Skip to main content
Glama

update_dfw_policy

Partially update a DFW security policy by changing only the provided fields. Use it to rename or re-prioritize the policy while leaving other settings unchanged.

Instructions

[WRITE] Partially update a DFW security policy (PATCH — only provided fields change).

Returns the updated policy dict; omitted arguments keep their values, so read them with get_dfw_policy first. Use it to rename or re-prioritise the policy itself — to change a rule inside use update_dfw_rule.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
targetNoOptional NSX Manager target from config.
statefulNoNew stateful flag.
policy_idYesID of the policy to update.
descriptionNoNew description.
display_nameNoNew display name.
sequence_numberNoNew sequence number.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed7 schema fields changedv1.10.0
    • addedInput schema / additionalProperties
      Added value: +false
    • addedInput schema / properties / description / description
      Added value: +"New description."
    • addedInput schema / properties / display_name / description
      Added value: +"New display name."
    • addedInput schema / properties / policy_id / description
      Added value: +"ID of the policy to update."
    • addedInput schema / properties / sequence_number / description
      Added value: +"New sequence number."
    • addedInput schema / properties / stateful / description
      Added value: +"New stateful flag."
    • addedInput schema / properties / target / description
      Added value: +"Optional NSX Manager target from config."
  2. Addedv1.5.29
  3. Removedv1.5.28
  4. First observedv1.3.2

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses that this is a partial update where only provided fields change, omitted fields keep their values, and the updated policy dict is returned. This goes well beyond the annotations, which only indicate write/non-readonly semantics and do not describe PATCH behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded with the operation type and PATCH semantics. Every sentence adds value: partial-update behavior, return value, prerequisite read, and the sibling tool alternative. No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 6-parameter mutation tool with no output schema, the description covers the essential behavioral contract: what changes, what doesn't, what is returned, and how to distinguish this from the rule update sibling. The schema already documents each parameter individually, so the description is complete enough for an agent to use it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds useful parameter-level context by explaining that omitted arguments retain their existing values and should be read first, which clarifies how the optional parameters behave beyond the schema's individual field descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description states a clear verb-resource pair: 'Partially update a DFW security policy' with PATCH semantics. It distinguishes itself from the sibling update_dfw_rule by explicitly saying it is for the policy itself, not rules inside it.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit usage guidance: use it to rename or re-prioritise the policy, and use update_dfw_rule instead for changing a rule inside the policy. It also advises reading the policy with get_dfw_policy first, providing clear context for safe invocation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.