Skip to main content
Glama
rubrikinc

Rubrik MCP

Official
by rubrikinc

rsc_get_events

Read-only

Retrieve recent backup jobs, failures, and anomalies for workloads within a time window. Filter by workload to diagnose failures and get recommended remedies.

Instructions

Get recent events and activity for workloads.

Returns backup jobs, failures, anomalies, and other activity. Always scoped to a time window (default: last 24 hours) to keep queries fast.

For failure details, each event includes the error message, reason, and recommended remedy where available.

Args: last_hours: How far back to look, in hours. Default 24. Always provide this — omitting a time range makes the query very slow. workload_id: Filter to a specific workload FID (from rsc_get_workloads). Use this to answer "why did the backup fail for workload X". object_name: Filter by object name substring. status: Filter by event status. One of: SUCCESS, FAILURE, WARNING, RUNNING, CANCELED, CANCELING, QUEUED, PARTIAL_SUCCESS, TASK_FAILURE, TASK_SUCCESS, INFO. severity: Filter by severity. One of: SEVERITY_CRITICAL, SEVERITY_WARNING, SEVERITY_INFO. activity_type: Filter by activity type. Common values: BACKUP, RECOVERY, REPLICATION, ARCHIVE, ANOMALY, INDEX, LOG_BACKUP. cluster_id: Filter by Rubrik cluster UUID. limit: Maximum number of events to return. Default 100.

Returns: A dict with count (true total matching the filter), returned (how many events are in this response), truncated (True when more events exist than were returned, because of limit or the record cap), and events (the list of event records). Report count for "how many" questions, not len(events).

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
limitNo
statusNo
severityNo
cluster_idNo
last_hoursNo
object_nameNo
workload_idNo
activity_typeNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish the safe read-only profile, so the description's added value is the performance constraint ('omitting a time range makes the query very slow'), the 24-hour default window, and the failure-detail enrichment (error message, reason, remedy). That is meaningful behavior beyond the annotations, though pagination/record-cap specifics are only implied.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the purpose, then organizes detail into Args and Returns sections with no filler sentences. It is longer than minimal, but each block (performance warning, enum lists, return-shape guidance) carries load; only mild redundancy keeps it from a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 8-parameter tool with 0% schema coverage and no output schema, the description covers filters, defaults, a performance caveat, and an explicit Returns block explaining count vs returned vs truncated and advising count over len(events). Nothing an agent needs to call or interpret the result is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description must carry all parameters and it does: it documents all 8, including full enum value lists for status and severity, common values for activity_type, the 'substring' semantics of object_name, and the origin of workload_id. This is exactly the compensation the schema needs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Get recent events and activity for workloads') and enumerates what those events contain (backup jobs, failures, anomalies). It is clearly distinguishable from siblings like rsc_get_workloads, which it references as the source of the workload FID rather than duplicating.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete usage context — 'Use this to answer "why did the backup fail for workload X"' — and instructs the agent to always pass last_hours for performance. It stops short of naming an alternative event tool or explicitly stating when not to use it, so it lands at 4 rather than 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.