Find security events in Windows EVTX logs by category like logons or process creation, with offset pagination for large result sets.
Search for security events by type: logon, failed_logon, process_creation, etc. Supports pagination with offset.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max results to return (default 50) | |
| offset | No | Skip first N matches for pagination | |
| evtx_path | Yes | ||
| event_type | Yes |
Changes observed during successful MCP inspections.
v1.3.0Input schema / properties / limit / defaultPrevious value: -100New value: +40Input schema / properties / limit / descriptionAdded value: +"Max results to return (default 50)"Input schema / properties / offsetAdded value: +{
+ "default": 0,
+ "description": "Skip first N matches for pagination",
+ "type": "integer"
+}v1.0.0Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Mentions pagination with offset, but no annotations are provided. Lacks disclosure of read-only nature, side effects, or authentication requirements. Search is inherently read-only, but not stated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence front-loads purpose and pagination. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema or annotations. Description omits return format, error handling, and prerequisites. Adequate for a simple search but incomplete for production use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50% (limit and offset have descriptions). Description adds minimal value: clarifies event_type usage by example list, but evtx_path remains undocumented. Baseline 3 with slight enhancement.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the verb (search) and resource (security events), lists specific event types, and includes pagination support. Distinguishes from sibling tools like evtx_search and evtx_explain_event_id.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies usage for security event search but does not explicitly state when to use this tool over alternatives like evtx_search, nor provides exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.