Skip to main content
Glama

StartApiTrace

Prepare an API call trace session by enumerating matching module imports and setting silent breakpoints, without running the debuggee; use RunApiTrace to collect calls.

Instructions

Set up (but do not yet run) an API call trace session.

Enumerates imports matching filter_json in modules_json and sets silent+continue-on-hit breakpoints on each target. Use RunApiTrace to drive the debuggee and collect calls.

Args: modules_json: JSON array of module names (e.g. ["kernel32.dll","ws2_32.dll"]). Empty → typical OS modules (kernel32/user32/advapi32/ws2_32/wininet/ntdll). filter_json: JSON array of substrings to match module!func. Empty → DEFAULT_API_FILTERS (file I/O, memory, process, net, crypto, etc.) custom_targets_json: Strict JSON array of explicit loaded-module targets. Each item selects exactly one symbol, RVA, or address. kind="import-resolver" records custom/hash resolver returns as exact PE exports using supplied resolver argument metadata. arg_count: Number of args to sample per call (default 4, max 8). label: Optional session label. max_targets: Max number of BPs to actually set (default 200). If the filter matches more, returns an error listing counts per module so the caller can narrow the filter. subscribe_modules: Periodically discover matching exports in modules that load after the trace starts. discover_dynamic_resolvers: Add a bounded owned breakpoint for a matching function pointer returned by GetProcAddress. native_return_hooks: Let the native breakpoint callback install and remove return hooks. Python remains a fail-safe if native scheduling is unavailable or rejects a hook.

Returns summary: {ok, traceId, targetCount, modules, filters, warnings}.

Input Schema

NameRequiredDescriptionDefault
labelNo
arg_countNo
filter_jsonNo
max_targetsNo
modules_jsonNo
caller_filterNo
max_out_bytesNo
capture_returnsNo
capture_callstackNo
subscribe_modulesNo
decode_string_argsNo
custom_targets_jsonNo
native_return_hooksNo
max_callstack_framesNo
collapse_nested_familiesNo
discover_dynamic_resolversNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.9

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only give the generic profile (readOnly=false, openWorld=true, non-idempotent). The description goes well beyond them: breakpoints are 'silent+continue-on-hit', there is a 200-BP cap that surfaces an error listing per-module counts, native vs. Python return-hook fallback is described, and the return summary shape is enumerated. That is meaningful operation-level disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the purpose and the RunApiTrace handoff, then uses a clean Args block with the return summary last. The custom_targets_json entry is dense but each sentence carries real information; only minor trimming is possible.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 16-parameter session-setup tool with no output schema, the description covers the core mechanics and return summary well, but seven parameters are left entirely undefined and no prerequisite (debuggee must already be initialized/attached) is stated. Adequate, with clear gaps for a tool of this complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden, and it documents 9 of 16 params with defaults, examples and non-obvious semantics (empty-string fallbacks for modules_json/filter_json, custom_targets_json selection rules and kind='import-resolver'). Gaps remain for caller_filter, max_out_bytes, capture_returns/callstack, decode_string_args, max_callstack_frames and collapse_nested_families, though several are guessable from their names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first line gives a precise verb+resource ('Set up ... an API call trace session') and immediately bounds the scope with '(but do not yet run)'. It also distinguishes itself from the sibling RunApiTrace by naming it and stating what that tool does. An agent can pick this over RunApiTrace/StopApiTrace without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly routes the caller: setup happens here, execution happens in RunApiTrace. The max_targets error path also tells the caller how to recover (narrow the filter). It stops short of stating prerequisites (InitDebuggee/AttachToProcess appear as siblings but are never referenced) or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.