Skip to main content
Glama
x746b

Windows Forensics MCP Server

by x746b

registry_get_persistence

Identify malware persistence by extracting Run keys, Winlogon values, and services from registry hives.

Instructions

Get persistence mechanisms (Run keys, Winlogon values, services) from registry.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
ntuser_hiveNo
system_hiveNo
software_hiveNo
include_microsoft_servicesNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.0.0

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry full behavioral burden, but it only states the target artifact types. It does not disclose how the supplied hives are read or combined, the effect of the include_microsoft_services default, or the output shape, leaving key behavioral traits implicit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence with no filler and no duplicated schema content; the main artifact categories are front-loaded. It is short, but the brevity comes at the cost of important context that other dimensions have to account for.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a four-parameter tool with no output schema, the description is too incomplete: it does not explain what the output looks like, how to choose hive paths, or when to set include_microsoft_services. An agent would need to rely on parameter names and potentially miss hidden assumptions.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description adds no parameter-level meaning. It mentions 'registry' and 'services' only indirectly, while ntuser_hive, system_hive, software_hive, and include_microsoft_services remain undocumented except for their names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Get') with a specific resource ('persistence mechanisms') and enumerates concrete artifact classes (Run keys, Winlogon values, services). This clearly separates it from sibling tools like registry_get_key and registry_get_system_info, which target different registry data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The use case is implied: call this when registry persistence mechanisms are needed. However, there is no explicit when/when-not guidance and no mention of alternatives such as registry_get_key or registry_search, so the agent must infer the applicable context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.