tool versus alternatives like cribl_listWorkerGroups or other restart mechanisms.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cribl_setPipelineConfigB

Applies a new configuration payload to a specified pipeline in a worker group.

ParametersJSON Schema
NameRequiredDescriptionDefault
groupNameNoOptional: The name of the Worker Group/Fleet. If omitted, defaults to attempting to use Cribl Stream and if only one group exists for Stream, it will use that sole group.
pipelineIdYesThe ID of the pipeline to set configuration for.
configYesPipeline configuration payload to validate.

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden. It describes a write operation but lacks details on validation, error handling, immediacy of effect, or required permissions. The minimal description does not adequately compensate for missing annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that front-loads the action and resource. Every word contributes to clarity with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has three parameters, nested objects, and no output schema, the description is too minimal. It omits return values, error scenarios, and prerequisites, leaving an agent underinformed for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All parameters have descriptions in the input schema (100% coverage), so the description does not need to repeat them. However, the description adds no additional meaning beyond the schema, such as constraints or usage nuances.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (applies) and the resource (new configuration payload to a specified pipeline in a worker group). This distinctly sets it apart from sibling tools like cribl_getPipelineConfig (retrieval) or cribl_deployPipeline (deployment).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for applying configuration but does not explicitly state when to use this tool instead of alternatives like cribl_commitPipeline or cribl_deployPipeline. No when-not-to-use guidance is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cribl_versionControlA

Detects if version control (git) is enabled on the Cribl instance and whether a remote repository URL is configured.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden for behavioral disclosure. It states the tool 'detects' enabling of version control and remote URL configuration, indicating a read-only, non-destructive operation. It adds context beyond the tool name but does not detail error cases or return format.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that is clear, front-loaded, and contains no unnecessary words. Every word contributes to the tool's purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity of the tool (no parameters, no output schema), the description fully captures what the tool does: detecting two specific aspects of version control. It is complete for its intended use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameters, so the description has no need to add parameter semantics. According to guidelines, baseline is 4 for zero parameters, and the description does not detract from this.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'detects' and clearly identifies the resource (version control status on Cribl instance). It distinguishes from sibling tools which focus on pipelines, sources, etc., none of which cover version control detection.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for checking git status, but does not explicitly state when to use this tool versus alternatives or provide exclusions. Given the sibling list, there are no direct alternatives, so the context is clear but guidelines are not explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 10 tool updatesv0.1.12
    • Addedcribl_commitPipeline
    • Addedcribl_deployPipeline
    • Addedcribl_getPipelineConfig
    • Addedcribl_getPipelines
    • Addedcribl_getSources
    • Addedcribl_getSystemMetrics
    • Addedcribl_listWorkerGroups
    • Addedcribl_restartWorkerGroup
    • Addedcribl_setPipelineConfig
    • Addedcribl_versionControl

TDQS

A3.9/5.0

Scored across 10 tools

Disambiguation5/5

Each tool targets a distinct action and resource: commit, deploy, get config, get list, sources, metrics, worker groups, restart, set config, version control. No overlapping purposes.

Naming Consistency5/5

All tools follow a consistent 'cribl_verbNoun' pattern with camelCase (e.g., cribl_commitPipeline, cribl_getPipelines). Even 'cribl_versionControl' fits the pattern as a noun-based verb.

Tool Count5/5

10 tools is well-scoped for a Cribl configuration and deployment server. It covers essential operations without being overwhelming or too sparse.

Completeness4/5

The tool set covers core pipeline lifecycle (get, set, commit, deploy), sources, worker groups, metrics, and version control. Missing are delete pipeline and potentially more granular worker group details, but the surface is solid for common use cases.

Maintenance

ActivityInactive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers