Skip to main content
Glama
rstierli

FortiManager MCP Server

by rstierli

find_object_usage

Find every policy, group, and object that references a given ADOM object to assess where-used dependencies before modification.

Instructions

Find everywhere an ADOM object is referenced (where-used).

Runs FortiManager's cache-daemon where-used search: policies, groups, and other objects that reference the given object. This is a usage-graph lookup, distinct from object_tools.search_objects (which matches objects BY NAME, not by reference).

Args: adom: ADOM name (use "global" to search a Global ADOM object) object_name: Name of the object to trace usage for object_type: One of "address", "address_group", "service", "service_group" (default: "address") timeout: Maximum seconds to wait for the search to complete (default: 60, capped at 300) poll_interval: Seconds between progress checks (default: 2, clamped to 1-30)

Returns: dict: Usage result with keys: - status: "success" or "error" - object_name: The object searched for - object_type: The object type searched - total_matches: Number of referencing locations - used_in: List of where-used entries, each with the referencing object's root ADOM/package and the matching attr/mapping_name/mkey detail FortiManager returned - message: Error message if failed

Example: >>> result = await find_object_usage("root", "WebServer") >>> for entry in result["used_in"]: ... print(entry["root"], entry["data"])

Input Schema

NameRequiredDescriptionDefault
adomYes
timeoutNo
object_nameYes
object_typeNoaddress
poll_intervalNo

Output Schema

NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv1.12.0

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses the backing mechanism, that the operation is a cache-daemon search, timeout behavior (default 60, capped at 300) and poll_interval clamping (1-30). It never explicitly states the operation is read-only/non-mutating or what permissions are needed, which is the remaining gap for an unannotated tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with a one-line summary followed by mechanism, args, returns, and an example — easy to scan. The Returns block restates keys that an output schema already covers, which is mild redundancy rather than a defect.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 5-parameter, unannotated tool, the description covers purpose, mechanism, every parameter's semantics and constraints, and error behavior via the status/message keys. Return values are additionally backed by an output schema, so nothing an agent needs to call this correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate entirely, and it does: adom accepts "global" for Global ADOM objects, object_name is the traced object, object_type enumerates the four valid values with its default, and both timeout and poll_interval get defaults plus caps. This adds real meaning the bare schema lacks.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb+resource ("Find everywhere an ADOM object is referenced (where-used)") and names the underlying mechanism (FortiManager cache-daemon where-used search). It explicitly differentiates itself from search_objects, so an agent can distinguish the two without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear usage context ("policies, groups, and other objects that reference the given object") and explicitly contrasts with search_objects, which matches by name rather than reference. It does not address other plausible alternatives such as find_duplicate_objects or policy_lookup, so the routing guidance is strong but not exhaustive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools