Skip to main content
Glama

Identify a device by MAC, IP, or hostname

find_device
Read-onlyIdempotent

Locate a device by MAC, IP, or hostname fragment. Merges wireless client, DHCP lease, and ARP data into one record, giving one answer instead of three partial ones.

Instructions

Identify a device on the network by MAC, IP, or hostname fragment.

Searches the wireless client list, the DHCP lease table, and the ARP table together, then merges everything known about each matching device into one record. A device seen in several places produces one result rather than three partial ones.

This is the tool for questions like "what is 198.51.100.47", "is that laptop on the network", or "which SSID is this MAC on".

A MAC query matches whatever punctuation the appliance used, so 20-47-47-7d-db-7b, 2047.477d.db7b, and 20:47:47:7d:db:7b all find the same device. An IP query is never treated as a MAC.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
vdomNoVirtual domain to search. Defaults to the one configured for this target. The `vdom` field in the response names the one actually searched, and a device in another vdom will not be found from here.
queryYesA MAC address, an IP address, or part of a hostname. Matching is case-insensitive and substring-based, so a partial MAC or a bare hostname prefix works. Partial MACs must keep their separators to be recognized as MACs.
targetNoWhich FortiGate to query. Optional when only one is configured.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, openWorld, and non-destructive, so the safety profile is covered. The description adds genuinely non-obvious behavior: cross-source merging, one-result-per-device deduplication rather than three partial records, and MAC punctuation normalization. It does not discuss result ordering or ambiguity when many devices match, keeping it below 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four short paragraphs, front-loaded with what the tool does, then behavior, then example questions, then query-format edge cases. No filler; each paragraph carries distinct information an agent needs.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, and annotations carry the safety profile. The description still supplies the merge/dedup behavioral model and query-format rules, leaving no material gap for calling this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description goes further by explaining that MAC matching ignores punctuation (three equivalent forms shown) and that an IP query is never treated as a MAC — semantics that the schema's 'partial MACs must keep their separators' text alone does not make fully clear.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Identify a device on the network by MAC, IP, or hostname fragment') and explains the mechanism: it searches the wireless client list, DHCP lease table, and ARP table together and merges matches. This implicitly and clearly distinguishes it from the sibling raw-table tools list_wifi_clients, list_dhcp_leases, and get_arp_table.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete triggering questions ('what is 198.51.100.47', 'is that laptop on the network', 'which SSID is this MAC on'), which makes the use case unambiguous. It does not explicitly name an alternative tool or state when not to use it (e.g., when raw per-table output is wanted), so it stops short of full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.