Skip to main content
Glama
rstierli

FortiManager MCP Server

by rstierli

list_packet_captures

Retrieves configured FortiManager packet capture definitions for traffic to or from the FortiManager, returning capture records such as ID, interface, host, port, and protocol.

Instructions

List existing FortiManager packet capture definitions.

Returns the packet capture (sniffer) definitions configured on the FortiManager itself, for traffic originating or destined to the FMG. These are configuration records, not live capture results -- use get_packet_capture_status() for running/packet-count state.

Returns: dict: Capture list with keys: - status: "success" or "error" - count: Number of capture definitions - captures: List of capture objects (id, interface, host, port, protocol, vlan, ipv6, non-ip, max-packet-count) - message: Error message if failed

Example: >>> result = await list_packet_captures() >>> for cap in result["captures"]: ... print(f"{cap['id']}: {cap['interface']}")

Input Schema

NameRequiredDescriptionDefault

No arguments

Output Schema

NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv1.12.0

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden and does so well: it discloses that these are configuration records rather than live capture results, and scopes them to FMG-local traffic rather than device traffic — a distinction an agent could easily get wrong. It omits any statement about read-only safety or volume/ordering of the returned list, which is the residual gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core disambiguation is front-loaded in the first two sentences and every sentence there earns its place. The trailing 'Returns' block and doctest example are somewhat verbose given an output schema already exists, but they are structured and skimmable rather than rambling.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-argument list tool with an output schema, the description covers the real ambiguity — definition records vs. live capture state, FMG-local vs. device scope. The Returns block partially duplicates the output schema, so it adds bulk rather than completeness, but nothing an agent needs in order to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the baseline of 4 applies. There is nothing for the description to compensate for, and the per-capture field list it mentions is extra context rather than a substitute for missing schema documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List existing FortiManager packet capture definitions') and immediately narrows the scope: captures configured on the FMG itself, for traffic to/from the FMG, not device-level sniffer configs. It explicitly separates itself from get_packet_capture_status(), so the agent can distinguish it from its closest sibling without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit conditional routing rule: use get_packet_capture_status() when you want running/packet-count state, this tool when you want the definitions. That is a clear when/when-not pair. It does not mention the other capture-related siblings (add_packet_capture, start_packet_capture, stop_packet_capture, create_device_sniffer), which would be the natural remaining confusion points, so it falls short of a full 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools