Skip to main content
Glama

build_incident_report

Read-onlyIdempotent

Build a forensic incident-report bundle for security review. Gathers evidence from session state and on-chain history, returning a structured envelope and narrative markdown for disclosure.

Instructions

Build a forensic incident-report bundle for a security review or disclosure. Read-only — gathers evidence already available to the server (demo-mode state, paired Ledger summary, skill / pin-drift notice flags) and, if you supply wallet + chain with scope: 'wallet' or 'custom', the wallet's recent on-chain tx history (uses the same data path as get_transaction_history, so address-poisoning suffix-lookalike heuristics are surfaced). Returns BOTH a structured envelope (machine-readable) and a narrative markdown string the user can paste into a GitHub issue / email / disclosure verbatim. REDACTION (default addresses): every address-shaped field is fuzzed to first-4 / last-4 of meaningful chars so the bundle is safe to display before the user has decided where to forward it. Use redact: 'all' to additionally bucket USD amounts to coarse ranges ($1k–10k etc.). Use redact: 'none' only when the user is ready to share full hex with a trusted security contact. v1 SCOPE: this tool only BUILDS the bundle; it does not submit anywhere. The user copies the narrative and routes it manually. A submit_incident_report companion that posts via the request_capability proxy is on the v2 roadmap (see claude-work/plan-incident-report-v2.md). Also deferred from v2: prepared-tx ring-buffer evidence ("last N prepared / broadcast txs"), so v1's tx evidence comes from on-chain history only.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
scopeNoEvidence-collection scope. `session` (default): notice flags fired this session, demo-mode state, paired Ledger summaries — no on-chain reads. `wallet`: same as `session` PLUS the supplied `wallet`'s recent on-chain history. `custom`: same as `wallet` but lets `incident_class` widen evidence (e.g. allowances for an address-poisoning incident). `last_tx` was reserved in the filed issue but is deferred to v2 (needs the prepared-tx ring buffer).session
incident_classNoWhat category of incident is being reported. Drives which evidence to fetch on top of the always-included session-level summary. `address_poisoning` adds allowance enumeration; `unexpected_tx` / `hash_mismatch` add recent tx history. `skill_pin_drift` adds the live drift status block. `unknown` is the safe default when the user isn't sure which category fits.
walletNoWallet address to scope evidence to. Required when `scope` is `wallet` or `custom`. Format: EVM hex / Solana base58 / TRON T-prefixed base58. Detected automatically from the prefix shape.
chainNoChain context for the wallet. Required when on-chain evidence is fetched (`scope: wallet` or `scope: custom`). Defaults to `ethereum` when omitted in those scopes.
txHashNoTransaction hash anchoring the incident to a specific tx. Surfaced verbatim in the bundle (with redaction applied to the user-facing shape per `redact`). v1 doesn't fetch the tx body itself — the agent / user pastes additional context separately.
redactNoRedaction mode. Default `addresses` fuzzes every address-shaped field (EVM/Solana/TRON/BTC) to first-4/last-4 of meaningful chars so the bundle is safe to display before the user has decided where to forward it. `all` additionally buckets USD amounts to coarse ranges. `none` shows full hex — opt-in only when the user is ready to share with a trusted security contact.addresses
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=true, idempotentHint=true, etc. The description reinforces this with 'Read-only — gathers evidence already available to the server.' It discloses behavioral traits: returns both envelope and narrative, redaction defaults, and that v1 doesn't fetch tx bodies. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose in the first sentence. It is detailed but not overly verbose; every sentence provides necessary context for a complex tool. Slight verbosity in roadmap details could be trimmed, but justified given tool complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 6 parameters, no output schema, and complex behavior (scopes, redaction, incident classes), the description is very complete. It explains return values (envelope and narrative), limitations, and deferred features. It fully compensates for lack of output schema and provides all needed context for safe use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema coverage is 100% with descriptions for all 6 parameters. The description adds value beyond schema by explaining practical usage, e.g., 'v1 doesn't fetch the tx body itself' for txHash and linking scope to evidence collection. It enriches parameter meaning without relying solely on schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool 'Build a forensic incident-report bundle for a security review or disclosure.' The verb is 'build', the resource is an incident report bundle, and it distinguishes itself from a future submit companion tool. It also differentiates from sibling tools like 'get_transaction_history' by noting it uses the same data path but for evidence gathering.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit when-to-use guidance for scope, redaction modes, and incident_class. It states when to use 'none' redaction only for trusted contacts and that v1 only builds, not submits. It references a v2 roadmap for submission and deferred tx evidence, giving clear context on limitations and alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/szhygulin/vaultpilot-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server