Skip to main content
Glama
x746b

Windows Forensics MCP Server

by x746b

registry_query

Search Windows registry hives using exact, substring, or regex matching, with subtree scoping, field selection, and pagination for forensic analysis.

Instructions

Query registry values with exact, substring, or regex matching, subtree scope, field projection, and pagination. Returns results and total_matched over the readable subtree, with read diagnostics. Follow next_offset for the next page.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
limitNo
fieldsNoReturn only selected fields; missing optional fields are omitted
offsetNo
patternYes
hive_pathYes
match_modeNosubstring
search_dataNo
search_namesNo
case_sensitiveNo
key_path_prefixNoWhole subtree key, hive-relative or including root name
diagnostic_limitNoMaximum read-error details; read_errors always counts all errors

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv1.4.5

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It explicitly mentions that results are limited to the 'readable subtree' (implying permission-based filtering), that it returns diagnostics for read errors, and that pagination is done via next_offset. This adds meaningful context beyond the schema, though it does not explicitly state it is a read-only operation (though implied by 'query').

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, with the first sentence listing core capabilities and the second describing output and pagination. It is front-loaded with the most important information and contains no fluff. Every clause adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (11 parameters, no output schema), the description is not fully complete. It covers the main features but leaves details like how to specify hive_path, the exact behavior of search_data vs search_names, and the meaning of case_sensitive to inference. An agent might need additional context to use the tool correctly, especially since the schema descriptions are sparse. However, the description does convey the essential workflow (query, read diagnostics, paginate).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 27% (3 of 11 parameters have descriptions). The description provides a high-level overview of capabilities (e.g., 'exact, substring, or regex matching' maps to match_mode, 'field projection' maps to fields, 'pagination' maps to limit/offset), but it does not explain individual parameters like search_data, search_names, case_sensitive, or diagnostic_limit. Since the schema is sparse, the description only partially compensates, leaving some parameters underspecified.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: querying registry values with exact, substring, or regex matching, and lists key capabilities like subtree scope, field projection, and pagination. This distinguishes it from siblings like registry_get_key (which likely retrieves a specific key) and registry_search (which may search for keys or values) by focusing on value-level querying with multiple match modes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use this tool by mentioning specific features (matching modes, projection, pagination), but it does not explicitly differentiate it from the sibling registry_search or other registry tools. It does not state when to prefer this over alternatives, leaving the agent to infer from the feature list. A clearer 'use this for X, use registry_search for Y' would be more helpful.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.