Skip to main content
Glama
rstierli

FortiManager MCP Server

by rstierli

create_device_on_demand_sniffer

Create a bounded on-demand packet sniffer definition to stage a one-shot capture job with a packet count limit and filters for hosts, ports, and protocols.

Instructions

Create a bounded on-demand packet sniffer on a managed device.

Distinct FortiOS object from create_device_sniffer's firewall sniffer: this one (firewall on-demand-sniffer) is name-keyed rather than id-keyed, and bounded by max_packet_count rather than running continuously -- closer to a one-shot capture job than a standing diagnostic rule. Filters are lists (multiple hosts/ports/ protocols at once), not the single range-string form the persistent sniffer uses.

How to actually trigger the capture and retrieve packets once this definition exists is not part of FortiOS's Configuration API (this tool only stages the definition, config-CRUD like every other tool in this module) -- that would be a separate monitor-API or CLI mechanism, out of scope here.

Args: device: Managed device name name: On-demand sniffer name interface: Interface name traffic sniffing takes place on max_packet_count: Maximum packets to capture (default: 4000) hosts: IPv4/IPv6 hosts to filter for ports: Ports to filter for (each 1-65535) protocols: IANA protocol numbers to filter for (each 0-255) capture_non_ip: Include non-IP packets (default: False) vdom: VDOM the sniffer lives in (default "root")

Returns: Creation result

Input Schema

NameRequiredDescriptionDefault
nameYes
vdomNoroot
hostsNo
portsNo
deviceYes
interfaceYes
protocolsNo
capture_non_ipNo
max_packet_countNo

Output Schema

NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv1.12.0

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden and does well by disclosing that this only stages the FortiOS configuration object and does not trigger or retrieve packets. It does not cover mutation edge cases such as duplicate names, permission requirements, or whether a commit is needed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core action and distinction from the sibling tool, then gives a useful scope caveat and parameter semantics. It is somewhat long, but the length is justified by the complex FortiOS distinction and the 0% schema description coverage.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the nine parameters, zero schema descriptions, and an output schema, the description provides everything needed to call the tool correctly. It explains all parameters, the tool's scope boundary, and its relationship to the persistent sniffer alternative.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for all nine parameters. It provides meaningful semantics for each: device, name, interface, max_packet_count default, IPv4/IPv6 hosts, port range, IANA protocol range, capture_non_ip default, and vdom default.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: creating a bounded on-demand packet sniffer on a managed device. It explicitly distinguishes this from create_device_sniffer by explaining the name-keyed, bounded one-shot nature versus the id-keyed persistent sniffer.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly tells the agent when this tool is appropriate versus create_device_sniffer and clarifies that triggering the capture or retrieving packets is out of scope. This prevents the agent from expecting the tool to start a live capture, which is handled elsewhere.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools