Skip to main content
Glama
Sign In
BloodHound MCP

BloodHound MCP

by stevenyu113228
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Hybrid

find_azure_app_owners_with_dangerous_rights

Identify Azure application owners who have dangerous administrative rights to service principals, enabling security teams to detect and address privilege escalation risks in Azure environments.

Instructions

Owned: [WIP] Find all Owners of Azure Applications with Owners to Service Principals with Dangerous Rights (Required: azurehound)

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "domain": "<domain>"
    },
    "name": "find_azure_app_owners_with_dangerous_rights"
  }
}

Input Schema

NameRequiredDescriptionDefault
domainYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

C2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It mentions 'Required: azurehound', hinting at a dependency, but doesn't disclose behavioral traits such as whether it's read-only, destructive, rate-limited, or what the output format might be. The '[WIP]' tag suggests incomplete information, further reducing transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is brief and front-loaded with the main purpose, but includes unnecessary elements like '[WIP]' and the parenthetical note, which add clutter without enhancing clarity. It's somewhat efficient but could be more polished.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity implied by the tool name (involving Azure apps, owners, service principals, and dangerous rights), no annotations, 0% schema coverage, and no output schema, the description is inadequate. It lacks details on behavior, parameters, and output, making it incomplete for effective use by an AI agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 1 parameter with 0% description coverage, and the tool description provides no information about the 'domain' parameter. It doesn't explain what the parameter means, its format, or how it influences the search. This fails to compensate for the lack of schema documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose2/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states 'Find all Owners of Azure Applications with Owners to Service Principals with Dangerous Rights', which specifies the verb 'Find' and resource 'Owners of Azure Applications', but it's vague about what 'Dangerous Rights' entails and includes '[WIP]' indicating it's incomplete. It distinguishes from siblings by focusing on Azure app owners, but the purpose remains somewhat unclear due to the WIP tag and lack of specificity on 'dangerous rights'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes 'Required: azurehound', which provides a prerequisite, but it offers no guidance on when to use this tool versus alternatives like 'list_all_principals_with_azure_tenancy_access' or other sibling tools. There's no explicit when/when-not context or named alternatives, leaving usage unclear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools