palo-alto-bgp-ipsec

get_traffic_logs

Read-only

Retrieve recent firewall traffic logs with optional filter queries and result limits to inspect network activity and troubleshoot BGP/IPsec issues.

Instructions

[READ-ONLY] Retrieves recent traffic logs from the firewall using the PanOS log API (type=log). Supports filtering by query and limiting result count.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "get_traffic_logs"
  }
}

Input Schema

Name	Required	Description
`nlogs`	No	Number of logs to retrieve (default: 20, max: 5000)
`query`	No	Filter query (e.g., '( addr.src in 10.0.0.0/8 )')
`firewall`	No	Target firewall name (from firewalls.json). Required when multiple firewalls are configured; optional otherwise.

Schema Changelog

Changes observed during successful MCP inspections.

First observedv1.0.0Sep 1, 2026

TDQS

A4/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, and the description reinforces this with '[READ-ONLY]'. It adds useful context about using the PanOS log API and supporting filtering/limiting, but it does not disclose details such as the time window behind 'recent' or the output structure. With annotations covering the safety profile, the extra disclosure is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one tightly written sentence that leads with the read-only marker and the core verb 'Retrieves', followed by the resource and key capabilities. There is no filler or repetition of schema details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a relatively simple tool with three optional parameters, all fully described in the schema, and annotations already establish the read-only safety profile. The description covers purpose, filtering, and result limiting, which is sufficient for an agent to call it correctly. A minor gap is the absence of any detail about the default/possible time range for 'recent', but this does not block correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the input schema already documents nlogs, query, and firewall clearly. The description adds only a high-level mention of 'filtering by query and limiting result count', which maps to query and nlogs but does not add meaning beyond the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'Retrieves recent traffic logs from the firewall using the PanOS log API (type=log)'. The term 'traffic logs' clearly distinguishes it from sibling log retrieval tools such as get_threat_logs, get_system_logs, and get_url_filter_logs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context by specifying that this tool retrieves traffic logs, which is the right category for firewall traffic-related log queries. It does not explicitly name alternative tools for other log types, but the scope is unambiguous enough for an agent to select it appropriately among the sibling log tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server