Skip to main content
Glama
jus1-c

Forensics Utils MCP Server

by jus1-c

Forensics Utils MCP Server

Python 3.10+ License: MIT MCP

A comprehensive MCP Server for forensic analysis that enables AI agents to analyze files, Chromium browser artifacts, and Firefox browser artifacts through the Model Context Protocol. Integrates with VirusTotal API, Detect It Easy (DIE), Binwalk, deep Chromium parsing, Firefox artifact parsing, and local analysis tools.

Features

  • VirusTotal Integration: Full API v3 support with file, URL, domain, and IP analysis

  • Local Analysis: Hash calculation, string extraction, EXIF metadata, DIE analysis

  • Firefox Artifacts: History, bookmarks, download candidates, cookies, sessions, session storage, favicons, extensions, preferences, web data, login metadata, local storage, IndexedDB, cache, and login decryption

  • Chromium Artifacts: History, downloads, sessions, favicons, bookmarks, saved logins, cookies, Web Data, extensions, preferences, Local Storage, Session Storage, IndexedDB, and HTTP cache parsing

  • Firmware Analysis: Binwalk integration for embedded file extraction

  • Intelligent Caching: In-memory cache with 200MB limit for optimal performance

  • Rate Limiting: Automatic queue management for VirusTotal API (4 req/min)

  • Multi-Format Support: EXE, ELF, firmware images, disk images, and more

  • Security First: API key protection via environment variables

Related MCP server: Reversecore_MCP

Requirements

  • Python 3.10+

  • VirusTotal API key (optional, for VT features)

  • External tools: DIE, ExifTool, Binwalk (optional, for local analysis)

  • MCP-compatible client (Claude Desktop, VSCode, Cline, etc.)

Installation

1. Clone Repository

git clone https://github.com/jus1-c/forensics-utils-mcp-server.git
cd forensics-utils-mcp-server

2. Create Virtual Environment

# Linux/Mac
python -m venv venv
source venv/bin/activate

# Windows
python -m venv venv
venv\Scripts\activate

3. Install Package

pip install -e ".[dev]"

This installs ccl_chromium_reader, lz4, and firefox_decrypt by default so the Chromium and Firefox browser-artifact tools are available without extra setup.

Configuration

Environment Variables

Create a .env file in the project root:

# Required for VirusTotal features
VIRUSTOTAL_API_KEY=your_api_key_here

# Optional
CACHE_MAX_SIZE_MB=200

Get your VirusTotal API key from: https://www.virustotal.com/gui/my-apikey

Claude Desktop

Edit claude_desktop_config.json:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "forensics-utils": {
      "command": "python",
      "args": ["-m", "forensics_utils_mcp_server"],
      "cwd": "/path/to/forensics-utils-mcp-server",
      "disabled": false,
      "autoApprove": []
    }
  }
}

Note: Change cwd to your actual project directory path.

VSCode (with Cline extension)

Add to your settings:

{
  "mcpServers": {
    "forensics-utils": {
      "command": "python",
      "args": ["-m", "forensics_utils_mcp_server"],
      "cwd": "/path/to/forensics-utils-mcp-server",
      "disabled": false,
      "autoApprove": []
    }
  }
}

Note: Change cwd to your actual project directory path.

OpenCode

Add to ~/.opencode/opencode.json:

{
  "mcp": {
    "forensics-utils": {
      "type": "local",
      "command": ["python", "-m", "forensics_utils_mcp_server"],
      "cwd": "/path/to/forensics-utils-mcp-server",
      "enabled": true,
      "timeout": 60000
    }
  }
}

Note: Change cwd to your actual project directory path.

External Dependencies

Detect It Easy (DIE)

Required for die_analyze_file tool.

ExifTool

Required for extract_exif tool.

Binwalk

Required for binwalk_scan and binwalk_extract tools.

pip install binwalk

Available Tools

Typical browser profile paths

The browser-artifact tools (chromium_* / firefox_*) operate on a profile directory that already exists on the local filesystem. The MCP does not mount disk images — pair it with a disk-extraction MCP such as disk-forensics to pull a profile out of a forensic image first.

Typical locations inside a Windows image:

Browser

Path (inside the user profile)

Google Chrome

C:\Users\<user>\AppData\Local\Google\Chrome\User Data\Default

Microsoft Edge

C:\Users\<user>\AppData\Local\Microsoft\Edge\User Data\Default

Mozilla Firefox

C:\Users\<user>\AppData\Roaming\Mozilla\Firefox\Profiles\<rand>.default-release

Suggested workflow with disk-forensics:

  1. extract_directory(image_path, partition_offset, directory_path=<above>, output_path=/tmp/opencode/case-A/chrome) to pull the profile onto disk.

  2. Pass the host path (e.g. /tmp/opencode/case-A/chrome/Default) as profile_path to any chromium_* / firefox_* tool.

Local State (Chromium v10/v11 decryption) lives one level up at C:\Users\<user>\AppData\Local\Google\Chrome\User Data\Local State — extract it alongside the profile and pass via local_state_path.

Firefox Artifacts

firefox_profile_summary_tool

Summarize basic Firefox artifacts present in a profile.

Parameters:

  • profile_path: Absolute path to Firefox profile directory (required)

  • sample_limit: Maximum number of sample identifiers per artifact (default: 10)

firefox_parse_history_tool

Parse Firefox browsing history records.

Parameters:

  • profile_path: Absolute path to Firefox profile directory (required)

  • url: Optional exact URL filter

  • title: Optional exact page title filter

  • limit: Maximum records to return (default: 100)

firefox_parse_bookmarks_tool

Parse Firefox bookmark entries.

Parameters:

  • profile_path: Absolute path to Firefox profile directory (required)

  • url: Optional exact bookmark URL filter

  • title: Optional exact bookmark title filter

  • limit: Maximum records to return (default: 100)

firefox_parse_downloads_tool

Parse Firefox download candidates reconstructed from places.sqlite.

Parameters:

  • profile_path: Absolute path to Firefox profile directory (required)

  • download_url: Optional exact downloaded file URL filter

  • source_url: Optional exact referring/source URL filter

  • limit: Maximum records to return (default: 100)

firefox_parse_cookies_tool

Parse Firefox cookies from cookies.sqlite.

Parameters:

  • profile_path: Absolute path to Firefox profile directory (required)

  • host: Optional exact cookie host filter

  • name: Optional exact cookie name filter

  • limit: Maximum records to return (default: 100)

firefox_parse_sessions_tool

Parse Firefox session restore entries from sessionstore.jsonlz4 and sessionstore-backups/*.jsonlz4.

Parameters:

  • profile_path: Absolute path to Firefox profile directory (required)

  • file_name: Optional exact session file name filter

  • url: Optional exact URL filter

  • title: Optional exact page title filter

  • limit: Maximum records to return (default: 100)

firefox_parse_session_storage_tool

Parse Firefox session storage records when sessionstore contains them.

Parameters:

  • profile_path: Absolute path to Firefox profile directory (required)

  • host: Optional exact session storage host/origin filter

  • key: Optional exact session storage key filter

  • limit: Maximum records to return (default: 100)

firefox_parse_favicons_tool

Parse Firefox favicon mappings and optional favicon image previews.

Parameters:

  • profile_path: Absolute path to Firefox profile directory (required)

  • page_url: Optional exact page URL filter

  • icon_url: Optional exact favicon URL filter

  • limit: Maximum records to return (default: 100)

  • include_image: Include favicon image previews as base64 (default: false)

  • max_image_bytes: Maximum bytes per favicon preview (default: 4096)

firefox_parse_extensions_tool

Parse Firefox installed extension metadata from extensions.json.

Parameters:

  • profile_path: Absolute path to Firefox profile directory (required)

  • extension_id: Optional exact extension ID filter

  • name: Optional exact extension name filter

  • limit: Maximum records to return (default: 100)

firefox_parse_preferences_tool

Parse Firefox preferences from prefs.js.

Parameters:

  • profile_path: Absolute path to Firefox profile directory (required)

  • key_path: Optional exact preference key filter

  • limit: Maximum records to return (default: 100)

firefox_parse_logins_tool

Parse Firefox saved-login metadata from logins.json without decrypting passwords.

Parameters:

  • profile_path: Absolute path to Firefox profile directory (required)

  • hostname: Optional exact hostname filter

  • limit: Maximum records to return (default: 100)

firefox_parse_web_data_tool

Parse Firefox web-data-like artifacts such as form history, permissions, content preferences, and search engines.

Parameters:

  • profile_path: Absolute path to Firefox profile directory (required)

  • category: Optional exact category filter (form_history, permissions, content_prefs, search_engines)

  • limit: Maximum records to return (default: 100)

firefox_parse_local_storage_tool

Parse Firefox local storage records from webappsstore.sqlite and storage/default/*/ls/data.sqlite.

Parameters:

  • profile_path: Absolute path to Firefox profile directory (required)

  • origin_key: Optional exact origin/storage key filter

  • key: Optional exact local storage key filter

  • limit: Maximum records to return (default: 100)

firefox_parse_indexeddb_tool

Parse Firefox IndexedDB records from storage/default/*/idb.

Parameters:

  • profile_path: Absolute path to Firefox profile directory (required)

  • host_id: Optional exact storage/default origin directory filter

  • database_name: Optional exact IndexedDB database name filter

  • object_store_name: Optional exact object store filter

  • limit: Maximum records to return (default: 100)

firefox_parse_cache_tool

Parse Firefox cache records from storage/default/*/cache.

Parameters:

  • profile_path: Absolute path to Firefox profile directory (required)

  • url: Optional exact request URL filter

  • limit: Maximum records to return (default: 100)

  • include_body: Include cached body previews when the morgue file is present (default: false)

  • max_body_bytes: Maximum bytes per body preview (default: 16384)

firefox_decrypt_cookies_tool

Return Firefox cookies as already-decrypted plaintext values.

Parameters:

  • profile_path: Absolute path to Firefox profile directory (required)

  • host: Optional exact cookie host filter

  • name: Optional exact cookie name filter

  • limit: Maximum records to return (default: 100)

firefox_decrypt_logins_tool

Attempt to decrypt Firefox saved passwords via firefox_decrypt.

Parameters:

  • profile_path: Absolute path to Firefox profile directory (required)

  • primary_password: Optional primary password. Leave empty or unset if none is configured

  • hostname: Optional exact hostname filter

  • limit: Maximum records to return (default: 100)

  • nss_lib_path: Optional path to an NSS library directory for firefox_decrypt

Notes:

  • Decryption depends on NSS being available in the active environment

  • If the profile is protected by a primary password, you must provide it explicitly

Chromium Deep Artifacts

chromium_profile_summary_tool

Summarize deep Chromium artifacts present in a profile.

Parameters:

  • profile_path: Absolute path to Chromium profile directory (required)

  • sample_limit: Maximum number of sample identifiers per artifact (default: 10)

chromium_parse_local_storage_tool

Parse Chromium Local Storage records.

Parameters:

  • profile_path: Absolute path to Chromium profile directory (required)

  • storage_key: Optional exact origin/storage key filter

  • script_key: Optional exact Local Storage key filter

  • limit: Maximum records to return (default: 100)

  • include_deletions: Include recovered deletion records when available (default: false)

chromium_parse_session_storage_tool

Parse Chromium Session Storage records.

Parameters:

  • profile_path: Absolute path to Chromium profile directory (required)

  • host: Optional exact host filter

  • key: Optional exact Session Storage key filter

  • limit: Maximum records to return (default: 100)

  • include_deletions: Include recovered deletion records when available (default: false)

chromium_parse_indexeddb_tool

Parse Chromium IndexedDB records.

Parameters:

  • profile_path: Absolute path to Chromium profile directory (required)

  • host_id: Optional exact IndexedDB host/origin folder filter

  • database_name: Optional exact database name filter

  • object_store_name: Optional exact object store filter

  • limit: Maximum records to return (default: 100)

  • include_deletions: Include deleted/non-live records when available (default: false)

chromium_parse_cache_tool

Parse Chromium HTTP cache metadata and optional cached body previews.

Parameters:

  • profile_path: Absolute path to Chromium profile directory (required)

  • url: Optional exact URL filter

  • limit: Maximum records to return (default: 100)

  • include_body: Include cached response body previews (default: false)

  • max_body_bytes: Maximum bytes per cached body preview (default: 16384)

  • decompress: Decompress gzip/brotli/deflate responses when possible (default: true)

chromium_parse_history_tool

Parse Chromium browsing history records.

Parameters:

  • profile_path: Absolute path to Chromium profile directory (required)

  • url: Optional exact URL filter

  • title: Optional exact page title filter

  • limit: Maximum records to return (default: 100)

chromium_parse_downloads_tool

Parse Chromium download records from History and shared_proto_db when present.

Parameters:

  • profile_path: Absolute path to Chromium profile directory (required)

  • download_url: Optional exact downloaded URL filter

  • tab_url: Optional exact originating tab URL filter

  • limit: Maximum records to return (default: 100)

chromium_parse_sessions_tool

Parse Chromium session restore navigation entries from Sessions/, Current Session, Last Session, Current Tabs, and Last Tabs when present.

Parameters:

  • profile_path: Absolute path to Chromium profile directory (required)

  • file_name: Optional exact session file name filter

  • url: Optional exact URL filter

  • title: Optional exact page title filter

  • limit: Maximum records to return (default: 100)

chromium_parse_favicons_tool

Parse Chromium favicon mappings and bitmap metadata from the Favicons database.

Parameters:

  • profile_path: Absolute path to Chromium profile directory (required)

  • page_url: Optional exact page URL filter

  • icon_url: Optional exact favicon URL filter

  • limit: Maximum records to return (default: 100)

  • include_image: Include favicon image previews as base64 (default: false)

  • max_image_bytes: Maximum bytes per favicon preview (default: 4096)

chromium_parse_web_data_tool

Parse common Chromium Web Data tables such as autofill, keywords, and profiles.

Parameters:

  • profile_path: Absolute path to Chromium profile directory (required)

  • category: Optional exact category filter (autofill, keywords, profiles)

  • limit: Maximum records to return (default: 100)

chromium_parse_extensions_tool

Parse Chromium installed extension metadata from Extensions/ and merge available state from Preferences.

Parameters:

  • profile_path: Absolute path to Chromium profile directory (required)

  • extension_id: Optional exact extension ID filter

  • name: Optional exact extension name filter

  • limit: Maximum records to return (default: 100)

chromium_parse_preferences_tool

Parse selected Chromium Preferences and Secure Preferences values.

Parameters:

  • profile_path: Absolute path to Chromium profile directory (required)

  • key_path: Optional dot-separated preference path filter

  • limit: Maximum records to return (default: 100)

chromium_parse_bookmarks_tool

Parse Chromium bookmark URL entries from the Bookmarks JSON file.

Parameters:

  • profile_path: Absolute path to Chromium profile directory (required)

  • url: Optional exact bookmark URL filter

  • title: Optional exact bookmark title filter

  • limit: Maximum records to return (default: 100)

chromium_parse_logins_tool

Parse Chromium saved-login metadata from the Login Data SQLite database without decrypting passwords.

Parameters:

  • profile_path: Absolute path to Chromium profile directory (required)

  • origin_url: Optional exact origin URL filter

  • username_value: Optional exact username filter

  • limit: Maximum records to return (default: 100)

chromium_decrypt_logins_tool

Attempt to decrypt Chromium saved passwords.

Supports two modes:

  • Windows current-user context using Local State + DPAPI

  • Offline/manual mode when a decrypted Chromium master key is supplied via master_key_b64

Parameters:

  • profile_path: Absolute path to Chromium profile directory (required)

  • local_state_path: Optional path to the Chromium Local State file

  • master_key_b64: Optional decrypted Chromium master key in base64 form

  • origin_url: Optional exact origin URL filter

  • username_value: Optional exact username filter

  • limit: Maximum records to return (default: 100)

Notes:

  • v10/v11 password blobs require the Chromium master key

  • Older DPAPI-only blobs require Windows DPAPI in the current user context

  • App-bound v20 encryption is not currently supported

chromium_parse_cookies_tool

Parse Chromium cookies from either legacy Cookies or modern Network/Cookies SQLite databases.

Parameters:

  • profile_path: Absolute path to Chromium profile directory (required)

  • host_key: Optional exact cookie domain filter

  • name: Optional exact cookie name filter

  • limit: Maximum records to return (default: 100)

chromium_decrypt_cookies_tool

Attempt to decrypt Chromium cookies.

Supports two modes:

  • Windows current-user context using Local State + DPAPI

  • Offline/manual mode when a decrypted Chromium master key is supplied via master_key_b64

Parameters:

  • profile_path: Absolute path to Chromium profile directory (required)

  • local_state_path: Optional path to the Chromium Local State file

  • master_key_b64: Optional decrypted Chromium master key in base64 form

  • host_key: Optional exact cookie domain filter

  • name: Optional exact cookie name filter

  • limit: Maximum records to return (default: 100)

Notes:

  • Plaintext cookie values are returned directly when no encrypted blob is present

  • v10/v11 cookie blobs require the Chromium master key

  • Older DPAPI-only blobs require Windows DPAPI in the current user context

  • App-bound v20 encryption is not currently supported

VirusTotal File Analysis

1. vt_scan_file

Upload a file to VirusTotal for scanning or check by hash.

Parameters:

  • file_path: Absolute path to file (required)

Example:

{
  "file_path": "/home/user/samples/suspicious.exe"
}

2. vt_get_file_report

Get VirusTotal analysis report for a file by its hash.

Parameters:

  • file_hash: MD5, SHA1, or SHA256 hash (required)

Example:

{
  "file_hash": "d41d8cd98f00b204e9800998ecf8427e"
}

3. vt_get_file_behavior

Get sandbox behavior analysis for a file.

Parameters:

  • file_hash: SHA256 hash (required)

Example:

{
  "file_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
}

VirusTotal URL Analysis

4. vt_scan_url

Submit a URL to VirusTotal for scanning.

Parameters:

  • url: URL to scan (required)

Example:

{
  "url": "http://example.com"
}

5. vt_get_url_report

Get VirusTotal analysis report for a URL.

Parameters:

  • url: URL to analyze (required)

Example:

{
  "url": "http://example.com"
}

VirusTotal Domain/IP Intelligence

6. vt_get_domain_report

Get VirusTotal intelligence report for a domain.

Parameters:

  • domain: Domain name (required)

Example:

{
  "domain": "example.com"
}

7. vt_get_ip_report

Get VirusTotal intelligence report for an IP address.

Parameters:

  • ip: IP address (required)

Example:

{
  "ip": "8.8.8.8"
}

8. vt_search_files

Search for files using VirusTotal Intelligence.

Parameters:

  • query: Search query string (required)

  • limit: Maximum results (default: 10)

Example:

{
  "query": "tag:peexe positives:5+",
  "limit": 10
}

9. vt_get_comments

Get community comments for a VirusTotal object.

Parameters:

  • object_id: Object ID (hash/URL ID) (required)

  • object_type: Type: "files", "urls", "domains", "ip_addresses" (default: "files")

Example:

{
  "object_id": "d41d8cd98f00b204e9800998ecf8427e",
  "object_type": "files"
}

Local File Analysis

10. calculate_hashes

Calculate multiple hash values (MD5, SHA1, SHA256, SHA512, SSDEEP) for a file.

Parameters:

  • file_path: Path to file (required)

Example:

{
  "file_path": "/home/user/samples/malware.exe"
}

11. extract_strings

Extract readable strings from a binary file.

Parameters:

  • file_path: Path to file (required)

  • min_length: Minimum string length (default: 4)

Example:

{
  "file_path": "/home/user/samples/malware.exe",
  "min_length": 4
}

12. extract_exif

Extract EXIF and metadata from files using ExifTool.

Parameters:

  • file_path: Path to file (required)

Example:

{
  "file_path": "/home/user/evidence/image.jpg"
}

13. die_analyze_file

Analyze file with Detect It Easy (DIE) - detects packers, compilers, etc.

Parameters:

  • file_path: Path to file (required)

Example:

{
  "file_path": "/home/user/samples/packed.exe"
}

Firmware Analysis

14. binwalk_scan

Scan file for embedded signatures (firmware, compressed data, etc.).

Parameters:

  • file_path: Path to file (required)

Example:

{
  "file_path": "/home/user/firmware/router.bin"
}

15. binwalk_extract

Extract embedded files from firmware/binary.

Parameters:

  • file_path: Path to file (required)

  • output_dir: Output directory (optional)

Example:

{
  "file_path": "/home/user/firmware/router.bin",
  "output_dir": "/home/user/extracted"
}

Cache Management

16. get_cache_stats

Get cache statistics.

Example:

{}

17. clear_cache

Clear all cache entries.

Example:

{}

Usage Examples

Malware Analysis Workflow

Analyze this suspicious executable and provide a detailed report.
File: /home/user/samples/suspicious.exe

Steps:
1. Calculate hashes
2. Check VirusTotal reputation
3. Analyze with DIE
4. Extract strings
5. Scan for embedded files with binwalk

URL Investigation

Investigate this suspicious URL and provide threat intelligence.
URL: http://suspicious-domain.com

Steps:
1. Get URL report from VirusTotal
2. Get domain report
3. Check IP reputation

Firmware Analysis

Analyze this firmware image and extract embedded files.
File: /home/user/firmware/router.bin

Steps:
1. Scan with binwalk
2. Extract all embedded files
3. Calculate hashes of extracted files
4. Check hashes on VirusTotal

Metadata Extraction

Extract all metadata from this image file.
File: /home/user/evidence/photo.jpg

Steps:
1. Extract EXIF data
2. Extract strings
3. Calculate hashes

Architecture

┌─────────────────┐     ┌──────────────────┐     ┌─────────────────┐
│   MCP Client    │────▶│  MCP Server      │────▶│   VirusTotal    │
│ (Claude/VSCode) │     │  (Python/MCP)    │     │     API         │
└─────────────────┘     └──────────────────┘     └─────────────────┘
                               │                           │
                               ▼                           │
                        ┌─────────────────┐                │
                        │  Memory Cache   │                │
                        │  (200MB limit)  │                │
                        └─────────────────┘                │
                               │                           ▼
                               ▼                  ┌─────────────────┐
                        ┌──────────────┐          │  Local Tools    │
                        │ Local Tools  │          │  (DIE, ExifTool,│
                        │  (Hash,      │          │   Binwalk)      │
                        │  Strings,    │          └─────────────────┘
                        │  EXIF)       │
                        └──────────────┘
                               │
                               ▼
                        ┌──────────────┐
                        │ Target File  │
                        └──────────────┘

Caching System

The server implements an intelligent in-memory caching system:

  • Cache Key Format: {tool_type}:{file_path} or vt:{endpoint}:{identifier}

  • Size Limit: 200MB with LRU eviction

  • Scope: Per-instance (clears on restart)

  • Benefits:

    • Avoids re-calculating hashes

    • Reduces VirusTotal API calls

    • Faster repeated analysis

Project Structure

forensics-utils-mcp-server/
├── forensics_utils_mcp_server/
│   ├── __init__.py
│   ├── server.py              # MCP server entry point
│   ├── cache.py               # In-memory cache implementation
│   ├── config.py              # Configuration settings
│   ├── exceptions.py          # Custom exceptions
│   ├── queue.py               # Rate-limited request queue
│   ├── vt_client.py           # VirusTotal API client
│   └── tools/
│       ├── __init__.py
│       ├── file_tools.py      # VT file analysis
│       ├── url_tools.py       # VT URL analysis
│       ├── domain_tools.py    # VT domain/IP analysis
│       ├── search_tools.py    # VT search
│       ├── hash_tools.py      # Hash calculation
│       ├── string_tools.py    # String extraction
│       ├── exif_tools.py      # EXIF extraction
│       ├── die_tools.py       # DIE analysis
│       └── binwalk_tools.py   # Binwalk integration
├── tests/
│   └── test_server.py
├── .env.example
├── .gitignore
├── pyproject.toml
├── README.md
└── requirements.txt

Development

Setup Development Environment

pip install -e ".[dev]"

Code Quality

black forensics_utils_mcp_server
mypy forensics_utils_mcp_server

Testing

pytest tests/

Security Features

  • API Key Protection: Stored in .env, never committed to git

  • Path Validation: Local-file tools (calculate_hashes, extract_strings, extract_exif, die_analyze_file, binwalk_*, vt_scan_file) require an absolute path that points to an existing regular file. Browser-artifact tools require an existing directory. All other input is forwarded unchanged.

  • Size Limits: File upload limited to 32MB for VirusTotal

  • Rate Limiting: 4 requests/minute for VT API

  • Timeout Protection: Request timeout configuration (default: 60s)

Troubleshooting

VirusTotal API Key Not Found

# Create .env file
echo "VIRUSTOTAL_API_KEY=your_key_here" > .env

DIE Not Found

# Download DIE from releases
# https://github.com/horsicq/Detect-It-Easy/releases
# Extract and add diec to PATH

Binwalk Not Found

pip install binwalk

ExifTool Not Found

# Windows: Download from https://exiftool.org/install.html
# Linux: sudo apt-get install libimage-exiftool-perl
# macOS: brew install exiftool

Rate Limits

  • VirusTotal Free Tier: 4 requests/minute

  • VirusTotal Paid Tier: Up to 10,000+ requests/day

Adjust in forensics_utils_mcp_server/config.py:

QUEUE_RATE_LIMIT = 4  # requests per minute
QUEUE_TIMEOUT_SECONDS = 60

Changelog

v1.0.0 - Initial Release

  • VirusTotal API v3 integration (9 tools)

  • Local analysis tools (6 tools)

  • In-memory caching system

  • Rate limiting and queue management

  • Support for DIE, ExifTool, Binwalk

License

MIT License - see LICENSE file for details.

Acknowledgments

Support

For issues and feature requests, please use the GitHub issue tracker.

Available Tools

51 tools
binwalk_extract_toolA

Extract embedded files from a binary using binwalk.

Automatically extracts known file types (ZIP, ELF, etc.) found within the binary. Uses recursive extraction to handle nested archives.

ParametersJSON Schema
NameRequiredDescriptionDefault
file_pathYesPath to the file to extract from
output_dirNoOptional custom extraction directory. When omitted, files are written to ``./extractions/<filename>/``.

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses that extraction is automatic for known file types and uses recursive extraction, which is useful. However, it does not elaborate on side effects like filesystem writes, potential overwrites, cleanup behavior, or error handling, leaving some gaps for an agent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the core purpose, and contains no filler. Every sentence adds meaningful information about the tool's behavior, making it highly concise and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity (2 parameters, no annotations, but an output schema exists), the description covers the essential aspects: purpose, method, and recursive behavior. The output schema handles return value documentation, so the description does not need to explain those. It is reasonably complete for an agent to select and use the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides complete descriptions for both parameters (file_path and output_dir), including the default output directory behavior. The tool description adds no additional parameter semantics beyond what the schema already states, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear verb+resource statement: 'Extract embedded files from a binary using binwalk.' It further specifies that it handles known file types and recursive extraction, making its purpose unambiguous and distinct from the sibling 'binwalk_scan_tool' which likely only scans without extracting.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly implies when to use this tool: when you need to extract embedded files from a binary. It does not explicitly mention alternatives or when not to use it, but the context of 'extract' versus the sibling 'binwalk_scan_tool' provides sufficient guidance for an agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

binwalk_scan_toolA

Scan a file for embedded signatures using binwalk.

Detects file signatures, archives, compressed data, and other embedded file types within binary data. Useful for firmware analysis, memory dumps, and packed executables.

ParametersJSON Schema
NameRequiredDescriptionDefault
file_pathYesPath to the file to scan

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. The term 'scan' implies a read-only operation, but this is not explicitly stated. The description adds context about detecting file signatures and embedded types, but does not disclose potential side effects, performance characteristics, or what happens when no signatures are found. It is adequate but lacks explicit behavioral detail.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured: three sentences that front-load the core purpose, then explain detection capabilities, and finally provide practical use cases. No wasted words, and every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description does not need to detail return values. It covers what the tool does, what it detects, and common use cases. While it could explicitly mention that it does not extract files (distinguishing from binwalk_extract_tool), the existing description is sufficiently complete for a scan tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The sole parameter 'file_path' is fully described in the schema as 'Path to the file to scan.' The description adds no additional parameter-level detail beyond what the schema provides. Since schema coverage is 100%, a baseline score of 3 is appropriate; the description does not improve or hinder parameter understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Scan a file for embedded signatures using binwalk' with a specific verb and resource. It distinguishes itself from siblings like binwalk_extract_tool by explicitly mentioning detection of signatures and embedded file types, making it clear this is a scan/detection tool rather than an extraction tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear usage context by listing example scenarios: 'firmware analysis, memory dumps, and packed executables.' While it doesn't explicitly mention when not to use the tool or point to specifically named alternatives, the context is sufficient to guide an agent toward appropriate use cases without confusion.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

calculate_hashes_toolA

Calculate multiple hash values for a file.

Calculates: MD5, SHA1, SHA256, SHA512, and SSDEEP (if available)

ParametersJSON Schema
NameRequiredDescriptionDefault
file_pathYesPath to the file

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

There are no annotations, so the description carries the full burden. It mentions the conditional 'SSDEEP (if available)' which hints at environment-dependent behavior, but does not disclose output format, error handling for missing files, permission requirements, or performance implications. The lack of annotations makes this less transparent than it could be.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the core purpose and immediately listing the hash algorithms. Every word is useful; no redundancy or fluff. It is appropriately concise for a simple tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple (one parameter) and has an output schema listed in the context, so the description does not need to explain return values. It covers the key algorithms and notes the conditional ssdeep. It could mention whether hashes are returned as a single object or separate fields, but that is likely captured in the output schema. Overall, adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides 100% coverage for the only parameter (file_path) with a description 'Path to the file'. The tool description adds no additional meaning beyond the schema, so it meets the baseline for high schema coverage but does not elevate it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool calculates multiple hash values for a file, then enumerates the exact algorithms (MD5, SHA1, SHA256, SHA512, SSDEEP). This is a specific verb+resource and is distinct from sibling tools, which focus on parsing browser data or scanning files via VirusTotal.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains what the tool does but gives no explicit guidance on when to use it or when to prefer another tool. Since no other hashing tool exists among siblings, the use case is implied but not stated. It would benefit from a phrase like 'Use this for file integrity checks or quick hash computation.'

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chromium_decrypt_cookies_toolA

Attempt to decrypt Chromium cookies from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default".

Supports two modes:

  • Windows current-user context using Local State + DPAPI

  • Offline decryption when a decrypted Chromium master key is supplied via master_key_b64

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNoOptional exact cookie name filter
limitNoMaximum number of cookie records to return
host_keyNoOptional exact cookie domain filter
profile_pathYesAbsolute path to the Chromium profile directory
master_key_b64NoOptional decrypted Chromium master key in base64 form
local_state_pathNoOptional path to the Chromium `Local State` file

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations were provided, so the description carries the burden. It honestly says 'Attempt', indicating potential failure, and discloses the Windows/DPAPI constraint and offline mode. It does not explicitly state the operation is read-only, but the nature of decryption implies non-mutating behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured, with three tight blocks: core purpose, typical path, and supported modes. No filler or redundant content; every sentence contributes useful information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (DPAPI, encryption), the description covers the essential modes and a typical path. Output schema exists, so the lack of return-value explanation is acceptable. Missing details like error conditions or required permissions are minor given the concise scope.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description adds value by explaining the purpose of master_key_b64 for offline decryption and mentioning 'Local State' + DPAPI, which enriches understanding beyond the raw schema field names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Attempt to decrypt Chromium cookies from a browser profile', using a specific verb and resource. It distinguishes from sibling parse tools (e.g., chromium_parse_cookies_tool) by emphasizing decryption, and provides a typical profile path as concrete context.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly outlines two usage modes (Windows current-user via DPAPI, and offline with master_key_b64), giving clear situational guidance. It does not explicitly exclude use of parse tools, but the decryption focus implies when this tool is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chromium_decrypt_logins_toolA

Attempt to decrypt Chromium saved passwords from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default".

Supports two modes:

  • Windows current-user context using Local State + DPAPI

  • Offline decryption when a decrypted Chromium master key is supplied via master_key_b64

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of login records to return
origin_urlNoOptional exact origin URL filter
profile_pathYesAbsolute path to the Chromium profile directory
master_key_b64NoOptional decrypted Chromium master key in base64 form
username_valueNoOptional exact username filter
local_state_pathNoOptional path to the Chromium `Local State` file

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds some behavioral context by explaining the two modes and providing a typical profile path. However, with no annotations, it does not fully disclose potential side effects, required privileges, or failure behavior beyond the word 'Attempt'. More detail about read-only nature or permission requirements would raise this score.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured, with a clear first sentence, an example path, and a bulleted list of modes. Every sentence contributes meaningful information without redundancy or unnecessary detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity and the presence of an output schema, the description provides adequate context for selecting and using the tool. It covers the main usage modes and gives a concrete path example. It could briefly mention common failure scenarios, but the output schema handles return values, so this is a minor gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already covers all parameters, and the description adds value by explaining how `master_key_b64` and `local_state_path` relate to the two decryption modes. The typical profile path example also helps clarify `profile_path`. The filtering parameters are self-explanatory and need no extra description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'decrypt' and clearly identifies the resource as 'Chromium saved passwords from a browser profile'. It distinguishes the tool from siblings like chromium_parse_logins_tool, which likely only parses encrypted data, by emphasizing decryption.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implicitly indicates when to use this tool (to decrypt saved passwords) and outlines two distinct operating modes: Windows current-user context and offline with a master key. It does not explicitly name alternatives or state when not to use it, but the context is sufficient for an agent to make the choice.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chromium_parse_bookmarks_toolA

Parse Chromium bookmark URL entries from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default".

ParametersJSON Schema
NameRequiredDescriptionDefault
urlNoOptional exact bookmark URL filter
limitNoMaximum number of bookmark entries to return
titleNoOptional exact bookmark title filter
profile_pathYesAbsolute path to the Chromium profile directory

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It only states that it 'parses' bookmarks, which implies a read-only operation, but it does not disclose whether it modifies data, requires specific permissions, handles running browser instances, or what the output looks like. This is a minimal disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, each earning its place: the first states the core purpose, the second provides a practical profile path hint. There is no unnecessary detail or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 4 parameters, a rich schema, and an output schema, the description is mostly complete. It provides the essential purpose and a key usage hint. However, it lacks any behavioral caveats (e.g., whether Chrome must be closed) or explicit alternative guidance, which would make it fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers all 4 parameters with clear descriptions (100% coverage), so the baseline is 3. The description adds value by providing a concrete example for 'profile_path' ('C:\Users\<user>\AppData\Local\Google\Chrome\User Data\Default'), which helps the agent understand how to construct the path. Beyond that, it does not add much for other parameters, but the schema already handles them well.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the action ('Parse'), the resource ('Chromium bookmark URL entries'), and the source ('from a browser profile'). This distinguishes it from sibling tools like chromium_parse_history_tool and firefox_parse_bookmarks_tool by specifying bookmarks and Chromium.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use when needing to parse Chromium bookmarks, and the typical profile path provides practical context. However, it does not explicitly state when to use this tool versus alternatives (e.g., Firefox bookmark parsing) or mention any exclusions or prerequisites beyond the profile path.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chromium_parse_cache_toolB

Parse Chromium HTTP cache records from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default".

ParametersJSON Schema
NameRequiredDescriptionDefault
urlNoOptional exact URL filter
limitNoMaximum number of cache records to return
decompressNoDecompress gzip/brotli/deflate responses when possible
include_bodyNoInclude cached response bodies as base64 previews
profile_pathYesAbsolute path to the Chromium profile directory
max_body_bytesNoMaximum number of bytes to include per cached body preview

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It only states 'Parse' which implies a read operation, but it does not mention whether the tool modifies anything, performance implications, limitations (e.g., only HTTP cache, not other cache types), or any required access permissions to the profile. No extra behavioral context is provided.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences and directly to the point. The inclusion of a typical profile path is useful and earns its place. There is no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has six parameters and an output schema, this description is quite sparse. It fails to explain what a 'cache record' contains, how the output is structured, or any caveats (e.g., cross-platform path differences, locked file issues). The sibling set includes many similar parse tools, but the description does not clarify how this one differs in context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already covers all six parameters with descriptions (100% coverage), so the baseline is 3. The description adds a typical Windows profile path example, which is helpful but only marginally extends the schema's formal definition of 'profile_path'. It does not provide deeper semantics for other parameters like 'decompress' or 'include_body'.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Parse') and the specific resource ('Chromium HTTP cache records'), which immediately distinguishes it from sibling tools that parse other data types like history, cookies, or downloads. It also provides a concrete profile path example, reinforcing the tool's focus.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes a typical profile path, which is a practical usage hint. However, it does not explicitly state when to use this tool versus alternatives (e.g., Firefox cache parser) or any exclusions. The usage context is implied by the tool name rather than explicitly articulated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chromium_parse_cookies_toolA

Parse Chromium cookies from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default".

Supports both legacy Cookies and modern Network/Cookies SQLite locations.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNoOptional exact cookie name filter
limitNoMaximum number of cookie records to return
host_keyNoOptional exact cookie domain filter
profile_pathYesAbsolute path to the Chromium profile directory

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the transparency burden. It adds useful behavioral context (legacy vs modern SQLite locations) but does not disclose potential encryption handling or error behavior. This is a moderate level of disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three concise, front-loaded sentences with no redundancy. The profile path example and storage location notes are directly useful and justify their inclusion.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the core purpose, path hint, and storage compatibility, and an output schema exists to document return values. It lacks explicit usage differentiation from the decrypt_cookies tool, which is a minor gap for a well-scoped parse tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the parameters are already well-documented. The description adds a typical profile path example and notes on storage locations, but does not further elaborate on the parameter formats or semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it parses Chromium cookies from a browser profile, with a concrete verb and resource. The mention of the typical profile path and support for legacy and modern SQLite locations distinguishes it from sibling tools like chromium_decrypt_cookies_tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear context that this is for parsing cookie SQLite files, including a typical profile path and path variations. However, it does not explicitly contrast with the decrypt_cookies sibling, leaving the when-to-use differentiation implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chromium_parse_downloads_toolA

Parse Chromium download records from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default".

Reads downloads from both the History database and shared_proto_db when present.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of download records to return
tab_urlNoOptional exact originating tab URL filter
download_urlNoOptional exact downloaded URL filter
profile_pathYesAbsolute path to the Chromium profile directory

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden. It discloses that the tool reads from both the History database and shared_proto_db when present, which is helpful behavioral context. 'Parse' implies read-only behavior, and no contradictory annotations exist.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences plus a path example. It is front-loaded with the core purpose, and every phrase earns its place without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description adequately covers the tool's purpose and key data sources, and an output schema exists to explain return values. It does not mention prerequisites like browser closed or error scenarios, but for a parse tool this is sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description provides an example profile path, which adds context to the profile_path parameter, but does not elaborate on limit or URL filters beyond what the schema already describes.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states 'Parse Chromium download records from a browser profile' with a clear verb and resource. It names the specific record type (downloads) and differentiates from sibling tools like chromium_parse_history_tool or chromium_parse_bookmarks_tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides useful context like a typical profile path and mentions data sources (History database, shared_proto_db), but does not explicitly state when to use this tool over alternatives or when not to use it. Usage is implied rather than explicitly guided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chromium_parse_extensions_toolA

Parse Chromium installed extension metadata. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default".

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNoOptional exact extension name filter
limitNoMaximum number of extension records to return
extension_idNoOptional exact extension ID filter
profile_pathYesAbsolute path to the Chromium profile directory

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It identifies the operation as 'parse' but does not state whether it is read-only, requires specific permissions, or has side effects. The typical path is helpful, but there is no mention of behavior for missing profiles or whether the browser must be closed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, with two sentences. The first states the purpose directly, and the second provides a useful, concrete example path. Every sentence contributes value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple and has a schema with 100% parameter coverage and an output schema, so the description doesn't need to explain return values. It gives enough context to understand that it reads extension metadata from a Chromium profile, and the typical path example helps the agent identify the target. However, it could benefit from a note about prerequisites or limitations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers all parameters with descriptions (100% coverage), so the baseline is 3. The description adds no additional parameter information beyond the schema; it merely gives an example of a profile path.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description begins with 'Parse Chromium installed extension metadata', which uses a specific verb (parse), resource (Chromium extensions), and scope (installed). This clearly distinguishes it from sibling tools like chromium_parse_history_tool or firefox_parse_extensions_tool by naming the exact data target.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides context by giving a typical profile path, which helps the agent understand where the data resides. However, it does not explicitly state when to use this tool over alternatives or mention exclusions (e.g., use the Firefox counterpart for Firefox profiles). The usage is implied by the tool name and description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chromium_parse_favicons_toolA

Parse Chromium favicons from the Favicons database. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default".

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of favicon records to return
icon_urlNoOptional exact favicon URL filter
page_urlNoOptional exact page URL filter
profile_pathYesAbsolute path to the Chromium profile directory
include_imageNoInclude favicon image previews as base64
max_image_bytesNoMaximum bytes to include per image preview

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. 'Parse' implies a read-only operation, but the description does not explicitly state that the tool is non-destructive, nor does it mention any potential side effects or requirements like an accessible, unlocked database. It adds minimal behavioral context beyond the purpose.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two compact sentences. The first states the core purpose clearly, and the second provides a concrete example of the typical profile path, which is practical and directly helpful for an agent preparing an invocation. Every sentence earns its place with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is adequate for a focused parse tool given the presence of an output schema and full parameter documentation. However, it lacks any contextual differentiation from the many sibling Chromium/Firefox parse tools and does not mention factors like database lock status or how the tool handles missing profiles. It meets the minimum viable bar but has clear gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% parameter description coverage, so the schema already documents all six parameters in detail. The tool description adds no extra meaning to the parameters, such as how 'limit' interacts with filters or how 'include_image' affects output. Baseline 3 is appropriate given the high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb+resource: 'Parse Chromium favicons from the Favicons database.' This clearly distinguishes it from sibling tools like chromium_parse_history_tool and firefox_parse_favicons_tool by naming the exact data source and browser type.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. It only states purpose and a typical profile path, with no mention of exclusions or alternative tools such as firefox_parse_favicons_tool for non-Chromium browsers. The usage context is implied solely by the tool's name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chromium_parse_history_toolA

Parse Chromium browsing history records from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default".

ParametersJSON Schema
NameRequiredDescriptionDefault
urlNoOptional exact URL filter
limitNoMaximum number of history records to return
titleNoOptional exact page title filter
profile_pathYesAbsolute path to the Chromium profile directory

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behavioral traits, but it only says 'Parse' without addressing whether the tool is read-only, requires the browser to be closed, or handles locked or encrypted profiles. The typical path example adds some context, but significant behavioral gaps remain (e.g., side effects, prerequisites).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise, consisting of two short sentences. It front-loads the core action and resource, includes a useful path example, and contains no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has an output schema, so return values are presumably covered elsewhere. However, the description lacks context on important prerequisites (e.g., profile must not be in use, chrome version compatibility) and any limitations (e.g., whether it only reads SQLite files or handles encrypted history). It is adequate but not rich enough for a complex parsing tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the parameters (url, limit, title, profile_path) are fully described in the schema. The description adds no additional parameter semantics beyond repeating the profile path example, which is already in the schema. Baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool parses Chromium browsing history records from a browser profile, using a specific verb ('Parse') and resource ('history records'). This distinguishes it from sibling tools that parse other data types (bookmarks, cookies, etc.) or from Firefox history parsing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context by specifying 'Chromium' and giving a typical profile path, which implies the tool is for use with Chromium-based browsers and for history records specifically. However, it does not explicitly mention when not to use it or name alternative tools, so it stops short of full exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chromium_parse_indexeddb_toolB

Parse Chromium IndexedDB records from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default".

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of records to return
host_idNoOptional exact IndexedDB host/origin directory filter
profile_pathYesAbsolute path to the Chromium profile directory
database_nameNoOptional exact IndexedDB database name filter
include_deletionsNoInclude deleted/non-live records when available
object_store_nameNoOptional exact object store filter

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It merely states 'Parse' and gives a path example, but does not mention whether the operation is read-only, what happens with deletion records, or any side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is brief and front-loaded with the core purpose. The additional path example is useful and does not distract. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite full schema coverage and an output schema, the description fails to provide use-case context, alternative tool comparisons, or behavioral caveats. With many sibling tools and no annotations, the description leaves the agent to infer when and how to use it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All six parameters have schema descriptions (100% coverage), so the schema fully documents their semantics. The description adds no parameter-specific detail except the profile path example, which is already implied by the parameter name.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Parse') and identifies the exact resource ('Chromium IndexedDB records') and source ('browser profile'). This clearly distinguishes it from sibling tools like chromium_parse_history or chromium_parse_cookies.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It only shows a typical profile path, which hints at how to run it but not when to prefer it over other Chromium parse tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chromium_parse_local_storage_toolA

Parse Chromium Local Storage records from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default".

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of records to return
script_keyNoOptional exact Local Storage key filter
storage_keyNoOptional exact storage key/origin filter
profile_pathYesAbsolute path to the Chromium profile directory
include_deletionsNoInclude recovered deletion records when available

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. The description only says 'Parse' and gives a path example; it does not state whether the tool is read-only, whether it modifies the profile, what side effects or limitations exist, or what the output format is. It lacks transparency about the operational behavior beyond the basic action.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no fluff. It front-loads the primary purpose and then provides a helpful example. Every word earns its place, making it highly efficient and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is a medium-complexity parser with 5 parameters, an output schema, and many sibling tools. The description adequately covers the core purpose and provides a useful path example, but lacks usage guidance and behavioral context. Given the output schema covers return values, the overall completeness is adequate but has clear gaps in usage and transparency.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides 100% description coverage for all 5 parameters, so the baseline is 3. The description adds meaningful value by giving a concrete example path for the required profile_path parameter, which aids in correctly selecting the path. This extra context justifies a slight increase above baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's action ('Parse') and the specific resource ('Chromium Local Storage records from a browser profile'). The verb+resource combination is specific and unambiguous, distinguishing it from sibling tools that parse history, cookies, etc., and from the related session_storage and indexeddb tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no explicit guidance on when to use this tool versus alternatives. It only provides a typical profile path, which is more about parameter context than usage decisions. There is no mention of exclusions, alternatives, or conditions under which this tool should be preferred.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chromium_parse_logins_toolA

Parse Chromium saved-login metadata from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default" (or Edge). On Windows the Local State file is required for v10/v11 decryption.

Reads the Login Data database and returns login metadata without decrypting passwords.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of login records to return
origin_urlNoOptional exact origin URL filter
profile_pathYesAbsolute path to the Chromium profile directory
username_valueNoOptional exact username filter

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It explicitly states the tool 'Reads' the database and returns metadata without decrypting passwords, implying a read-only, non-destructive behavior. However, it does not detail any potential side effects or permission requirements beyond the path context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded with purpose, using four short sentences. The note about the Local State file is slightly tangential for a non-decrypting tool but does not detract significantly; it could potentially confuse but is placed clearly in the context of decryption.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description explains the tool's scope (metadata only), the database it reads, and typical profile paths. It distinguishes from decrypt_logins and other parsers. An output schema exists, so return values are covered, and the description is sufficient for a read-only parser.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so all parameters have descriptions in the schema. The tool description itself adds minimal parameter-specific value, though the typical profile path example aids understanding of the profile_path parameter. This aligns with the baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool parses Chromium saved-login metadata from a browser profile, specifically reading the Login Data database and returning metadata without decrypting passwords. This distinguishes it from the sibling chromium_decrypt_logins_tool and other parse tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context by specifying it reads metadata without decrypting passwords, which implicitly indicates when to use this tool (for metadata) versus a decryption tool. It also gives a typical profile path and mentions Windows Local State for decryption, but does not explicitly name alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chromium_parse_preferences_toolC

Parse Chromium Preferences and Secure Preferences data. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default".

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of preference entries to return
key_pathNoOptional dot-separated preference path filter
profile_pathYesAbsolute path to the Chromium profile directory

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It only says 'Parse' without disclosing whether the operation is read-only, what happens on missing files, or what output to expect. Minimal behavioral insight beyond the basic verb.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: two sentences, the first stating the action and the second giving a helpful example path. Every word earns its place without unnecessary elaboration.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having a schema and output schema, the description lacks usage guidelines and behavioral transparency, which are crucial for a tool with no annotations. The path example is useful but does not compensate for the missing contextual information.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All three parameters (limit, key_path, profile_path) have descriptions in the schema, providing full coverage. The description adds no extra parameter meaning beyond the schema, so the baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it parses Chromium Preferences and Secure Preferences data, identifying the specific resource and action. It doesn't explicitly contrast with sibling tools like chromium_parse_history_tool, but the resource is distinct enough that the purpose is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given about when to use this tool versus alternatives. It only provides a typical file path, which is contextual but not about when to invoke the tool. Lacks any exclusions or alternative recommendations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chromium_parse_sessions_toolB

Parse Chromium session restore files from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default".

ParametersJSON Schema
NameRequiredDescriptionDefault
urlNoOptional exact URL filter
limitNoMaximum number of session navigation records to return
titleNoOptional exact page title filter
file_nameNoOptional exact session file name filter
profile_pathYesAbsolute path to the Chromium profile directory

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must disclose behavioral traits itself. It only states it parses files and gives a profile path example, but does not indicate whether the operation is read-only, requires permissions, handles encrypted data, or has any limitations. This lacks sufficient transparency for a tool with no annotation support.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise, with the first sentence front-loading the core action and resource. The second sentence provides a relevant concrete example path without unnecessary verbosity, earning its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that the schema fully documents all five parameters and an output schema exists, the description is adequate but minimal. It lacks explicit usage context and behavioral details, but the tool's purpose is discernible from the name and description, and the schema covers invocation details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds marginal value by giving a concrete Windows profile path example, which clarifies profile_path beyond the schema's generic 'Absolute path' description, but it does not enhance understanding of the filter parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool 'Parse Chromium session restore files from a browser profile,' using a specific verb and resource. This distinguishes it from sibling tools like chromium_parse_history or chromium_parse_bookmarks, which target different data types.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no explicit guidance on when to use this tool versus alternatives. While the purpose is clear, there is no mention of exclusions, prerequisites, or comparisons to related tools, leaving the agent to infer usage from the name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chromium_parse_session_storage_toolA

Parse Chromium Session Storage records from a browser profile. Typical profile path: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default".

ParametersJSON Schema
NameRequiredDescriptionDefault
keyNoOptional exact Session Storage key filter
hostNoOptional exact host filter
limitNoMaximum number of records to return
profile_pathYesAbsolute path to the Chromium profile directory
include_deletionsNoInclude recovered deletion records when available

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. The verb 'Parse' implies a read-only operation, and the typical path adds context, but the description does not address potential side effects, permission requirements, or behavior like handling locked files or output format. This is a moderate level of transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is only two sentences, front-loaded with the core purpose and followed by a useful path example. Every word earns its place, with no unnecessary fluff or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the rich input schema (100% coverage) and the presence of an output schema, the description is sufficiently complete for basic invocation. It provides the essential purpose and a typical path, though it could optionally mention forensic use cases or conditions like browser closure, but that is not essential given the other structured fields.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All five parameters are described in the input schema with full coverage (100%), so the schema already provides the necessary semantics. The description itself does not add any additional parameter details beyond what the schema offers, matching the baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Parse') and the specific resource ('Chromium Session Storage records') within a browser profile. This distinguishes it from sibling tools like chromium_parse_local_storage_tool and chromium_parse_indexeddb_tool, which target different storage types.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context by specifying it parses session storage from a browser profile and gives a typical path, which implies the intended use case. However, it does not explicitly mention when not to use this tool or name alternatives, so it lacks exclusions and explicit alternative references.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chromium_parse_web_data_toolB

Parse common Chromium Web Data tables.

Supports categories such as autofill, keywords, and profiles when present.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of records to return
categoryNoOptional exact Web Data category filter
profile_pathYesAbsolute path to the Chromium profile directory

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of disclosing behavioral traits. It notes that tables are parsed 'when present,' implying optional missing tables, but it doesn't state whether this is a read-only operation, what happens on locked profiles, or how 'common' tables are determined. There is no mention of side effects, data access limits, or error behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the core action and resource. The second sentence adds a useful detail about supported categories without any filler. Every word earns its place, making it highly efficient for an agent to quickly grasp the tool's purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of an output schema, the description doesn't need to explain return values. However, for a tool with an optional category filter, it's unclear what the default behavior is when no category is provided (does it return all tables?). The phrase 'when present' hints at dynamic table availability but doesn't specify the exact selection behavior or the meaning of 'common' tables. This makes it somewhat incomplete for a robust selection decision.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides 100% parameter descriptions, so the baseline is 3. The description adds value by giving concrete examples for the 'category' parameter (autofill, keywords, profiles), which helps the agent understand what values to use. For 'limit' and 'profile_path', the schema descriptions are sufficient, and the description doesn't contradict them.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool parses Chromium Web Data tables, which is a specific resource distinct from sibling tools like history, cookies, or bookmarks. The mention of concrete categories (autofill, keywords, profiles) further clarifies scope. It doesn't explicitly compare against siblings, but the resource name is distinctive enough.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage context is implied by the tool's name and scope: it's for Chromium Web Data, not for other Chromium stores or Firefox Web Data. However, there is no explicit guidance on when to choose this tool over alternatives like firefox_parse_web_data_tool, nor any exclusions or prerequisites. The description leaves the when-to-use decision largely to the agent's inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chromium_profile_summary_toolA

Summarize deep Chromium artifacts available in a browser profile. Typical Chromium profile paths: "C:\Users<user>\AppData\Local\Google\Chrome\User Data\Default" (Chrome) or "C:\Users<user>\AppData\Local\Microsoft\Edge\User Data\Default" (Edge). Extract with disk-forensics first, then point this tool at the extracted directory.

Detects whether Local Storage, Session Storage, IndexedDB, and Cache are present and returns a small sample of the content identifiers for each.

ParametersJSON Schema
NameRequiredDescriptionDefault
profile_pathYesAbsolute path to the Chromium profile directory
sample_limitNoMaximum number of sample identifiers per artifact

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of disclosing behavior. It explains that the tool 'detects whether artifacts are present' and 'returns a small sample' of identifiers, indicating a non-mutating read-only behavior. It also adds the key constraint that the profile should be an extracted copy, not a live directory. This provides meaningful behavioral context, though it does not detail any side effects (which are likely none) or permissions needed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is appropriately sized and front-loaded. It begins with the purpose, then gives path examples and a prerequisite, and finally states what the tool returns. Every sentence contributes useful information without redundancy or fluff, making it very efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is complete given the tool's complexity. It has an output schema, so return values are already defined. The description explains the tool's role (summary of artifacts), the input requirements (extracted profile path), and what it reports (presence and samples). This covers the necessary context for a tool with only two parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides 100% coverage with descriptions for both profile_path and sample_limit. The description adds value by giving example paths and clarifying that the path should point to an extracted directory, which augments the schema's description. It also explains the sample_limit concept indirectly by stating the tool returns a small sample. This extra context raises it above the baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Summarize deep Chromium artifacts available in a browser profile.' It specifies which artifacts are detected (Local Storage, Session Storage, IndexedDB, Cache) and the type of output (sample identifiers). This distinguishes it from the many sibling parse tools, which focus on individual artifact types.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear usage context by giving typical Chromium profile paths and instructing the user to 'Extract with disk-forensics first, then point this tool at the extracted directory.' It does not explicitly name alternatives, but the workflow implies this is a preliminary summary before using dedicated parse tools. It lacks explicit exclusion or alternative guidance, but the intended use is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

clear_cacheA

Clear all cache entries.

Returns: JSON object with operation status

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It fails to mention that clearing all cache entries is destructive, irreversible, or has performance implications. It only notes the return value, which is insufficient for a mutating operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short sentences, front-loading the action and clearly stating the return type. Every word earns its place, with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple no-parameter tool, the description provides the core purpose and return format, which is adequate in basic terms. However, it lacks context about the scope ('all cache entries' is ambiguous) and the consequences of the action, which is a notable gap for a destructive operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the baseline is 4. The description correctly omits parameter details since there are none, and the empty schema confirms this.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Clear all cache entries') with a specific verb and resource. This distinguishes it from sibling tools like get_cache_stats, which retrieves stats rather than clearing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool, when not to use it, or how it compares to alternatives. The description is a bare imperative without context, leaving the agent to infer appropriate usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

die_analyze_file_toolA

Analyze a file using Detect It Easy (DIE) with deep scan mode.

Uses flags: -a (all types), -u (heuristic scan), --verbose, -j (JSON output)

Returns detailed analysis including:

  • Packer/Compiler detection

  • Entropy analysis

  • Section details

  • Import/Export tables

  • Resources info

  • Signature matches

  • Heuristic detections

ParametersJSON Schema
NameRequiredDescriptionDefault
file_pathYesPath to the file to analyze

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries full responsibility. It does disclose that the tool performs a deep scan using specific flags (-a, -u, --verbose, -j), indicating read-only analysis and JSON output. However, it does not explicitly confirm non-destructive behavior, mention file size limitations, or discuss failure modes. The behavioral traits are partially transparent but not exhaustive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is moderately concise: a clear opening sentence, a brief flags note, and a bulleted list of return items. The structure is scannable and front-loaded. The flags line might be considered minor technical detail, but it does not waste words. Overall, it earns a 4 for efficiency.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has only one parameter and an output schema exists, the description covers the essential context: what the tool does, what it returns, and how it operates. It lacks information on prerequisites (e.g., file existence) or error handling, but these are not critical for selection. It is complete enough for an agent to use it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already documents the single parameter file_path with a clear description. The tool description does not add further parameter details, but with 100% schema coverage, the baseline of 3 is appropriate. No extra semantics are needed for a straightforward path parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Analyze a file'), the specific tool (Detect It Easy), and mode ('deep scan mode'). It lists detailed detection categories (Packer/Compiler, Entropy, Sections, etc.) which distinguishes it from sibling tools like extract_exif_tool or calculate_hashes_tool. The verb+resource+method is explicit and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage context is implied through the detailed list of what the tool returns (packer detection, entropy, etc.), but there is no explicit 'when to use' or 'when not to use' guidance. No alternative tools are mentioned. The agent can infer it's for binary structure analysis, but the description does not proactively steer selection compared to siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

extract_exif_toolA

Extract EXIF and metadata from a file using ExifTool.

Supports images, documents, media files, and many other formats. Extracts: camera info, GPS coordinates, timestamps, software versions, author information, and hundreds of other metadata fields.

ParametersJSON Schema
NameRequiredDescriptionDefault
file_pathYesPath to the file

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It implies a read-only operation by using 'Extract' and mentions the underlying ExifTool, but it does not disclose potential side effects, limitations, or error behavior. This is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded with a clear verb and resource. Two sentences plus a bulleted list of examples convey the necessary information without any wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple (one parameter) and has an output schema, so the description does not need to explain return values. It adequately covers supported formats and the breadth of metadata extracted, though it could mention error conditions or file size limitations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage with a simple 'file_path' parameter described as 'Path to the file'. The description adds no further meaning to the parameter beyond what the schema already provides, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific action (extract EXIF and metadata) on a specific resource (a file) using a well-known tool (ExifTool). It clearly differentiates from sibling tools like extract_strings_tool or calculate_hashes_tool, which serve different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context on what types of files are supported and what kind of metadata is extracted, implying when to use it. However, it does not explicitly mention alternatives or when not to use it, though the extensive list of supported formats makes the intended use fairly obvious.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

extract_strings_toolA

Extract readable strings from a binary file.

Useful for analyzing malware, finding embedded URLs, file paths, error messages, and other interesting artifacts.

ParametersJSON Schema
NameRequiredDescriptionDefault
file_pathYesPath to the file
min_lengthNoMinimum string length to include (default: 4)

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It implies a read-only operation ('Extract') but does not disclose details such as encoding support, performance on large files, or the specific output structure. The behavior is not misleading, but additional context would improve transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two succinct sentences, front-loaded with the primary action and followed by relevant use cases. No filler or redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple extraction tool with an output schema available, the description is sufficiently complete. It states what it does and when it is useful, though it omits minor behavior details like encoding or file size limits.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers 100% of the parameters with clear descriptions (file_path, min_length). The description adds no extra parameter semantics, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific action ('Extract readable strings') and a clear resource ('from a binary file'). This clearly distinguishes it from sibling tools such as binwalk_scan or extract_exif, which perform different analysis tasks.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides context on when to use the tool: 'analyzing malware, finding embedded URLs, file paths, error messages'. However, it does not mention when not to use it or suggest alternative tools for other analysis needs.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

firefox_decrypt_cookies_toolA

Return Firefox cookies as already-decrypted plaintext values. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release".

Firefox stores cookies plaintext in cookies.sqlite, so this tool provides parity with Chromium-style decrypt flows by normalizing plaintext values into a decrypt-oriented response.

ParametersJSON Schema
NameRequiredDescriptionDefault
hostNoOptional exact cookie host filter
nameNoOptional exact cookie name filter
limitNoMaximum number of cookie records to return
profile_pathYesAbsolute path to the Firefox profile directory

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It honestly reveals that cookies are already plaintext and that the tool only normalizes values, not actually decrypting. It also supplies a typical profile path, adding context. This is good transparency for a simple read tool, though it could mention error behavior or pagination limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences with no filler. It front-loads the core purpose and then provides necessary context about the profile path and the tool's relationship to Chromium-style flows. Every phrase earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple, has an output schema (so return values are covered), and no annotations. The description explains the tool's purpose, the profile location, and its behavioral quirk (normalizing plaintext). It could mention that it reads from cookies.sqlite, but that is implied. Overall it is complete for an agent to select and invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds value by giving a concrete example for profile_path, the required parameter, which is not in the schema. The other parameters (host, name, limit) are adequately described in the schema, so the description need not repeat them. This extra context warrants a 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Return Firefox cookies as already-decrypted plaintext values.' This specific verb+resource+result distinguishes it from sibling tools like firefox_parse_cookies_tool (which likely returns raw stored data) and chromium_decrypt_cookies_tool (different browser). The mention of 'parity with Chromium-style decrypt flows' further clarifies its niche.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context by explaining that Firefox stores cookies plaintext and that this tool normalizes them into a decrypt-oriented response. It provides the typical profile path, which is practical guidance. However, it does not explicitly name alternatives or state when-not-to-use, so it stops short of full explicit exclusion.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

firefox_decrypt_logins_toolA

Attempt to decrypt Firefox saved passwords via firefox_decrypt. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release". Requires NSS libs and optional primary_password.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of decrypted login records to return
hostnameNoOptional exact hostname filter
nss_lib_pathNoOptional path to an NSS library directory for firefox_decrypt
profile_pathYesAbsolute path to the Firefox profile directory
primary_passwordNoOptional primary password. Leave empty or unset if none is configured

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It adds useful context ('Attempt' indicates possible failure, requires NSS libs, optional primary_password) but does not mention failure modes, whether the operation is read-only, or how errors are handled. This is moderate transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description consists of three concise, information-dense sentences: purpose, typical path, and dependencies. Every sentence earns its place with no redundancy or irrelevant detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity, the description includes purpose, prerequisites, and a typical path. An output schema exists, so return value explanation is unnecessary. It could benefit from explicit guidance on when to prefer this over parse-only tools, but overall it is complete enough for a well-scoped decryption tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already covers all 5 parameters with descriptions (100% coverage), so the baseline is 3. The description adds value by explaining the typical profile path structure and clarifying that primary_password is optional and NSS libs are required, which helps agents construct parameters correctly beyond schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action 'decrypt' and the resource 'Firefox saved passwords', which distinguishes it from sibling tools like firefox_parse_logins_tool (which likely parses without decryption) and firefox_decrypt_cookies_tool (which targets cookies). The verb+resource pairing is specific and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear usage context by giving a typical profile path and required dependencies (NSS libs, optional primary password), implying when this tool is appropriate. However, it does not explicitly mention alternatives or exclusion scenarios, so it falls short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

firefox_parse_bookmarks_toolA

Parse Firefox bookmark entries from a browser profile. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release".

ParametersJSON Schema
NameRequiredDescriptionDefault
urlNoOptional exact bookmark URL filter
limitNoMaximum number of bookmark entries to return
titleNoOptional exact bookmark title filter
profile_pathYesAbsolute path to the Firefox profile directory

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It only states the basic parse function and a typical path, with no mention of read-only behavior, error handling, or prerequisites.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the core purpose and followed by a useful example. Every sentence earns its place with no extraneous detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values do not need explanation. The description covers the essential function and a practical path example, though it omits edge cases or prerequisites, which is acceptable for a straightforward parse tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and parameters have clear descriptions. The description adds a concrete example of a typical profile_path value, enhancing parameter understanding beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool parses Firefox bookmark entries from a browser profile, with a specific verb and resource. This unambiguously distinguishes it from sibling tools that parse other Firefox data types.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a typical profile path, offering contextual guidance for use. However, it does not explicitly state when to choose this tool over other Firefox parse tools, nor does it mention exclusions or alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

firefox_parse_cache_toolB

Parse Firefox cache records from storage/default/*/cache. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release".

ParametersJSON Schema
NameRequiredDescriptionDefault
urlNoOptional exact request URL filter
limitNoMaximum number of cache records to return
include_bodyNoInclude cached body previews when the morgue file is present
profile_pathYesAbsolute path to the Firefox profile directory
max_body_bytesNoMaximum bytes to include per body preview

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behavioral traits. It only mentions parsing from a directory and provides a path example. It does not state whether the operation is read-only, whether the profile must be closed, whether it writes any temporary files, or any side effects. This is a significant gap for a tool that accesses browser storage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the core purpose, and the path example is directly useful. Every sentence earns its place, with no redundant or filler content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has five parameters and an output schema, but the description is minimal. Given the schema fully documents parameters and an output schema exists, the missing context is about the nature of cache records, potential size/performance implications, and the read-only nature. It is adequate but not complete for a storage-parsing tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and each parameter has a clear description (e.g., 'Optional exact request URL filter', 'Include cached body previews when the morgue file is present'). The description adds a typical profile path example which aids in understanding the profile_path parameter, but adds no new meaning beyond the schema's parameter descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it parses Firefox cache records from a specific path pattern, using the verb 'parse' with a specific resource. It differentiates from Chromium cache and other Firefox parse tools implicitly by naming Firefox and the cache directory, though it doesn't explicitly contrast with siblings like chromium_parse_cache_tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus alternatives (e.g., chromium_parse_cache_tool or other Firefox parsers). The typical profile path offers some usage context, but there is no explicit 'when to use' or 'when not to use' direction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

firefox_parse_cookies_toolB

Parse Firefox cookies from a browser profile. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release".

ParametersJSON Schema
NameRequiredDescriptionDefault
hostNoOptional exact cookie host filter
nameNoOptional exact cookie name filter
limitNoMaximum number of cookie records to return
profile_pathYesAbsolute path to the Firefox profile directory

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description carries full responsibility. It merely says 'Parse Firefox cookies' without disclosing side effects, permissions, or whether cookie values may remain encrypted (relevant because a decrypt sibling exists). The read-only nature and limitations are not addressed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the core purpose, and includes a useful illustrative path. Every word earns its place and there is no fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

While the output schema and parameter documentation cover return values and inputs, the description fails to position this tool relative to firefox_decrypt_cookies_tool. An agent cannot tell if this tool extracts encrypted cookie values or if it performs a fundamentally different operation, making selection ambiguous.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds a concrete typical profile path example, which aids understanding of the profile_path parameter, but does not add meaning for host, name, or limit filters beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Parse'), the resource ('Firefox cookies'), and the context ('from a browser profile'). This distinguishes it from sibling tools like firefox_decrypt_cookies_tool (which decrypts) and chromium_parse_cookies_tool (different browser).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit guidance on when to use this tool versus alternatives such as firefox_decrypt_cookies_tool. The typical profile path is a hint for parameter formatting, not a usage context. No exclusions or alternative tool references are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

firefox_parse_downloads_toolB

Parse Firefox download candidates from a browser profile.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of download records to return
source_urlNoOptional exact referring/source URL filter
download_urlNoOptional exact downloaded file URL filter
profile_pathYesAbsolute path to the Firefox profile directory

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full responsibility for behavioral disclosure. It only states 'Parse,' which implies reading and extraction, but does not mention whether the tool modifies the profile, requires exclusive access, or has any side effects. This minimal disclosure leaves key behavioral traits undisclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that immediately states the action and target without filler. It is efficiently structured and easy to process, with no redundant or extraneous content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite the existence of an output schema and complete parameter descriptions, the tool description lacks context about what constitutes a 'download candidate' or how parsing works. It also does not mention typical use cases, prerequisites like profile accessibility, or whether the profile should be closed. The brief description leaves significant gaps for a specialized tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All four parameters have descriptions in the input schema, covering 100% of the schema. The description adds no parameter-specific semantics beyond what the schema already provides. This meets the baseline expectation for schema-heavy documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool as parsing Firefox download candidates from a browser profile, which is a specific verb+resource combination. It distinguishes from sibling tools like firefox_parse_history_tool or chromium_parse_downloads_tool by explicitly targeting downloads. The term 'candidates' adds specificity without confusion.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternative Firefox or Chromium parsing tools. There are no explicit or implicit conditions for selection, no prerequisites, and no mention of alternatives. Users are left without context to decide if this tool is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

firefox_parse_extensions_toolA

Parse Firefox installed extension metadata. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release".

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNoOptional exact extension name filter
limitNoMaximum number of extension records to return
extension_idNoOptional exact extension ID filter
profile_pathYesAbsolute path to the Firefox profile directory

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must fully disclose behavioral traits. It states the purpose but does not mention read-only nature, potential side effects, permissions, or error behavior. Parsing implies reading, but this is not explicitly stated, leaving a transparency gap for mutation-aware agents.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description consists of two short sentences, front-loaded with the purpose and followed by a practical path hint. Every sentence earns its place, with no redundant text or unnecessary details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of an output schema and full parameter descriptions, the description covers the essential purpose and gives a helpful path format hint. It lacks notes on edge cases or behavior on invalid paths, but for a straightforward parse tool, it is adequately complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so all parameters are already described in the schema. The description adds the typical profile path, which gives helpful context for the required 'profile_path' parameter, but it does not elaborate on 'name', 'limit', or 'extension_id' beyond what the schema provides. This meets the baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific action ('Parse') and resource ('Firefox installed extension metadata'), which distinguishes it from sibling tools like firefox_parse_history_tool or chromium_parse_extensions_tool. The verb and object are unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage through the name and the typical profile path example, but it does not explicitly state when to choose this over other Firefox parse tools or provide exclusions. The path hint is useful contextual guidance, but no alternative tools are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

firefox_parse_favicons_toolA

Parse Firefox favicons from the favicons database. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release".

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of favicon records to return
icon_urlNoOptional exact favicon URL filter
page_urlNoOptional exact page URL filter
profile_pathYesAbsolute path to the Firefox profile directory
include_imageNoInclude favicon image previews as base64
max_image_bytesNoMaximum bytes to include per image preview

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must convey behavioral context. It reveals the tool reads a database and gives a typical path, but it does not disclose return format, whether any write operations occur, potential side effects, or required permissions. The behavioral disclosure is minimal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long. The first sentence states the core function, and the second sentence provides a concrete example path that is immediately useful. Every word earns its place with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema exists and the input schema covers all parameters, the description does not need to explain return values or parameter details. It provides sufficient context about the tool's domain (Firefox profiles) and the typical path, though it lacks deeper behavioral details and alternative guidance.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents all six parameters. The description adds no parameter-level detail beyond what the schema already provides, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Parse Firefox favicons from the favicons database.' The verb 'parse' and resource 'Firefox favicons' are specific, and the mention of 'Firefox' distinguishes it from the sibling chromium_parse_favicons_tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage by providing a typical profile path, which is helpful for execution, but it does not explicitly state when to use this tool versus alternatives or mention any prerequisites or exclusions. The guidance is implicit rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

firefox_parse_history_toolA

Parse Firefox browsing history records from a browser profile. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release".

ParametersJSON Schema
NameRequiredDescriptionDefault
urlNoOptional exact URL filter
limitNoMaximum number of history records to return
titleNoOptional exact page title filter
profile_pathYesAbsolute path to the Firefox profile directory

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description must carry the full burden. It says 'parse' but does not explicitly state that this is a read-only operation or disclose any side effects, permissions, or potential failure modes. The only added context is the profile path, which is minimal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences: the first states the purpose, the second gives a concrete example path. It is front-loaded, concise, and every sentence provides value with no fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that an output schema exists and all parameters are documented, the description is adequate for basic invocation. However, it lacks behavioral transparency (no read-only disclosure) and usage guidance (no when-to-use vs alternatives), making it minimally complete rather than comprehensive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with each parameter (profile_path, url, limit, title) having a description, so the schema already handles parameter semantics. The description adds the example profile path format, but that's also evident from the schema. Baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Parse Firefox browsing history records from a browser profile' using a specific verb and resource, which distinguishes it from sibling tools like firefox_parse_bookmarks_tool and chromium_parse_history_tool. The scope is precise and actionable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a typical profile path, which implies when to use (e.g., when analyzing Firefox history), but does not explicitly mention when not to use or alternatives. Usage context is implied rather than clearly stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

firefox_parse_indexeddb_toolB

Parse Firefox IndexedDB records from storage/default/*/idb. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release".

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of IndexedDB records to return
host_idNoOptional exact storage/default origin directory filter
profile_pathYesAbsolute path to the Firefox profile directory
database_nameNoOptional exact IndexedDB database name filter
object_store_nameNoOptional exact object store filter

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must fully disclose behavior. It states the source location (storage/default/*/idb) but does not clarify whether the operation is read-only, whether it modifies the profile, how it handles multiple databases, or any performance implications. This is a significant gap for a forensic parsing tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no fluff, and the example profile path adds valuable context without unnecessary length. The structure is clean and front-loaded with the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has five parameters and an output schema, the description is minimal but not inadequate. It would benefit from mentioning that filters are optional and that it parses all IndexedDB data in the profile, but the schema covers parameter details and the output schema covers return values.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description does not elaborate on parameter meanings beyond what the schema already provides, but it does not introduce confusion either.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool parses Firefox IndexedDB records from a specific storage path, with a concrete example profile path. This distinguishes it from sibling tools like firefox_parse_local_storage_tool and chromium_parse_indexeddb_tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a typical profile path as practical usage context, but does not explicitly explain when to use this tool versus alternatives (e.g., when IndexedDB evidence is needed, or how it differs from other browser data parsers). The guidance is implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

firefox_parse_local_storage_toolA

Parse Firefox local storage records from webappsstore and storage/default/ls. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release".

ParametersJSON Schema
NameRequiredDescriptionDefault
keyNoOptional exact local storage key filter
limitNoMaximum number of local storage records to return
origin_keyNoOptional exact origin/storage key filter
profile_pathYesAbsolute path to the Firefox profile directory

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the transparency burden. It adds useful behavioral context by naming the exact files parsed and the typical profile path, implying a read-only operation. However, it does not explicitly state that the tool only reads data and never modifies the profile, nor does it mention any prerequisites like profile availability or permission requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences: the first states exactly what the tool does, and the second provides a concrete example of a typical profile path. Every word earns its place—there is no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a relatively simple parse tool with a full input schema and output schema, the description is nearly complete. It identifies the target resource and provides a path template. It could add a brief note about return format or that it only works on Firefox profiles, but the output schema covers return values and the description already gives sufficient context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides 100% coverage of all four parameters with clear descriptions, so the baseline is 3. The tool description adds no additional meaning about parameters such as 'key', 'limit', or 'origin_key' beyond what the schema already states, and does not need to compensate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with a specific verb ('Parse') and resource ('Firefox local storage records'), and it explicitly names the two data sources ('webappsstore' and 'storage/default/ls'). This distinguishes it from sibling tools like history/cookies parsers and the Chromium local storage parser.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage by naming the resource and providing a typical profile path, which gives context for when to use it. However, it does not explicitly state when to prefer this tool over alternatives or mention any exclusions, leaving the agent to infer from the tool name and sibling list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

firefox_parse_logins_toolA

Parse Firefox saved-login metadata from logins.json. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release".

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of login metadata records to return
hostnameNoOptional exact hostname filter
profile_pathYesAbsolute path to the Firefox profile directory

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description does not disclose behavioral traits such as whether it is read-only, whether it requires specific permissions, or that it does not decrypt passwords. Given the existence of a decrypt sibling, this omission is significant. The description adds little beyond the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences: the first states the function, the second provides a useful path example. No redundancy, front-loaded, and every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Output schema and parameter schema are complete, covering return and parameter details. However, the description does not clarify the scope of 'metadata' (e.g., excludes decrypted passwords) or differentiate from firefox_decrypt_logins_tool. This is a notable completeness gap for tool selection.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the parameters are already documented. The description adds a typical profile path example for profile_path, which is helpful but does not clarify limit or hostname semantics beyond the schema. This meets the baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states 'Parse Firefox saved-login metadata from logins.json' – a specific verb+resource. The sibling 'firefox_decrypt_logins_tool' reinforces that this tool handles metadata, making the purpose distinct even if not explicitly contrasted.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides a typical Firefox profile path as practical usage context, implying when to use the tool (when you have a profile path). However, it gives no explicit guidance on alternatives or exclusions, such as not using this tool when decrypted passwords are needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

firefox_parse_preferences_toolA

Parse Firefox preferences from prefs.js. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release".

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of preference entries to return
key_pathNoOptional exact preference key filter
profile_pathYesAbsolute path to the Firefox profile directory

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It only states that it parses preferences, with no mention of return format, handling of missing prefs.js, or any limitations. For a parser tool, this is minimal and leaves the agent without insight into edge cases or expected output behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is only two sentences long, with the purpose stated first in a direct, action-oriented sentence. The second sentence provides a useful path example without any redundancy. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity and the presence of an output schema (which handles return values), the description is largely complete. It covers the core purpose and provides a path example. The only minor gap is that it doesn't explicitly mention that profile_path should be a directory containing prefs.js, but this is easily inferred. For a straightforward parse tool, this is sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already covers all three parameters (100% coverage), providing a baseline of 3. The description adds value by giving a concrete profile path example and explicitly identifying prefs.js as the target file, which clarifies the relationship between profile_path and the file being parsed. This supplementary context raises the score above baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb ('Parse') and the specific resource ('Firefox preferences from prefs.js'). It distinguishes itself from sibling tools like firefox_parse_history_tool by explicitly naming the prefs.js file, making its purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a typical profile path example, offering some context for when the tool might be used. However, it does not explicitly state when to use this tool over alternatives (e.g., chromium_parse_preferences_tool) or any exclusions. The usage is implied by the name and the path hint, but not fully articulated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

firefox_parse_sessions_toolB

Parse Firefox session restore files from a browser profile. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release".

ParametersJSON Schema
NameRequiredDescriptionDefault
urlNoOptional exact URL filter
limitNoMaximum number of session navigation records to return
titleNoOptional exact page title filter
file_nameNoOptional exact session file name filter
profile_pathYesAbsolute path to the Firefox profile directory

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must convey behavioral traits. It only states 'Parse Firefox session restore files,' which implies read-only reading but does not confirm side effects, file modifications, or how the session restore files are handled (e.g., decompression of jsonlz4). The typical path hint adds context but does not disclose behavior beyond the obvious parsing action. With no annotations, this is a significant transparency gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the core purpose and followed by a helpful path example. Every word earns its place; there is no redundancy or filler. This is exemplary conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 5 parameters and an output schema, so the description needn't explain return values. However, it does not mention session file specifics (e.g., that session restore files exist in multiple formats or are compressed) or any limitations. The profile path hint adds practical context, but overall the description is minimal for the tool's complexity. It is adequate but not comprehensive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so parameters are already well-documented (e.g., url, limit, title, file_name, profile_path). The tool description adds a concrete example for profile_path with a typical Windows path, enhancing that parameter's semantics. This is a small bonus, but the description does not explain parameter interactions or output details, keeping it at the baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Parse Firefox session restore files from a browser profile.' This is a specific verb and resource, distinguishing it from sibling tools like firefox_parse_history_tool or firefox_parse_session_storage_tool by explicitly targeting session restore data. However, it does not explicitly call out alternatives or differentiate from other parse tools, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a typical profile path, which is helpful for locating input, but it gives no guidance on when to use this tool versus alternatives (e.g., firefox_parse_history_tool for history). There is no mention of exclusions or scenarios where this tool is inappropriate. The usage context is implied by the tool's name and description, but not explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

firefox_parse_session_storage_toolC

Parse Firefox session storage records when sessionstore contains them. Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release".

ParametersJSON Schema
NameRequiredDescriptionDefault
keyNoOptional exact session storage key filter
hostNoOptional exact session storage host/origin filter
limitNoMaximum number of session storage records to return
profile_pathYesAbsolute path to the Firefox profile directory

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description carries the burden. The phrase 'when sessionstore contains them' offers a condition, but there is no disclosure of side effects, return value, or safety profile. The word 'Parse' implies read-only, but this is not explicit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences and front-loaded with the main action. The profile path example is somewhat useful but not essential; still, it is concise and waste-free.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The output schema and parameter descriptions cover return values and inputs. The description adds the typical profile path and a condition about sessionstore, but it lacks explanation of how session storage differs from local storage or sessions, leaving some contextual gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all parameters are documented in the schema. The tool description adds no extra parameter semantics, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool parses Firefox session storage records, using a specific verb and resource. It distinguishes from siblings like firefox_parse_sessions_tool by the term 'session storage', though it does not explicitly name alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. It only mentions a typical profile path, which is a minor contextual hint but not usage guidance or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

firefox_parse_web_data_toolC

Parse Firefox web-data-like artifacts such as form history, permissions, Typical profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release". content preferences, and search engines.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of records to return
categoryNoOptional exact category filter (`form_history`, `permissions`, `content_prefs`, `search_engines`)
profile_pathYesAbsolute path to the Firefox profile directory

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It does not disclose whether this is a read-only operation, whether specific permissions are needed, what happens if the artifact is missing, or any side effects. The only added behavior is the typical profile path note, which is minimal and does not address safety or operational traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short but structurally flawed. The typical profile path sentence is awkwardly inserted between the list items, breaking the flow and making the text confusing. While concise in word count, the poor formatting harms readability and structure.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema is present, so return values are covered, but the description lacks context for a multi-category tool. It does not explain how the categories relate, whether output is unified, or what to expect across categories. Given no annotations, the lack of behavioral and usage context makes the description insufficient for full operational understanding.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds little beyond the schema: the 'such as' list partially mirrors the category parameter's allowed values, and the profile path hint provides a useful example for the profile_path parameter, but this is marginal and not a substantive semantic addition.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear verb and resource: 'Parse Firefox web-data-like artifacts' and lists specific examples (form history, permissions, content preferences, search engines). This distinguishes it from sibling tools that target specific artifacts like history or bookmarks, though the term 'web-data-like' is somewhat vague and could be sharper.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus the many sibling Firefox parse tools. It does not mention that this tool aggregates multiple artifact types or that specific alternatives exist for individual categories. No exclusions or context are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

firefox_profile_summary_toolA

Summarize basic Firefox artifacts available in a browser profile. Typical Firefox profile path: "C:\Users<user>\AppData\Roaming\Mozilla\Firefox\Profiles<rand>.default-release". Extract with disk-forensics first, then point this tool at the extracted directory.

Detects whether history, bookmarks, downloads, cookies, sessions, favicons, extensions, preferences, and login metadata artifacts are present.

ParametersJSON Schema
NameRequiredDescriptionDefault
profile_pathYesAbsolute path to the Firefox profile directory
sample_limitNoMaximum number of sample identifiers per artifact

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the burden of behavioral disclosure. It accurately states that the tool only 'Detects whether' artifacts are present, setting expectations that it is a summary/presence check rather than a deep parser. It also gives a typical profile path, aiding correct usage. However, it doesn't explicitly state the tool is read-only or non-destructive, though that is implied.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact (four sentences) and front-loaded with the main purpose. Every sentence adds value: the purpose, a typical path, a usage prerequisite, and the list of detected artifacts. No redundant or filler content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has an output schema (per context signals), so the description needn't explain return values. It covers the essential context: what the tool does, what artifacts it checks for, the expected profile path, and a prerequisite step. It could slightly improve by explicitly noting that this is a triage step before using specific parse tools, but current completeness is high.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with both parameters already well-documented in the schema. The description adds only a typical path example but no new semantics beyond the schema's 'Absolute path' and 'Maximum number of sample identifiers per artifact.' Baseline 3 applies when the schema handles parameter explanation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's action ('Summarize basic Firefox artifacts available in a browser profile') and identifies the specific resource (the Firefox profile). It also lists concrete artifact types it detects, distinguishing it from sibling parse tools that target individual artifacts.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit workflow guidance: 'Extract with disk-forensics first, then point this tool at the extracted directory.' It implies this tool is for triage/summary before using more specific parse tools, though it does not explicitly name those alternatives or state 'use this before firefox_parse_*'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_cache_statsB

Get cache statistics.

Returns: JSON object with cache stats including size and entry count

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses that the tool returns statistics, but does not state whether it is read-only, what cache is being referenced, or any side effects. The minimal description leaves behavioral traits opaque.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is exceptionally concise: two sentences, no waste. It front-loads the action and then specifies the return value. Every word contributes meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple with no parameters and an output schema, so the description doesn't need to explain return values in detail. However, it fails to specify which cache is being referenced—a significant gap given the sibling tools for browser data. Without this context, the agent cannot fully interpret the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the baseline is 4. There is nothing to document in the input schema, and the description does not need to compensate. The description adds value by explaining the output, which is relevant for a tool with no inputs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: to get cache statistics. It also specifies the return type (JSON object) and key details (size and entry count). While it doesn't explicitly distinguish from sibling tools, the verb 'get' and resource 'cache stats' make its purpose clear enough.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It does not mention scenarios like checking cache health before parsing or clearing, nor does it reference sibling tools. The agent is left to infer usage from the name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vt_get_comments_toolB

Get community comments for a VirusTotal object.

ParametersJSON Schema
NameRequiredDescriptionDefault
object_idYesThe ID of the object (hash for files, URL ID for URLs)
object_typeNoType of object ("files", "urls", "domains", "ip_addresses")files

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

There are no annotations, so the description carries the full burden. It fails to disclose any behavioral context such as API key requirements, rate limits, pagination, or how object_type affects the request.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that conveys the essential action without redundancy. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple retrieval tool with an output schema, the description is adequate. It could mention the default object_type or usage scenarios, but the schema and context signals fill most gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds no extra meaning beyond the schema, which already documents both parameters and their types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Get community comments for a VirusTotal object' uses a specific verb and resource, clearly distinguishing it from sibling report/scan tools. The scope is explicit and matches the tool name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives, nor any exclusions. The description only states what it does, leaving selection entirely to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vt_get_domain_report_toolA

Get VirusTotal intelligence report for a domain.

Includes: WHOIS data, DNS records, SSL certificates, reputation score, and related files/URLs.

ParametersJSON Schema
NameRequiredDescriptionDefault
domainYesThe domain name (e.g., "example.com")

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description is the sole source of behavioral transparency. It implies a read-only operation ('Get') and lists report contents, but does not mention authentication needs, rate limits, or error/edge-case behavior. It provides some useful context but is not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise: two sentences, front-loaded with the purpose, and the second sentence lists useful included data. No wasted words or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema is present, so return values are covered. The description effectively summarizes the report content and the tool's simple single-parameter interface. It is adequately complete for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides 100% coverage with a clear description for the 'domain' parameter. The tool description adds no additional parameter semantics beyond what the schema gives, so the baseline score of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Get' and the specific resource 'VirusTotal intelligence report for a domain'. It lists concrete included data (WHOIS, DNS, SSL, reputation, related files/URLs), which distinguishes it from sibling tools that target files, URLs, or IPs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly indicates use for domains, giving enough context for an agent to select it when domain intelligence is needed. It does not explicitly compare with alternatives like vt_get_url_report_tool, but the domain-specific scope is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vt_get_file_behavior_toolA

Get behavior summary for a file analyzed in VirusTotal's sandbox.

ParametersJSON Schema
NameRequiredDescriptionDefault
file_hashYesSHA256 hash of the file

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description is the sole source of behavioral info. It clearly indicates a read operation ('Get') but does not disclose prerequisites (e.g., whether the file must already be analyzed) or error conditions. This is adequate but minimal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, front-loaded with the verb, no unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter tool with output schema, the description is functional but lacks guidance on when to choose this over sibling tools and does not mention any prerequisite about prior analysis. Output schema covers return values.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers 100% of parameters with a clear description for file_hash. The tool description adds no parameter-level detail; baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description uses specific verb 'Get' with resource 'behavior summary' and scope 'file analyzed in VirusTotal's sandbox'. This clearly distinguishes from vt_get_file_report_tool which likely provides the full report.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternative VT tools like vt_get_file_report_tool. The description only states what it does, leaving the agent to infer selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vt_get_file_report_toolA

Get VirusTotal analysis report for a file by its hash.

ParametersJSON Schema
NameRequiredDescriptionDefault
file_hashYesMD5, SHA1, or SHA256 hash of the file

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavior. It indicates a read operation ('Get') but provides no details about API key requirements, rate limits, error cases (e.g., hash not found), or whether the report includes detection stats. This is a significant gap for an external API tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One sentence, front-loaded with the verb and object. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The output schema exists, so return values are documented elsewhere. However, the description lacks any context about prerequisites (e.g., API key), when to use this vs alternative report tools, or potential limitations. For a simple one-parameter tool, it's adequate but not complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema fully describes the single parameter file_hash, including its type, requirement, and accepted hash formats (MD5, SHA1, SHA256). The description adds no additional parameter information, so it earns the baseline 3 for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States verb 'Get', resource 'VirusTotal analysis report', and identifies the specific entity type 'file by its hash'. This clearly differentiates from sibling tools like vt_scan_file_tool (scanning) and vt_get_url_report_tool (URL reports).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when you have a file hash and need the analysis report, but it doesn't explicitly state when not to use it or mention alternatives. For example, it doesn't say 'use vt_scan_file_tool to submit a file for analysis' or 'use vt_get_url_report_tool for URLs.' The context is clear but only implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vt_get_ip_report_toolA

Get VirusTotal intelligence report for an IP address.

Includes: Geolocation, ASN information, reputation score, related files, URLs, and domains.

ParametersJSON Schema
NameRequiredDescriptionDefault
ipYesThe IP address (e.g., "8.8.8.8")

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It indicates a read-style operation ('Get') and lists the content of the report, but it does not mention potential API key requirements, rate limits, or whether it makes a live network call. This is adequate for a simple read tool but leaves some context unstated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is only two sentences, front-loaded with the main purpose, and the second sentence provides a clear list of included data. Every word earns its place with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter tool with output schema available, the description is sufficient. It names the primary use and key output categories. It falls short only on missing alternatives and access prerequisites, but those are not critical for a straightforward read report.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with the 'ip' parameter well-described in the schema itself. The description adds no extra meaning about the parameter beyond what is already in the schema, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool gets a VirusTotal intelligence report for an IP address, with a specific verb and resource. The included items (geolocation, ASN, reputation, related files, URLs, domains) further distinguish it from sibling tools that report on URLs, domains, or files.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when an IP address report is needed, but it does not explicitly name alternatives or state when not to use this tool. There is clear context, but no explicit exclusions or comparisons with sibling tools like vt_get_url_report_tool or vt_get_domain_report_tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vt_get_url_report_toolB

Get VirusTotal analysis report for a URL.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYesThe URL to get the report for

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It does not state whether this is a read-only operation, whether an API key is required, or what happens when no report exists for the URL (e.g., whether it returns an error or an empty result). No side effects or rate limits are mentioned.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no wasted words. It efficiently states the tool's core purpose and earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple with one parameter and an output schema, but the description lacks context about prerequisites (e.g., API key) and behavior for unanalyzed URLs. It is minimally complete but leaves important gaps that could affect correct usage in a larger toolset.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single 'url' parameter is already fully described in the schema with 100% coverage ('The URL to get the report for'). The description adds no additional parameter semantics, so the baseline score of 3 is appropriate per the rubric.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Get VirusTotal analysis report for a URL' uses a clear verb and resource, specifying the URL scope. It distinguishes from sibling tools for files, domains, and IPs by its 'URL' scope, but it does not explicitly differentiate from vt_scan_url_tool, though 'get report' implies retrieval rather than submission.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives such as vt_scan_url_tool or other report tools. It does not mention that this is for retrieving existing reports rather than submitting new scans, nor any prerequisites or contextual use cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vt_scan_file_toolA

Scan a file using VirusTotal.

For files smaller than 32MB, uploads the file directly. For larger files, calculates hash and checks VirusTotal database.

ParametersJSON Schema
NameRequiredDescriptionDefault
file_pathYesPath to the file to scan

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses the upload-vs-hash-lookup behavior, which is useful beyond the tool name. However, with no annotations, it omits critical details like API key requirements, behavior for unknown large files, and potential side effects of uploading.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with purpose, and each sentence adds essential behavioral detail without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists to explain return values, and the description covers the main file-size branching. However, it leaves gaps around prerequisites (e.g., API authentication, file path validity) and edge cases such as a large file not already in VirusTotal's database.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema fully documents file_path with a clear description, so the 100% coverage means the description adds no additional parameter meaning. Baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool scans a file using VirusTotal, with a specific verb and resource. It distinguishes from siblings like vt_scan_url_tool, though it doesn't explicitly mention alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides size-based operational context (under/over 32MB) but gives no guidance on when to choose this over vt_get_file_report_tool or other related tools. The usage context is implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vt_scan_url_toolC

Submit a URL to VirusTotal for scanning.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYesThe URL to scan (e.g., "http://example.com")

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

C2.9/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure, but it only states the action without detailing behavior like authentication requirements, rate limits, response format, or whether the scan is synchronous. This is a significant gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence with no wasted words. It front-loads the action and resource clearly. However, it is arguably too sparse to be fully helpful, though the conciseness itself is effective.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has one parameter and an output schema, but with no annotations and no behavioral details in the description, important contextual information is missing (e.g., API key requirements, what the response contains, whether jobs are asynchronous). The low complexity is offset by the absence of essential usage context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides a description for the only parameter 'url' with an example. The tool description adds no additional semantic detail beyond the schema, so the baseline of 3 is appropriate per the schema coverage rubric.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific action ('Submit') on a specific resource ('a URL to VirusTotal') for a specific purpose ('scanning'). It distinguishes from sibling tools like vt_get_url_report_tool (retrieval) and vt_scan_file_tool (file vs URL), making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives such as vt_get_url_report_tool. It does not mention prerequisites (e.g., API key) or context in which submission is appropriate, leaving the agent without decision criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vt_search_files_toolA

Search for files using VirusTotal Intelligence.

Supports advanced search syntax:

  • tag:peexe (PE executables)

  • positives:5+ (files with 5+ detections)

  • fs:2023-01-01+ (first seen after date)

  • content:{ "magic": "PE32" } (YARA-style content search)

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of results (default: 10)
queryYesSearch query string

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses that advanced search syntax is supported and provides examples, which is useful behavioral context. However, it does not explicitly state that the operation is read-only, nor does it mention rate limits, authentication, or error behavior, leaving gaps in safety and operational transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded with the core purpose, followed by a bulleted list of syntax examples. Every sentence contributes actionable information with no redundant filler or repetition of schema fields.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The output schema covers return values, and the description explains the main complexity (query syntax). However, it lacks any guidance on when to use this tool relative to other VT tools and does not mention operational constraints like pagination or search scope. Given the tool's simplicity and presence of an output schema, this is adequate but slightly incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% so the baseline is 3. The description adds concrete syntax examples for the 'query' parameter (tag:, positives:, fs:, content:), which enriches meaning beyond the schema's simple 'query string' text. This extra detail supports correct query construction.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with 'Search for files using VirusTotal Intelligence', a specific verb+resource pair. The advanced syntax examples further clarify the intended function and distinguish it from sibling tools that scan or fetch reports.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for searching files but provides no explicit when-to-use vs alternatives such as vt_get_file_report_tool or vt_scan_file_tool. There are no exclusions or comparative guidance, so the agent must infer the appropriate context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 51 tool updatesv1.0.0
    • First observedbinwalk_extract_tool
    • First observedbinwalk_scan_tool
    • First observedcalculate_hashes_tool
    • First observedchromium_decrypt_cookies_tool
    • First observedchromium_decrypt_logins_tool
    • First observedchromium_parse_bookmarks_tool
    • First observedchromium_parse_cache_tool
    • First observedchromium_parse_cookies_tool
    • First observedchromium_parse_downloads_tool
    • First observedchromium_parse_extensions_tool
    • First observedchromium_parse_favicons_tool
    • First observedchromium_parse_history_tool
    • First observedchromium_parse_indexeddb_tool
    • First observedchromium_parse_local_storage_tool
    • First observedchromium_parse_logins_tool
    • First observedchromium_parse_preferences_tool
    • First observedchromium_parse_session_storage_tool
    • First observedchromium_parse_sessions_tool
    • First observedchromium_parse_web_data_tool
    • First observedchromium_profile_summary_tool
    • First observedclear_cache
    • First observeddie_analyze_file_tool
    • First observedextract_exif_tool
    • First observedextract_strings_tool
    • First observedfirefox_decrypt_cookies_tool
    • First observedfirefox_decrypt_logins_tool
    • First observedfirefox_parse_bookmarks_tool
    • First observedfirefox_parse_cache_tool
    • First observedfirefox_parse_cookies_tool
    • First observedfirefox_parse_downloads_tool
    • First observedfirefox_parse_extensions_tool
    • First observedfirefox_parse_favicons_tool
    • First observedfirefox_parse_history_tool
    • First observedfirefox_parse_indexeddb_tool
    • First observedfirefox_parse_local_storage_tool
    • First observedfirefox_parse_logins_tool
    • First observedfirefox_parse_preferences_tool
    • First observedfirefox_parse_session_storage_tool
    • First observedfirefox_parse_sessions_tool
    • First observedfirefox_parse_web_data_tool
    • First observedfirefox_profile_summary_tool
    • First observedget_cache_stats
    • First observedvt_get_comments_tool
    • First observedvt_get_domain_report_tool
    • First observedvt_get_file_behavior_tool
    • First observedvt_get_file_report_tool
    • First observedvt_get_ip_report_tool
    • First observedvt_get_url_report_tool
    • First observedvt_scan_file_tool
    • First observedvt_scan_url_tool
    • First observedvt_search_files_tool

TDQS

B3.2/5.0
Disambiguation3/5

Most tools have distinct targets, but there are several easily confused pairs: parse vs decrypt cookies for both Chromium and Firefox, session vs session storage, and the generic get_cache_stats vs browser-specific cache parsing tools. These ambiguities could lead an agent to select the wrong tool.

Naming Consistency4/5

The majority of tools follow a clear snake_case pattern with domain prefixes (vt_, chromium_, firefox_), but the cache utilities (get_cache_stats, clear_cache) lack the _tool suffix, and some tools use verb-first naming (extract_exif_tool) while others use tool-first (binwalk_scan_tool). Overall, the naming is mostly consistent and readable.

Tool Count2/5

With 51 tools, the server far exceeds the threshold where a toolset feels heavy. While the breadth of browser forensics explains many tools, the granularity (e.g., separate tools for each artifact type in each browser) makes the server difficult to navigate, and the presence of two unrelated cache utilities adds unnecessary bloat.

Completeness4/5

The toolset provides comprehensive coverage for file analysis (hashing, EXIF, strings, binwalk, DIE) and VirusTotal interactions, and very thorough browser forensics for Chromium and Firefox, including parsing, decryption, and profile summaries. Minor gaps exist, such as no direct memory/disk forensics and no ability to add VirusTotal comments, but these are outside the apparent core scope.

Maintenance

ActivityStale
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    An MCP server that enables AI agents to analyze executable files using Detect It Easy (DIE), providing capabilities to examine file structures, detect packers, compilers, and gather other forensic information.
    13
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    An enterprise-grade MCP server for AI-powered reverse engineering. Enables AI agents to perform comprehensive binary analysis through natural language commands.
    199
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    A local MCP server that wraps common forensic command-line tools for CTF/forensics competitions into MCP tools, enabling automated analysis of disk images, memory dumps, network captures, SQLite databases, archives, and steganography.
    1
    MIT
  • F
    license
    A
    quality
    D
    maintenance
    MCP server for security analysis using VirusTotal API, enabling AI assistants to analyze URLs, files, IP addresses, and domains with automatic relationship fetching.
    8
    1
    -

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/jus1-c/forensics-utils-mcp-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server