Skip to main content
Glama
AIops-tools

endpoint-aiops-mcp

Endpoint AIops

Disclaimer: Community-maintained open-source project. Not affiliated with, endorsed by, or sponsored by any endpoint-management vendor. Product and trademark names belong to their owners. MIT licensed.

Governed AI-ops for managed-endpoint fleets — thin clients, VDI endpoints, and other centrally-managed devices — with a built-in governance harness: unified audit log, token/runaway budget guard, undo-token recording, and descriptive risk tiers. Vendor-neutral: it talks to an endpoint-management server's REST API (Bearer auth) through a configurable dialect — see Dialects. Self-contained: no dependencies beyond httpx and the MCP SDK. The test suite is mock-based; the endpoint-management REST paths have not yet been exercised against a live management server — see docs/VERIFICATION.md.

What it does

Two signature analyses, plus the guarded reads and writes around them:

  • Login-storm analysis — during a "everyone logs in at 9am" incident, detect the storm (bursts of concurrent logins in a sliding window) and rank the endpoints/users dragging login and boot times. Every flag is reported with its number, not a black-box verdict.

  • Patch / config drift — find endpoints that have drifted from the fleet (outdated patch level, stray agent version, divergent OS build or config profile). With no declared baseline it derives one by fleet majority, so it works before a gold image exists.

Related MCP server: aiops-mcp

What works

  • CLI (endpoint-aiops ...): init, overview, endpoint list/get/assign-profile/reboot, session list/storm, drift report/patch, secret set/list/rm/migrate/rotate-password, doctor, mcp.

  • MCP server (endpoint-aiops mcp or endpoint-aiops-mcp): 13 tools (10 read, 3 write), every one wrapped with the bundled @governed_tool harness.

  • Encrypted credentials: the management-server API key lives in an encrypted store ~/.endpoint-aiops/secrets.enc (Fernet + scrypt) — never plaintext on disk. Unlock with a master password from ENDPOINT_AIOPS_MASTER_PASSWORD (MCP/CI) or an interactive prompt (CLI).

  • Reversibility: endpoint_assign_profile (high risk) captures the prior profile and records an inverse "reassign the prior profile" undo descriptor. endpoint_reboot (medium risk) captures the prior online state for the audit record but declares no undo (a reboot has no safe inverse).

  • Safety: state-changing CLI ops (endpoint assign-profile, endpoint reboot) require double confirmation and support --dry-run.

Capability matrix (13 MCP tools)

Category

Tools

Count

R/W

Overview

overview

1

read

Inventory

endpoint_list, endpoint_get, endpoint_health_score

3

read

Sessions

session_list, login_storm_analysis

2

read

Drift

drift_report, patch_status, patch_compliance

3

read

Remediation

endpoint_assign_profile

1

write (high)

endpoint_reboot

1

write (medium)

Undo

undo_list

1

read

undo_apply

1

write (medium)

The analysis tools (login_storm_analysis, drift_report, patch_status, patch_compliance, endpoint_health_score) accept injected records for pure/offline analysis; endpoint_health_score and patch_compliance are injected-only, the others also pull live from a configured target.

What this tool does, and does not, decide

It delivers managed-endpoint operations — reads and writes — accurately and efficiently, and records every one of them. It does not decide whether a write is allowed to happen. That is the agent's judgement, or the permission of the account you connect it with: give it a management-console account or API token scoped to a read-only role and the writes fail at the server — the place that actually owns the permission.

So there is no read-only switch, no policy file, no approval gate to configure. The one thing the tool guarantees is that nothing is silent: every call, over MCP and over the CLI alike, lands an audit row in ~/.endpoint-aiops/audit.db, and reversible writes still capture their before-state and record an inverse where one exists.

Each tool declares a risk_level, kept in agreement with its [READ]/[WRITE] documentation tag by a test, and carried into the audit row as a descriptive tier — so a reviewer can see at a glance that a row was a high-risk write. It is a label, not a gate.

Running a smaller / local model? See agent-guardrails.md — it lists the guardrails this tool now enforces for you (so you don't spend prompt budget restating them) and gives a ready-made system prompt for what's left.

Payload conventions

  • Absent is not empty. A field the management server did not report comes back as null, never as "" — the key is always present, so a missing patch level cannot be mistaken for a blank one.

  • Capped lists announce themselves. Any list a limit can cut short is a truncation envelope: {"items": [...], "returned": N, "limit": L, "truncated": bool}, with truncated measured rather than inferred. Companion totals (driftedCount, behindCount, nonCompliantCount, stormCount, the health summary) are always the full, uncapped figures.

Quick start

As a Claude Code plugin

One install gives an agent both the skill and the MCP server:

/plugin marketplace add AIops-tools/marketplace
/plugin install endpoint-aiops@aiops-tools

The MCP server is fetched with uv and pinned to the package version this plugin declares, so an audit row can be traced back to the code that wrote it. Credentials are still configured with endpoint-aiops init — see below.

As an OpenClaw plugin

The same bundle is published on ClawHub, where one install delivers the skill and its MCP server together:

openclaw plugins install clawhub:@zw008/endpoint-aiops
openclaw skills info endpoint-aiops          # expect: Visible to model: yes

Restart the OpenClaw gateway afterwards so it loads the plugin. The MCP server is fetched with uv, pinned to this exact release, so uvx has to be on PATH — without it the skill still installs but reports Visible to model: no. Credentials are configured exactly as below.

As a CLI or standalone MCP server

uv tool install endpoint-aiops          # or: pipx install endpoint-aiops
endpoint-aiops init                     # wizard: add a target + store its API key (encrypted)
endpoint-aiops doctor                   # verify config, secrets, connectivity
endpoint-aiops overview                 # one-shot fleet health
endpoint-aiops session storm            # detect a login storm + slow contributors
endpoint-aiops drift report             # endpoints drifted from the fleet baseline

Run as an MCP server (stdio):

export ENDPOINT_AIOPS_MASTER_PASSWORD=...   # unlock secrets non-interactively
endpoint-aiops-mcp

Where that password then lives: an exported variable is readable by every process this shell starts and is recorded by shell history. On a shared or long-lived host, prefer the interactive prompt, or inject it from a secret manager for the life of the one command that needs it.

Governance

Every operation — MCP and CLI — passes through the bundled @governed_tool harness. It records; it does not authorize (see above).

  • Audit — every call (params, result, status, duration, risk tier, and any operator-supplied approver/rationale) is logged to ~/.endpoint-aiops/audit.db (relocatable via ENDPOINT_AIOPS_HOME). The CLI writes the same row the MCP path does — there is no unaudited entry point.

  • Runaway guard — a safety backstop, not an authorization gate: the same call hammered in a tight loop trips a circuit breaker so a stuck agent can't burn unbounded calls/time. Disable with ENDPOINT_RUNAWAY_MAX=0; optional hard ceilings via ENDPOINT_MAX_TOOL_CALLS / ENDPOINT_MAX_TOOL_SECONDS.

  • Undo recording — reversible writes record an inverse descriptor built from the fetched before-state.

  • Risk tier — a descriptive label on the audit row derived from risk_level; it gates nothing.

Scope

This is the IT-endpoint member of the AIops-tools family (governed AI-ops with audit + budget + undo + risk tiers). For OT / industrial edge (Modbus, OPC-UA, PROFINET, …) see the separate industrial-aiops line.

Dialects — which server are you actually pointing at?

A dialect is the management server's API shape: resource paths, response field names, the transport defaults (port + API base path), and how to authenticate. Set it per target in config.yaml; endpoint-aiops init asks for it and prints which one it configured.

Dialect

Transport

Auth

Status

generic (default)

/api/v2.0 on 443

static Bearer API key

Neutral placeholder — not a real vendor API. Useful only once you describe your server's paths in a dialect: block.

igel-ums

/umsapi/v3 on 8443

HTTP Basic login → JSESSIONID cookie

Documented-but-unverified dialect for IGEL UMS (IMI). This is not a claim that IGEL is supported — see Status.

targets:
  - name: ums1
    host: ums.example.local
    dialect: igel-ums        # IMI paths, port 8443, /umsapi/v3, Basic-login auth
    username: ums-admin      # UMS account; the password lives in secrets.enc
    scheme: https            # or 'http' for a reverse-proxied server
    verify_ssl: false        # self-signed lab UMS only

The generic default is not an IGEL configuration and never was: IGEL serves IMI at /umsapi/v3 on 8443, so a target left on the generic shape 404s on its first probe. That mismatch is why the preset exists.

Where a server genuinely has no such resource, the dialect says so rather than guessing a URL — IMI exposes no login/boot session resource, so session_list and login_storm_analysis on an igel-ums target return a teaching error naming the absent resource instead of calling an invented path.

A dialect selects the auth scheme too, not just paths — IMI rejects the static Bearer token the generic dialect sends, so it logs in with HTTP Basic at POST /umsapi/v3/login and carries the returned JSESSIONID cookie (once per connection, then cached). Because the scheme comes from the dialect, a credentials failure and a wrong-dialect failure are reported differently: a 401 names the scheme presented and, when the server sends a WWW-Authenticate challenge, the scheme it actually wants — so a dialect mismatch does not send you off rotating a perfectly good key.

⚠️ Note for IGEL specifically: a UMS account with too few permissions receives empty lists rather than a 403. endpoint-aiops doctor authenticates as a step separate from its reachability probe and warns when a successful login returns no endpoints, because "no devices" and "not allowed to see the devices" are otherwise indistinguishable.

Status

The test suite is mock-based. No dialect in this package has been exercised against a real management server, so this package does not claim support for any specific product — including IGEL.

  • generic is a placeholder shape, not a vendor API.

  • igel-ums is a documented-but-unverified dialect. Its paths and field aliases are modelled from IGEL's published IMI documentation; its auth scheme is documented in the IMI manual and matches what three independent real-world IMI clients do. Neither has been run against an appliance by this project — IGEL UMS has no free edition, so it cannot be verified on the maintainer's hardware.

Both are recorded as UNKNOWN-pending-live in docs/VERIFICATION.md, which ranks what a live run is most likely to find wrong and defines the checklist it must cover. If you have a UMS and run that checklist, the results are very welcome as an issue. Missing a capability or a server dialect? Open an issue or PR — contributions welcome.

Available Tools

13 tools
drift_reportA

[READ] Report endpoints drifted from a per-field baseline (patch/agent/OS/profile).

Answers "which endpoints have drifted from the fleet?" With no baseline it derives one by fleet majority (the most common value per field is treated as intended), so it works before any gold image is declared. Pass 'endpoints' for pure analysis, or a target to pull live inventory.

Args: baseline: Field→intended-value map; omit to derive the fleet majority. fields: Inventory fields to check (default agentVersion, patchLevel, osBuild, profileId). endpoints: Injected inventory rows; skips live collection. target: Endpoint-management target name from config; omit for the default. limit: Max drifted endpoints to return (default 200).

Returns dict: {totalEndpoints, baselineSource, baseline, fieldsChecked, driftedCount, compliantCount, driftByField, driftedEndpoints:{items[], returned, limit, truncated}}. driftedCount is the full count; when driftedEndpoints.truncated is true, re-run with a higher limit.

Example: drift_report(endpoints=[{"hostname":"tc01","patchLevel":"2026-06"}, {"hostname":"tc02","patchLevel":"2026-05"}]).

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
fieldsNo
targetNo
baselineNo
endpointsNo

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the read-only nature with '[READ]', explains the baseline derivation behavior when no baseline is provided (fleet majority), and details truncation semantics with the 'truncated' flag and guidance to re-run with a higher limit. This is thorough behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a clear lead-in, a succinct answer to the core question, and a bulleted argument list. It includes a concise example. Every sentence adds value; there is no fluff. It is appropriately sized for the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description provides the return dict structure, explains the meaning of 'driftedCount' vs 'truncated', and gives a concrete example. It covers all necessary details for an agent to invoke the tool correctly, including the optional baseline derivation and the endpoints/target alternatives. Nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does so comprehensively: each parameter (baseline, fields, endpoints, target, limit) is explained with its purpose and default behavior, going beyond the schema's type/default information. For example, it clarifies that omitting baseline derives fleet majority and that endpoints skips live collection.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Report endpoints drifted from a per-field baseline.' It uses a specific verb and resource, and it distinguishes itself from sibling tools like overview or patch_compliance by focusing on drift analysis. The '[READ]' prefix further clarifies its nature.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when to use it: 'Answers which endpoints have drifted from the fleet?' and provides guidance on using 'endpoints' for pure analysis vs 'target' for live inventory. It doesn't explicitly name alternative tools or exclusion conditions, but the context is clear enough for an agent to decide when to invoke it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

endpoint_assign_profileA

[WRITE][risk=high] Assign a config profile to an endpoint (reversible).

Captures the prior profile before switching, so the harness records an undo (reassign the prior profile) and a faithful audit trail. Pass dry_run=True to preview: it resolves the same path and reads the same before-state as the real call, so it reports the profile that would actually be replaced and refuses on the same grounds the write would.

Args: endpoint_id: Endpoint id as returned by endpoint_list. profile_id: Config profile to assign. dry_run: If True, preview without assigning. target: Endpoint-management target name from config; omit for the default.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetNo
dry_runNo
profile_idYes
endpoint_idYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, but the description supplies the safety profile itself: it is a write, high risk, reversible, captures the prior profile for an undo and audit trail, and dry-run resolves the same path and before-state while refusing on the same grounds as the real call. This is exceptionally transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the [WRITE][risk=high] tag and a one-line summary, followed by a tight dry-run explanation and a concise Args block. Every sentence adds useful information without filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a high-risk write tool with no annotations and no output schema, the description covers behavior, reversibility, undo/audit trail, dry-run behavior, and argument provenance. It is slightly incomplete in not describing the success response or explicit error conditions beyond the dry-run refusal scenario.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the Args section fully compensates for all four parameters. It explains dry_run semantics, endpoint_id provenance via endpoint_list, the meaning of profile_id, and the target source/config default behavior beyond what the schema states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening line names a specific action (assign), the resource (config profile), and the destination (endpoint), and marks it as a write/reversible operation. This makes it immediately distinguishable from sibling read tools like endpoint_get and maintenance actions like endpoint_reboot.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear operational guidance for using dry_run=True as a preview versus the real write, and explains that endpoint_id comes from endpoint_list and target can be omitted for the default. It does not explicitly name alternatives such as undo_apply or state when not to use this tool, so it misses the top anchor of 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

endpoint_getB

[READ] One managed endpoint by id, normalised to the stable shape.

Args: endpoint_id: Endpoint id (or uuid/mac) as returned by endpoint_list. target: Endpoint-management target name from config; omit for the default.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetNo
endpoint_idYes

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must fully disclose behavior. It mentions it is a READ operation and returns a normalized shape, but omits details about error handling (e.g., not found), authentication requirements, rate limits, or any side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with a clear label ([READ]) and structured argument list. No redundant information, though it could be slightly tighter.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple (single endpoint retrieval), but the description lacks details about the output shape beyond 'normalised stable shape'. No output schema is provided, so more detail on the return format would improve completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description adds meaningful context for both parameters: endpoint_id is the id from endpoint_list (including uuid/mac), and target is an optional config name. This clarifies usage beyond the schema's type-only definition.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves one managed endpoint by id and normalizes it. It distinguishes implicitly from endpoint_list (list vs. single) but does not explicitly differentiate from other siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description indicates that the endpoint_id comes from endpoint_list and that target can be omitted for the default. However, it does not specify when to use this tool vs. alternatives like endpoint_assign_profile or session_list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

endpoint_health_scoreA

[READ] Composite per-endpoint health score (0-100), worst endpoints first.

Answers "which endpoints are worst?" by folding the fleet signals into one ranked view: it deducts points for each risk signal (offline, stale, patch-behind, agent-behind) and cites every deduction in the endpoint's 'reasons'. Pure analysis over injected inventory rows (the shape from endpoint_list) — no live connection is used. With no baseline, the patch and agent baselines are derived by fleet majority, so it works before a gold image is declared.

Args: endpoints: Injected inventory rows (id, hostname, online, lastSeenHours, agentVersion, patchLevel) to score. Required — no live pull. stale_hours: An endpoint whose lastSeenHours >= this is 'stale' (default 24). baseline: Intended {'agentVersion', 'patchLevel'}; omit to derive the fleet majority. limit: Max worst-first endpoints to return (default 50).

Returns dict: {endpointsEvaluated, baseline:{agentVersion, patchLevel, source}, summary:{healthy, degraded, critical}, worst:{items:[{endpoint, score, band, reasons[]} ...worst-first], returned, limit, truncated}, note}. The summary always counts the whole fleet; when worst.truncated is true, re-run with a higher limit to see further down the ranking.

Example: endpoint_health_score(endpoints=[ {"hostname":"tc01","online":True,"agentVersion":"12.6","patchLevel":"2026-06"}, {"hostname":"tc02","online":False,"agentVersion":"12.5","patchLevel":"2026-05"}]).

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
baselineNo
endpointsYes
stale_hoursNo

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full behavioral burden. It discloses that the tool is read-only, uses no live connection, deducts points for specific risk signals, cites deductions in 'reasons', derives baselines by fleet majority when none is given, and describes truncation behavior. This is exceptionally transparent for an unannotated tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured with a summary, Args, Returns, and an Example. Every section adds necessary information: scoring logic, parameter semantics, output shape, and truncation guidance. There is minor redundancy about 'no live connection', but overall it is dense and purposeful rather than padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 4-parameter tool with no output schema and no annotations, the description is remarkably complete. It covers all parameter meanings, the scoring model, baseline derivation, return structure, and a practical edge case (truncation). The presence of an output shape description compensates fully for the missing output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must fully document parameters. It does: 'endpoints' is described with its expected shape, 'stale_hours' has a threshold definition and default, 'baseline' is explained with its intended object shape and fallback, and 'limit' has a default and behavioral meaning. The example further clarifies real usage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with '[READ] Composite per-endpoint health score (0-100), worst endpoints first' and explicitly answers 'which endpoints are worst?'. This is a specific verb, resource, and ranking behavior. It also distinguishes itself from siblings by stating it analyzes injected inventory rows rather than using a live connection.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly states when to use it: when you want a ranked health score over already-injected endpoint inventory rows, and it notes no live connection is used. It also explains baseline fallback behavior. It does not explicitly name alternative tools or say when not to use it, but the context is strong enough to guide selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

endpoint_listA

[READ] List all managed endpoints (id, hostname, OS, agent/patch, online).

Args: target: Endpoint-management target name from config; omit for the default.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetNo

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The [READ] prefix indicates a non-destructive read operation, which is valuable given no annotations are provided. However, the description lacks details on authentication, rate limits, or any potential side effects, though for a simple list these are likely minimal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with two clear sections: a summary line and an Args list. Every sentence provides value; no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one optional parameter, no output schema), the description covers the key aspects: what the tool returns, that it is a read operation, and the parameter's purpose. It could mention pagination or endpoint count limits but is complete enough for a basic list tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. The Args section explains the 'target' parameter as 'Endpoint-management target name from config; omit for the default', adding meaningful context beyond the schema's type info.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'List all managed endpoints' with a [READ] prefix, specifying the verb and resource. It lists the fields returned (id, hostname, OS, agent/patch, online), which distinguishes it from sibling tools like endpoint_get (single endpoint) or drift_report (report).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide explicit guidance on when to use this tool versus alternatives like endpoint_get or patch_status. There is no mention of context or exclusions, leaving the agent to infer usage from the tool name and siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

endpoint_rebootA

[WRITE][risk=medium] Request an endpoint reboot (no safe inverse).

Records the endpoint's prior online state for the audit trail; a reboot cannot be undone, so no undo descriptor is offered. Pass dry_run=True to preview — for an operation with no inverse, knowing whether the endpoint is even online (and how long since it was last seen) before committing is the whole value of asking first.

Args: endpoint_id: Endpoint id as returned by endpoint_list. dry_run: If True, preview without rebooting. target: Endpoint-management target name from config; omit for the default.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetNo
dry_runNo
endpoint_idYes

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses key behaviors: the operation is irreversible ('no safe inverse'), records prior online state for audit, and offers a dry_run preview. This is substantial, though it does not detail permissions, side effects on the endpoint, or failure behavior. Still, it is transparent about the most critical aspects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a front-loaded purpose, followed by explanatory context and a clear Args list. It is slightly verbose due to the contextual explanation, but every sentence adds value. The bracket notation [WRITE][risk=medium] is unconventional but informative. Overall, it is appropriately sized and organized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, no annotations, and three parameters, the description covers purpose, usage, parameter meanings, and irreversibility. It references endpoint_list for ID acquisition, which aids integration. It does not describe return values or failure modes, but for a request-type tool this is a minor gap. The description is sufficient for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. It does so comprehensively: each parameter is explained in the Args section (endpoint_id from endpoint_list, dry_run for preview, target from config with default). This adds meaning far beyond the bare schema types and defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action: 'Request an endpoint reboot'. The verb and resource are specific and unambiguous. However, it does not explicitly differentiate from sibling tools (e.g., endpoint_get, endpoint_assign_profile) beyond the action itself, so it lacks the explicit sibling distinction seen in top-tier examples.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context on when to use the dry_run parameter (preview before committing) and references endpoint_list for obtaining the endpoint_id. However, it does not explicitly state when to use this tool versus alternatives, nor does it mention any exclusions. It implies usage but doesn't offer explicit when-not scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

login_storm_analysisA

[READ] Detect login storms + rank the slowest login/boot contributors.

Answers "is this a morning login storm, and which endpoints/users are dragging login and boot times?" Groups logins into storm episodes (>= min_concurrent within a window_s sliding window) and flags sessions slower than the thresholds — every flag is reported with its number, not a verdict. Pass 'sessions' for pure analysis, or a target to pull live via session_list.

Args: since_hours: Live look-back window when sessions is omitted (default 24). window_s: Sliding window that defines "concurrent" logins (default 300). min_concurrent: Logins within a window that constitute a storm (default 10). slow_login_ms: Login duration (ms) flagged as slow (default 30000). slow_boot_ms: Boot duration (ms) flagged as slow (default 90000). sessions: Injected session records — {endpoint, user, login_ms, boot_ms, timestamp (ISO-8601), result}; skips live collection. target: Endpoint-management target name from config; omit for the default. limit: Max rows in each returned list (default 25).

Returns dict: {totalSessions, sessionsReceived, inputTruncated, stormCount, storms:{items:[{start, end, count, peakConcurrent, spanS, distinctUsers, distinctEndpoints, avgLoginMs}], returned, limit, truncated}, slowLoginCount, slowestByLogin:{items[], ...}, slowestByBoot:{items[], ...}, failedLogins, thresholds}. Each list is a truncation envelope — when its 'truncated' is true, re-run with a higher limit; stormCount is the full episode count.

Example: login_storm_analysis(sessions=[{"endpoint":"tc01","user":"a", "login_ms":42000,"timestamp":"2026-07-12T08:00:00Z"}, ...]).

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
targetNo
sessionsNo
window_sNo
since_hoursNo
slow_boot_msNo
slow_login_msNo
min_concurrentNo

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It declares '[READ]', explains that every flag is reported as a number rather than a verdict, describes storm grouping semantics, threshold behavior, truncation envelopes, and when live collection is skipped. This gives an agent a reliable model of what the tool does and does not do.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with a summary, then organized into Args, Returns, and Example sections. Every sentence provides necessary information about behavior, parameters, or output structure, with no filler or repetition of the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description correctly explains the full return dict, list truncation envelopes, and how to interpret stormCount. A concrete example is included. The only minor ambiguity is precedence when both sessions and target are provided, but the 'or' phrasing sufficiently signals that they are alternative modes.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it does. All 8 parameters are documented with defaults, meaning, and interactions: since_hours applies when sessions is omitted, target triggers live collection, and sessions must contain specific fields. This adds substantial meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: it detects login storms and ranks the slowest login/boot contributors. It answers a concrete question and is clearly distinct from sibling tools like endpoint_list or endpoint_reboot because it is a pure aggregation and analysis operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit guidance on input modes: pass 'sessions' for pure analysis, or use a target to pull live data via session_list. It also frames the tool around the question 'is this a morning login storm...'. It does not explicitly list when not to use this tool relative to siblings, but the decision context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

overviewA

[READ] One-shot fleet health: online/offline, stale endpoints, version spread.

Call this first to triage a managed-endpoint fleet before drilling into a specific endpoint, login storm, or drift report.

Args: target: Endpoint-management target name from config; omit for the default.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetNo

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden. It clearly labels the tool as '[READ]' (read-only), describes what it returns (fleet health statuses), and explains the parameter. However, it lacks details on authentication needs, rate limits, or whether the data is cached or real-time, which would be helpful for full transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured. The first sentence front-loads the core purpose, and the second paragraph provides usage guidance and parameter details. No wasted words; every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one optional parameter) and no output schema, the description provides adequate context: what it does, when to use, and parameter semantics. However, it could be improved by briefly describing the output format or any limitations, but overall it's sufficiently complete for an agent to use correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero description coverage for the 'target' parameter. The description compensates fully by explaining the parameter's meaning ('Endpoint-management target name from config') and usage ('omit for the default'), adding significant value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with specific verb 'READ' and resource 'fleet health', listing included elements (online/offline, stale endpoints, version spread). It distinguishes from siblings by advising to call this first before drilling into specific tools like endpoint, login storm, or drift report.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use ('Call this first to triage a managed-endpoint fleet') and implies when not to (before drilling into specific endpoint, login storm, or drift report). It names alternative tools that provide more detailed views.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

patch_complianceA

[READ] Patch-compliance SLA measure: % of the fleet on the target patch level.

Reframes patch_status (the patch-level distribution) as an SLA/compliance verdict: what fraction of the fleet is on the target level, whether that meets the SLA, and which endpoints are non-compliant. Compliance is an exact string match on patchLevel — a transparent check, not a version-semantics parser. Injected-only: pass 'endpoints' (inventory rows); no live collection.

Args: endpoints: Injected inventory rows to evaluate (e.g. from endpoint_list). target_patch: Desired patch level; omit to use the fleet-majority level. sla_pct: Compliance SLA threshold percent; default 95.0. limit: Max non-compliant endpoints to return (default 200).

Returns dict: {endpointsEvaluated, targetPatch, targetSource, slaTargetPct, complianceRatePct, compliantCount, verdict, nonCompliantCount, nonCompliant:{items[], returned, limit, truncated}, note}. The rate is always computed over the whole fleet, never over the capped list.

Example: patch_compliance(endpoints=[{"hostname":"tc01","patchLevel":"2026-06"}, {"hostname":"tc02","patchLevel":"2026-05"}], target_patch="2026-06").

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
sla_pctNo
endpointsYes
target_patchNo

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of disclosure. It clearly labels the tool as '[READ]' (read-only), states 'no live collection' (no side effects), and reveals the internal check is 'an exact string match on patchLevel — a transparent check, not a version-semantics parser.' It also discloses the important nuance that 'the rate is always computed over the whole fleet, never over the capped list,' which prevents misinterpretation of the limited output.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured with a clear opening summary, then separate Args, Returns, and Example sections. It is somewhat verbose but every sentence contributes critical information, such as the fleet-wide rate computation caveat. The front-loading of the purpose and the injection constraint ensures an agent quickly understands the tool's role.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a computation tool with 4 parameters and no output schema, the description is remarkably complete. It details the return dictionary keys, explains the default target_patch behavior, specifies the compliance rule (exact string match), and clarifies the non-compliance listing truncation. Combined with the clear injection requirement and example, an agent has everything needed to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must fully explain each parameter. It does: 'endpoints: Injected inventory rows to evaluate (e.g. from endpoint_list)', 'target_patch: Desired patch level; omit to use the fleet-majority level', 'sla_pct: Compliance SLA threshold percent; default 95.0', and 'limit: Max non-compliant endpoints to return (default 200)'. This fully compensates for the schema gap, even providing a concrete example.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear verb and resource: 'Patch-compliance SLA measure: % of the fleet on the target patch level.' It explicitly distinguishes itself from the sibling patch_status by stating it 'Reframes patch_status (the patch-level distribution) as an SLA/compliance verdict,' making its unique role unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explains when to use this tool by noting it is 'Injected-only' and expects 'endpoints' from inventory (e.g., endpoint_list), and frames its relationship to patch_status as a reframing into SLA terms. While it does not explicitly list when NOT to use it or name alternatives like drift_report, the injected-data constraint and the SLA focus provide clear usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

patch_statusA

[READ] Patch-level distribution + which endpoints are behind the target level.

Args: target_patch: Desired patch level; omit to use the fleet-majority level. endpoints: Injected inventory rows; skips live collection. target: Endpoint-management target name from config; omit for the default. limit: Max behind-endpoints to return (default 200).

Returns dict: {totalEndpoints, targetPatch, targetSource, distribution, behindCount, behind:{items[], returned, limit, truncated}}. behindCount is the full count; when behind.truncated is true, re-run with a higher limit.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
targetNo
endpointsNo
target_patchNo

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It labels the operation [READ], documents the fallback to fleet-majority when target_patch is omitted, and explains truncation semantics and how to re-run with a higher limit. This is transparent about data source behavior and output limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured into a summary line, Args list, and Returns paragraph. Every sentence carries useful information, and the return-type detail is justified because there is no output schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and no annotations, the description covers parameter semantics, return dict shape, truncation behavior, and the remedy for truncated results. It omits explicit comparison to patch_compliance, but for a stateless read tool the invocation and output guidance are essentially complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description's Args section fully compensates by explaining all four parameters: target_patch's defaulting behavior, endpoints as injected inventory that skips live collection, target as a config name with default, and limit as the max behind-endpoints with a default of 200. This adds meaning well beyond the raw schema types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with '[READ] Patch-level distribution + which endpoints are behind the target level,' which names a concrete resource and read action. It clearly states what the tool computes, though it does not explicitly differentiate itself from the sibling patch_compliance.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides parameter-level usage tips, such as omitting target_patch to use the fleet-majority level and injecting endpoints to skip live collection, but it gives no guidance about when to prefer this tool over patch_compliance or other siblings. There is no when-to-use, when-not-to-use, or alternative routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

session_listA

[READ] Recent login/boot sessions (endpoint, user, login_ms, boot_ms, result).

Args: since_hours: Look-back window in hours (1..720, default 24). target: Endpoint-management target name from config; omit for the default.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetNo
since_hoursNo

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. The [READ] prefix indicates read-only, but it does not disclose details like pagination, sorting, error handling, or behavior when parameters are invalid. This is adequate for a simple tool but could be more transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise, front-loaded with the purpose, and uses bullet points for arguments. Every sentence provides value without redundancy, making it efficient for an agent to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (2 parameters, no output schema, no annotations), the description covers purpose, return fields, and parameter details. While it lacks sorting or pagination info, it is largely complete for its complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, but the description compensates well: it explains since_hours (range 1..720, default 24) and target (endpoint-management target name from config; omit for default). This adds meaningful context beyond the schema's type and default.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool reads recent login/boot sessions and lists the fields returned (endpoint, user, login_ms, boot_ms, result). This distinguishes it from sibling tools like endpoint_list, which lists endpoints, making its purpose specific and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no explicit guidance on when to use this tool versus alternatives. It does not mention conditions, prerequisites, or scenarios where other siblings would be more appropriate, leaving the agent to infer usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

undo_applyA

[WRITE][risk=medium] Apply a recorded undo by dispatching its inverse tool.

The inverse runs through its own governed tool, so its real risk tier is recorded there. Pass dry_run=True to preview the inverse call without executing it. A token can only be applied once.

Args: undo_id: The undoId from undo_list (or an _undo_id in a write result). dry_run: If True, preview the inverse tool + params without running it. target: Passed through to the inverse tool when it accepts a target.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetNo
dry_runNo
undo_idYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It discloses dispatching the inverse tool, the governed execution, dry-run preview, and one-time token use. Lacks explicit mention of side effects like token consumption or error handling, but covers key behaviors.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Five sentences with clear structure: purpose statement, behavioral details, parameter list. Front-loaded with '[WRITE][risk=medium]'. Every sentence adds value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Describes parameters and overall mechanism, but lacks output description or error conditions. With no output schema, the agent is left guessing the return value. Adequate for a simple tool but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so description must compensate. It explains each parameter: undo_id source, dry_run purpose, and target pass-through. Adds meaningful context beyond schema types and defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it applies a recorded undo by dispatching its inverse tool. It references undo_list as the source of undo IDs, distinguishing it from listing tools and other mutation tools like retry_pipeline or cancel_pipeline.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides context for use: apply undo from undo_list, preview with dry_run, and notes that each token can only be applied once. Does not explicitly list when not to use or alternatives, but the implicit guidance is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

undo_listA

[READ] List recorded, not-yet-applied undo tokens (most recent first).

Each entry names the original tool, the inverse tool that undo_apply would run, and a human note. Use the undoId with undo_apply.

Each entry carries effectVerified. False means the original write lost its response, so the change it reverses is PROBABLE, not confirmed — check the live state before applying, and do not report the result as a restore of a state that may never have been reached.

Args: limit: Max rows to return (1..500, default 50). target: Unused (undo state is host-local); accepted for CLI uniformity.

Returns dict: {undos[], returned, limit, truncated}. One extra row is fetched, so 'truncated' is measured rather than guessed from the returned count happening to equal the limit; re-run with a higher limit when true.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
targetNo

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full behavioral burden and does so thoroughly. It states this is a read operation, explains the meaning of effectVerified, warns that a false value means the reversed change is only probable, and even cautions against misreporting restore results. It also documents the extra-row fetch behavior that makes 'truncated' reliable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose and flows logically into entry fields, safety caveats, parameters, and return values. Every sentence earns its place, and the Args/Returns structure makes it easy to scan. No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description appropriately documents the return dict shape, the meaning of truncated, and how to handle truncation. It covers the caveat about effectVerified, the parameter semantics, and the apply workflow. For a two-optional-parameter list tool, this is comprehensive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must fully explain parameters. It does: limit is given a range (1..500) and default (50), and target is explicitly documented as unused but accepted for CLI uniformity. This adds meaningful semantics that the bare schema completely lacks.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'List recorded, not-yet-applied undo tokens (most recent first).' It clearly distinguishes this listing tool from the apply tool (undo_apply) by explaining entries are for later application via undoId. The scope and behavior are unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool: when you need to inspect pending undo tokens before applying them. It explicitly tells the agent to use the returned undoId with undo_apply, connecting the tool to its sibling workflow. It does not fully enumerate exclusions or alternatives, but the workflow context is strong.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 7 tool updatesv0.10.3
    • Changeddrift_report1 field changed
      • addedInput schema / properties / limit
        Added value: +{
        +  "default": 200,
        +  "title": "Limit",
        +  "type": "integer"
        +}
    • Changedendpoint_assign_profile1 field changed
      • addedInput schema / properties / dry_run
        Added value: +{
        +  "default": false,
        +  "title": "Dry Run",
        +  "type": "boolean"
        +}
    • Changedendpoint_health_score1 field changed
      • addedInput schema / properties / limit
        Added value: +{
        +  "default": 50,
        +  "title": "Limit",
        +  "type": "integer"
        +}
    • Changedendpoint_reboot1 field changed
      • addedInput schema / properties / dry_run
        Added value: +{
        +  "default": false,
        +  "title": "Dry Run",
        +  "type": "boolean"
        +}
    • Changedlogin_storm_analysis1 field changed
      • addedInput schema / properties / limit
        Added value: +{
        +  "default": 25,
        +  "title": "Limit",
        +  "type": "integer"
        +}
    • Changedpatch_compliance1 field changed
      • addedInput schema / properties / limit
        Added value: +{
        +  "default": 200,
        +  "title": "Limit",
        +  "type": "integer"
        +}
    • Changedpatch_status1 field changed
      • addedInput schema / properties / limit
        Added value: +{
        +  "default": 200,
        +  "title": "Limit",
        +  "type": "integer"
        +}
  2. 2 tool updatesv0.3.0
    • Addedundo_apply
    • Addedundo_list
  3. 2 tool updatesv0.2.0
    • Addedendpoint_health_score
    • Addedpatch_compliance
  4. 9 tool updatesv0.1.0
    • First observeddrift_report
    • First observedendpoint_assign_profile
    • First observedendpoint_get
    • First observedendpoint_list
    • First observedendpoint_reboot
    • First observedlogin_storm_analysis
    • First observedoverview
    • First observedpatch_status
    • First observedsession_list

TDQS

A4.1/5.0

Scored across 13 tools

Disambiguation4/5

Most tools are clearly distinct (endpoint_list vs endpoint_get vs endpoint_health_score). Patch-related tools (patch_status, patch_compliance, drift_report, endpoint_health_score) overlap in patch-level analysis, but each has a distinct framing (distribution, SLA, drift, health) and descriptions clarify the differences.

Naming Consistency4/5

Uses snake_case throughout with a consistent noun_verb pattern for most tools (endpoint_list, session_list, patch_status, login_storm_analysis). A few deviations like 'overview' (noun only) and 'undo_apply' (verb_noun) are minor and do not impede readability.

Tool Count5/5

13 tools is well within the typical 3-15 range and each tool serves a clear purpose in the endpoint-management/aiops domain. No redundant or superfluous tools; the count feels right for the scope.

Completeness4/5

Covers core monitoring (health, patch, drift, sessions) and common actions (assign profile, reboot) with undo support. Missing operations like endpoint create/delete or a direct patch-apply tool, but these may be out of scope for a monitoring/aiops server; the surface is largely complete for its stated purpose.

Maintenance

ActivityActive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    B
    maintenance
    A self-contained, security-first, EU-sovereign unified AI-operations MCP server that fuses a live bitemporal fleet model, a drift engine, and a tiered audited actuator into one control plane.
    5
    Apache 2.0
  • A
    license
    A
    quality
    A
    maintenance
    Governed AI-ops for Ceph, providing root-cause health analysis and guarded destructive operations via a built-in governance harness with risk tiers, audit, and undo recording.
    37
    MIT
  • A
    license
    A
    quality
    A
    maintenance
    Governed network controller-layer operations (Cisco Meraki, plus Catalyst Center / Arista CVP / UniFi) — uplink loss/latency RCA, fleet health scoring, and config-template drift, with unbypassable audit logging (MCP + CLI), budget/runaway guards, and rollback.
    34
    MIT